@open-mercato/core 0.8.1-develop.7228.1.b7ea09d2d3 → 0.8.1-develop.7237.1.635faf2c7a

package/dist/modules/wms/subscribers/invalidate-availability-cache.js

@@ -0,0 +1,16 @@
+import { invalidateWmsAvailabilityCache } from "../lib/availabilityCache.js";
+const metadata = {
+  event: "wms.inventory_balance.*",
+  persistent: false,
+  id: "wms:invalidate-availability-cache"
+};
+async function handle(payload, ctx) {
+  const data = payload ?? {};
+  const tenantId = typeof data.tenantId === "string" && data.tenantId.length > 0 ? data.tenantId : ctx.tenantId ?? null;
+  await invalidateWmsAvailabilityCache(ctx, tenantId);
+}
+export {
+  handle as default,
+  metadata
+};
+//# sourceMappingURL=invalidate-availability-cache.js.map

package/dist/modules/wms/subscribers/invalidate-availability-cache.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/wms/subscribers/invalidate-availability-cache.ts"],
+  "sourcesContent": ["// Invalidates the wms AvailabilityProvider's read-through cache\n// (`availabilityCache.ts`) whenever a balance changes. Ephemeral\n// (`persistent: false`) \u2014 cache invalidation is a real-time housekeeping\n// concern, not something that needs retry/audit semantics; the cache's own\n// 60s TTL is the backstop if an event is ever lost.\n//\n// `wms.*` does NOT match `wms.inventory_balance.created` (single-segment\n// matcher) \u2014 `wms.inventory_balance.*` matches all three CRUD actions\n// (created/updated/deleted) in one subscriber, mirroring\n// `invalidate-enricher-cache-balance.ts`.\n\nimport { invalidateWmsAvailabilityCache } from '../lib/availabilityCache'\n\nexport const metadata = {\n  event: 'wms.inventory_balance.*',\n  persistent: false,\n  id: 'wms:invalidate-availability-cache',\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n  tenantId?: string | null\n}\n\nexport default async function handle(payload: unknown, ctx: SubscriberContext): Promise<void> {\n  const data = (payload ?? {}) as Record<string, unknown>\n  const tenantId =\n    typeof data.tenantId === 'string' && data.tenantId.length > 0 ? data.tenantId : ctx.tenantId ?? null\n  await invalidateWmsAvailabilityCache(ctx, tenantId)\n}\n"],
+  "mappings": "AAWA,SAAS,sCAAsC;AAExC,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAOA,eAAO,OAA8B,SAAkB,KAAuC;AAC5F,QAAM,OAAQ,WAAW,CAAC;AAC1B,QAAM,WACJ,OAAO,KAAK,aAAa,YAAY,KAAK,SAAS,SAAS,IAAI,KAAK,WAAW,IAAI,YAAY;AAClG,QAAM,+BAA+B,KAAK,QAAQ;AACpD;",
+  "names": []
+}

package/generated/entities/availability_policy/index.ts

@@ -0,0 +1,19 @@
+export const id = "id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const store_id = "store_id";
+export const product_id = "product_id";
+export const variant_id = "variant_id";
+export const is_stock_managed = "is_stock_managed";
+export const allow_backorder = "allow_backorder";
+export const backorder_lead_time_days = "backorder_lead_time_days";
+export const preorder_release_at = "preorder_release_at";
+export const low_stock_threshold = "low_stock_threshold";
+export const min_order_quantity = "min_order_quantity";
+export const max_order_quantity = "max_order_quantity";
+export const quantity_increment = "quantity_increment";
+export const hide_when_out_of_stock = "hide_when_out_of_stock";
+export const is_active = "is_active";
+export const created_at = "created_at";
+export const updated_at = "updated_at";
+export const deleted_at = "deleted_at";

package/generated/entities.ids.generated.ts

@@ -14,6 +14,7 @@ export const M = {
     "sales": "sales",
     "warranty_claims": "warranty_claims",
     "wms": "wms",
+    "availability": "availability",
     "api_keys": "api_keys",
     "devices": "devices",
     "dictionaries": "dictionaries",
@@ -191,6 +192,9 @@ export const M = {
       "sales_order_warehouse_assignment": "wms:sales_order_warehouse_assignment",
       "inventory_movement": "wms:inventory_movement"
     },
+    "availability": {
+      "availability_policy": "availability:availability_policy"
+    },
     "api_keys": {
       "api_key": "api_keys:api_key"
     },

package/generated/entity-fields-registry.ts

@@ -112,6 +112,27 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "created_at": "created_at",
       "updated_at": "updated_at"
     },
+    "availability_policy": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "store_id": "store_id",
+      "product_id": "product_id",
+      "variant_id": "variant_id",
+      "is_stock_managed": "is_stock_managed",
+      "allow_backorder": "allow_backorder",
+      "backorder_lead_time_days": "backorder_lead_time_days",
+      "preorder_release_at": "preorder_release_at",
+      "low_stock_threshold": "low_stock_threshold",
+      "min_order_quantity": "min_order_quantity",
+      "max_order_quantity": "max_order_quantity",
+      "quantity_increment": "quantity_increment",
+      "hide_when_out_of_stock": "hide_when_out_of_stock",
+      "is_active": "is_active",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
     "business_rule": {
       "id": "id",
       "rule_id": "rule_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.8.1-develop.7228.1.b7ea09d2d3",
+  "version": "0.8.1-develop.7237.1.635faf2c7a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7228.1.b7ea09d2d3",
-    "@open-mercato/shared": "0.8.1-develop.7228.1.b7ea09d2d3",
-    "@open-mercato/ui": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7237.1.635faf2c7a",
+    "@open-mercato/shared": "0.8.1-develop.7237.1.635faf2c7a",
+    "@open-mercato/ui": "0.8.1-develop.7237.1.635faf2c7a",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.8.1-develop.7228.1.b7ea09d2d3",
-    "@open-mercato/shared": "0.8.1-develop.7228.1.b7ea09d2d3",
-    "@open-mercato/ui": "0.8.1-develop.7228.1.b7ea09d2d3",
+    "@open-mercato/ai-assistant": "0.8.1-develop.7237.1.635faf2c7a",
+    "@open-mercato/shared": "0.8.1-develop.7237.1.635faf2c7a",
+    "@open-mercato/ui": "0.8.1-develop.7237.1.635faf2c7a",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/attachments/data/entities.ts

@@ -1,4 +1,4 @@
-import { OptionalProps } from '@mikro-orm/core'
+import { BigIntType, OptionalProps } from '@mikro-orm/core'
 import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorators/legacy'
 import { resolveDefaultAttachmentOcrEnabled } from '../lib/ocrConfig'
 
@@ -121,10 +121,12 @@ export class AttachmentQuotaReservation {
   @Property({ name: 'organization_id', type: 'uuid' })
   organizationId!: string
 
-  @Property({ name: 'reserved_bytes', type: 'bigint' })
+  /** Backed by a `bigint` column; hydrate as `number` (safe under Number.MAX_SAFE_INTEGER for attachment byte counts) instead of MikroORM's default JS `bigint`. */
+  @Property({ name: 'reserved_bytes', type: new BigIntType('number') })
   reservedBytes!: number
 
-  @Property({ name: 'actual_bytes', type: 'bigint', nullable: true })
+  /** Backed by a `bigint` column; hydrate as `number`, not MikroORM's default JS `bigint`. */
+  @Property({ name: 'actual_bytes', type: new BigIntType('number'), nullable: true })
   actualBytes?: number | null
 
   @Property({ type: 'text', default: 'reserved' })

package/src/modules/auth/i18n/de.json

@@ -62,6 +62,9 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
+  "auth.acl.features.availability.check": "Run availability checks",
+  "auth.acl.features.availability.policies.manage": "Manage availability policies",
+  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/en.json

@@ -62,6 +62,9 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
+  "auth.acl.features.availability.check": "Run availability checks",
+  "auth.acl.features.availability.policies.manage": "Manage availability policies",
+  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/es.json

@@ -62,6 +62,9 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
+  "auth.acl.features.availability.check": "Run availability checks",
+  "auth.acl.features.availability.policies.manage": "Manage availability policies",
+  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/ko.json

@@ -62,6 +62,9 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
+  "auth.acl.features.availability.check": "Run availability checks",
+  "auth.acl.features.availability.policies.manage": "Manage availability policies",
+  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/pl.json

@@ -62,6 +62,9 @@
   "auth.acl.features.auth.users.delete": "Usuwaj użytkowników",
   "auth.acl.features.auth.users.edit": "Edytuj użytkowników",
   "auth.acl.features.auth.users.list": "Wyświetl listę użytkowników",
+  "auth.acl.features.availability.check": "Uruchamiaj sprawdzenia dostępności",
+  "auth.acl.features.availability.policies.manage": "Zarządzaj politykami dostępności",
+  "auth.acl.features.availability.policies.view": "Wyświetl polityki dostępności",
   "auth.acl.features.business_rules.execute": "Uruchamiaj reguły biznesowe ręcznie",
   "auth.acl.features.business_rules.manage": "Twórz, edytuj i usuwaj reguły biznesowe",
   "auth.acl.features.business_rules.manage_sets": "Zarządzaj zestawami reguł",

package/src/modules/availability/acl.ts

@@ -0,0 +1,12 @@
+export const features = [
+  { id: 'availability.policies.view', title: 'View availability policies', module: 'availability' },
+  {
+    id: 'availability.policies.manage',
+    title: 'Manage availability policies',
+    module: 'availability',
+    dependsOn: ['availability.policies.view'],
+  },
+  { id: 'availability.check', title: 'Run availability checks', module: 'availability' },
+]
+
+export default features

package/src/modules/availability/api/check/route.ts

@@ -0,0 +1,114 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveActiveOrganizationId, organizationScopeRequiredResponse } from '@open-mercato/shared/lib/auth/organizationScope'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveAvailability, availabilityItemKey } from '@open-mercato/shared/lib/availability'
+import type { AvailabilityModuleConfigReader, AvailabilityQuery } from '@open-mercato/shared/lib/availability'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { tryResolve } from '../../lib/tryResolve'
+import type { PolicyResolutionService } from '../../lib/policyResolution'
+
+/**
+ * `POST /api/availability/check` — admin/debug reproduction of what a buyer saw,
+ * including the per-field `policySourceId` trace. No public storefront endpoints
+ * ship in this module (§8).
+ */
+const routeMetadata = {
+  POST: { requireAuth: true, requireFeatures: ['availability.check'] },
+}
+
+export const metadata = routeMetadata
+
+export const openApi = {
+  tags: ['Availability'],
+  summary: 'Reproduce the availability state and policy trace a buyer would see for one item.',
+  description: 'Admin/debug tool. Mirrors resolveAvailability() and includes the per-field policySourceId trace.',
+}
+
+const checkSchema = z.object({
+  productId: z.uuid(),
+  variantId: z.uuid().nullable().optional(),
+  quantity: z.coerce.number().int().min(1).default(1),
+  storeId: z.uuid().nullable().optional(),
+})
+
+export async function POST(req: Request) {
+  const { translate } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) {
+    return NextResponse.json({ error: translate('availability.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) return organizationScopeRequiredResponse()
+
+  const body = await req.json().catch(() => ({}))
+  const parsed = checkSchema.safeParse(body)
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: translate('availability.errors.invalidCheckRequest', 'Invalid request') },
+      { status: 400 },
+    )
+  }
+  const { productId, variantId, quantity, storeId } = parsed.data
+  const tenantId = auth.tenantId
+
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+
+  // Soft-resolved product/variant existence check — degrades gracefully when
+  // `catalog` is ejected (Phase 1 gate: coherent behaviour without it).
+  const CatalogProduct = tryResolve<new () => unknown>(container, 'CatalogProduct')
+  if (CatalogProduct) {
+    const product = await em.findOne(CatalogProduct as any, { id: productId, organizationId, tenantId, deletedAt: null })
+    if (!product) {
+      return NextResponse.json(
+        { error: translate('availability.errors.productNotFound', 'No such product') },
+        { status: 404 },
+      )
+    }
+    if (variantId) {
+      const CatalogProductVariant = tryResolve<new () => unknown>(container, 'CatalogProductVariant')
+      if (CatalogProductVariant) {
+        const variant = await em.findOne(CatalogProductVariant as any, {
+          id: variantId,
+          organizationId,
+          tenantId,
+          deletedAt: null,
+        })
+        if (!variant) {
+          return NextResponse.json(
+            { error: translate('availability.errors.variantNotFound', 'No such variant') },
+            { status: 404 },
+          )
+        }
+      }
+    }
+  }
+
+  const query: AvailabilityQuery = {
+    tenantId,
+    organizationId,
+    storeId: storeId ?? null,
+    items: [{ catalogProductId: productId, catalogVariantId: variantId ?? null, quantity }],
+  }
+
+  const moduleConfig = tryResolve<AvailabilityModuleConfigReader>(container, 'moduleConfigService')
+  const result = await resolveAvailability(query, moduleConfig ? { moduleConfig } : undefined)
+  const item = result.byItem[availabilityItemKey({ catalogProductId: productId, catalogVariantId: variantId ?? null })] ?? null
+
+  const policyResolutionService = tryResolve<PolicyResolutionService>(container, 'policyResolutionService')
+  const policyTrace = policyResolutionService
+    ? await policyResolutionService.resolve(em, {
+        tenantId,
+        organizationId,
+        storeId: storeId ?? null,
+        productId,
+        variantId: variantId ?? null,
+      })
+    : null
+
+  return NextResponse.json({ availability: item, policyTrace })
+}

package/src/modules/availability/api/openapi.ts

@@ -0,0 +1,28 @@
+import { type ZodTypeAny } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import {
+  createCrudOpenApiFactory,
+  createPagedListResponseSchema as createSharedPagedListResponseSchema,
+  defaultCreateResponseSchema as sharedDefaultCreateResponseSchema,
+  defaultOkResponseSchema as sharedDefaultOkResponseSchema,
+  type CrudOpenApiOptions,
+} from '@open-mercato/shared/lib/openapi/crud'
+
+export const defaultCreateResponseSchema = sharedDefaultCreateResponseSchema
+export const defaultOkResponseSchema = sharedDefaultOkResponseSchema
+
+export function createPagedListResponseSchema(itemSchema: ZodTypeAny) {
+  return createSharedPagedListResponseSchema(itemSchema, { paginationMetaOptional: true })
+}
+
+const buildAvailabilityCrudOpenApi = createCrudOpenApiFactory({
+  defaultTag: 'Availability',
+  defaultCreateResponseSchema,
+  defaultOkResponseSchema,
+  makeListDescription: ({ pluralLower }) =>
+    `Returns a paginated collection of ${pluralLower} scoped to the authenticated organization.`,
+})
+
+export function createAvailabilityCrudOpenApi(options: CrudOpenApiOptions): OpenApiRouteDoc {
+  return buildAvailabilityCrudOpenApi(options)
+}

package/src/modules/availability/api/policies/resolve-preview/route.ts

@@ -0,0 +1,67 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveActiveOrganizationId, organizationScopeRequiredResponse } from '@open-mercato/shared/lib/auth/organizationScope'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createPolicyResolutionService } from '../../../lib/policyResolution'
+
+/**
+ * `GET /api/availability/policies/resolve-preview` — the currently PERSISTED
+ * resolution chain for a (product, variant, store) target, used by the policy
+ * edit/create form to show "which level currently decides each field" (US-A2)
+ * before the admin saves an override.
+ */
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ['availability.policies.view'] },
+}
+
+export const metadata = routeMetadata
+
+export const openApi = {
+  tags: ['Availability'],
+  summary: 'Preview the currently persisted policy resolution chain for a product/variant/store target.',
+}
+
+const querySchema = z.object({
+  productId: z.uuid(),
+  variantId: z.uuid().nullable().optional(),
+  storeId: z.uuid().nullable().optional(),
+})
+
+export async function GET(req: Request) {
+  const { translate } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) {
+    return NextResponse.json({ error: translate('availability.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  const organizationId = resolveActiveOrganizationId(auth)
+  if (!organizationId) return organizationScopeRequiredResponse()
+
+  const url = new URL(req.url)
+  const parsed = querySchema.safeParse({
+    productId: url.searchParams.get('productId') ?? undefined,
+    variantId: url.searchParams.get('variantId') ?? undefined,
+    storeId: url.searchParams.get('storeId') ?? undefined,
+  })
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: translate('availability.errors.invalidPreviewRequest', 'Invalid request') },
+      { status: 400 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const service = createPolicyResolutionService(container)
+  const trace = await service.resolve(em, {
+    tenantId: auth.tenantId,
+    organizationId,
+    storeId: parsed.data.storeId ?? null,
+    productId: parsed.data.productId,
+    variantId: parsed.data.variantId ?? null,
+  })
+
+  return NextResponse.json({ policyTrace: trace })
+}

package/src/modules/availability/api/policies/route.ts

@@ -0,0 +1,224 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { AvailabilityPolicy } from '../../data/entities'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { FilterQuery } from '@mikro-orm/core'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveActiveOrganizationId, organizationScopeRequiredResponse } from '@open-mercato/shared/lib/auth/organizationScope'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { availabilityPolicyCreateSchema, availabilityPolicyUpdateSchema } from '../../data/validators'
+import {
+  createAvailabilityCrudOpenApi,
+  createPagedListResponseSchema,
+  defaultOkResponseSchema,
+} from '../openapi'
+
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ['availability.policies.view'] },
+  POST: { requireAuth: true, requireFeatures: ['availability.policies.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['availability.policies.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['availability.policies.manage'] },
+}
+
+export const metadata = routeMetadata
+
+const rawBodySchema = z.object({}).loose()
+type CrudInput = Record<string, unknown>
+
+const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
+  metadata: routeMetadata,
+  orm: {
+    entity: AvailabilityPolicy,
+    idField: 'id',
+    orgField: 'organizationId',
+    tenantField: 'tenantId',
+    softDeleteField: 'deletedAt',
+  },
+  events: {
+    module: 'availability',
+    entity: 'policy',
+    persistent: true,
+  },
+  actions: {
+    create: {
+      commandId: 'availability.policies.create',
+      schema: rawBodySchema,
+      mapInput: ({ parsed }) => parsed,
+      response: ({ result }) => ({ id: String(result.policyId) }),
+      status: 201,
+    },
+    update: {
+      commandId: 'availability.policies.update',
+      schema: rawBodySchema,
+      mapInput: ({ parsed }) => parsed,
+      response: () => ({ ok: true }),
+    },
+    delete: {
+      commandId: 'availability.policies.delete',
+      schema: rawBodySchema,
+      mapInput: ({ raw, ctx }) => ({
+        id: ((raw as Record<string, unknown>).query as Record<string, unknown> | undefined)?.id as string | undefined,
+        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? undefined,
+        tenantId: ctx.auth?.tenantId ?? undefined,
+      }),
+      response: () => ({ ok: true }),
+    },
+  },
+})
+
+const listQuerySchema = z.object({
+  id: z.uuid().optional(),
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(50),
+  storeId: z.uuid().optional(),
+  productId: z.uuid().optional(),
+  variantId: z.uuid().optional(),
+  isActive: z.enum(['true', 'false']).optional(),
+  sortField: z.enum(['createdAt', 'updatedAt']).optional(),
+  sortDir: z.enum(['asc', 'desc']).optional(),
+}).loose()
+
+type AvailabilityPolicyRow = {
+  id: string
+  organizationId: string
+  tenantId: string
+  storeId: string | null
+  productId: string | null
+  variantId: string | null
+  isStockManaged: boolean
+  allowBackorder: boolean
+  backorderLeadTimeDays: number | null
+  preorderReleaseAt: string | null
+  lowStockThreshold: number | null
+  minOrderQuantity: number | null
+  maxOrderQuantity: number | null
+  quantityIncrement: number | null
+  hideWhenOutOfStock: boolean
+  isActive: boolean
+  createdAt: string | null
+  updatedAt: string | null
+}
+
+const toRow = (policy: AvailabilityPolicy): AvailabilityPolicyRow => ({
+  id: String(policy.id),
+  organizationId: String(policy.organizationId),
+  tenantId: String(policy.tenantId),
+  storeId: policy.storeId ?? null,
+  productId: policy.productId ?? null,
+  variantId: policy.variantId ?? null,
+  isStockManaged: !!policy.isStockManaged,
+  allowBackorder: !!policy.allowBackorder,
+  backorderLeadTimeDays: policy.backorderLeadTimeDays ?? null,
+  preorderReleaseAt: policy.preorderReleaseAt ? policy.preorderReleaseAt.toISOString() : null,
+  lowStockThreshold: policy.lowStockThreshold ?? null,
+  minOrderQuantity: policy.minOrderQuantity ?? null,
+  maxOrderQuantity: policy.maxOrderQuantity ?? null,
+  quantityIncrement: policy.quantityIncrement ?? null,
+  hideWhenOutOfStock: !!policy.hideWhenOutOfStock,
+  isActive: !!policy.isActive,
+  createdAt: policy.createdAt ? policy.createdAt.toISOString() : null,
+  updatedAt: policy.updatedAt ? policy.updatedAt.toISOString() : null,
+})
+
+export async function GET(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) {
+    return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 401 })
+  }
+  const organizationId = resolveActiveOrganizationId(auth)
+  // A superadmin with no organization selected legitimately sees every
+  // organization in the tenant (om_selected_org=__all__); anyone else with
+  // an unresolved scope gets the standard 400, never a 401 (that reads as an
+  // expired session to the client and redirect-loops through session
+  // refresh — see organizationScope.ts).
+  if (!organizationId && !auth.isSuperAdmin) return organizationScopeRequiredResponse()
+
+  const url = new URL(req.url)
+  const parsed = listQuerySchema.safeParse({
+    id: url.searchParams.get('id') ?? undefined,
+    page: url.searchParams.get('page') ?? undefined,
+    pageSize: url.searchParams.get('pageSize') ?? undefined,
+    storeId: url.searchParams.get('storeId') ?? undefined,
+    productId: url.searchParams.get('productId') ?? undefined,
+    variantId: url.searchParams.get('variantId') ?? undefined,
+    isActive: url.searchParams.get('isActive') ?? undefined,
+    sortField: url.searchParams.get('sortField') ?? undefined,
+    sortDir: url.searchParams.get('sortDir') ?? undefined,
+  })
+  if (!parsed.success) {
+    return NextResponse.json({ items: [], total: 0, page: 1, pageSize: 50, totalPages: 1 }, { status: 400 })
+  }
+
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+
+  const { id, page, pageSize, storeId, productId, variantId, isActive, sortField, sortDir } = parsed.data
+  const filter: FilterQuery<AvailabilityPolicy> = {
+    tenantId: auth.tenantId,
+    deletedAt: null,
+  }
+  if (organizationId) filter.organizationId = organizationId
+  if (id) filter.id = id
+  if (storeId) filter.storeId = storeId
+  if (productId) filter.productId = productId
+  if (variantId) filter.variantId = variantId
+  if (isActive === 'true') filter.isActive = true
+  if (isActive === 'false') filter.isActive = false
+
+  const orderBy: Record<string, 'ASC' | 'DESC'> = {}
+  orderBy[sortField ?? 'createdAt'] = sortDir === 'asc' ? 'ASC' : 'DESC'
+
+  const offset = (page - 1) * pageSize
+  const [rows, total] = await em.findAndCount(AvailabilityPolicy, filter, { orderBy, limit: pageSize, offset })
+  const items = rows.map(toRow)
+  const totalPages = Math.max(1, Math.ceil(total / pageSize))
+
+  return NextResponse.json({ items, total, page, pageSize, totalPages })
+}
+
+export const POST = crud.POST
+export const PUT = crud.PUT
+export const DELETE = crud.DELETE
+
+const availabilityPolicyListItemSchema = z.object({
+  id: z.uuid(),
+  organizationId: z.uuid(),
+  tenantId: z.uuid(),
+  storeId: z.uuid().nullable(),
+  productId: z.uuid().nullable(),
+  variantId: z.uuid().nullable(),
+  isStockManaged: z.boolean(),
+  allowBackorder: z.boolean(),
+  backorderLeadTimeDays: z.number().nullable(),
+  preorderReleaseAt: z.string().nullable(),
+  lowStockThreshold: z.number().nullable(),
+  minOrderQuantity: z.number().nullable(),
+  maxOrderQuantity: z.number().nullable(),
+  quantityIncrement: z.number().nullable(),
+  hideWhenOutOfStock: z.boolean(),
+  isActive: z.boolean(),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+})
+
+export const openApi = createAvailabilityCrudOpenApi({
+  resourceName: 'AvailabilityPolicy',
+  pluralName: 'AvailabilityPolicies',
+  querySchema: listQuerySchema,
+  listResponseSchema: createPagedListResponseSchema(availabilityPolicyListItemSchema),
+  create: {
+    schema: availabilityPolicyCreateSchema,
+    description: 'Creates a new availability policy.',
+  },
+  update: {
+    schema: availabilityPolicyUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description: 'Updates an existing availability policy by id.',
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description: 'Deletes an availability policy by id.',
+  },
+})