@open-mercato/core 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/dist/modules/entities/api/entity-settings.js

@@ -2,6 +2,9 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { beginEntitiesMutationGuard } from "./definitions.mutation-guard.js";
+import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 const CONFIG_MODULE = "entities";
 const NEW_ENTITIES_RESTRICTED_KEY = "newEntitiesRestrictedByDefault";
 const metadata = {
@@ -24,11 +27,19 @@ async function readPolicy(tenantId) {
 async function GET(req) {
   const auth = await getAuthFromRequest(req);
   if (!auth || !auth.tenantId) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
-  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null);
-  return NextResponse.json({ newEntitiesRestrictedByDefault });
+  const { resolve } = await createRequestContainer();
+  const moduleConfigService = resolve("moduleConfigService");
+  const record = await moduleConfigService.getRecord(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {
+    tenantId: auth.tenantId ?? null
+  });
+  return NextResponse.json({
+    newEntitiesRestrictedByDefault: record ? record.value === true : false,
+    updatedAt: record ? record.updatedAt : null
+  });
 }
 const putBodySchema = z.object({
-  newEntitiesRestrictedByDefault: z.boolean()
+  newEntitiesRestrictedByDefault: z.boolean(),
+  expectedUpdatedAt: z.string().optional()
 });
 async function PUT(req) {
   const auth = await getAuthFromRequest(req);
@@ -43,18 +54,56 @@ async function PUT(req) {
   if (!parsed.success) {
     return NextResponse.json({ error: "Validation failed", details: parsed.error.flatten() }, { status: 400 });
   }
-  const { resolve } = await createRequestContainer();
+  const container = await createRequestContainer();
+  const { resolve } = container;
   const moduleConfigService = resolve("moduleConfigService");
-  await moduleConfigService.setValue(
+  const currentRecord = await moduleConfigService.getRecord(
+    CONFIG_MODULE,
+    NEW_ENTITIES_RESTRICTED_KEY,
+    { tenantId: auth.tenantId ?? null }
+  );
+  const guard = await beginEntitiesMutationGuard({
+    container,
+    auth,
+    req,
+    resourceKind: "entities.settings",
+    resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+    operation: currentRecord ? "update" : "create",
+    mutationPayload: parsed.data
+  });
+  if (guard.blockedResponse) return guard.blockedResponse;
+  const ifMatchHeader = req.headers.get("If-Match") || req.headers.get("x-om-ext-optimistic-lock-expected-updated-at");
+  const expectedUpdatedAt = ifMatchHeader || parsed.data.expectedUpdatedAt;
+  try {
+    await enforceCommandOptimisticLockWithGuards(container, {
+      resourceKind: "entities.settings",
+      resourceId: NEW_ENTITIES_RESTRICTED_KEY,
+      current: currentRecord ? currentRecord.updatedAt : null,
+      expected: expectedUpdatedAt,
+      request: req
+    });
+  } catch (lockError) {
+    if (isCrudHttpError(lockError)) {
+      return NextResponse.json(lockError.body, { status: lockError.status });
+    }
+    throw lockError;
+  }
+  const updatedRecord = await moduleConfigService.setValue(
     CONFIG_MODULE,
     NEW_ENTITIES_RESTRICTED_KEY,
     parsed.data.newEntitiesRestrictedByDefault,
     { tenantId: auth.tenantId ?? null }
   );
-  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault });
+  await guard.runAfterSuccess();
+  return NextResponse.json({
+    ok: true,
+    newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault,
+    updatedAt: updatedRecord ? updatedRecord.updatedAt : null
+  });
 }
 const settingsResponseSchema = z.object({
-  newEntitiesRestrictedByDefault: z.boolean()
+  newEntitiesRestrictedByDefault: z.boolean(),
+  updatedAt: z.string().nullable().optional()
 });
 const openApi = {
   tag: "Entities",
@@ -73,9 +122,10 @@ const openApi = {
       description: "Sets the tenant-scoped default-restricted policy for new custom entities.",
       requestBody: { schema: putBodySchema },
       responses: [
-        { status: 200, description: "Updated settings", schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },
+        { status: 200, description: "Updated settings", schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean(), updatedAt: z.string().nullable().optional() }) },
         { status: 400, description: "Invalid payload", schema: z.object({ error: z.string() }) },
-        { status: 401, description: "Missing authentication", schema: z.object({ error: z.string() }) }
+        { status: 401, description: "Missing authentication", schema: z.object({ error: z.string() }) },
+        { status: 409, description: "Optimistic lock conflict", schema: z.object({ code: z.string(), error: z.string() }) }
       ]
     }
   }

package/dist/modules/entities/api/entity-settings.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/entities/api/entity-settings.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\n// Tenant-scoped policy: when true, new custom entities are created with\n// `access_restricted = true` unless the create request explicitly sets the flag.\nconst CONFIG_MODULE = 'entities'\nconst NEW_ENTITIES_RESTRICTED_KEY = 'newEntitiesRestrictedByDefault'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\ntype ModuleConfigServiceLike = {\n  getValue: (\n    moduleId: string,\n    name: string,\n    options?: { defaultValue?: unknown; scope?: { tenantId?: string | null } },\n  ) => Promise<unknown>\n  setValue: (\n    moduleId: string,\n    name: string,\n    value: unknown,\n    scope?: { tenantId?: string | null },\n  ) => Promise<unknown>\n}\n\nasync function readPolicy(tenantId: string | null): Promise<boolean> {\n  try {\n    const { resolve } = await createRequestContainer()\n    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike\n    const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {\n      defaultValue: false,\n      scope: { tenantId },\n    })\n    return value === true\n  } catch {\n    return false\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const newEntitiesRestrictedByDefault = await readPolicy(auth.tenantId ?? null)\n  return NextResponse.json({ newEntitiesRestrictedByDefault })\n}\n\nconst putBodySchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n})\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: unknown\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = putBodySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const { resolve } = await createRequestContainer()\n  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigServiceLike\n  await moduleConfigService.setValue(\n    CONFIG_MODULE,\n    NEW_ENTITIES_RESTRICTED_KEY,\n    parsed.data.newEntitiesRestrictedByDefault,\n    { tenantId: auth.tenantId ?? null },\n  )\n  return NextResponse.json({ ok: true, newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault })\n}\n\nconst settingsResponseSchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Custom entity workspace settings',\n  methods: {\n    GET: {\n      summary: 'Get custom entity settings',\n      description: 'Returns the tenant-scoped default-restricted policy for new custom entities.',\n      responses: [\n        { status: 200, description: 'Current settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update custom entity settings',\n      description: 'Sets the tenant-scoped default-restricted policy for new custom entities.',\n      requestBody: { schema: putBodySchema },\n      responses: [\n        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAKvC,MAAM,gBAAgB;AACtB,MAAM,8BAA8B;AAE7B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC7E;AAgBA,eAAe,WAAW,UAA2C;AACnE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,sBAAsB,QAAQ,qBAAqB;AACzD,UAAM,QAAQ,MAAM,oBAAoB,SAAS,eAAe,6BAA6B;AAAA,MAC3F,cAAc;AAAA,MACd,OAAO,EAAE,SAAS;AAAA,IACpB,CAAC;AACD,WAAO,UAAU;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,QAAM,iCAAiC,MAAM,WAAW,KAAK,YAAY,IAAI;AAC7E,SAAO,aAAa,KAAK,EAAE,+BAA+B,CAAC;AAC7D;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,sBAAsB,QAAQ,qBAAqB;AACzD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,YAAY,KAAK;AAAA,EACpC;AACA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,gCAAgC,OAAO,KAAK,+BAA+B,CAAC;AACnH;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gCAAgC,EAAE,QAAQ;AAC5C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE;AAAA,QACnI,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { beginEntitiesMutationGuard } from './definitions.mutation-guard'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { ModuleConfigService } from '../../configs/lib/module-config-service'\n\n// Tenant-scoped policy: when true, new custom entities are created with\n// `access_restricted = true` unless the create request explicitly sets the flag.\nconst CONFIG_MODULE = 'entities'\nconst NEW_ENTITIES_RESTRICTED_KEY = 'newEntitiesRestrictedByDefault'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['entities.definitions.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },\n}\n\nasync function readPolicy(tenantId: string | null): Promise<boolean> {\n  try {\n    const { resolve } = await createRequestContainer()\n    const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService\n    const value = await moduleConfigService.getValue(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {\n      defaultValue: false,\n      scope: { tenantId },\n    })\n    return value === true\n  } catch {\n    return false\n  }\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const { resolve } = await createRequestContainer()\n  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService\n  const record = await moduleConfigService.getRecord(CONFIG_MODULE, NEW_ENTITIES_RESTRICTED_KEY, {\n    tenantId: auth.tenantId ?? null,\n  })\n  return NextResponse.json({\n    newEntitiesRestrictedByDefault: record ? record.value === true : false,\n    updatedAt: record ? record.updatedAt : null,\n  })\n}\n\nconst putBodySchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n  expectedUpdatedAt: z.string().optional(),\n})\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  let body: unknown\n  try { body = await req.json() } catch { return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n  const parsed = putBodySchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Validation failed', details: parsed.error.flatten() }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const moduleConfigService = resolve('moduleConfigService') as ModuleConfigService\n\n  const currentRecord = await moduleConfigService.getRecord(\n    CONFIG_MODULE,\n    NEW_ENTITIES_RESTRICTED_KEY,\n    { tenantId: auth.tenantId ?? null },\n  )\n\n  const guard = await beginEntitiesMutationGuard({\n    container,\n    auth,\n    req,\n    resourceKind: 'entities.settings',\n    resourceId: NEW_ENTITIES_RESTRICTED_KEY,\n    operation: currentRecord ? 'update' : 'create',\n    mutationPayload: parsed.data as unknown as Record<string, unknown>,\n  })\n  if (guard.blockedResponse) return guard.blockedResponse\n\n  const ifMatchHeader = req.headers.get('If-Match') || req.headers.get('x-om-ext-optimistic-lock-expected-updated-at')\n  const expectedUpdatedAt = ifMatchHeader || parsed.data.expectedUpdatedAt\n\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'entities.settings',\n      resourceId: NEW_ENTITIES_RESTRICTED_KEY,\n      current: currentRecord ? currentRecord.updatedAt : null,\n      expected: expectedUpdatedAt,\n      request: req,\n    })\n  } catch (lockError) {\n    if (isCrudHttpError(lockError)) {\n      return NextResponse.json(lockError.body, { status: lockError.status })\n    }\n    throw lockError\n  }\n\n  const updatedRecord = await moduleConfigService.setValue(\n    CONFIG_MODULE,\n    NEW_ENTITIES_RESTRICTED_KEY,\n    parsed.data.newEntitiesRestrictedByDefault,\n    { tenantId: auth.tenantId ?? null },\n  )\n\n  await guard.runAfterSuccess()\n\n  return NextResponse.json({\n    ok: true,\n    newEntitiesRestrictedByDefault: parsed.data.newEntitiesRestrictedByDefault,\n    updatedAt: updatedRecord ? updatedRecord.updatedAt : null,\n  })\n}\n\nconst settingsResponseSchema = z.object({\n  newEntitiesRestrictedByDefault: z.boolean(),\n  updatedAt: z.string().nullable().optional(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Entities',\n  summary: 'Custom entity workspace settings',\n  methods: {\n    GET: {\n      summary: 'Get custom entity settings',\n      description: 'Returns the tenant-scoped default-restricted policy for new custom entities.',\n      responses: [\n        { status: 200, description: 'Current settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update custom entity settings',\n      description: 'Sets the tenant-scoped default-restricted policy for new custom entities.',\n      requestBody: { schema: putBodySchema },\n      responses: [\n        { status: 200, description: 'Updated settings', schema: z.object({ ok: z.boolean(), newEntitiesRestrictedByDefault: z.boolean(), updatedAt: z.string().nullable().optional() }) },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Missing authentication', schema: z.object({ error: z.string() }) },\n        { status: 409, description: 'Optimistic lock conflict', schema: z.object({ code: z.string(), error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,kCAAkC;AAC3C,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAKhC,MAAM,gBAAgB;AACtB,MAAM,8BAA8B;AAE7B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EACzE,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,6BAA6B,EAAE;AAC7E;AAEA,eAAe,WAAW,UAA2C;AACnE,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,sBAAsB,QAAQ,qBAAqB;AACzD,UAAM,QAAQ,MAAM,oBAAoB,SAAS,eAAe,6BAA6B;AAAA,MAC3F,cAAc;AAAA,MACd,OAAO,EAAE,SAAS;AAAA,IACpB,CAAC;AACD,WAAO,UAAU;AAAA,EACnB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,sBAAsB,QAAQ,qBAAqB;AACzD,QAAM,SAAS,MAAM,oBAAoB,UAAU,eAAe,6BAA6B;AAAA,IAC7F,UAAU,KAAK,YAAY;AAAA,EAC7B,CAAC;AACD,SAAO,aAAa,KAAK;AAAA,IACvB,gCAAgC,SAAS,OAAO,UAAU,OAAO;AAAA,IACjE,WAAW,SAAS,OAAO,YAAY;AAAA,EACzC,CAAC;AACH;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,gCAAgC,EAAE,QAAQ;AAAA,EAC1C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,SAAU,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAChG,MAAI;AACJ,MAAI;AAAE,WAAO,MAAM,IAAI,KAAK;AAAA,EAAE,QAAQ;AAAE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAAE;AAC7G,QAAM,SAAS,cAAc,UAAU,IAAI;AAC3C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,sBAAsB,QAAQ,qBAAqB;AAEzD,QAAM,gBAAgB,MAAM,oBAAoB;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,YAAY,KAAK;AAAA,EACpC;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW,gBAAgB,WAAW;AAAA,IACtC,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,MAAM,gBAAiB,QAAO,MAAM;AAExC,QAAM,gBAAgB,IAAI,QAAQ,IAAI,UAAU,KAAK,IAAI,QAAQ,IAAI,8CAA8C;AACnH,QAAM,oBAAoB,iBAAiB,OAAO,KAAK;AAEvD,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,SAAS,gBAAgB,cAAc,YAAY;AAAA,MACnD,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,WAAW;AAClB,QAAI,gBAAgB,SAAS,GAAG;AAC9B,aAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AAAA,IACvE;AACA,UAAM;AAAA,EACR;AAEA,QAAM,gBAAgB,MAAM,oBAAoB;AAAA,IAC9C;AAAA,IACA;AAAA,IACA,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,YAAY,KAAK;AAAA,EACpC;AAEA,QAAM,MAAM,gBAAgB;AAE5B,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,gCAAgC,OAAO,KAAK;AAAA,IAC5C,WAAW,gBAAgB,cAAc,YAAY;AAAA,EACvD,CAAC;AACH;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gCAAgC,EAAE,QAAQ;AAAA,EAC1C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,uBAAuB;AAAA,QAC/E,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MAChG;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,gCAAgC,EAAE,QAAQ,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,EAAE;AAAA,QAChL,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACpH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/entities/backend/config/settings/page.js

@@ -0,0 +1,10 @@
+import { jsx } from "react/jsx-runtime";
+import { Page, PageBody } from "@open-mercato/ui/backend/Page";
+import { EntitySettingsManager } from "../../../components/EntitySettingsManager.js";
+function EntitySettingsPage() {
+  return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { className: "space-y-8", children: /* @__PURE__ */ jsx(EntitySettingsManager, {}) }) });
+}
+export {
+  EntitySettingsPage as default
+};
+//# sourceMappingURL=page.js.map

package/dist/modules/entities/backend/config/settings/page.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/entities/backend/config/settings/page.tsx"],
+  "sourcesContent": ["import { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { EntitySettingsManager } from '../../../components/EntitySettingsManager'\n\nexport default function EntitySettingsPage() {\n  return (\n    <Page>\n      <PageBody className=\"space-y-8\">\n        <EntitySettingsManager />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": "AAOQ;AAPR,SAAS,MAAM,gBAAgB;AAC/B,SAAS,6BAA6B;AAEvB,SAAR,qBAAsC;AAC3C,SACE,oBAAC,QACC,8BAAC,YAAS,WAAU,aAClB,8BAAC,yBAAsB,GACzB,GACF;AAEJ;",
+  "names": []
+}

package/dist/modules/entities/backend/config/settings/page.meta.js

@@ -0,0 +1,36 @@
+import React from "react";
+const settingsIcon = React.createElement(
+  "svg",
+  {
+    width: 16,
+    height: 16,
+    viewBox: "0 0 24 24",
+    fill: "none",
+    stroke: "currentColor",
+    strokeWidth: 2,
+    strokeLinecap: "round",
+    strokeLinejoin: "round"
+  },
+  React.createElement("circle", { cx: 12, cy: 12, r: 3 }),
+  React.createElement("path", {
+    d: "M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z"
+  })
+);
+const metadata = {
+  requireAuth: true,
+  requireFeatures: ["entities.definitions.manage"],
+  pageTitle: "Custom Entities",
+  pageTitleKey: "entities.settings.title",
+  pageGroup: "Module Configs",
+  pageGroupKey: "settings.sections.moduleConfigs",
+  pageOrder: 5,
+  icon: settingsIcon,
+  pageContext: "settings",
+  breadcrumb: [
+    { label: "Custom Entities", labelKey: "entities.settings.title" }
+  ]
+};
+export {
+  metadata
+};
+//# sourceMappingURL=page.meta.js.map

package/dist/modules/entities/backend/config/settings/page.meta.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/entities/backend/config/settings/page.meta.ts"],
+  "sourcesContent": ["import React from 'react'\n\nconst settingsIcon = React.createElement(\n  'svg',\n  {\n    width: 16,\n    height: 16,\n    viewBox: '0 0 24 24',\n    fill: 'none',\n    stroke: 'currentColor',\n    strokeWidth: 2,\n    strokeLinecap: 'round',\n    strokeLinejoin: 'round',\n  },\n  React.createElement('circle', { cx: 12, cy: 12, r: 3 }),\n  React.createElement('path', {\n    d: 'M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 1 1-2.83 2.83l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-4 0v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 1 1-2.83-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1 0-4h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 1 1 2.83-2.83l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 4 0v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 1 1 2.83 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 0 4h-.09a1.65 1.65 0 0 0-1.51 1z'\n  })\n)\n\nexport const metadata = {\n  requireAuth: true,\n  requireFeatures: ['entities.definitions.manage'],\n  pageTitle: 'Custom Entities',\n  pageTitleKey: 'entities.settings.title',\n  pageGroup: 'Module Configs',\n  pageGroupKey: 'settings.sections.moduleConfigs',\n  pageOrder: 5,\n  icon: settingsIcon,\n  pageContext: 'settings' as const,\n  breadcrumb: [\n    { label: 'Custom Entities', labelKey: 'entities.settings.title' },\n  ],\n} as const\n"],
+  "mappings": "AAAA,OAAO,WAAW;AAElB,MAAM,eAAe,MAAM;AAAA,EACzB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,eAAe;AAAA,IACf,gBAAgB;AAAA,EAClB;AAAA,EACA,MAAM,cAAc,UAAU,EAAE,IAAI,IAAI,IAAI,IAAI,GAAG,EAAE,CAAC;AAAA,EACtD,MAAM,cAAc,QAAQ;AAAA,IAC1B,GAAG;AAAA,EACL,CAAC;AACH;AAEO,MAAM,WAAW;AAAA,EACtB,aAAa;AAAA,EACb,iBAAiB,CAAC,6BAA6B;AAAA,EAC/C,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,cAAc;AAAA,EACd,WAAW;AAAA,EACX,MAAM;AAAA,EACN,aAAa;AAAA,EACb,YAAY;AAAA,IACV,EAAE,OAAO,mBAAmB,UAAU,0BAA0B;AAAA,EAClE;AACF;",
+  "names": []
+}

package/dist/modules/entities/backend/entities/user/create/page.js

@@ -10,6 +10,7 @@ import { useRouter } from "next/navigation";
 import { pushWithFlash } from "@open-mercato/ui/backend/utils/flash";
 import { readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
 import { LoadingMessage } from "@open-mercato/ui/backend/detail";
+import { flash } from "@open-mercato/ui/backend/FlashMessages";
 const schema = upsertCustomEntitySchema;
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 function CreateEntityPage() {
@@ -19,17 +20,25 @@ function CreateEntityPage() {
   React.useEffect(() => {
     let active = true;
     (async () => {
-      const data = await readApiResultOrThrow(
-        "/api/entities/entity-settings",
-        void 0,
-        { errorMessage: "[internal] Failed to load entity settings", fallback: { newEntitiesRestrictedByDefault: false } }
-      ).catch(() => ({ newEntitiesRestrictedByDefault: false }));
-      if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true);
+      try {
+        const data = await readApiResultOrThrow(
+          "/api/entities/entity-settings",
+          void 0,
+          {
+            errorMessage: t("entities.userEntities.errors.settingsLoadFailed", "Could not load default restriction policy; using default"),
+            fallback: { newEntitiesRestrictedByDefault: false }
+          }
+        );
+        if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true);
+      } catch {
+        flash(t("entities.userEntities.errors.settingsLoadFailed", "Could not load default restriction policy; using default"), "warning");
+        if (active) setDefaultRestricted(false);
+      }
     })();
     return () => {
       active = false;
     };
-  }, []);
+  }, [t]);
   const fields = React.useMemo(() => [
     {
       id: "entityId",

package/dist/modules/entities/backend/entities/user/create/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/entities/backend/entities/user/create/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { z } from 'zod'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { useRouter } from 'next/navigation'\nimport { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { LoadingMessage } from '@open-mercato/ui/backend/detail'\n\nconst schema = upsertCustomEntitySchema\n\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\n\nexport default function CreateEntityPage() {\n  const t = useT()\n  const router = useRouter()\n  // Pre-fill the restriction toggle from the tenant default-restricted policy so\n  // the form reflects the workspace posture; null while loading.\n  const [defaultRestricted, setDefaultRestricted] = React.useState<boolean | null>(null)\n  React.useEffect(() => {\n    let active = true\n    ;(async () => {\n      const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(\n        '/api/entities/entity-settings',\n        undefined,\n        { errorMessage: '[internal] Failed to load entity settings', fallback: { newEntitiesRestrictedByDefault: false } },\n      ).catch(() => ({ newEntitiesRestrictedByDefault: false }))\n      if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)\n    })()\n    return () => { active = false }\n  }, [])\n  const fields = React.useMemo<CrudField[]>(() => ([\n    {\n      id: 'entityId',\n      label: t('entities.userEntities.form.entityId.label', 'Entity ID'),\n      type: 'text',\n      required: true,\n      placeholder: t('entities.userEntities.form.entityId.placeholder', 'module_name:entity_id'),\n    },\n    { id: 'label', label: t('entities.userEntities.form.label.label', 'Label'), type: 'text', required: true },\n    { id: 'description', label: t('entities.userEntities.form.description.label', 'Description'), type: 'textarea' },\n    {\n      id: 'defaultEditor',\n      label: t('entities.userEntities.form.defaultEditor.label', 'Default Editor (multiline)'),\n      type: 'select',\n      options: [\n        { value: '', label: t('entities.userEntities.form.defaultEditor.options.default', 'Default (Markdown)') },\n        { value: 'markdown', label: t('entities.userEntities.form.defaultEditor.options.markdown', 'Markdown (UIW)') },\n        { value: 'simpleMarkdown', label: t('entities.userEntities.form.defaultEditor.options.simpleMarkdown', 'Simple Markdown') },\n        { value: 'htmlRichText', label: t('entities.userEntities.form.defaultEditor.options.htmlRichText', 'HTML Rich Text') },\n        { value: 'plain', label: t('entities.userEntities.form.defaultEditor.options.plain', 'Plain textarea') },\n      ],\n    } as unknown as CrudField,\n    { id: 'showInSidebar', label: t('entities.userEntities.form.showInSidebar.label', 'Show in sidebar'), type: 'checkbox' } as CrudField,\n    {\n      id: 'accessRestricted',\n      label: t('entities.userEntities.form.accessRestricted.label', 'Restrict record access'),\n      type: 'checkbox',\n      description: t('entities.userEntities.form.accessRestricted.help', 'Require an explicit per-entity permission to view or manage this entity\u2019s records. Leave off to allow anyone with the general records permission.'),\n    } as CrudField,\n  ]), [t])\n\n  if (defaultRestricted === null) {\n    return (\n      <Page>\n        <PageBody>\n          <LoadingMessage label={t('entities.userEntities.form.loading', 'Loading\u2026')} />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={t('entities.userEntities.form.title', 'Create Entity')}\n          backHref=\"/backend/entities/user\"\n          schema={schema}\n          fields={fields}\n          initialValues={{ entityId: 'user:your_entity', label: '', showInSidebar: false, accessRestricted: defaultRestricted }}\n          submitLabel={t('entities.userEntities.form.submit', 'Create')}\n          cancelHref=\"/backend/entities/user\"\n          onSubmit={async (vals) => {\n            const entityId = await submitCreateEntity({\n              values: vals as Record<string, unknown>,\n              messages: {\n                entityIdRequired: t('entities.userEntities.errors.entityIdRequired', 'Entity ID is required'),\n                entityIdExists: t('entities.userEntities.errors.entityIdExists', 'Entity ID already exists'),\n                loadFailed: t('entities.userEntities.errors.loadFailed', 'Failed to load entities'),\n              },\n            })\n            try {\n              window.dispatchEvent(new Event('om:refresh-sidebar'))\n            } catch {}\n            const successMessage = t('entities.userEntities.flash.created', 'Entity created')\n            pushWithFlash(router, `/backend/entities/user/${encodeURIComponent(entityId)}`, successMessage, 'success')\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\ntype EntityListEntry = {\n  entityId?: string\n  source?: string\n}\n\ntype FetchCustomEntities = (errorMessage?: string) => Promise<EntityListEntry[]>\n\nasync function defaultFetchCustomEntities(errorMessage?: string): Promise<EntityListEntry[]> {\n  const data = await readApiResultOrThrow<{ items?: EntityListEntry[] }>(\n    '/api/entities/entities',\n    undefined,\n    { errorMessage: errorMessage ?? 'Failed to load entities', fallback: { items: [] } },\n  )\n  return Array.isArray(data?.items) ? data.items! : []\n}\n\ntype CreateEntityRequest = (payload: Record<string, unknown>) => Promise<void>\n\nasync function defaultCreateEntityRequest(payload: Record<string, unknown>) {\n  await createCrud('entities/entities', payload)\n}\n\nexport async function submitCreateEntity(options: {\n  values: Record<string, unknown>\n  fetchEntities?: FetchCustomEntities\n  createEntity?: CreateEntityRequest\n  messages?: {\n    entityIdRequired?: string\n    entityIdExists?: string\n    loadFailed?: string\n  }\n}): Promise<string> {\n  const {\n    values,\n    fetchEntities = defaultFetchCustomEntities,\n    createEntity = defaultCreateEntityRequest,\n    messages,\n  } = options\n  const rawEntityId = typeof values.entityId === 'string' ? values.entityId.trim() : ''\n  if (!rawEntityId) {\n    const message = messages?.entityIdRequired ?? 'Entity ID is required'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const existing = await fetchEntities(messages?.loadFailed)\n  const exists = existing.some(\n    (entry) => entry?.entityId === rawEntityId && (entry?.source === 'custom' || entry?.source === undefined),\n  )\n  if (exists) {\n    const message = messages?.entityIdExists ?? 'Entity ID already exists'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const payload: Record<string, unknown> = {\n    ...values,\n    entityId: rawEntityId,\n    labelField: 'name',\n    defaultEditor:\n      typeof (values as Record<string, unknown>).defaultEditor === 'string' &&\n      (values as Record<string, unknown>).defaultEditor\n        ? (values as Record<string, unknown>).defaultEditor\n        : undefined,\n  }\n\n  await createEntity(payload)\n  return rawEntityId\n}\n"],
-  "mappings": ";AAsEU;AArEV,YAAY,WAAW;AAEvB,SAAS,YAAY;AACrB,SAAS,gBAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAE/B,MAAM,SAAS;AAEf,SAAS,MAAM,gBAAgB;AAEhB,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AAGzB,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAyB,IAAI;AACrF,QAAM,UAAU,MAAM;AACpB,QAAI,SAAS;AACZ,KAAC,YAAY;AACZ,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,cAAc,6CAA6C,UAAU,EAAE,gCAAgC,MAAM,EAAE;AAAA,MACnH,EAAE,MAAM,OAAO,EAAE,gCAAgC,MAAM,EAAE;AACzD,UAAI,OAAQ,sBAAqB,MAAM,mCAAmC,IAAI;AAAA,IAChF,GAAG;AACH,WAAO,MAAM;AAAE,eAAS;AAAA,IAAM;AAAA,EAChC,GAAG,CAAC,CAAC;AACL,QAAM,SAAS,MAAM,QAAqB,MAAO;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,6CAA6C,WAAW;AAAA,MACjE,MAAM;AAAA,MACN,UAAU;AAAA,MACV,aAAa,EAAE,mDAAmD,uBAAuB;AAAA,IAC3F;AAAA,IACA,EAAE,IAAI,SAAS,OAAO,EAAE,0CAA0C,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzG,EAAE,IAAI,eAAe,OAAO,EAAE,gDAAgD,aAAa,GAAG,MAAM,WAAW;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kDAAkD,4BAA4B;AAAA,MACvF,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,4DAA4D,oBAAoB,EAAE;AAAA,QACxG,EAAE,OAAO,YAAY,OAAO,EAAE,6DAA6D,gBAAgB,EAAE;AAAA,QAC7G,EAAE,OAAO,kBAAkB,OAAO,EAAE,mEAAmE,iBAAiB,EAAE;AAAA,QAC1H,EAAE,OAAO,gBAAgB,OAAO,EAAE,iEAAiE,gBAAgB,EAAE;AAAA,QACrH,EAAE,OAAO,SAAS,OAAO,EAAE,0DAA0D,gBAAgB,EAAE;AAAA,MACzG;AAAA,IACF;AAAA,IACA,EAAE,IAAI,iBAAiB,OAAO,EAAE,kDAAkD,iBAAiB,GAAG,MAAM,WAAW;AAAA,IACvH;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qDAAqD,wBAAwB;AAAA,MACtF,MAAM;AAAA,MACN,aAAa,EAAE,oDAAoD,wJAAmJ;AAAA,IACxN;AAAA,EACF,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,sBAAsB,MAAM;AAC9B,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,kBAAe,OAAO,EAAE,sCAAsC,eAAU,GAAG,GAC9E,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,eAAe;AAAA,MAC5D,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,UAAU,oBAAoB,OAAO,IAAI,eAAe,OAAO,kBAAkB,kBAAkB;AAAA,MACpH,aAAa,EAAE,qCAAqC,QAAQ;AAAA,MAC5D,YAAW;AAAA,MACX,UAAU,OAAO,SAAS;AACxB,cAAM,WAAW,MAAM,mBAAmB;AAAA,UACxC,QAAQ;AAAA,UACR,UAAU;AAAA,YACR,kBAAkB,EAAE,iDAAiD,uBAAuB;AAAA,YAC5F,gBAAgB,EAAE,+CAA+C,0BAA0B;AAAA,YAC3F,YAAY,EAAE,2CAA2C,yBAAyB;AAAA,UACpF;AAAA,QACF,CAAC;AACD,YAAI;AACF,iBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,QACtD,QAAQ;AAAA,QAAC;AACT,cAAM,iBAAiB,EAAE,uCAAuC,gBAAgB;AAChF,sBAAc,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,gBAAgB,SAAS;AAAA,MAC3G;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AASA,eAAe,2BAA2B,cAAmD;AAC3F,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,cAAc,gBAAgB,2BAA2B,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EACrF;AACA,SAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAS,CAAC;AACrD;AAIA,eAAe,2BAA2B,SAAkC;AAC1E,QAAM,WAAW,qBAAqB,OAAO;AAC/C;AAEA,eAAsB,mBAAmB,SASrB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AACJ,QAAM,cAAc,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACnF,MAAI,CAAC,aAAa;AAChB,UAAM,UAAU,UAAU,oBAAoB;AAC9C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,WAAW,MAAM,cAAc,UAAU,UAAU;AACzD,QAAM,SAAS,SAAS;AAAA,IACtB,CAAC,UAAU,OAAO,aAAa,gBAAgB,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACjG;AACA,MAAI,QAAQ;AACV,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,UAAmC;AAAA,IACvC,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,eACE,OAAQ,OAAmC,kBAAkB,YAC5D,OAAmC,gBAC/B,OAAmC,gBACpC;AAAA,EACR;AAEA,QAAM,aAAa,OAAO;AAC1B,SAAO;AACT;",
+  "sourcesContent": ["\"use client\"\nimport * as React from 'react'\nimport { z } from 'zod'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { CrudForm, type CrudField } from '@open-mercato/ui/backend/CrudForm'\nimport { createCrud } from '@open-mercato/ui/backend/utils/crud'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { upsertCustomEntitySchema } from '@open-mercato/core/modules/entities/data/validators'\nimport { useRouter } from 'next/navigation'\nimport { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { LoadingMessage } from '@open-mercato/ui/backend/detail'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\nconst schema = upsertCustomEntitySchema\n\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\n\nexport default function CreateEntityPage() {\n  const t = useT()\n  const router = useRouter()\n  // Pre-fill the restriction toggle from the tenant default-restricted policy so\n  // the form reflects the workspace posture; null while loading.\n  const [defaultRestricted, setDefaultRestricted] = React.useState<boolean | null>(null)\n  React.useEffect(() => {\n    let active = true\n    ;(async () => {\n      try {\n        const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean }>(\n          '/api/entities/entity-settings',\n          undefined,\n          {\n            errorMessage: t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'),\n            fallback: { newEntitiesRestrictedByDefault: false },\n          },\n        )\n        if (active) setDefaultRestricted(data?.newEntitiesRestrictedByDefault === true)\n      } catch {\n        flash(t('entities.userEntities.errors.settingsLoadFailed', 'Could not load default restriction policy; using default'), 'warning')\n        if (active) setDefaultRestricted(false)\n      }\n    })()\n    return () => { active = false }\n  }, [t])\n  const fields = React.useMemo<CrudField[]>(() => ([\n    {\n      id: 'entityId',\n      label: t('entities.userEntities.form.entityId.label', 'Entity ID'),\n      type: 'text',\n      required: true,\n      placeholder: t('entities.userEntities.form.entityId.placeholder', 'module_name:entity_id'),\n    },\n    { id: 'label', label: t('entities.userEntities.form.label.label', 'Label'), type: 'text', required: true },\n    { id: 'description', label: t('entities.userEntities.form.description.label', 'Description'), type: 'textarea' },\n    {\n      id: 'defaultEditor',\n      label: t('entities.userEntities.form.defaultEditor.label', 'Default Editor (multiline)'),\n      type: 'select',\n      options: [\n        { value: '', label: t('entities.userEntities.form.defaultEditor.options.default', 'Default (Markdown)') },\n        { value: 'markdown', label: t('entities.userEntities.form.defaultEditor.options.markdown', 'Markdown (UIW)') },\n        { value: 'simpleMarkdown', label: t('entities.userEntities.form.defaultEditor.options.simpleMarkdown', 'Simple Markdown') },\n        { value: 'htmlRichText', label: t('entities.userEntities.form.defaultEditor.options.htmlRichText', 'HTML Rich Text') },\n        { value: 'plain', label: t('entities.userEntities.form.defaultEditor.options.plain', 'Plain textarea') },\n      ],\n    } as unknown as CrudField,\n    { id: 'showInSidebar', label: t('entities.userEntities.form.showInSidebar.label', 'Show in sidebar'), type: 'checkbox' } as CrudField,\n    {\n      id: 'accessRestricted',\n      label: t('entities.userEntities.form.accessRestricted.label', 'Restrict record access'),\n      type: 'checkbox',\n      description: t('entities.userEntities.form.accessRestricted.help', 'Require an explicit per-entity permission to view or manage this entity\u2019s records. Leave off to allow anyone with the general records permission.'),\n    } as CrudField,\n  ]), [t])\n\n  if (defaultRestricted === null) {\n    return (\n      <Page>\n        <PageBody>\n          <LoadingMessage label={t('entities.userEntities.form.loading', 'Loading\u2026')} />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={t('entities.userEntities.form.title', 'Create Entity')}\n          backHref=\"/backend/entities/user\"\n          schema={schema}\n          fields={fields}\n          initialValues={{ entityId: 'user:your_entity', label: '', showInSidebar: false, accessRestricted: defaultRestricted }}\n          submitLabel={t('entities.userEntities.form.submit', 'Create')}\n          cancelHref=\"/backend/entities/user\"\n          onSubmit={async (vals) => {\n            const entityId = await submitCreateEntity({\n              values: vals as Record<string, unknown>,\n              messages: {\n                entityIdRequired: t('entities.userEntities.errors.entityIdRequired', 'Entity ID is required'),\n                entityIdExists: t('entities.userEntities.errors.entityIdExists', 'Entity ID already exists'),\n                loadFailed: t('entities.userEntities.errors.loadFailed', 'Failed to load entities'),\n              },\n            })\n            try {\n              window.dispatchEvent(new Event('om:refresh-sidebar'))\n            } catch {}\n            const successMessage = t('entities.userEntities.flash.created', 'Entity created')\n            pushWithFlash(router, `/backend/entities/user/${encodeURIComponent(entityId)}`, successMessage, 'success')\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\ntype EntityListEntry = {\n  entityId?: string\n  source?: string\n}\n\ntype FetchCustomEntities = (errorMessage?: string) => Promise<EntityListEntry[]>\n\nasync function defaultFetchCustomEntities(errorMessage?: string): Promise<EntityListEntry[]> {\n  const data = await readApiResultOrThrow<{ items?: EntityListEntry[] }>(\n    '/api/entities/entities',\n    undefined,\n    { errorMessage: errorMessage ?? 'Failed to load entities', fallback: { items: [] } },\n  )\n  return Array.isArray(data?.items) ? data.items! : []\n}\n\ntype CreateEntityRequest = (payload: Record<string, unknown>) => Promise<void>\n\nasync function defaultCreateEntityRequest(payload: Record<string, unknown>) {\n  await createCrud('entities/entities', payload)\n}\n\nexport async function submitCreateEntity(options: {\n  values: Record<string, unknown>\n  fetchEntities?: FetchCustomEntities\n  createEntity?: CreateEntityRequest\n  messages?: {\n    entityIdRequired?: string\n    entityIdExists?: string\n    loadFailed?: string\n  }\n}): Promise<string> {\n  const {\n    values,\n    fetchEntities = defaultFetchCustomEntities,\n    createEntity = defaultCreateEntityRequest,\n    messages,\n  } = options\n  const rawEntityId = typeof values.entityId === 'string' ? values.entityId.trim() : ''\n  if (!rawEntityId) {\n    const message = messages?.entityIdRequired ?? 'Entity ID is required'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const existing = await fetchEntities(messages?.loadFailed)\n  const exists = existing.some(\n    (entry) => entry?.entityId === rawEntityId && (entry?.source === 'custom' || entry?.source === undefined),\n  )\n  if (exists) {\n    const message = messages?.entityIdExists ?? 'Entity ID already exists'\n    throw createCrudFormError(message, { entityId: message })\n  }\n\n  const payload: Record<string, unknown> = {\n    ...values,\n    entityId: rawEntityId,\n    labelField: 'name',\n    defaultEditor:\n      typeof (values as Record<string, unknown>).defaultEditor === 'string' &&\n      (values as Record<string, unknown>).defaultEditor\n        ? (values as Record<string, unknown>).defaultEditor\n        : undefined,\n  }\n\n  await createEntity(payload)\n  return rawEntityId\n}\n"],
+  "mappings": ";AA+EU;AA9EV,YAAY,WAAW;AAEvB,SAAS,YAAY;AACrB,SAAS,gBAAgC;AACzC,SAAS,kBAAkB;AAC3B,SAAS,2BAA2B;AACpC,SAAS,gCAAgC;AACzC,SAAS,iBAAiB;AAC1B,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,aAAa;AAEtB,MAAM,SAAS;AAEf,SAAS,MAAM,gBAAgB;AAEhB,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AAGzB,QAAM,CAAC,mBAAmB,oBAAoB,IAAI,MAAM,SAAyB,IAAI;AACrF,QAAM,UAAU,MAAM;AACpB,QAAI,SAAS;AACZ,KAAC,YAAY;AACZ,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,UACA;AAAA,UACA;AAAA,YACE,cAAc,EAAE,mDAAmD,0DAA0D;AAAA,YAC7H,UAAU,EAAE,gCAAgC,MAAM;AAAA,UACpD;AAAA,QACF;AACA,YAAI,OAAQ,sBAAqB,MAAM,mCAAmC,IAAI;AAAA,MAChF,QAAQ;AACN,cAAM,EAAE,mDAAmD,0DAA0D,GAAG,SAAS;AACjI,YAAI,OAAQ,sBAAqB,KAAK;AAAA,MACxC;AAAA,IACF,GAAG;AACH,WAAO,MAAM;AAAE,eAAS;AAAA,IAAM;AAAA,EAChC,GAAG,CAAC,CAAC,CAAC;AACN,QAAM,SAAS,MAAM,QAAqB,MAAO;AAAA,IAC/C;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,6CAA6C,WAAW;AAAA,MACjE,MAAM;AAAA,MACN,UAAU;AAAA,MACV,aAAa,EAAE,mDAAmD,uBAAuB;AAAA,IAC3F;AAAA,IACA,EAAE,IAAI,SAAS,OAAO,EAAE,0CAA0C,OAAO,GAAG,MAAM,QAAQ,UAAU,KAAK;AAAA,IACzG,EAAE,IAAI,eAAe,OAAO,EAAE,gDAAgD,aAAa,GAAG,MAAM,WAAW;AAAA,IAC/G;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,kDAAkD,4BAA4B;AAAA,MACvF,MAAM;AAAA,MACN,SAAS;AAAA,QACP,EAAE,OAAO,IAAI,OAAO,EAAE,4DAA4D,oBAAoB,EAAE;AAAA,QACxG,EAAE,OAAO,YAAY,OAAO,EAAE,6DAA6D,gBAAgB,EAAE;AAAA,QAC7G,EAAE,OAAO,kBAAkB,OAAO,EAAE,mEAAmE,iBAAiB,EAAE;AAAA,QAC1H,EAAE,OAAO,gBAAgB,OAAO,EAAE,iEAAiE,gBAAgB,EAAE;AAAA,QACrH,EAAE,OAAO,SAAS,OAAO,EAAE,0DAA0D,gBAAgB,EAAE;AAAA,MACzG;AAAA,IACF;AAAA,IACA,EAAE,IAAI,iBAAiB,OAAO,EAAE,kDAAkD,iBAAiB,GAAG,MAAM,WAAW;AAAA,IACvH;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,qDAAqD,wBAAwB;AAAA,MACtF,MAAM;AAAA,MACN,aAAa,EAAE,oDAAoD,wJAAmJ;AAAA,IACxN;AAAA,EACF,GAAI,CAAC,CAAC,CAAC;AAEP,MAAI,sBAAsB,MAAM;AAC9B,WACE,oBAAC,QACC,8BAAC,YACC,8BAAC,kBAAe,OAAO,EAAE,sCAAsC,eAAU,GAAG,GAC9E,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,eAAe;AAAA,MAC5D,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,eAAe,EAAE,UAAU,oBAAoB,OAAO,IAAI,eAAe,OAAO,kBAAkB,kBAAkB;AAAA,MACpH,aAAa,EAAE,qCAAqC,QAAQ;AAAA,MAC5D,YAAW;AAAA,MACX,UAAU,OAAO,SAAS;AACxB,cAAM,WAAW,MAAM,mBAAmB;AAAA,UACxC,QAAQ;AAAA,UACR,UAAU;AAAA,YACR,kBAAkB,EAAE,iDAAiD,uBAAuB;AAAA,YAC5F,gBAAgB,EAAE,+CAA+C,0BAA0B;AAAA,YAC3F,YAAY,EAAE,2CAA2C,yBAAyB;AAAA,UACpF;AAAA,QACF,CAAC;AACD,YAAI;AACF,iBAAO,cAAc,IAAI,MAAM,oBAAoB,CAAC;AAAA,QACtD,QAAQ;AAAA,QAAC;AACT,cAAM,iBAAiB,EAAE,uCAAuC,gBAAgB;AAChF,sBAAc,QAAQ,0BAA0B,mBAAmB,QAAQ,CAAC,IAAI,gBAAgB,SAAS;AAAA,MAC3G;AAAA;AAAA,EACF,GACF,GACF;AAEJ;AASA,eAAe,2BAA2B,cAAmD;AAC3F,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,cAAc,gBAAgB,2BAA2B,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE;AAAA,EACrF;AACA,SAAO,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAS,CAAC;AACrD;AAIA,eAAe,2BAA2B,SAAkC;AAC1E,QAAM,WAAW,qBAAqB,OAAO;AAC/C;AAEA,eAAsB,mBAAmB,SASrB;AAClB,QAAM;AAAA,IACJ;AAAA,IACA,gBAAgB;AAAA,IAChB,eAAe;AAAA,IACf;AAAA,EACF,IAAI;AACJ,QAAM,cAAc,OAAO,OAAO,aAAa,WAAW,OAAO,SAAS,KAAK,IAAI;AACnF,MAAI,CAAC,aAAa;AAChB,UAAM,UAAU,UAAU,oBAAoB;AAC9C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,WAAW,MAAM,cAAc,UAAU,UAAU;AACzD,QAAM,SAAS,SAAS;AAAA,IACtB,CAAC,UAAU,OAAO,aAAa,gBAAgB,OAAO,WAAW,YAAY,OAAO,WAAW;AAAA,EACjG;AACA,MAAI,QAAQ;AACV,UAAM,UAAU,UAAU,kBAAkB;AAC5C,UAAM,oBAAoB,SAAS,EAAE,UAAU,QAAQ,CAAC;AAAA,EAC1D;AAEA,QAAM,UAAmC;AAAA,IACvC,GAAG;AAAA,IACH,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,eACE,OAAQ,OAAmC,kBAAkB,YAC5D,OAAmC,gBAC/B,OAAmC,gBACpC;AAAA,EACR;AAEA,QAAM,aAAa,OAAO;AAC1B,SAAO;AACT;",
   "names": []
 }

package/dist/modules/entities/components/EntitySettingsManager.js

@@ -0,0 +1,136 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { Checkbox } from "@open-mercato/ui/primitives/checkbox";
+import { Label } from "@open-mercato/ui/primitives/label";
+import { Spinner } from "@open-mercato/ui/primitives/spinner";
+import { flash } from "@open-mercato/ui/backend/FlashMessages";
+import { apiCallOrThrow, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { ErrorMessage } from "@open-mercato/ui/backend/detail";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+function EntitySettingsManager() {
+  const t = useT();
+  const [loading, setLoading] = React.useState(true);
+  const [loadError, setLoadError] = React.useState(false);
+  const [saving, setSaving] = React.useState(false);
+  const [restricted, setRestricted] = React.useState(false);
+  const [updatedAt, setUpdatedAt] = React.useState(null);
+  const { runMutation } = useGuardedMutation({
+    contextId: "custom-entities-settings"
+  });
+  const loadSettings = React.useCallback(async () => {
+    setLoading(true);
+    setLoadError(false);
+    try {
+      const data = await readApiResultOrThrow(
+        "/api/entities/entity-settings",
+        void 0,
+        {
+          errorMessage: t("entities.settings.errors.loadFailed", "Failed to load settings")
+        }
+      );
+      setRestricted(data.newEntitiesRestrictedByDefault === true);
+      setUpdatedAt(data.updatedAt ?? null);
+    } catch {
+      setLoadError(true);
+    } finally {
+      setLoading(false);
+    }
+  }, [t]);
+  React.useEffect(() => {
+    void loadSettings();
+  }, [loadSettings]);
+  const handleSubmit = async (e) => {
+    e.preventDefault();
+    setSaving(true);
+    try {
+      const headers = buildOptimisticLockHeader(updatedAt);
+      await runMutation({
+        operation: () => withScopedApiRequestHeaders(headers, async () => {
+          const res = await apiCallOrThrow(
+            "/api/entities/entity-settings",
+            {
+              method: "PUT",
+              headers: { "content-type": "application/json" },
+              body: JSON.stringify({
+                newEntitiesRestrictedByDefault: restricted,
+                expectedUpdatedAt: updatedAt ?? void 0
+              })
+            },
+            {
+              errorMessage: t("entities.settings.errors.saveFailed", "Failed to save settings")
+            }
+          );
+          if (res.ok && res.result) {
+            setUpdatedAt(res.result.updatedAt);
+            flash(t("entities.settings.flash.saved", "Settings saved"), "success");
+          }
+          return res;
+        }),
+        context: {},
+        mutationPayload: {
+          newEntitiesRestrictedByDefault: restricted
+        }
+      });
+    } catch (err) {
+      const conflict = extractOptimisticLockConflict(err);
+      if (conflict) {
+        setLoading(true);
+        await loadSettings();
+      } else {
+        flash(t("entities.settings.errors.saveFailed", "Failed to save settings"), "error");
+      }
+    } finally {
+      setSaving(false);
+    }
+  };
+  if (loading) {
+    return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 text-sm text-muted-foreground", children: [
+      /* @__PURE__ */ jsx(Spinner, { className: "h-4 w-4" }),
+      /* @__PURE__ */ jsx("span", { children: t("entities.userEntities.form.loading", "Loading\u2026") })
+    ] });
+  }
+  if (loadError) {
+    return /* @__PURE__ */ jsx(
+      ErrorMessage,
+      {
+        label: t("entities.settings.errors.loadFailed", "Failed to load settings"),
+        action: /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", size: "sm", onClick: () => void loadSettings(), children: t("common.retry", "Retry") })
+      }
+    );
+  }
+  return /* @__PURE__ */ jsxs("form", { onSubmit: (e) => void handleSubmit(e), className: "space-y-6 max-w-2xl", children: [
+    /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
+      /* @__PURE__ */ jsx("h3", { className: "text-base font-semibold", children: t("entities.settings.title", "Custom Entities") }),
+      /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: t("entities.settings.description", "Manage global custom entity configurations.") })
+    ] }),
+    /* @__PURE__ */ jsx("div", { className: "rounded-lg border bg-card p-4 space-y-4", children: /* @__PURE__ */ jsxs("div", { className: "flex items-start gap-3", children: [
+      /* @__PURE__ */ jsx(
+        Checkbox,
+        {
+          id: "newEntitiesRestrictedByDefault",
+          checked: restricted,
+          onCheckedChange: (checked) => setRestricted(checked === true),
+          disabled: saving,
+          className: "mt-1"
+        }
+      ),
+      /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
+        /* @__PURE__ */ jsx(Label, { htmlFor: "newEntitiesRestrictedByDefault", className: "font-medium cursor-pointer", children: t("entities.settings.newEntitiesRestrictedByDefault.label", "Restrict record access by default") }),
+        /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: t("entities.settings.newEntitiesRestrictedByDefault.description", "Require explicit per-entity permissions for records of newly created custom entities by default.") })
+      ] })
+    ] }) }),
+    /* @__PURE__ */ jsx("div", { className: "flex items-center justify-end gap-3 border-t pt-4", children: /* @__PURE__ */ jsxs(Button, { type: "submit", disabled: saving, children: [
+      saving ? /* @__PURE__ */ jsx(Spinner, { className: "mr-2 h-4 w-4" }) : null,
+      t("common.save", "Save")
+    ] }) })
+  ] });
+}
+export {
+  EntitySettingsManager
+};
+//# sourceMappingURL=EntitySettingsManager.js.map

package/dist/modules/entities/components/EntitySettingsManager.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/entities/components/EntitySettingsManager.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall, apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { ErrorMessage } from '@open-mercato/ui/backend/detail'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport function EntitySettingsManager(): React.ReactElement {\n  const t = useT()\n  const [loading, setLoading] = React.useState(true)\n  const [loadError, setLoadError] = React.useState(false)\n  const [saving, setSaving] = React.useState(false)\n  const [restricted, setRestricted] = React.useState(false)\n  const [updatedAt, setUpdatedAt] = React.useState<string | null>(null)\n\n  const { runMutation } = useGuardedMutation({\n    contextId: 'custom-entities-settings',\n  })\n\n  const loadSettings = React.useCallback(async () => {\n    setLoading(true)\n    setLoadError(false)\n    try {\n      const data = await readApiResultOrThrow<{ newEntitiesRestrictedByDefault?: boolean; updatedAt?: string | null }>(\n        '/api/entities/entity-settings',\n        undefined,\n        {\n          errorMessage: t('entities.settings.errors.loadFailed', 'Failed to load settings'),\n        }\n      )\n      setRestricted(data.newEntitiesRestrictedByDefault === true)\n      setUpdatedAt(data.updatedAt ?? null)\n    } catch {\n      setLoadError(true)\n    } finally {\n      setLoading(false)\n    }\n  }, [t])\n\n  React.useEffect(() => {\n    void loadSettings()\n  }, [loadSettings])\n\n  const handleSubmit = async (e: React.FormEvent) => {\n    e.preventDefault()\n    setSaving(true)\n    try {\n      const headers = buildOptimisticLockHeader(updatedAt)\n      await runMutation({\n        operation: () =>\n          withScopedApiRequestHeaders(headers, async () => {\n            const res = await apiCallOrThrow<{ ok: boolean; newEntitiesRestrictedByDefault: boolean; updatedAt: string | null }>(\n              '/api/entities/entity-settings',\n              {\n                method: 'PUT',\n                headers: { 'content-type': 'application/json' },\n                body: JSON.stringify({\n                  newEntitiesRestrictedByDefault: restricted,\n                  expectedUpdatedAt: updatedAt ?? undefined,\n                }),\n              },\n              {\n                errorMessage: t('entities.settings.errors.saveFailed', 'Failed to save settings'),\n              }\n            )\n\n            if (res.ok && res.result) {\n              setUpdatedAt(res.result.updatedAt)\n              flash(t('entities.settings.flash.saved', 'Settings saved'), 'success')\n            }\n            return res\n          }),\n        context: {},\n        mutationPayload: {\n          newEntitiesRestrictedByDefault: restricted,\n        },\n      })\n    } catch (err) {\n      const conflict = extractOptimisticLockConflict(err)\n      if (conflict) {\n        setLoading(true)\n        await loadSettings()\n      } else {\n        flash(t('entities.settings.errors.saveFailed', 'Failed to save settings'), 'error')\n      }\n    } finally {\n      setSaving(false)\n    }\n  }\n\n  if (loading) {\n    return (\n      <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n        <Spinner className=\"h-4 w-4\" />\n        <span>{t('entities.userEntities.form.loading', 'Loading\u2026')}</span>\n      </div>\n    )\n  }\n\n  if (loadError) {\n    return (\n      <ErrorMessage\n        label={t('entities.settings.errors.loadFailed', 'Failed to load settings')}\n        action={(\n          <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={() => void loadSettings()}>\n            {t('common.retry', 'Retry')}\n          </Button>\n        )}\n      />\n    )\n  }\n\n  return (\n    <form onSubmit={(e) => void handleSubmit(e)} className=\"space-y-6 max-w-2xl\">\n      <div className=\"space-y-1\">\n        <h3 className=\"text-base font-semibold\">\n          {t('entities.settings.title', 'Custom Entities')}\n        </h3>\n        <p className=\"text-sm text-muted-foreground\">\n          {t('entities.settings.description', 'Manage global custom entity configurations.')}\n        </p>\n      </div>\n\n      <div className=\"rounded-lg border bg-card p-4 space-y-4\">\n        <div className=\"flex items-start gap-3\">\n          <Checkbox\n            id=\"newEntitiesRestrictedByDefault\"\n            checked={restricted}\n            onCheckedChange={(checked) => setRestricted(checked === true)}\n            disabled={saving}\n            className=\"mt-1\"\n          />\n          <div className=\"space-y-1\">\n            <Label htmlFor=\"newEntitiesRestrictedByDefault\" className=\"font-medium cursor-pointer\">\n              {t('entities.settings.newEntitiesRestrictedByDefault.label', 'Restrict record access by default')}\n            </Label>\n            <p className=\"text-sm text-muted-foreground\">\n              {t('entities.settings.newEntitiesRestrictedByDefault.description', 'Require explicit per-entity permissions for records of newly created custom entities by default.')}\n            </p>\n          </div>\n        </div>\n      </div>\n\n      <div className=\"flex items-center justify-end gap-3 border-t pt-4\">\n        <Button type=\"submit\" disabled={saving}>\n          {saving ? <Spinner className=\"mr-2 h-4 w-4\" /> : null}\n          {t('common.save', 'Save')}\n        </Button>\n      </div>\n    </form>\n  )\n}\n"],
+  "mappings": ";AAoGM,SACE,KADF;AAlGN,YAAY,WAAW;AACvB,SAAS,cAAc;AACvB,SAAS,gBAAgB;AACzB,SAAS,aAAa;AACtB,SAAS,eAAe;AACxB,SAAS,aAAa;AACtB,SAAkB,gBAAgB,4BAA4B;AAC9D,SAAS,YAAY;AACrB,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,qCAAqC;AACzE,SAAS,mCAAmC;AAErC,SAAS,wBAA4C;AAC1D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,IAAI;AACjD,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK;AAChD,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwB,IAAI;AAEpE,QAAM,EAAE,YAAY,IAAI,mBAAmB;AAAA,IACzC,WAAW;AAAA,EACb,CAAC;AAED,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,eAAW,IAAI;AACf,iBAAa,KAAK;AAClB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA;AAAA,UACE,cAAc,EAAE,uCAAuC,yBAAyB;AAAA,QAClF;AAAA,MACF;AACA,oBAAc,KAAK,mCAAmC,IAAI;AAC1D,mBAAa,KAAK,aAAa,IAAI;AAAA,IACrC,QAAQ;AACN,mBAAa,IAAI;AAAA,IACnB,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,UAAU,MAAM;AACpB,SAAK,aAAa;AAAA,EACpB,GAAG,CAAC,YAAY,CAAC;AAEjB,QAAM,eAAe,OAAO,MAAuB;AACjD,MAAE,eAAe;AACjB,cAAU,IAAI;AACd,QAAI;AACF,YAAM,UAAU,0BAA0B,SAAS;AACnD,YAAM,YAAY;AAAA,QAChB,WAAW,MACT,4BAA4B,SAAS,YAAY;AAC/C,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,gCAAgC;AAAA,gBAChC,mBAAmB,aAAa;AAAA,cAClC,CAAC;AAAA,YACH;AAAA,YACA;AAAA,cACE,cAAc,EAAE,uCAAuC,yBAAyB;AAAA,YAClF;AAAA,UACF;AAEA,cAAI,IAAI,MAAM,IAAI,QAAQ;AACxB,yBAAa,IAAI,OAAO,SAAS;AACjC,kBAAM,EAAE,iCAAiC,gBAAgB,GAAG,SAAS;AAAA,UACvE;AACA,iBAAO;AAAA,QACT,CAAC;AAAA,QACH,SAAS,CAAC;AAAA,QACV,iBAAiB;AAAA,UACf,gCAAgC;AAAA,QAClC;AAAA,MACF,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,WAAW,8BAA8B,GAAG;AAClD,UAAI,UAAU;AACZ,mBAAW,IAAI;AACf,cAAM,aAAa;AAAA,MACrB,OAAO;AACL,cAAM,EAAE,uCAAuC,yBAAyB,GAAG,OAAO;AAAA,MACpF;AAAA,IACF,UAAE;AACA,gBAAU,KAAK;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,SAAS;AACX,WACE,qBAAC,SAAI,WAAU,yDACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,sCAAsC,eAAU,GAAE;AAAA,OAC7D;AAAA,EAEJ;AAEA,MAAI,WAAW;AACb,WACE;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,uCAAuC,yBAAyB;AAAA,QACzE,QACE,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,MAAM,KAAK,aAAa,GAChF,YAAE,gBAAgB,OAAO,GAC5B;AAAA;AAAA,IAEJ;AAAA,EAEJ;AAEA,SACE,qBAAC,UAAK,UAAU,CAAC,MAAM,KAAK,aAAa,CAAC,GAAG,WAAU,uBACrD;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,QAAG,WAAU,2BACX,YAAE,2BAA2B,iBAAiB,GACjD;AAAA,MACA,oBAAC,OAAE,WAAU,iCACV,YAAE,iCAAiC,6CAA6C,GACnF;AAAA,OACF;AAAA,IAEA,oBAAC,SAAI,WAAU,2CACb,+BAAC,SAAI,WAAU,0BACb;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,SAAS;AAAA,UACT,iBAAiB,CAAC,YAAY,cAAc,YAAY,IAAI;AAAA,UAC5D,UAAU;AAAA,UACV,WAAU;AAAA;AAAA,MACZ;AAAA,MACA,qBAAC,SAAI,WAAU,aACb;AAAA,4BAAC,SAAM,SAAQ,kCAAiC,WAAU,8BACvD,YAAE,0DAA0D,mCAAmC,GAClG;AAAA,QACA,oBAAC,OAAE,WAAU,iCACV,YAAE,gEAAgE,kGAAkG,GACvK;AAAA,SACF;AAAA,OACF,GACF;AAAA,IAEA,oBAAC,SAAI,WAAU,qDACb,+BAAC,UAAO,MAAK,UAAS,UAAU,QAC7B;AAAA,eAAS,oBAAC,WAAQ,WAAU,gBAAe,IAAK;AAAA,MAChD,EAAE,eAAe,MAAM;AAAA,OAC1B,GACF;AAAA,KACF;AAEJ;",
+  "names": []
+}

package/dist/modules/inbox_ops/api/webhook/inbound.js

@@ -10,11 +10,19 @@ import { parseInboundEmail } from "../../lib/emailParser.js";
 import { checkRateLimit } from "../../lib/rateLimiter.js";
 import { emitInboxOpsEvent } from "../../events.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes,
+  WebhookBodyTooLargeError
+} from "@open-mercato/shared/lib/webhooks";
 const logger = createLogger("inbox_ops").child({ component: "webhook" });
 const metadata = {
   POST: { requireAuth: false }
 };
-const MAX_PAYLOAD_SIZE = 2 * 1024 * 1024;
+const MAX_PAYLOAD_SIZE = resolveWebhookBodyLimitBytes(
+  process.env.INBOX_OPS_WEBHOOK_MAX_BODY_BYTES ?? process.env.OM_WEBHOOK_MAX_BODY_BYTES,
+  2 * 1024 * 1024
+);
 const REPLAY_WINDOW_MS = 5 * 60 * 1e3;
 function isTimestampFresh(timestamp) {
   if (!timestamp) return false;
@@ -140,19 +148,15 @@ async function POST(req) {
     logger.error("Neither INBOX_OPS_WEBHOOK_SECRET nor RESEND_WEBHOOK_SIGNING_SECRET is configured");
     return NextResponse.json({ error: "Service unavailable" }, { status: 503 });
   }
-  const contentLength = parseInt(req.headers.get("content-length") || "0", 10);
-  if (contentLength > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: "Payload too large" }, { status: 413 });
-  }
   let rawBody;
   try {
-    rawBody = await req.text();
-  } catch {
+    rawBody = await readBoundedRequestBody(req, { maxBytes: MAX_PAYLOAD_SIZE });
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) {
+      return NextResponse.json({ error: "Payload too large" }, { status: 413 });
+    }
     return NextResponse.json({ error: "Bad request" }, { status: 400 });
   }
-  if (rawBody.length > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: "Payload too large" }, { status: 413 });
-  }
   const verified = await verifyAndParse(req, rawBody);
   if (!verified.ok) {
     return verified.response;