@open-mercato/core 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6784.1.f80b9afce5

package/src/modules/entities/lib/entityAcl.ts

@@ -1,7 +1,7 @@
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { hasAllFeatures } from '@open-mercato/shared/security/features'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { getModules } from '@open-mercato/shared/lib/i18n/server'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { deriveCustomEntityRecordFeature } from './recordFeatures'
 
 export type EntityAclRequirement = {
@@ -102,7 +102,10 @@ export function canReadAllEntityMetadata(acl: {
   isSuperAdmin?: boolean
   features?: readonly string[]
 }): boolean {
-  return Boolean(acl.isSuperAdmin) || hasAllFeatures(acl.features, ['entities.definitions.view'])
+  return authorizeFeatures(['entities.definitions.view'], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: Boolean(acl.isSuperAdmin),
+  })
 }
 
 export function canReadEntityMetadata(args: {
@@ -111,20 +114,29 @@ export function canReadEntityMetadata(args: {
   isRestricted?: boolean
   acl: { isSuperAdmin?: boolean; features?: readonly string[] }
 }): boolean {
-  if (args.acl.isSuperAdmin) return true
-
   const requirement = resolveEntityAclRequirement(args.entityId)
-  if (requirement?.platformOnly) return false
+  if (requirement?.platformOnly) {
+    return Boolean(args.acl.isSuperAdmin) && authorizeFeatures(requirement.view, {
+      grantedFeatures: args.acl.features ?? [],
+      unrestricted: true,
+    })
+  }
   if (canReadAllEntityMetadata(args.acl)) return true
   if (args.isCustomEntity) {
     const requiredFeatures = ['entities.records.view']
     if (args.isRestricted) {
       requiredFeatures.push(deriveCustomEntityRecordFeature(args.entityId, 'view'))
     }
-    return hasAllFeatures(args.acl.features, requiredFeatures)
+    return authorizeFeatures(requiredFeatures, {
+      grantedFeatures: args.acl.features ?? [],
+      unrestricted: Boolean(args.acl.isSuperAdmin),
+    })
   }
-  if (!requirement) return false
-  return hasAllFeatures(args.acl.features, requirement.view)
+  if (!requirement) return Boolean(args.acl.isSuperAdmin)
+  return authorizeFeatures(requirement.view, {
+    grantedFeatures: args.acl.features ?? [],
+    unrestricted: Boolean(args.acl.isSuperAdmin),
+  })
 }
 
 type EntityAclActor = {
@@ -163,11 +175,16 @@ export async function assertEntityAclForRequest(args: AssertEntityAclArgs): Prom
     // entities.records.view/.manage route guard is the whole authorization.
     if (!args.isRestricted) return
 
-    const acl = await loadActorAcl(args)
-    if (acl?.isSuperAdmin) return
-
     const required = deriveCustomEntityRecordFeature(args.entityId, args.action)
-    if (!hasAllFeatures(acl?.features, [required])) {
+    const allowed = await args.rbac.userHasAllFeatures(
+      args.auth.sub ?? '',
+      [required],
+      {
+        tenantId: args.auth.tenantId ?? null,
+        organizationId: args.auth.orgId ?? null,
+      },
+    )
+    if (!allowed) {
       throw forbiddenEntityAccess()
     }
     return
@@ -175,14 +192,26 @@ export async function assertEntityAclForRequest(args: AssertEntityAclArgs): Prom
 
   const requirement = resolveEntityAclRequirement(args.entityId)
 
-  const acl = await loadActorAcl(args)
-
-  if (acl?.isSuperAdmin) return
+  if (!requirement) {
+    const acl = await loadActorAcl(args)
+    if (!acl.isSuperAdmin) throw forbiddenEntityAccess()
+    return
+  }
 
-  if (!requirement) throw forbiddenEntityAccess()
-  if (requirement.platformOnly) throw forbiddenEntityAccess()
+  if (requirement.platformOnly) {
+    const acl = await loadActorAcl(args)
+    if (!acl.isSuperAdmin) throw forbiddenEntityAccess()
+  }
 
-  if (!hasAllFeatures(acl?.features, requirement[args.action])) {
+  const allowed = await args.rbac.userHasAllFeatures(
+    args.auth.sub ?? '',
+    requirement[args.action],
+    {
+      tenantId: args.auth.tenantId ?? null,
+      organizationId: args.auth.orgId ?? null,
+    },
+  )
+  if (!allowed) {
     throw forbiddenEntityAccess()
   }
 }

package/src/modules/inbox_ops/ai-tools.ts

@@ -3,7 +3,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AwilixContainer } from 'awilix'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { InboxProposal, InboxProposalAction, InboxDiscrepancy } from './data/entities'
 import { inboxProposalCategoryEnum } from './data/validators'
 import { executeAction } from './lib/executionEngine'
@@ -311,8 +311,10 @@ Returns on error: error message with appropriate detail.`,
 
     // Check target module permission
     if (action.requiredFeature) {
-      const featureGranted =
-        ctx.isSuperAdmin || hasFeature(ctx.userFeatures, action.requiredFeature)
+      const featureGranted = authorizeFeatures([action.requiredFeature], {
+        grantedFeatures: ctx.userFeatures,
+        unrestricted: ctx.isSuperAdmin,
+      })
       if (!featureGranted) {
         return {
           error: 'Insufficient permissions',

package/src/modules/messages/lib/routeHelpers.ts

@@ -1,5 +1,4 @@
 import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
-import { hasFeature } from '@open-mercato/shared/security/features'
 
 export function hasOrganizationAccess(
   scopeOrganizationId: string | null,
@@ -33,10 +32,11 @@ export async function resolveMessageContext(req: Request): Promise<{
 }
 
 type RbacService = {
-  loadAcl: (
+  userHasAllFeatures: (
     userId: string,
+    required: string[],
     scope: { tenantId: string | null; organizationId: string | null }
-  ) => Promise<{ features?: string[]; isSuperAdmin?: boolean }>
+  ) => Promise<boolean>
 }
 
 export async function parseRequestBodySafe(req: Request): Promise<unknown> {
@@ -56,10 +56,8 @@ export async function canUseMessageEmailFeature(
   if (!scope.userId || !scope.tenantId) return false
 
   const rbac = ctx.container.resolve('rbacService') as RbacService
-  const acl = await rbac.loadAcl(scope.userId, {
+  return rbac.userHasAllFeatures(scope.userId, ['messages.email'], {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
   })
-
-  return Boolean(acl.isSuperAdmin) || hasFeature(acl.features, 'messages.email')
 }

package/src/modules/notifications/lib/notificationRecipients.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 
 interface AclRow {
   user_id: string
@@ -22,13 +22,11 @@ function collectUsersWithFeature(
   requiredFeature: string
 ): void {
   for (const row of rows) {
-    if (row.is_super_admin) {
-      userIdsSet.add(row.user_id)
-      continue
-    }
-
-    const features = normalizeFeatures(row.features_json)
-    if (features && hasFeature(features, requiredFeature)) {
+    const features = normalizeFeatures(row.features_json) ?? []
+    if (authorizeFeatures([requiredFeature], {
+      grantedFeatures: features,
+      unrestricted: row.is_super_admin,
+    })) {
       userIdsSet.add(row.user_id)
     }
   }

package/src/modules/query_index/di.ts

@@ -4,6 +4,7 @@ import { HybridQueryEngine } from './lib/engine'
 import { markDeleted } from './lib/indexer'
 import type { EventBus } from '@open-mercato/events'
 import type { VectorIndexService } from '@open-mercato/search/vector'
+import { CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY } from '@open-mercato/shared/lib/crud/types'
 
 function toEntityTypeFromEvent(event: string): string | null {
   // Expect '<module>.<entity>.<action>'
@@ -65,6 +66,10 @@ export function register(container: AppContainer) {
 
     const makeUpsertHandler = (entityType: string) => async (payload: any, ctx: any) => {
       try {
+        // DataEngine emits the canonical query_index.upsert_one itself. The
+        // bridge only covers domain events from write paths that do not own an
+        // indexer, otherwise failures and error logs are duplicated.
+        if (payload?.[CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY] === true) return
         const em = ctx.resolve('em')
         let orgId = payload?.organizationId || payload?.orgId || ctx?.organizationId || null
         let tenantId = payload?.tenantId || ctx?.tenantId || null
@@ -118,6 +123,7 @@ export function register(container: AppContainer) {
     }
     const makeDeleteHandler = (entityType: string) => async (payload: any, ctx: any) => {
       try {
+        if (payload?.[CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY] === true) return
         const em = ctx.resolve('em')
         let orgId = payload?.organizationId || payload?.orgId || ctx?.organizationId || null
         let tenantId = payload?.tenantId || ctx?.tenantId || null

package/src/modules/query_index/lib/coverage.ts

@@ -1,10 +1,12 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { type Kysely, sql } from 'kysely'
+import { type Kysely, type Transaction, sql } from 'kysely'
 import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('query_index').child({ component: 'coverage' })
 
+type CoverageExecutor = Kysely<any> | Transaction<any>
+
 export type CoverageScope = {
   entityType: string
   tenantId?: string | null
@@ -95,7 +97,7 @@ function applyOrganizationCondition<QB extends { where: (...args: any[]) => QB }
 }
 
 async function fetchCoverageRow(
-  db: Kysely<any>,
+  db: CoverageExecutor,
   scope: CoverageScope
 ): Promise<(CoverageRow & { organization_id: string | null }) | null> {
   const { entityType, tenantId, organizationId, withDeleted } = scope
@@ -120,7 +122,7 @@ async function fetchCoverageRow(
 }
 
 async function pruneDuplicateCoverageRows(
-  db: Kysely<any>,
+  db: CoverageExecutor,
   scope: CoverageScope,
   keepId: string | null
 ): Promise<void> {
@@ -139,7 +141,7 @@ async function pruneDuplicateCoverageRows(
 }
 
 async function upsertCoverageRow(
-  db: Kysely<any>,
+  db: CoverageExecutor,
   scope: CoverageScope,
   counts: { baseCount: number; indexedCount: number; vectorIndexedCount: number }
 ): Promise<void> {
@@ -260,10 +262,11 @@ export async function readCoverageSnapshots(
 
 export async function applyCoverageAdjustments(
   em: EntityManager,
-  adjustments: CoverageAdjustment[]
+  adjustments: CoverageAdjustment[],
+  options?: { trx?: CoverageExecutor },
 ): Promise<void> {
   if (!adjustments.length) return
-  const db = (em as any).getKysely() as Kysely<any>
+  const db = options?.trx ?? ((em as any).getKysely() as Kysely<any>)
   const aggregated = aggregateAdjustments(adjustments)
   for (const entry of aggregated) {
     const scope = entry.scope

package/src/modules/query_index/lib/indexer.ts

@@ -2,13 +2,21 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { decryptIndexDocForSearch, encryptIndexDocForStorage } from '@open-mercato/shared/lib/encryption/indexDoc'
-import { sql } from 'kysely'
+import {
+  buildCustomFieldDefinitionIndexFromRows,
+  normalizeDefinitionKey,
+  selectDefinitionForRecord,
+  type CustomFieldDefinitionRow,
+} from '@open-mercato/shared/lib/crud/custom-field-definition-index'
+import { type Kysely, type Transaction, sql } from 'kysely'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { replaceSearchTokensForRecord, deleteSearchTokensForRecord } from './search-tokens'
 import { attachAggregateSearchField } from './document'
 
 const logger = createLogger('query_index').child({ component: 'indexer' })
 
+type QueryIndexExecutor = Kysely<any> | Transaction<any>
+
 type BuildDocParams = {
   entityType: string // '<module>:<entity>'
   recordId: string
@@ -96,9 +104,74 @@ export async function buildIndexDoc(em: EntityManager, params: BuildDocParams):
     if (!cfMap[cfKey]) cfMap[cfKey] = []
     cfMap[cfKey].push(val)
   }
+
+  const multiKeys = new Set<string>()
+  const fieldKeys = Object.keys(cfMap).map((key) => key.slice(3))
+  if (fieldKeys.length > 0) {
+    let defQuery = db
+      .selectFrom('custom_field_defs' as any)
+      .select([
+        'key' as any,
+        'kind' as any,
+        'config_json' as any,
+        'organization_id' as any,
+        'tenant_id' as any,
+        'deleted_at' as any,
+        'updated_at' as any,
+      ])
+      .where('entity_id' as any, '=', params.entityType)
+      .where('key' as any, 'in', fieldKeys)
+      .where('is_active' as any, '=', true)
+      .where('deleted_at' as any, 'is', null)
+
+    if (params.organizationId != null) {
+      defQuery = defQuery.where((eb: any) => eb.or([
+        eb('organization_id' as any, '=', params.organizationId),
+        eb('organization_id' as any, 'is', null),
+      ]))
+    } else {
+      defQuery = defQuery.where('organization_id' as any, 'is', null)
+    }
+
+    if (params.tenantId != null) {
+      defQuery = defQuery.where((eb: any) => eb.or([
+        eb('tenant_id' as any, '=', params.tenantId),
+        eb('tenant_id' as any, 'is', null),
+      ]))
+    } else {
+      defQuery = defQuery.where('tenant_id' as any, 'is', null)
+    }
+
+    const defRows = await defQuery.execute() as Array<Record<string, any>>
+    const definitionIndex = buildCustomFieldDefinitionIndexFromRows(
+      defRows.map((row): CustomFieldDefinitionRow => ({
+        key: String(row.key ?? ''),
+        entityId: params.entityType,
+        kind: typeof row.kind === 'string' ? row.kind : null,
+        configJson: row.config_json,
+        organizationId: row.organization_id ?? null,
+        tenantId: row.tenant_id ?? null,
+        deletedAt: row.deleted_at ?? null,
+        updatedAt: row.updated_at ?? null,
+      })),
+      { organizationIds: params.organizationId ? [params.organizationId] : [] },
+    )
+    for (const key of fieldKeys) {
+      const definitions = definitionIndex.get(normalizeDefinitionKey(key)) ?? []
+      const definition = selectDefinitionForRecord(
+        definitions,
+        params.organizationId ?? null,
+        params.tenantId ?? null,
+      )
+      if (definition?.multi) multiKeys.add(key)
+    }
+  }
+
   for (const [key, arr] of Object.entries(cfMap)) {
-    // Store singletons as simple value; multis as array
-    doc[key] = arr.length <= 1 ? arr[0] : arr
+    // Cardinality belongs to the field definition, not the current row count:
+    // a multi field containing one value must still hydrate as an array.
+    const fieldKey = key.slice(3)
+    doc[key] = multiKeys.has(fieldKey) || arr.length > 1 ? arr : arr[0]
   }
 
   // Attach translations under flat keys 'l10n:{locale}:{field}'
@@ -181,12 +254,13 @@ function scopeEntityIndexes<QB extends { where: (...args: any[]) => QB }>(
 
 export async function upsertIndexRow(
   em: EntityManager,
-  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean }
+  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; searchTokenDoc?: Record<string, unknown> | null; deferSearchTokens?: boolean; trx?: QueryIndexExecutor }
 ): Promise<UpsertIndexResult> {
   const db = (em as any).getKysely()
+  const executor = args.trx ?? db
 
   const existing = await scopeEntityIndexes(
-    db.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),
+    executor.selectFrom('entity_indexes' as any).select(['id' as any, 'deleted_at' as any]),
     args,
   ).executeTakeFirst() as { id: string; deleted_at: Date | null } | undefined
 
@@ -205,12 +279,15 @@ export async function upsertIndexRow(
           organizationId: args.organizationId ?? null,
           tenantId: args.tenantId ?? null,
           doc: null,
+          trx: args.trx,
         })
-      } catch {}
+      } catch (error) {
+        if (args.trx) throw error
+      }
     }
     if (existed) {
       await scopeEntityIndexes(
-        db.deleteFrom('entity_indexes' as any) as any,
+        executor.deleteFrom('entity_indexes' as any) as any,
         args,
       ).execute()
     }
@@ -230,7 +307,7 @@ export async function upsertIndexRow(
 
   // Prefer modern upsert keyed by coalesced org id when available; fallback to update-then-insert
   try {
-    await db
+    await executor
       .insertInto('entity_indexes' as any)
       .values({ ...payload, created_at: sql`now()` } as any)
       .onConflict((oc: any) => oc
@@ -246,16 +323,18 @@ export async function upsertIndexRow(
   } catch {
     // Fallback for schemas without organization_id_coalesced column/index
     const updated = await scopeEntityIndexes(
-      db.updateTable('entity_indexes' as any).set(payload as any) as any,
+      executor.updateTable('entity_indexes' as any).set(payload as any) as any,
       args,
     ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined
     if (!updated || Number(updated.numUpdatedRows ?? 0) === 0) {
       try {
-        await db
+        await executor
           .insertInto('entity_indexes' as any)
           .values({ ...payload, created_at: sql`now()` } as any)
           .execute()
-      } catch {}
+      } catch (error) {
+        if (args.trx) throw error
+      }
     }
   }
 
@@ -273,8 +352,11 @@ export async function upsertIndexRow(
         tenantId: args.tenantId ?? null,
         doc,
         searchTokenDoc: args.searchTokenDoc ?? null,
+        trx: args.trx,
       })
-    } catch {}
+    } catch (error) {
+      if (args.trx) throw error
+    }
   }
   return { doc, existed, wasDeleted, created, revived }
 }
@@ -294,6 +376,7 @@ export async function reindexSearchTokensForRecord(
     tenantId?: string | null
     doc: Record<string, any> | null
     searchTokenDoc?: Record<string, unknown> | null
+    trx?: QueryIndexExecutor
   },
 ): Promise<void> {
   const db = (em as any).getKysely()
@@ -303,7 +386,7 @@ export async function reindexSearchTokensForRecord(
       recordId: args.recordId,
       organizationId: args.organizationId ?? null,
       tenantId: args.tenantId ?? null,
-    })
+    }, { trx: args.trx })
     return
   }
   const tokenDoc = args.searchTokenDoc ?? (() => {
@@ -323,16 +406,17 @@ export async function reindexSearchTokensForRecord(
     organizationId: args.organizationId ?? null,
     tenantId: args.tenantId ?? null,
     doc: await tokenDoc,
-  })
+  }, { trx: args.trx })
 }
 
 export async function markDeleted(
   em: EntityManager,
-  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null }
+  args: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null; trx?: QueryIndexExecutor }
 ): Promise<{ wasActive: boolean }> {
   const db = (em as any).getKysely()
+  const executor = args.trx ?? db
   const existing = await scopeEntityIndexes(
-    db.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),
+    executor.selectFrom('entity_indexes' as any).select(['deleted_at' as any]),
     args,
   ).executeTakeFirst() as { deleted_at: Date | null } | undefined
 
@@ -345,10 +429,12 @@ export async function markDeleted(
         recordId: args.recordId,
         organizationId: args.organizationId ?? null,
         tenantId: args.tenantId ?? null,
-      })
-    } catch {}
+      }, { trx: args.trx })
+    } catch (error) {
+      if (args.trx) throw error
+    }
     await scopeEntityIndexes(
-      db.deleteFrom('entity_indexes' as any) as any,
+      executor.deleteFrom('entity_indexes' as any) as any,
       args,
     ).execute()
   }

package/src/modules/query_index/lib/search-tokens.ts

@@ -1,4 +1,4 @@
-import { type Kysely, sql } from 'kysely'
+import { type Kysely, type Transaction, sql } from 'kysely'
 import {
   isSearchFieldBlocklisted,
   resolveSearchConfig,
@@ -40,6 +40,7 @@ type BuildTokenOptions = {
 
 const DEFAULT_SCOPE = { organizationId: null, tenantId: null }
 type EntityFieldPair = [string, string]
+type SearchTokenExecutor = Kysely<any> | Transaction<any>
 
 export const isSearchDebugEnabled = (): boolean => {
   return parseBooleanToken(process.env.OM_SEARCH_DEBUG ?? '') === true
@@ -151,7 +152,8 @@ function buildFieldPairs(recordId: string, doc?: Record<string, unknown> | null)
 
 export async function replaceSearchTokensForRecord(
   db: Kysely<any>,
-  params: BuildTokenOptions
+  params: BuildTokenOptions,
+  options?: { trx?: SearchTokenExecutor },
 ): Promise<void> {
   const rows = buildSearchTokenRows(params)
   const config = params.config ?? resolveSearchConfig()
@@ -160,8 +162,8 @@ export async function replaceSearchTokensForRecord(
   const tenantId = params.tenantId ?? null
   const fieldPairs = buildFieldPairs(String(params.recordId), params.doc)
 
-  await db.transaction().execute(async (trx) => {
-    let deleteQuery = trx
+  const writeTokens = async (executor: SearchTokenExecutor): Promise<void> => {
+    let deleteQuery = executor
       .deleteFrom('search_tokens' as any)
       .where('entity_type' as any, '=', params.entityType)
       .where(sql<boolean>`organization_id is not distinct from ${organizationId}`)
@@ -180,18 +182,27 @@ export async function replaceSearchTokensForRecord(
     if (!rows.length) return
     const payloads = rows.map((row) => ({ ...row, created_at: sql`now()` }))
     for (const batch of chunk(payloads, INSERT_BATCH_SIZE)) {
-      await trx.insertInto('search_tokens' as any).values(batch as any).execute()
+      await executor.insertInto('search_tokens' as any).values(batch as any).execute()
     }
-  })
+  }
+
+  if (options?.trx) {
+    await writeTokens(options.trx)
+    return
+  }
+
+  await db.transaction().execute(writeTokens)
 }
 
 export async function deleteSearchTokensForRecord(
   db: Kysely<any>,
-  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null }
+  params: { entityType: string; recordId: string; organizationId?: string | null; tenantId?: string | null },
+  options?: { trx?: SearchTokenExecutor },
 ): Promise<void> {
   const organizationId = params.organizationId ?? null
   const tenantId = params.tenantId ?? null
-  await db
+  const executor = options?.trx ?? db
+  await executor
     .deleteFrom('search_tokens' as any)
     .where('entity_type' as any, '=', params.entityType)
     .where('entity_id' as any, '=', String(params.recordId))

package/src/modules/query_index/subscribers/coverage_refresh.ts

@@ -1,5 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
+import { isReadProjectionAlwaysConsistent } from '@open-mercato/shared/lib/data/consistency'
 import { refreshCoverageSnapshot } from '../lib/coverage'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -70,6 +71,9 @@ export default async function handle(payload: Payload, ctx: { resolve: <T = any>
           payload,
         },
       )
+      if (isReadProjectionAlwaysConsistent()) {
+        throw err
+      }
     }
   }