@open-mercato/core 0.9.1-develop.7474.1.51db10479d → 0.9.1-develop.7475.1.28ca93ed97

package/generated/entity-fields-registry.ts

@@ -227,6 +227,33 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "deleted_at": "deleted_at"
     },
+    "catalog_price_history_entry": {
+      "id": "id",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "price_id": "price_id",
+      "product_id": "product_id",
+      "variant_id": "variant_id",
+      "offer_id": "offer_id",
+      "channel_id": "channel_id",
+      "price_kind_id": "price_kind_id",
+      "price_kind_code": "price_kind_code",
+      "currency_code": "currency_code",
+      "unit_price_net": "unit_price_net",
+      "unit_price_gross": "unit_price_gross",
+      "tax_rate": "tax_rate",
+      "tax_amount": "tax_amount",
+      "min_quantity": "min_quantity",
+      "max_quantity": "max_quantity",
+      "starts_at": "starts_at",
+      "ends_at": "ends_at",
+      "recorded_at": "recorded_at",
+      "change_type": "change_type",
+      "source": "source",
+      "is_announced": "is_announced",
+      "idempotency_key": "idempotency_key",
+      "metadata": "metadata"
+    },
     "catalog_price_kind": {
       "id": "id",
       "organization_id": "organization_id",
@@ -868,6 +895,7 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "credit_currency_code": "credit_currency_code",
       "approval_required_above": "approval_required_above",
       "min_order_value": "min_order_value",
+      "assortment_scope": "assortment_scope",
       "metadata": "metadata",
       "created_at": "created_at",
       "updated_at": "updated_at",
@@ -1210,6 +1238,50 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "created_at": "created_at",
       "updated_at": "updated_at"
     },
+    "ecommerce_store": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "code": "code",
+      "name": "name",
+      "slug": "slug",
+      "status": "status",
+      "default_locale": "default_locale",
+      "supported_locales": "supported_locales",
+      "default_currency_code": "default_currency_code",
+      "is_primary": "is_primary",
+      "settings": "settings",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "ecommerce_store_channel_binding": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "store_id": "store_id",
+      "sales_channel_id": "sales_channel_id",
+      "price_kind_id": "price_kind_id",
+      "assortment_scope": "assortment_scope",
+      "price_sort_fallback": "price_sort_fallback",
+      "is_default": "is_default",
+      "require_authentication": "require_authentication",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
+    "ecommerce_store_domain_binding": {
+      "id": "id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "store_id": "store_id",
+      "domain_mapping_id": "domain_mapping_id",
+      "path_prefix": "path_prefix",
+      "is_primary": "is_primary",
+      "created_at": "created_at",
+      "updated_at": "updated_at",
+      "deleted_at": "deleted_at"
+    },
     "encryption_map": {
       "id": "id",
       "entity_id": "entity_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.9.1-develop.7474.1.51db10479d",
+  "version": "0.9.1-develop.7475.1.28ca93ed97",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -264,16 +264,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7474.1.51db10479d",
-    "@open-mercato/shared": "0.9.1-develop.7474.1.51db10479d",
-    "@open-mercato/ui": "0.9.1-develop.7474.1.51db10479d",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7475.1.28ca93ed97",
+    "@open-mercato/shared": "0.9.1-develop.7475.1.28ca93ed97",
+    "@open-mercato/ui": "0.9.1-develop.7475.1.28ca93ed97",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7474.1.51db10479d",
-    "@open-mercato/shared": "0.9.1-develop.7474.1.51db10479d",
-    "@open-mercato/ui": "0.9.1-develop.7474.1.51db10479d",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7475.1.28ca93ed97",
+    "@open-mercato/shared": "0.9.1-develop.7475.1.28ca93ed97",
+    "@open-mercato/ui": "0.9.1-develop.7475.1.28ca93ed97",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/helpers/integration/customerGroupsFixtures.ts

@@ -1,5 +1,6 @@
 import { randomInt } from 'node:crypto';
 import { expect, type APIRequestContext } from '@playwright/test';
+import type { AssortmentScope } from '@open-mercato/shared/lib/catalog-visibility';
 import { apiRequest } from './api';
 import { expectId, readJsonSafe } from './generalFixtures';
 
@@ -114,6 +115,7 @@ export type CustomerGroupTermsFixtureInput = {
   creditCurrencyCode?: string | null;
   approvalRequiredAbove?: number | null;
   minOrderValue?: number | null;
+  assortmentScope?: AssortmentScope | null;
   metadata?: Record<string, unknown> | null;
 };
 

package/src/modules/auth/i18n/de.json

@@ -72,10 +72,12 @@
   "auth.acl.features.business_rules.view_logs": "View rule execution logs",
   "auth.acl.features.catalog.categories.manage": "Manage catalog categories",
   "auth.acl.features.catalog.categories.view": "View catalog categories",
+  "auth.acl.features.catalog.price_history.view": "Preisverlauf im Katalog anzeigen",
   "auth.acl.features.catalog.pricing.manage": "Manage catalog pricing",
   "auth.acl.features.catalog.products.manage": "Manage catalog products",
   "auth.acl.features.catalog.products.view": "View catalog products",
   "auth.acl.features.catalog.settings.manage": "Manage catalog settings",
+  "auth.acl.features.catalog.settings.view": "Katalogeinstellungen anzeigen",
   "auth.acl.features.catalog.variants.manage": "Manage catalog variants",
   "auth.acl.features.channel_apns.configure": "Configure APNs credentials",
   "auth.acl.features.channel_apns.view": "View APNs channel configuration",
@@ -176,6 +178,11 @@
   "auth.acl.features.documents.share": "Share documents",
   "auth.acl.features.documents.templates.manage": "Manage document templates",
   "auth.acl.features.documents.view": "View documents",
+  "auth.acl.features.ecommerce.branding.manage": "Shop-Branding verwalten",
+  "auth.acl.features.ecommerce.channels.manage": "Kanal-Bindungen des Shops verwalten",
+  "auth.acl.features.ecommerce.domains.manage": "Domain-Bindungen des Shops verwalten",
+  "auth.acl.features.ecommerce.stores.manage": "Shops verwalten",
+  "auth.acl.features.ecommerce.stores.view": "Shops anzeigen",
   "auth.acl.features.entities.definitions.manage": "Manage custom field definitions",
   "auth.acl.features.entities.definitions.view": "View custom field definitions",
   "auth.acl.features.entities.records.manage": "Manage records",
@@ -424,6 +431,7 @@
   "auth.acl.modules.dictionaries": "Shared Dictionaries",
   "auth.acl.modules.directory": "Directory (Tenants & Organizations)",
   "auth.acl.modules.documents": "Documents",
+  "auth.acl.modules.ecommerce": "E-Commerce-Shops",
   "auth.acl.modules.entities": "Custom Entities & Fields",
   "auth.acl.modules.eudr": "EUDR Compliance",
   "auth.acl.modules.example": "Example Module",

package/src/modules/auth/i18n/en.json

@@ -72,10 +72,12 @@
   "auth.acl.features.business_rules.view_logs": "View rule execution logs",
   "auth.acl.features.catalog.categories.manage": "Manage catalog categories",
   "auth.acl.features.catalog.categories.view": "View catalog categories",
+  "auth.acl.features.catalog.price_history.view": "View catalog price history",
   "auth.acl.features.catalog.pricing.manage": "Manage catalog pricing",
   "auth.acl.features.catalog.products.manage": "Manage catalog products",
   "auth.acl.features.catalog.products.view": "View catalog products",
   "auth.acl.features.catalog.settings.manage": "Manage catalog settings",
+  "auth.acl.features.catalog.settings.view": "View catalog settings",
   "auth.acl.features.catalog.variants.manage": "Manage catalog variants",
   "auth.acl.features.channel_apns.configure": "Configure APNs credentials",
   "auth.acl.features.channel_apns.view": "View APNs channel configuration",
@@ -176,6 +178,11 @@
   "auth.acl.features.documents.share": "Share documents",
   "auth.acl.features.documents.templates.manage": "Manage document templates",
   "auth.acl.features.documents.view": "View documents",
+  "auth.acl.features.ecommerce.branding.manage": "Manage store branding",
+  "auth.acl.features.ecommerce.channels.manage": "Manage store channel bindings",
+  "auth.acl.features.ecommerce.domains.manage": "Manage store domain bindings",
+  "auth.acl.features.ecommerce.stores.manage": "Manage stores",
+  "auth.acl.features.ecommerce.stores.view": "View stores",
   "auth.acl.features.entities.definitions.manage": "Manage custom field definitions",
   "auth.acl.features.entities.definitions.view": "View custom field definitions",
   "auth.acl.features.entities.records.manage": "Manage records",
@@ -424,6 +431,7 @@
   "auth.acl.modules.dictionaries": "Shared Dictionaries",
   "auth.acl.modules.directory": "Directory (Tenants & Organizations)",
   "auth.acl.modules.documents": "Documents",
+  "auth.acl.modules.ecommerce": "Ecommerce Stores",
   "auth.acl.modules.entities": "Custom Entities & Fields",
   "auth.acl.modules.eudr": "EUDR Compliance",
   "auth.acl.modules.example": "Example Module",

package/src/modules/auth/i18n/es.json

@@ -72,10 +72,12 @@
   "auth.acl.features.business_rules.view_logs": "View rule execution logs",
   "auth.acl.features.catalog.categories.manage": "Manage catalog categories",
   "auth.acl.features.catalog.categories.view": "View catalog categories",
+  "auth.acl.features.catalog.price_history.view": "Ver historial de precios del catálogo",
   "auth.acl.features.catalog.pricing.manage": "Manage catalog pricing",
   "auth.acl.features.catalog.products.manage": "Manage catalog products",
   "auth.acl.features.catalog.products.view": "View catalog products",
   "auth.acl.features.catalog.settings.manage": "Manage catalog settings",
+  "auth.acl.features.catalog.settings.view": "Ver configuración del catálogo",
   "auth.acl.features.catalog.variants.manage": "Manage catalog variants",
   "auth.acl.features.channel_apns.configure": "Configure APNs credentials",
   "auth.acl.features.channel_apns.view": "View APNs channel configuration",
@@ -176,6 +178,11 @@
   "auth.acl.features.documents.share": "Share documents",
   "auth.acl.features.documents.templates.manage": "Manage document templates",
   "auth.acl.features.documents.view": "View documents",
+  "auth.acl.features.ecommerce.branding.manage": "Gestionar la imagen de marca de la tienda",
+  "auth.acl.features.ecommerce.channels.manage": "Gestionar vinculaciones de canal de la tienda",
+  "auth.acl.features.ecommerce.domains.manage": "Gestionar vinculaciones de dominio de la tienda",
+  "auth.acl.features.ecommerce.stores.manage": "Gestionar tiendas",
+  "auth.acl.features.ecommerce.stores.view": "Ver tiendas",
   "auth.acl.features.entities.definitions.manage": "Manage custom field definitions",
   "auth.acl.features.entities.definitions.view": "View custom field definitions",
   "auth.acl.features.entities.records.manage": "Manage records",
@@ -424,6 +431,7 @@
   "auth.acl.modules.dictionaries": "Shared Dictionaries",
   "auth.acl.modules.directory": "Directory (Tenants & Organizations)",
   "auth.acl.modules.documents": "Documents",
+  "auth.acl.modules.ecommerce": "Tiendas de comercio electrónico",
   "auth.acl.modules.entities": "Custom Entities & Fields",
   "auth.acl.modules.eudr": "EUDR Compliance",
   "auth.acl.modules.example": "Example Module",

package/src/modules/auth/i18n/ko.json

@@ -72,10 +72,12 @@
   "auth.acl.features.business_rules.view_logs": "View rule execution logs",
   "auth.acl.features.catalog.categories.manage": "Manage catalog categories",
   "auth.acl.features.catalog.categories.view": "View catalog categories",
+  "auth.acl.features.catalog.price_history.view": "카탈로그 가격 이력 보기",
   "auth.acl.features.catalog.pricing.manage": "Manage catalog pricing",
   "auth.acl.features.catalog.products.manage": "Manage catalog products",
   "auth.acl.features.catalog.products.view": "View catalog products",
   "auth.acl.features.catalog.settings.manage": "Manage catalog settings",
+  "auth.acl.features.catalog.settings.view": "카탈로그 설정 보기",
   "auth.acl.features.catalog.variants.manage": "Manage catalog variants",
   "auth.acl.features.channel_apns.configure": "Configure APNs credentials",
   "auth.acl.features.channel_apns.view": "View APNs channel configuration",
@@ -176,6 +178,11 @@
   "auth.acl.features.documents.share": "Share documents",
   "auth.acl.features.documents.templates.manage": "Manage document templates",
   "auth.acl.features.documents.view": "View documents",
+  "auth.acl.features.ecommerce.branding.manage": "스토어 브랜딩 관리",
+  "auth.acl.features.ecommerce.channels.manage": "스토어 채널 바인딩 관리",
+  "auth.acl.features.ecommerce.domains.manage": "스토어 도메인 바인딩 관리",
+  "auth.acl.features.ecommerce.stores.manage": "스토어 관리",
+  "auth.acl.features.ecommerce.stores.view": "스토어 보기",
   "auth.acl.features.entities.definitions.manage": "Manage custom field definitions",
   "auth.acl.features.entities.definitions.view": "View custom field definitions",
   "auth.acl.features.entities.records.manage": "Manage records",
@@ -424,6 +431,7 @@
   "auth.acl.modules.dictionaries": "Shared Dictionaries",
   "auth.acl.modules.directory": "Directory (Tenants & Organizations)",
   "auth.acl.modules.documents": "Documents",
+  "auth.acl.modules.ecommerce": "이커머스 스토어",
   "auth.acl.modules.entities": "Custom Entities & Fields",
   "auth.acl.modules.eudr": "EUDR Compliance",
   "auth.acl.modules.example": "Example Module",

package/src/modules/auth/i18n/pl.json

@@ -72,10 +72,12 @@
   "auth.acl.features.business_rules.view_logs": "Wyświetl dzienniki wykonywania reguł",
   "auth.acl.features.catalog.categories.manage": "Zarządzaj kategoriami katalogu",
   "auth.acl.features.catalog.categories.view": "Wyświetl kategorie katalogu",
+  "auth.acl.features.catalog.price_history.view": "Wyświetlaj historię cen w katalogu",
   "auth.acl.features.catalog.pricing.manage": "Zarządzaj cenami w katalogu",
   "auth.acl.features.catalog.products.manage": "Zarządzaj produktami w katalogu",
   "auth.acl.features.catalog.products.view": "Wyświetl produkty w katalogu",
   "auth.acl.features.catalog.settings.manage": "Zarządzaj ustawieniami katalogu",
+  "auth.acl.features.catalog.settings.view": "Wyświetlaj ustawienia katalogu",
   "auth.acl.features.catalog.variants.manage": "Zarządzaj wariantami w katalogu",
   "auth.acl.features.channel_apns.configure": "Konfiguruj dane dostępowe APNs",
   "auth.acl.features.channel_apns.view": "Wyświetl konfigurację kanału APNs",
@@ -176,6 +178,11 @@
   "auth.acl.features.documents.share": "Udostępniaj dokumenty",
   "auth.acl.features.documents.templates.manage": "Zarządzaj szablonami dokumentów",
   "auth.acl.features.documents.view": "Wyświetl dokumenty",
+  "auth.acl.features.ecommerce.branding.manage": "Zarządzanie brandingiem sklepu",
+  "auth.acl.features.ecommerce.channels.manage": "Zarządzanie powiązaniami kanałów sklepu",
+  "auth.acl.features.ecommerce.domains.manage": "Zarządzanie powiązaniami domen sklepu",
+  "auth.acl.features.ecommerce.stores.manage": "Zarządzanie sklepami",
+  "auth.acl.features.ecommerce.stores.view": "Wyświetlanie sklepów",
   "auth.acl.features.entities.definitions.manage": "Zarządzaj definicjami pól własnych",
   "auth.acl.features.entities.definitions.view": "Wyświetl definicje pól własnych",
   "auth.acl.features.entities.records.manage": "Zarządzaj rekordami",
@@ -424,6 +431,7 @@
   "auth.acl.modules.dictionaries": "Współdzielone słowniki",
   "auth.acl.modules.directory": "Katalog najemców i organizacji",
   "auth.acl.modules.documents": "Dokumenty",
+  "auth.acl.modules.ecommerce": "Sklepy e-commerce",
   "auth.acl.modules.entities": "Własne encje i pola",
   "auth.acl.modules.eudr": "Zgodność z EUDR",
   "auth.acl.modules.example": "Moduł przykładowy",

package/src/modules/catalog/AGENTS.md

@@ -47,11 +47,14 @@ The default pipeline emits `catalog.pricing.resolve.before|after` events. `prici
 
 ### Price selection order
 
+Candidate rows are those `matchesContext` admits. When `ctx.priceKindId` is set, that means rows of that kind **plus** rows of any promotional kind (`priceKind.isPromotion === true`, populated relation required), and `buildPriceRowFilter` mirrors this with a `priceKind.isPromotion` relation clause. Keep the two in sync: the filter MUST admit every row the matcher admits.
+
 When multiple price rows match the same context, `selectBestPrice` resolves ties in this order:
 
 1. **Score** (descending) — `custom` > `promotion` > `tier` > `regular`, plus additional points for variant, offer, channel, user, group, and customer scoping. See `scorePrice` for the full rubric.
-2. **`startsAt`** (descending) — when scores tie, the row with the more recent `startsAt` wins.
-3. **`minQuantity`** — direction depends on whether the tied rows share the same resolved kind:
+2. **Buyer order** — when scores tie and both rows are customer-scoped, the row whose `customerId` comes earlier in `ctx.customerIds` (person before company) wins.
+3. **`startsAt`** (descending) — when scores tie, the row with the more recent `startsAt` wins.
+4. **`minQuantity`** — direction depends on whether the tied rows share the same resolved kind:
     - **Same kind** (e.g. tier vs tier): **descending** — the row with the larger `minQuantity` wins. This implements the standard volume-discount semantic: for `qty=50` with tiers `minQty=10` ($9) and `minQty=50` ($8), the `minQty=50` row applies (issue #1706).
     - **Different kinds** (e.g. promotion vs tier): **ascending** — the row with the smaller `minQuantity` wins. The `+1 for minQuantity > 1` bonus in `scorePrice` can pull a lower-base kind up to the same total as a higher-base kind (e.g. tier `minQty=3` = 3+1 vs promotion `minQty=1` = 4). Ascending across kinds preserves the kind precedence in those collisions.
 

package/src/modules/catalog/acl.ts

@@ -30,7 +30,14 @@ export const features = [
     module: 'catalog',
     dependsOn: ['catalog.products.view', 'currencies.view'],
   },
+  { id: 'catalog.settings.view', title: 'View catalog settings', module: 'catalog' },
   { id: 'catalog.settings.manage', title: 'Manage catalog settings', module: 'catalog' },
+  {
+    id: 'catalog.price_history.view',
+    title: 'View catalog price history',
+    module: 'catalog',
+    dependsOn: ['catalog.products.view'],
+  },
 ]
 
 export default features

package/src/modules/catalog/api/config/omnibus/route.ts

@@ -0,0 +1,204 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  bridgeLegacyGuard,
+  runMutationGuards,
+  type MutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard-registry'
+import { getAllMutationGuardInstances } from '@open-mercato/shared/lib/crud/mutation-guard-store'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { omnibusConfigPatchSchema, type OmnibusConfigPatch } from '../../../data/validators'
+import { OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, omnibusConfigSchema, type OmnibusConfig } from '../../../lib/omnibusTypes'
+import {
+  buildOmnibusFieldErrors,
+  evaluateOmnibusConfig,
+  invalidOmnibusConfig,
+  mergeOmnibusConfig,
+  parseStoredOmnibusConfig,
+  type OmnibusConfigEvaluation,
+} from '../../../lib/omnibusConfig'
+import { invalidateOmnibusTenantCache, resolveOmnibusCache } from '../../../lib/omnibusCache'
+
+const logger = createLogger('catalog')
+
+const OMNIBUS_CONFIG_RESOURCE_KIND = 'catalog.settings'
+
+const OMNIBUS_CONFIG_READ_FEATURES = ['catalog.settings.view', 'catalog.settings.manage'] as const
+
+export const metadata = {
+  GET: { requireAuth: true },
+  PATCH: { requireAuth: true, requireFeatures: ['catalog.settings.manage'] },
+}
+
+function resolveUserFeatures(auth: unknown): string[] {
+  const features = (auth as { features?: unknown })?.features
+  if (!Array.isArray(features)) return []
+  return features.filter((value): value is string => typeof value === 'string')
+}
+
+async function readStoredConfig(service: ModuleConfigService, tenantId: string): Promise<OmnibusConfig | null> {
+  const raw = await service.getValue<unknown>(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, { scope: { tenantId } })
+  const config = parseStoredOmnibusConfig(raw)
+  if (raw !== null && raw !== undefined && !config) {
+    logger.warn('[internal] catalog omnibus stored config is invalid; treating it as unset', { tenantId })
+  }
+  return config
+}
+
+function evaluatePatch(existing: OmnibusConfig | null, payload: unknown): OmnibusConfigEvaluation & { patch?: OmnibusConfigPatch } {
+  const parsed = omnibusConfigPatchSchema.safeParse(payload)
+  if (!parsed.success) return invalidOmnibusConfig(buildOmnibusFieldErrors(parsed.error.issues))
+  return { ...evaluateOmnibusConfig(mergeOmnibusConfig(existing, parsed.data)), patch: parsed.data }
+}
+
+export async function GET(req: Request) {
+  try {
+    const auth = await getAuthFromRequest(req)
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+    const container = await createRequestContainer()
+    const rbacService = container.resolve('rbacService') as RbacService
+    const scope = { tenantId: auth.tenantId, organizationId: auth.orgId ?? null }
+    let canRead = false
+    for (const feature of OMNIBUS_CONFIG_READ_FEATURES) {
+      if (await rbacService.userHasAllFeatures(auth.sub, [feature], scope)) {
+        canRead = true
+        break
+      }
+    }
+    if (!canRead) return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+    const service = container.resolve('moduleConfigService') as ModuleConfigService
+    const config = await readStoredConfig(service, auth.tenantId)
+    return NextResponse.json(config ?? {})
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('catalog.config.omnibus.GET failed', { err })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export async function PATCH(req: Request) {
+  try {
+    const auth = await getAuthFromRequest(req)
+    if (!auth || !auth.tenantId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+    const tenantId = auth.tenantId
+    const organizationId = auth.orgId ?? null
+
+    let body: unknown
+    try {
+      body = await req.json()
+    } catch {
+      return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })
+    }
+
+    const container = await createRequestContainer()
+    const service = container.resolve('moduleConfigService') as ModuleConfigService
+    const existing = await readStoredConfig(service, tenantId)
+
+    let evaluation = evaluatePatch(existing, body)
+    if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status })
+
+    const legacyGuard = bridgeLegacyGuard(container)
+    const guards: MutationGuard[] = [...getAllMutationGuardInstances()]
+    if (legacyGuard) guards.push(legacyGuard)
+    const guardInput = {
+      tenantId,
+      organizationId,
+      userId: auth.sub ?? '',
+      resourceKind: OMNIBUS_CONFIG_RESOURCE_KIND,
+      resourceId: OMNIBUS_CONFIG_NAME,
+      operation: 'update' as const,
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    }
+    const guardResult = await runMutationGuards(
+      guards,
+      { ...guardInput, mutationPayload: evaluation.patch ?? null },
+      { userFeatures: resolveUserFeatures(auth) },
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {
+        status: guardResult.errorStatus ?? 422,
+      })
+    }
+    if (guardResult.modifiedPayload) {
+      evaluation = evaluatePatch(existing, { ...evaluation.patch, ...guardResult.modifiedPayload })
+      if (!evaluation.ok) return NextResponse.json(evaluation.body, { status: evaluation.status })
+    }
+
+    const nextConfig = evaluation.config
+    // optimistic-lock-exempt: single tenant-scoped config blob merged server-side; no per-record version to compare
+    await service.setValue(OMNIBUS_CONFIG_MODULE_ID, OMNIBUS_CONFIG_NAME, nextConfig, { tenantId })
+    await invalidateOmnibusTenantCache(resolveOmnibusCache(container), tenantId)
+
+    for (const callback of guardResult.afterSuccessCallbacks) {
+      if (!callback.guard.afterSuccess) continue
+      try {
+        await callback.guard.afterSuccess({ ...guardInput, metadata: callback.metadata ?? null })
+      } catch (callbackError) {
+        logger.error('Mutation guard afterSuccess callback failed', {
+          component: 'catalog.config.omnibus',
+          guardId: callback.guard.id,
+          err: callbackError,
+        })
+      }
+    }
+
+    return NextResponse.json(nextConfig)
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('catalog.config.omnibus.PATCH failed', { err })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+const errorSchema = z.object({ error: z.string() }).passthrough()
+
+const invalidConfigSchema = z.object({
+  error: z.literal('Invalid config'),
+  details: z.object({ fieldErrors: z.record(z.string(), z.array(z.string())) }),
+})
+
+const backfillRequiredSchema = z.object({
+  field: z.literal('enabled'),
+  error: z.literal('backfill_required_before_enable'),
+  channels: z.array(z.string()),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Catalog',
+  summary: 'Omnibus price-reference configuration',
+  methods: {
+    GET: {
+      summary: 'Read the tenant Omnibus configuration',
+      description: 'Returns the tenant-scoped Omnibus configuration with defaults applied, or an empty object when it has never been configured.',
+      tags: ['Catalog'],
+      responses: [
+        { status: 200, description: 'Tenant Omnibus configuration ({} when unset)', schema: omnibusConfigSchema.partial() },
+      ],
+      errors: [{ status: 401, description: 'Unauthorized', schema: errorSchema }],
+    },
+    PATCH: {
+      summary: 'Update the tenant Omnibus configuration',
+      description:
+        'Shallow-merges the provided top-level fields into the stored tenant configuration (a provided `channels` map replaces the stored one; `null` clears `defaultPresentedPriceKindId`). Member-state derogation fields and `backfillCoverage` are rejected. Enabling requires a resolvable presented price kind and completed backfill coverage for every in-scope EU channel.',
+      tags: ['Catalog'],
+      requestBody: { schema: omnibusConfigPatchSchema },
+      responses: [{ status: 200, description: 'Merged Omnibus configuration', schema: omnibusConfigSchema }],
+      errors: [
+        { status: 400, description: 'Invalid JSON body or invalid config', schema: invalidConfigSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 422, description: 'Backfill required before enabling, or blocked by a mutation guard', schema: backfillRequiredSchema },
+      ],
+    },
+  },
+}