@open-mercato/core 0.6.7-develop.6851.1.c1680b00d8 → 0.6.7-develop.6860.1.f796b22e80

package/src/modules/attachments/migrations/Migration20260709234741_attachments.ts

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260709234741_attachments extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`create table "attachment_quota_reservations" ("id" uuid not null, "tenant_id" uuid not null, "organization_id" uuid not null, "reserved_bytes" bigint not null, "actual_bytes" bigint null, "status" text not null default 'reserved', "source" text not null, "storage_driver" text not null, "partition_code" text null, "storage_path" text not null, "lease_token" uuid not null, "upload_token_hash" text null, "expires_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
+    this.addSql(`create index "attachment_quota_reservations_expires_idx" on "attachment_quota_reservations" ("expires_at");`);
+    this.addSql(`create index "attachment_quota_reservations_tenant_status_idx" on "attachment_quota_reservations" ("tenant_id", "status");`);
+    this.addSql(`alter table "attachment_quota_reservations" add constraint "attachment_quota_reservations_scope_path_unique" unique ("tenant_id", "storage_driver", "storage_path");`);
+  }
+
+}

package/src/modules/attachments/workers/quota-recovery.ts

@@ -0,0 +1,68 @@
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AttachmentQuotaService } from '../lib/quota-service'
+import type { StorageDriverFactory } from '../lib/drivers'
+import { scheduleAttachmentQuotaRecovery, type AttachmentQuotaRecoveryJob } from '../lib/quota-recovery-queue'
+
+export const metadata: WorkerMeta = {
+  queue: 'attachments-quota-recovery',
+  id: 'attachments:quota-recovery',
+  concurrency: 2,
+}
+
+type HandlerContext = JobContext & { resolve: <T = unknown>(name: string) => T }
+
+type AttachmentLookupDatabase = {
+  attachments: {
+    id: string
+    tenant_id: string
+    storage_driver: string
+    storage_path: string
+  }
+}
+
+export default async function handle(
+  job: QueuedJob<AttachmentQuotaRecoveryJob>,
+  ctx: HandlerContext,
+): Promise<void> {
+  const quotaService = ctx.resolve<AttachmentQuotaService>('attachmentQuotaService')
+  const scope = {
+    tenantId: job.payload.tenantId,
+    organizationId: job.payload.organizationId,
+  }
+  const record = await quotaService.getReservation(job.payload.reservationId, scope)
+  if (!record || record.status === 'committed') return
+  if (record.expiresAt && record.expiresAt.getTime() > Date.now()) {
+    await scheduleAttachmentQuotaRecovery(job.payload, record.expiresAt.getTime() - Date.now())
+    return
+  }
+
+  const claimed = await quotaService.claimExpired(record.id, scope)
+  if (!claimed) return
+  try {
+    const em = ctx.resolve<EntityManager>('em')
+    const existingAttachment = await em.getKysely<AttachmentLookupDatabase>()
+      .selectFrom('attachments')
+      .select('id')
+      .where('tenant_id', '=', claimed.tenantId)
+      .where('storage_driver', '=', claimed.storageDriver)
+      .where('storage_path', '=', claimed.storagePath)
+      .executeTakeFirst()
+    if (!existingAttachment) {
+      if (!claimed.partitionCode) throw new Error('Attachment quota recovery is missing its partition code.')
+      const factory = ctx.resolve<StorageDriverFactory>('storageDriverFactory')
+      const driver = await factory.resolveForPartition(claimed.partitionCode, {
+        tenantId: claimed.tenantId,
+        organizationId: claimed.organizationId,
+      })
+      await (driver.deleteStrict?.(claimed.partitionCode, claimed.storagePath)
+        ?? driver.delete(claimed.partitionCode, claimed.storagePath))
+    }
+    await quotaService.release(claimed.id, claimed.leaseToken)
+  } catch (error) {
+    if (claimed.expiresAt) {
+      await scheduleAttachmentQuotaRecovery(job.payload, claimed.expiresAt.getTime() - Date.now())
+    }
+    throw error
+  }
+}

package/src/modules/auth/lib/setup-app.ts

@@ -5,7 +5,7 @@ import { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/d
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { normalizeTenantId } from './tenantAccess'
-import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'
@@ -190,7 +190,20 @@ export async function setupInitialTenant(
   const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)
 
   const mainEmail = primaryUser.email
-  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })
+  const existingUserByHash = await findOneWithDecryption(
+    em,
+    User,
+    { emailHash: { $in: emailHashLookupValues(mainEmail) }, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  const existingUser = existingUserByHash ?? await findOneWithDecryption(
+    em,
+    User,
+    { email: mainEmail, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
   if (existingUser && failIfUserExists) {
     throw new Error('USER_EXISTS')
   }
@@ -358,7 +371,12 @@ export async function setupInitialTenant(
       await tem.flush()
 
       if (isTenantDataEncryptionEnabled()) {
+        // System-scoped maps are resolved from module code, never from a tenant row.
+        // Persisting one here would make the tenant-scoped encryption CLIs believe they
+        // own that entity and re-wrap its `system:<entityId>` ciphertext under the tenant
+        // DEK, which runtime decryption can no longer read.
         for (const spec of defaultEncryptionMaps) {
+          if (spec.keyScope === 'system') continue
           const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })
           if (!existing) {
             tem.persist(tem.create(EncryptionMap, {

package/src/modules/dashboards/services/widgetDataService.ts

@@ -5,6 +5,7 @@ import { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
 import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 import {
   type DateRangePreset,
   resolveDateRange,
@@ -865,12 +866,8 @@ export class WidgetDataService {
   }
 
   private resolveEntityMetadata(tableName: string): Record<string, any> | null {
-    const registry = (this.em as any)?.getMetadata?.()
-    if (!registry) return null
-    const entries =
-      (typeof registry.getAll === 'function' && registry.getAll()) ||
-      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))
-    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})
+    const metas = listEntityMetadata(this.em)
+    if (!metas.length) return null
     const match = metas.find((meta: any) => {
       const table = meta?.tableName ?? meta?.collection
       if (typeof table !== 'string') return false

package/src/modules/entities/cli.ts

@@ -23,6 +23,7 @@ import {
   parseDecryptedFieldValue,
 } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
+import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 import { Organization } from '../directory/data/entities'
 import crypto from 'node:crypto'
 
@@ -263,8 +264,28 @@ function resolveEncryptionMapModules(): Module[] {
   }
 }
 
+/**
+ * Entity ids whose encryption map is declared in module code with `keyScope: 'system'`.
+ *
+ * Their ciphertext is sealed under a `system:<entityId>` DEK that has no tenant, so every
+ * tenant-scoped command here MUST leave them alone: re-wrapping such a value under a tenant
+ * DEK produces a payload runtime decryption can never read again. `backfill-system-encryption`
+ * is the one command that handles them.
+ */
+function getSystemScopedEntityIds(): Set<string> {
+  return new Set(
+    getDefaultEncryptionMaps(resolveEncryptionMapModules())
+      .filter((map) => map.keyScope === 'system')
+      .map((map) => map.entityId),
+  )
+}
+
 async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
   for (const spec of getDefaultEncryptionMaps(resolveEncryptionMapModules())) {
+    if (spec.keyScope === 'system') {
+      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)
+      continue
+    }
     const existing = await em.findOne(EncryptionMap, {
       entityId: spec.entityId,
       tenantId,
@@ -378,9 +399,7 @@ function resolveProperty(meta: any, field: string): { columnName: string | null;
 }
 
 function buildEntityMetaRegistry(em: any): Map<string, any> {
-  const registry = em?.getMetadata?.()
-  const allMetaRaw = typeof registry?.getAll === 'function' ? registry.getAll() : []
-  const allMeta = Array.isArray(allMetaRaw) ? allMetaRaw : Object.values(allMetaRaw ?? {})
+  const allMeta = listEntityMetadata(em)
   const metaByEntityId = new Map<string, any>()
   for (const meta of allMeta) {
     const resolved = resolveEntityIdFromMetadata(meta)
@@ -414,6 +433,21 @@ function resolveMapMeta(
   return { entityId, meta, fields, tenantId }
 }
 
+function isEncryptedPayload(value: unknown): boolean {
+  if (typeof value !== 'string') return false
+  const parts = value.split(':')
+  return parts.length === 4 && parts[3] === 'v1'
+}
+
+function formatValueForColumn(prop: any, value: unknown): unknown {
+  if (value === null || value === undefined) return value
+  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
+  const type = String(prop?.type ?? '').toLowerCase()
+  const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
+  if (!isJson) return value
+  return JSON.stringify(value)
+}
+
 const rotateEncryptionKey: ModuleCli = {
   command: 'rotate-encryption-key',
   async run(rest) {
@@ -470,32 +504,25 @@ const rotateEncryptionKey: ModuleCli = {
       }
     }
 
-    const isEncryptedPayload = (value: unknown): boolean => {
-      if (typeof value !== 'string') return false
-      const parts = value.split(':')
-      return parts.length === 4 && parts[3] === 'v1'
-    }
-
     const metaByEntityId = buildEntityMetaRegistry(em)
 
     const where: any = { deletedAt: null }
     if (tenantIdArg) where.tenantId = tenantIdArg
     if (organizationIdArg) where.organizationId = organizationIdArg
-    const maps = await em.find(EncryptionMap, where)
+    const allMaps = await em.find(EncryptionMap, where)
+    const systemScopedEntityIds = getSystemScopedEntityIds()
+    const maps = allMaps.filter((map: EncryptionMap) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key — use "mercato entities backfill-system-encryption" instead.`,
+      )
+      return false
+    })
     if (!maps.length) {
       console.log('No encryption maps found for the selected scope.')
       return
     }
 
-    const formatValueForColumn = (prop: any, value: unknown): unknown => {
-      if (value === null || value === undefined) return value
-      const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
-      const type = String(prop?.type ?? '').toLowerCase()
-      const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
-      if (!isJson) return value
-      return JSON.stringify(value)
-    }
-
     const resolveScopes = async (tenantId: string, organizationId: string | null) => {
       if (organizationId) return [{ tenantId, organizationId }]
       const orgs = await em.find(Organization, { tenant: tenantId })
@@ -699,7 +726,15 @@ const decryptDatabase: ModuleCli = {
     const mapWhere: any = { tenantId: tenantIdArg, deletedAt: null, isActive: true }
     if (organizationIdArg) mapWhere.organizationId = organizationIdArg
     if (entityIdArg) mapWhere.entityId = entityIdArg
-    const maps = await em.find(EncryptionMap, mapWhere)
+    const allMaps = await em.find(EncryptionMap, mapWhere)
+    const systemScopedEntityIds = getSystemScopedEntityIds()
+    const maps = allMaps.filter((map: EncryptionMap) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`,
+      )
+      return false
+    })
 
     if (!maps.length) {
       console.log('No active encryption maps found for the selected scope.')
@@ -986,5 +1021,187 @@ const decryptDatabase: ModuleCli = {
   },
 }
 
+/**
+ * Encrypt rows that a **system-scoped** encryption map covers but that were written
+ * before the map existed.
+ *
+ * `rotate-encryption-key` cannot reach them: it walks the `encryption_maps` table and
+ * skips every row without a `tenant_id`, while system-scoped maps are declared in module
+ * code (`defaultEncryptionMaps` with `keyScope: 'system'`) and cover pre-tenant records
+ * that have no tenant at all — onboarding requests being the first such entity. Without a
+ * backfill those historical rows stay plaintext forever, since only the write path
+ * encrypts.
+ *
+ * The command is forward-only (plaintext → ciphertext), never accepts an old key and never
+ * decrypts, so it cannot re-encrypt data under the wrong key. It is idempotent: values that
+ * already decrypt under the current system DEK are left untouched by
+ * `encryptEntityPayload`, so a partial run can simply be repeated.
+ */
+const backfillSystemEncryption: ModuleCli = {
+  command: 'backfill-system-encryption',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const entityIdArg = (args.entity as string) || null
+    const dryRun = Boolean(args['dry-run'] || args.dry)
+    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)
+    const debug = Boolean(args.debug)
+
+    if (!isTenantDataEncryptionEnabled()) {
+      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.')
+      return
+    }
+
+    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === 'system')
+    if (!systemMaps.length) {
+      console.log('No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.')
+      return
+    }
+    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps
+    if (!selectedMaps.length) {
+      console.error(`No system-scoped encryption map declared for entity "${entityIdArg}".`)
+      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(', ')}`)
+      return
+    }
+
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as any
+    const conn: any = em?.getConnection?.()
+    if (!conn || typeof conn.execute !== 'function') {
+      console.error('Unable to access raw database connection; aborting.')
+      return
+    }
+
+    const encryptionService = new TenantDataEncryptionService(em as any, {
+      kms: createKmsService(),
+      defaultEncryptionMaps: systemMaps,
+    })
+    if (!encryptionService.isEnabled()) {
+      console.error('Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.')
+      return
+    }
+
+    const metaByEntityId = buildEntityMetaRegistry(em)
+    const prefix = dryRun ? '[dry-run] ' : ''
+    let totalRowsScanned = 0
+    let totalRowsUpdated = 0
+    let totalRowsUnchanged = 0
+
+    for (const map of selectedMaps) {
+      const entityId = map.entityId
+      const meta = metaByEntityId.get(entityId)
+      if (!meta) {
+        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`)
+        continue
+      }
+      const tableName = meta?.tableName
+      if (!tableName) {
+        console.warn(`Skipping ${entityId}: entity has no table name.`)
+        continue
+      }
+      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'
+      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey)
+      const pkColumn = primaryKeyColumn ?? primaryKey
+      const qualifiedTable = meta?.schema ? `"${meta.schema}"."${tableName}"` : `"${tableName}"`
+
+      const columns = new Set<string>([pkColumn])
+      for (const rule of map.fields) {
+        const resolved = resolveProperty(meta, rule.field)
+        if (resolved.columnName) columns.add(resolved.columnName)
+        if (rule.hashField) {
+          const resolvedHash = resolveProperty(meta, rule.hashField)
+          if (resolvedHash.columnName) columns.add(resolvedHash.columnName)
+        }
+      }
+      const columnList = Array.from(columns)
+      const selectList = columnList.map((column) => `"${column}"`).join(', ')
+
+      let cursor: unknown = null
+      let entityRowsScanned = 0
+      let entityRowsUpdated = 0
+      let entityRowsUnchanged = 0
+
+      for (;;) {
+        const selectSql = cursor === null
+          ? `select ${selectList} from ${qualifiedTable} order by "${pkColumn}" asc limit ?`
+          : `select ${selectList} from ${qualifiedTable} where "${pkColumn}" > ? order by "${pkColumn}" asc limit ?`
+        const params = cursor === null ? [batchSize] : [cursor, batchSize]
+        const rows = await conn.execute(selectSql, params)
+        const list = Array.isArray(rows) ? rows : []
+        if (!list.length) break
+
+        for (const row of list) {
+          entityRowsScanned += 1
+          cursor = row[pkColumn]
+          const payload: Record<string, unknown> = {}
+          let hasPlaintext = false
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field)
+            if (!resolved.columnName) continue
+            const rawValue = row[resolved.columnName]
+            payload[rule.field] = rawValue
+            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField)
+              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]
+            }
+          }
+          if (!hasPlaintext) continue
+
+          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null)
+          const updates: Record<string, unknown> = {}
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field)
+            if (resolved.columnName) {
+              const nextValue = encrypted[rule.field]
+              if (nextValue !== undefined && nextValue !== row[resolved.columnName]) {
+                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue)
+              }
+            }
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField)
+              const nextHash = encrypted[rule.hashField]
+              if (resolvedHash.columnName && nextHash !== undefined && nextHash !== row[resolvedHash.columnName]) {
+                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash)
+              }
+            }
+          }
+          if (!Object.keys(updates).length) {
+            entityRowsUnchanged += 1
+            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`)
+            continue
+          }
+          if (!dryRun) {
+            const setSql = Object.keys(updates).map((column) => `"${column}" = ?`).join(', ')
+            await conn.execute(
+              `update ${qualifiedTable} set ${setSql} where "${pkColumn}" = ?`,
+              [...Object.values(updates), row[pkColumn]],
+            )
+          }
+          entityRowsUpdated += 1
+        }
+
+        if (list.length < batchSize) break
+      }
+
+      totalRowsScanned += entityRowsScanned
+      totalRowsUpdated += entityRowsUpdated
+      totalRowsUnchanged += entityRowsUnchanged
+      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`)
+    }
+
+    console.log(`\n${prefix}Backfill summary:`)
+    console.log(`  Rows scanned:   ${totalRowsScanned}`)
+    console.log(`  Rows encrypted: ${totalRowsUpdated}`)
+    if (totalRowsUnchanged > 0) {
+      console.warn(
+        `  ⚠ ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted — the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`,
+      )
+    }
+    if (!dryRun && totalRowsUpdated > 0) {
+      console.log('\n✅ Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.')
+    }
+  },
+}
+
 // Keep default export stable (install first for help listing)
-export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase]
+export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption]

package/src/modules/messages/api/[id]/route.ts

@@ -402,6 +402,27 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
+  const isSender = message.senderUserId === scope.userId
+  // Only look the recipient row up when the actor is not the sender: deleting one's own
+  // message is the common path, and the lookup is a decryption-aware query.
+  const isRecipient = isSender
+    ? false
+    : Boolean(await findOneWithDecryption(
+      em,
+      MessageRecipient,
+      {
+        messageId: params.id,
+        recipientUserId: scope.userId,
+        deletedAt: null,
+      },
+      undefined,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
+    ))
+
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {

package/src/modules/query_index/lib/subscriber-scope.ts

@@ -1,6 +1,7 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
 import { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 
 export type QueryIndexScope = {
   tenantId: string | null
@@ -58,13 +59,7 @@ export function resolveQueryIndexSourceMetadata(
     throw new QueryIndexScopeError(`Query index entity type has no registered ORM table: ${entityType}`)
   }
 
-  const registry = em.getMetadata?.()
-  const allMetadataRaw = typeof registry?.getAll === 'function' ? registry.getAll() : null
-  const allMetadata: QueryIndexEntityMetadata[] = Array.isArray(allMetadataRaw)
-    ? allMetadataRaw as QueryIndexEntityMetadata[]
-    : allMetadataRaw instanceof Map
-      ? Array.from(allMetadataRaw.values()) as QueryIndexEntityMetadata[]
-      : Object.values(allMetadataRaw ?? {}) as QueryIndexEntityMetadata[]
+  const allMetadata = listEntityMetadata(em) as unknown as QueryIndexEntityMetadata[]
   const metadata = allMetadata.find((candidate) => String(candidate.tableName ?? '') === table)
   if (!metadata) {
     throw new QueryIndexScopeError(`Query index entity metadata was not found for table: ${table}`)