@open-mercato/shared 0.4.6-develop-af28b566dd → 0.4.6-develop-4d77832982

package/dist/lib/crud/interceptor-registry.js

@@ -0,0 +1,82 @@
+let _interceptorEntries = null;
+const GLOBAL_INTERCEPTOR_KEY = "__openMercatoApiInterceptors__";
+function readGlobalInterceptors() {
+  try {
+    const value = globalThis[GLOBAL_INTERCEPTOR_KEY];
+    return Array.isArray(value) ? value : null;
+  } catch {
+    return null;
+  }
+}
+function writeGlobalInterceptors(entries) {
+  try {
+    ;
+    globalThis[GLOBAL_INTERCEPTOR_KEY] = entries;
+  } catch {
+  }
+}
+function registerApiInterceptors(entries) {
+  const flat = [];
+  entries.forEach((entry, moduleOrder) => {
+    entry.interceptors.forEach((interceptor, interceptorOrder) => {
+      flat.push({
+        moduleId: entry.moduleId,
+        interceptor,
+        moduleOrder,
+        interceptorOrder
+      });
+    });
+  });
+  _interceptorEntries = flat;
+  writeGlobalInterceptors(flat);
+}
+function getAllApiInterceptors() {
+  const globalEntries = readGlobalInterceptors();
+  if (globalEntries) return globalEntries;
+  if (!_interceptorEntries) return [];
+  return _interceptorEntries;
+}
+function routeMatches(targetRoute, routePath) {
+  if (targetRoute === "*") return true;
+  if (targetRoute.endsWith("/*")) {
+    const prefix = targetRoute.slice(0, -2);
+    return routePath === prefix || routePath.startsWith(`${prefix}/`);
+  }
+  return targetRoute === routePath;
+}
+const collisionWarnings = /* @__PURE__ */ new Set();
+function getApiInterceptorsForRoute(routePath, method) {
+  const matching = getAllApiInterceptors().filter((entry) => {
+    const methods = entry.interceptor.methods ?? [];
+    return methods.includes(method) && routeMatches(entry.interceptor.targetRoute, routePath);
+  });
+  const sorted = matching.sort((a, b) => {
+    const byPriority = (b.interceptor.priority ?? 0) - (a.interceptor.priority ?? 0);
+    if (byPriority !== 0) return byPriority;
+    const byModule = a.moduleOrder - b.moduleOrder;
+    if (byModule !== 0) return byModule;
+    return a.interceptorOrder - b.interceptorOrder;
+  });
+  if (process.env.NODE_ENV !== "production") {
+    for (let i = 1; i < sorted.length; i++) {
+      const prev = sorted[i - 1];
+      const current = sorted[i];
+      const prevPriority = prev.interceptor.priority ?? 0;
+      const currentPriority = current.interceptor.priority ?? 0;
+      if (prevPriority !== currentPriority) continue;
+      const warningKey = `${routePath}:${method}:${prev.interceptor.id}:${current.interceptor.id}:${currentPriority}`;
+      if (collisionWarnings.has(warningKey)) continue;
+      collisionWarnings.add(warningKey);
+      console.warn(
+        `[UMES] Interceptors "${prev.interceptor.id}" and "${current.interceptor.id}" have the same priority (${currentPriority}) for route "${routePath}". Execution order is based on module registration order.`
+      );
+    }
+  }
+  return sorted;
+}
+export {
+  getAllApiInterceptors,
+  getApiInterceptorsForRoute,
+  registerApiInterceptors
+};
+//# sourceMappingURL=interceptor-registry.js.map

package/dist/lib/crud/interceptor-registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/crud/interceptor-registry.ts"],
+  "sourcesContent": ["import type { ApiInterceptor, ApiInterceptorMethod, ApiInterceptorRegistryEntry } from './api-interceptor'\n\nlet _interceptorEntries: ApiInterceptorRegistryEntry[] | null = null\nconst GLOBAL_INTERCEPTOR_KEY = '__openMercatoApiInterceptors__'\n\nfunction readGlobalInterceptors(): ApiInterceptorRegistryEntry[] | null {\n  try {\n    const value = (globalThis as Record<string, unknown>)[GLOBAL_INTERCEPTOR_KEY]\n    return Array.isArray(value) ? (value as ApiInterceptorRegistryEntry[]) : null\n  } catch {\n    return null\n  }\n}\n\nfunction writeGlobalInterceptors(entries: ApiInterceptorRegistryEntry[]) {\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_INTERCEPTOR_KEY] = entries\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\nexport function registerApiInterceptors(entries: Array<{ moduleId: string; interceptors: ApiInterceptor[] }>) {\n  const flat: ApiInterceptorRegistryEntry[] = []\n  entries.forEach((entry, moduleOrder) => {\n    entry.interceptors.forEach((interceptor, interceptorOrder) => {\n      flat.push({\n        moduleId: entry.moduleId,\n        interceptor,\n        moduleOrder,\n        interceptorOrder,\n      })\n    })\n  })\n  _interceptorEntries = flat\n  writeGlobalInterceptors(flat)\n}\n\nexport function getAllApiInterceptors(): ApiInterceptorRegistryEntry[] {\n  const globalEntries = readGlobalInterceptors()\n  if (globalEntries) return globalEntries\n  if (!_interceptorEntries) return []\n  return _interceptorEntries\n}\n\nfunction routeMatches(targetRoute: string, routePath: string): boolean {\n  if (targetRoute === '*') return true\n  if (targetRoute.endsWith('/*')) {\n    const prefix = targetRoute.slice(0, -2)\n    return routePath === prefix || routePath.startsWith(`${prefix}/`)\n  }\n  return targetRoute === routePath\n}\n\nconst collisionWarnings = new Set<string>()\n\nexport function getApiInterceptorsForRoute(routePath: string, method: ApiInterceptorMethod): ApiInterceptorRegistryEntry[] {\n  const matching = getAllApiInterceptors().filter((entry) => {\n    const methods = entry.interceptor.methods ?? []\n    return methods.includes(method) && routeMatches(entry.interceptor.targetRoute, routePath)\n  })\n\n  const sorted = matching.sort((a, b) => {\n    const byPriority = (b.interceptor.priority ?? 0) - (a.interceptor.priority ?? 0)\n    if (byPriority !== 0) return byPriority\n    const byModule = a.moduleOrder - b.moduleOrder\n    if (byModule !== 0) return byModule\n    return a.interceptorOrder - b.interceptorOrder\n  })\n\n  if (process.env.NODE_ENV !== 'production') {\n    for (let i = 1; i < sorted.length; i++) {\n      const prev = sorted[i - 1]\n      const current = sorted[i]\n      const prevPriority = prev.interceptor.priority ?? 0\n      const currentPriority = current.interceptor.priority ?? 0\n      if (prevPriority !== currentPriority) continue\n      const warningKey = `${routePath}:${method}:${prev.interceptor.id}:${current.interceptor.id}:${currentPriority}`\n      if (collisionWarnings.has(warningKey)) continue\n      collisionWarnings.add(warningKey)\n      console.warn(\n        `[UMES] Interceptors \"${prev.interceptor.id}\" and \"${current.interceptor.id}\" have the same priority (${currentPriority}) for route \"${routePath}\". Execution order is based on module registration order.`\n      )\n    }\n  }\n\n  return sorted\n}\n"],
+  "mappings": "AAEA,IAAI,sBAA4D;AAChE,MAAM,yBAAyB;AAE/B,SAAS,yBAA+D;AACtE,MAAI;AACF,UAAM,QAAS,WAAuC,sBAAsB;AAC5E,WAAO,MAAM,QAAQ,KAAK,IAAK,QAA0C;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,wBAAwB,SAAwC;AACvE,MAAI;AACF;AAAC,IAAC,WAAuC,sBAAsB,IAAI;AAAA,EACrE,QAAQ;AAAA,EAER;AACF;AAEO,SAAS,wBAAwB,SAAsE;AAC5G,QAAM,OAAsC,CAAC;AAC7C,UAAQ,QAAQ,CAAC,OAAO,gBAAgB;AACtC,UAAM,aAAa,QAAQ,CAAC,aAAa,qBAAqB;AAC5D,WAAK,KAAK;AAAA,QACR,UAAU,MAAM;AAAA,QAChB;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,CAAC;AAAA,EACH,CAAC;AACD,wBAAsB;AACtB,0BAAwB,IAAI;AAC9B;AAEO,SAAS,wBAAuD;AACrE,QAAM,gBAAgB,uBAAuB;AAC7C,MAAI,cAAe,QAAO;AAC1B,MAAI,CAAC,oBAAqB,QAAO,CAAC;AAClC,SAAO;AACT;AAEA,SAAS,aAAa,aAAqB,WAA4B;AACrE,MAAI,gBAAgB,IAAK,QAAO;AAChC,MAAI,YAAY,SAAS,IAAI,GAAG;AAC9B,UAAM,SAAS,YAAY,MAAM,GAAG,EAAE;AACtC,WAAO,cAAc,UAAU,UAAU,WAAW,GAAG,MAAM,GAAG;AAAA,EAClE;AACA,SAAO,gBAAgB;AACzB;AAEA,MAAM,oBAAoB,oBAAI,IAAY;AAEnC,SAAS,2BAA2B,WAAmB,QAA6D;AACzH,QAAM,WAAW,sBAAsB,EAAE,OAAO,CAAC,UAAU;AACzD,UAAM,UAAU,MAAM,YAAY,WAAW,CAAC;AAC9C,WAAO,QAAQ,SAAS,MAAM,KAAK,aAAa,MAAM,YAAY,aAAa,SAAS;AAAA,EAC1F,CAAC;AAED,QAAM,SAAS,SAAS,KAAK,CAAC,GAAG,MAAM;AACrC,UAAM,cAAc,EAAE,YAAY,YAAY,MAAM,EAAE,YAAY,YAAY;AAC9E,QAAI,eAAe,EAAG,QAAO;AAC7B,UAAM,WAAW,EAAE,cAAc,EAAE;AACnC,QAAI,aAAa,EAAG,QAAO;AAC3B,WAAO,EAAE,mBAAmB,EAAE;AAAA,EAChC,CAAC;AAED,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,OAAO,OAAO,IAAI,CAAC;AACzB,YAAM,UAAU,OAAO,CAAC;AACxB,YAAM,eAAe,KAAK,YAAY,YAAY;AAClD,YAAM,kBAAkB,QAAQ,YAAY,YAAY;AACxD,UAAI,iBAAiB,gBAAiB;AACtC,YAAM,aAAa,GAAG,SAAS,IAAI,MAAM,IAAI,KAAK,YAAY,EAAE,IAAI,QAAQ,YAAY,EAAE,IAAI,eAAe;AAC7G,UAAI,kBAAkB,IAAI,UAAU,EAAG;AACvC,wBAAkB,IAAI,UAAU;AAChC,cAAQ;AAAA,QACN,wBAAwB,KAAK,YAAY,EAAE,UAAU,QAAQ,YAAY,EAAE,6BAA6B,eAAe,gBAAgB,SAAS;AAAA,MAClJ;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/lib/crud/interceptor-runner.js

@@ -0,0 +1,175 @@
+import { getApiInterceptorsForRoute } from "./interceptor-registry.js";
+import { hasAllFeatures } from "../../security/features.js";
+const DEFAULT_TIMEOUT_MS = 5e3;
+function sanitizeObject(input) {
+  if (!input || typeof input !== "object") return void 0;
+  const clean = Object.fromEntries(Object.entries(input).filter(([, value]) => value !== void 0));
+  return Object.keys(clean).length > 0 ? clean : {};
+}
+function hasRequiredFeatures(features, userFeatures) {
+  return hasAllFeatures(userFeatures, features);
+}
+function timeoutPromise(ms, interceptorId) {
+  return new Promise((_, reject) => {
+    setTimeout(() => {
+      reject(new Error(`INTERCEPTOR_TIMEOUT:${interceptorId}`));
+    }, ms);
+  });
+}
+function isTimeoutError(error) {
+  return error instanceof Error && error.message.startsWith("INTERCEPTOR_TIMEOUT:");
+}
+async function runWithTimeout(task, timeoutMs, interceptorId) {
+  return Promise.race([task, timeoutPromise(timeoutMs, interceptorId)]);
+}
+function toErrorBody(interceptorId, error) {
+  const body = {
+    error: "Internal interceptor error"
+  };
+  if (process.env.NODE_ENV !== "production") {
+    body.interceptorId = interceptorId;
+    body.message = error instanceof Error ? error.message : String(error);
+  }
+  return body;
+}
+async function runApiInterceptorsBefore(args) {
+  const { routePath, method, context } = args;
+  let currentRequest = {
+    ...args.request,
+    body: sanitizeObject(args.request.body),
+    query: sanitizeObject(args.request.query),
+    headers: { ...args.request.headers ?? {} }
+  };
+  const metadataByInterceptor = {};
+  const interceptors = getApiInterceptorsForRoute(routePath, method);
+  for (const entry of interceptors) {
+    const interceptor = entry.interceptor;
+    if (!interceptor.before) continue;
+    if (!hasRequiredFeatures(interceptor.features, context.userFeatures)) continue;
+    try {
+      const timeoutMs = interceptor.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+      const result = await runWithTimeout(
+        interceptor.before(currentRequest, context),
+        timeoutMs,
+        interceptor.id
+      );
+      const normalized = result ?? { ok: true };
+      if (!normalized.ok) {
+        const rejectBody = {
+          error: normalized.message ?? "Request blocked by API interceptor"
+        };
+        if (process.env.NODE_ENV !== "production") {
+          rejectBody.interceptorId = interceptor.id;
+        }
+        return {
+          ok: false,
+          statusCode: normalized.statusCode ?? 400,
+          body: rejectBody
+        };
+      }
+      if (normalized.headers) {
+        currentRequest = {
+          ...currentRequest,
+          headers: {
+            ...currentRequest.headers,
+            ...normalized.headers
+          }
+        };
+      }
+      if (normalized.body) {
+        currentRequest = {
+          ...currentRequest,
+          body: sanitizeObject(normalized.body)
+        };
+      }
+      if (normalized.query) {
+        currentRequest = {
+          ...currentRequest,
+          query: sanitizeObject(normalized.query)
+        };
+      }
+      metadataByInterceptor[interceptor.id] = normalized.metadata;
+    } catch (error) {
+      if (isTimeoutError(error)) {
+        const timeoutBody = { error: "Interceptor timeout" };
+        if (process.env.NODE_ENV !== "production") {
+          timeoutBody.interceptorId = interceptor.id;
+        }
+        return {
+          ok: false,
+          statusCode: 504,
+          body: timeoutBody
+        };
+      }
+      return {
+        ok: false,
+        statusCode: 500,
+        body: toErrorBody(interceptor.id, error)
+      };
+    }
+  }
+  return {
+    ok: true,
+    request: currentRequest,
+    metadataByInterceptor
+  };
+}
+async function runApiInterceptorsAfter(args) {
+  const { routePath, method, context } = args;
+  let body = { ...args.response.body ?? {} };
+  let headers = { ...args.response.headers ?? {} };
+  const interceptors = getApiInterceptorsForRoute(routePath, method);
+  for (const entry of interceptors) {
+    const interceptor = entry.interceptor;
+    if (!interceptor.after) continue;
+    if (!hasRequiredFeatures(interceptor.features, context.userFeatures)) continue;
+    try {
+      const timeoutMs = interceptor.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+      const result = await runWithTimeout(
+        interceptor.after(
+          args.request,
+          { statusCode: args.response.statusCode, body, headers },
+          { ...context, metadata: args.metadataByInterceptor?.[interceptor.id] }
+        ),
+        timeoutMs,
+        interceptor.id
+      );
+      if (!result) continue;
+      if (result.replace && typeof result.replace === "object") {
+        body = { ...result.replace };
+      } else if (result.merge && typeof result.merge === "object") {
+        body = { ...body, ...result.merge };
+      }
+    } catch (error) {
+      if (isTimeoutError(error)) {
+        const timeoutBody = { error: "Interceptor timeout" };
+        if (process.env.NODE_ENV !== "production") {
+          timeoutBody.interceptorId = interceptor.id;
+        }
+        return {
+          ok: false,
+          statusCode: 504,
+          body: timeoutBody,
+          headers
+        };
+      }
+      return {
+        ok: false,
+        statusCode: 500,
+        body: toErrorBody(interceptor.id, error),
+        headers
+      };
+    }
+  }
+  return {
+    ok: true,
+    statusCode: args.response.statusCode,
+    body,
+    headers
+  };
+}
+export {
+  runApiInterceptorsAfter,
+  runApiInterceptorsBefore
+};
+//# sourceMappingURL=interceptor-runner.js.map

package/dist/lib/crud/interceptor-runner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/crud/interceptor-runner.ts"],
+  "sourcesContent": ["import type {\n  ApiInterceptorMethod,\n  InterceptorContext,\n  InterceptorRequest,\n  InterceptorResponse,\n  InterceptorBeforeResult,\n} from './api-interceptor'\nimport { getApiInterceptorsForRoute } from './interceptor-registry'\nimport { hasAllFeatures } from '../../security/features'\n\nconst DEFAULT_TIMEOUT_MS = 5000\n\ntype BeforeRunOk = {\n  ok: true\n  request: InterceptorRequest\n  metadataByInterceptor: Record<string, Record<string, unknown> | undefined>\n}\n\ntype BeforeRunFailed = {\n  ok: false\n  statusCode: number\n  body: Record<string, unknown>\n}\n\nexport type RunInterceptorsBeforeResult = BeforeRunOk | BeforeRunFailed\n\nexport type RunInterceptorsAfterResult = {\n  ok: boolean\n  statusCode: number\n  body: Record<string, unknown>\n  headers: Record<string, string>\n}\n\nfunction sanitizeObject(input?: Record<string, unknown>): Record<string, unknown> | undefined {\n  if (!input || typeof input !== 'object') return undefined\n  const clean = Object.fromEntries(Object.entries(input).filter(([, value]) => value !== undefined))\n  return Object.keys(clean).length > 0 ? clean : {}\n}\n\nfunction hasRequiredFeatures(features: string[] | undefined, userFeatures: string[] | undefined): boolean {\n  return hasAllFeatures(userFeatures, features)\n}\n\nfunction timeoutPromise(ms: number, interceptorId: string): Promise<never> {\n  return new Promise((_, reject) => {\n    setTimeout(() => {\n      reject(new Error(`INTERCEPTOR_TIMEOUT:${interceptorId}`))\n    }, ms)\n  })\n}\n\nfunction isTimeoutError(error: unknown): boolean {\n  return error instanceof Error && error.message.startsWith('INTERCEPTOR_TIMEOUT:')\n}\n\nasync function runWithTimeout<T>(\n  task: Promise<T>,\n  timeoutMs: number,\n  interceptorId: string,\n): Promise<T> {\n  return Promise.race([task, timeoutPromise(timeoutMs, interceptorId)])\n}\n\nfunction toErrorBody(interceptorId: string, error: unknown): Record<string, unknown> {\n  const body: Record<string, unknown> = {\n    error: 'Internal interceptor error',\n  }\n  if (process.env.NODE_ENV !== 'production') {\n    body.interceptorId = interceptorId\n    body.message = error instanceof Error ? error.message : String(error)\n  }\n  return body\n}\n\nexport async function runApiInterceptorsBefore(args: {\n  routePath: string\n  method: ApiInterceptorMethod\n  request: InterceptorRequest\n  context: Omit<InterceptorContext, 'metadata'>\n}): Promise<RunInterceptorsBeforeResult> {\n  const { routePath, method, context } = args\n  let currentRequest: InterceptorRequest = {\n    ...args.request,\n    body: sanitizeObject(args.request.body),\n    query: sanitizeObject(args.request.query),\n    headers: { ...(args.request.headers ?? {}) },\n  }\n\n  const metadataByInterceptor: Record<string, Record<string, unknown> | undefined> = {}\n  const interceptors = getApiInterceptorsForRoute(routePath, method)\n\n  for (const entry of interceptors) {\n    const interceptor = entry.interceptor\n    if (!interceptor.before) continue\n    if (!hasRequiredFeatures(interceptor.features, context.userFeatures)) continue\n\n    try {\n      const timeoutMs = interceptor.timeoutMs ?? DEFAULT_TIMEOUT_MS\n      const result = await runWithTimeout(\n        interceptor.before(currentRequest, context),\n        timeoutMs,\n        interceptor.id,\n      )\n\n      const normalized: InterceptorBeforeResult = result ?? { ok: true }\n      if (!normalized.ok) {\n        const rejectBody: Record<string, unknown> = {\n          error: normalized.message ?? 'Request blocked by API interceptor',\n        }\n        if (process.env.NODE_ENV !== 'production') {\n          rejectBody.interceptorId = interceptor.id\n        }\n        return {\n          ok: false,\n          statusCode: normalized.statusCode ?? 400,\n          body: rejectBody,\n        }\n      }\n\n      if (normalized.headers) {\n        currentRequest = {\n          ...currentRequest,\n          headers: {\n            ...currentRequest.headers,\n            ...normalized.headers,\n          },\n        }\n      }\n      if (normalized.body) {\n        currentRequest = {\n          ...currentRequest,\n          body: sanitizeObject(normalized.body),\n        }\n      }\n      if (normalized.query) {\n        currentRequest = {\n          ...currentRequest,\n          query: sanitizeObject(normalized.query),\n        }\n      }\n      metadataByInterceptor[interceptor.id] = normalized.metadata\n    } catch (error) {\n      if (isTimeoutError(error)) {\n        const timeoutBody: Record<string, unknown> = { error: 'Interceptor timeout' }\n        if (process.env.NODE_ENV !== 'production') {\n          timeoutBody.interceptorId = interceptor.id\n        }\n        return {\n          ok: false,\n          statusCode: 504,\n          body: timeoutBody,\n        }\n      }\n      return {\n        ok: false,\n        statusCode: 500,\n        body: toErrorBody(interceptor.id, error),\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    request: currentRequest,\n    metadataByInterceptor,\n  }\n}\n\nexport async function runApiInterceptorsAfter(args: {\n  routePath: string\n  method: ApiInterceptorMethod\n  request: InterceptorRequest\n  response: InterceptorResponse\n  context: Omit<InterceptorContext, 'metadata'>\n  metadataByInterceptor?: Record<string, Record<string, unknown> | undefined>\n}): Promise<RunInterceptorsAfterResult> {\n  const { routePath, method, context } = args\n  let body: Record<string, unknown> = { ...(args.response.body ?? {}) }\n  let headers: Record<string, string> = { ...(args.response.headers ?? {}) }\n\n  const interceptors = getApiInterceptorsForRoute(routePath, method)\n  for (const entry of interceptors) {\n    const interceptor = entry.interceptor\n    if (!interceptor.after) continue\n    if (!hasRequiredFeatures(interceptor.features, context.userFeatures)) continue\n\n    try {\n      const timeoutMs = interceptor.timeoutMs ?? DEFAULT_TIMEOUT_MS\n      const result = await runWithTimeout(\n        interceptor.after(\n          args.request,\n          { statusCode: args.response.statusCode, body, headers },\n          { ...context, metadata: args.metadataByInterceptor?.[interceptor.id] },\n        ),\n        timeoutMs,\n        interceptor.id,\n      )\n      if (!result) continue\n      if (result.replace && typeof result.replace === 'object') {\n        body = { ...result.replace }\n      } else if (result.merge && typeof result.merge === 'object') {\n        body = { ...body, ...result.merge }\n      }\n    } catch (error) {\n      if (isTimeoutError(error)) {\n        const timeoutBody: Record<string, unknown> = { error: 'Interceptor timeout' }\n        if (process.env.NODE_ENV !== 'production') {\n          timeoutBody.interceptorId = interceptor.id\n        }\n        return {\n          ok: false,\n          statusCode: 504,\n          body: timeoutBody,\n          headers,\n        }\n      }\n      return {\n        ok: false,\n        statusCode: 500,\n        body: toErrorBody(interceptor.id, error),\n        headers,\n      }\n    }\n  }\n\n  return {\n    ok: true,\n    statusCode: args.response.statusCode,\n    body,\n    headers,\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,kCAAkC;AAC3C,SAAS,sBAAsB;AAE/B,MAAM,qBAAqB;AAuB3B,SAAS,eAAe,OAAsE;AAC5F,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,QAAQ,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE,KAAK,MAAM,UAAU,MAAS,CAAC;AACjG,SAAO,OAAO,KAAK,KAAK,EAAE,SAAS,IAAI,QAAQ,CAAC;AAClD;AAEA,SAAS,oBAAoB,UAAgC,cAA6C;AACxG,SAAO,eAAe,cAAc,QAAQ;AAC9C;AAEA,SAAS,eAAe,IAAY,eAAuC;AACzE,SAAO,IAAI,QAAQ,CAAC,GAAG,WAAW;AAChC,eAAW,MAAM;AACf,aAAO,IAAI,MAAM,uBAAuB,aAAa,EAAE,CAAC;AAAA,IAC1D,GAAG,EAAE;AAAA,EACP,CAAC;AACH;AAEA,SAAS,eAAe,OAAyB;AAC/C,SAAO,iBAAiB,SAAS,MAAM,QAAQ,WAAW,sBAAsB;AAClF;AAEA,eAAe,eACb,MACA,WACA,eACY;AACZ,SAAO,QAAQ,KAAK,CAAC,MAAM,eAAe,WAAW,aAAa,CAAC,CAAC;AACtE;AAEA,SAAS,YAAY,eAAuB,OAAyC;AACnF,QAAM,OAAgC;AAAA,IACpC,OAAO;AAAA,EACT;AACA,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,SAAK,gBAAgB;AACrB,SAAK,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,EACtE;AACA,SAAO;AACT;AAEA,eAAsB,yBAAyB,MAKN;AACvC,QAAM,EAAE,WAAW,QAAQ,QAAQ,IAAI;AACvC,MAAI,iBAAqC;AAAA,IACvC,GAAG,KAAK;AAAA,IACR,MAAM,eAAe,KAAK,QAAQ,IAAI;AAAA,IACtC,OAAO,eAAe,KAAK,QAAQ,KAAK;AAAA,IACxC,SAAS,EAAE,GAAI,KAAK,QAAQ,WAAW,CAAC,EAAG;AAAA,EAC7C;AAEA,QAAM,wBAA6E,CAAC;AACpF,QAAM,eAAe,2BAA2B,WAAW,MAAM;AAEjE,aAAW,SAAS,cAAc;AAChC,UAAM,cAAc,MAAM;AAC1B,QAAI,CAAC,YAAY,OAAQ;AACzB,QAAI,CAAC,oBAAoB,YAAY,UAAU,QAAQ,YAAY,EAAG;AAEtE,QAAI;AACF,YAAM,YAAY,YAAY,aAAa;AAC3C,YAAM,SAAS,MAAM;AAAA,QACnB,YAAY,OAAO,gBAAgB,OAAO;AAAA,QAC1C;AAAA,QACA,YAAY;AAAA,MACd;AAEA,YAAM,aAAsC,UAAU,EAAE,IAAI,KAAK;AACjE,UAAI,CAAC,WAAW,IAAI;AAClB,cAAM,aAAsC;AAAA,UAC1C,OAAO,WAAW,WAAW;AAAA,QAC/B;AACA,YAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,qBAAW,gBAAgB,YAAY;AAAA,QACzC;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY,WAAW,cAAc;AAAA,UACrC,MAAM;AAAA,QACR;AAAA,MACF;AAEA,UAAI,WAAW,SAAS;AACtB,yBAAiB;AAAA,UACf,GAAG;AAAA,UACH,SAAS;AAAA,YACP,GAAG,eAAe;AAAA,YAClB,GAAG,WAAW;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AACA,UAAI,WAAW,MAAM;AACnB,yBAAiB;AAAA,UACf,GAAG;AAAA,UACH,MAAM,eAAe,WAAW,IAAI;AAAA,QACtC;AAAA,MACF;AACA,UAAI,WAAW,OAAO;AACpB,yBAAiB;AAAA,UACf,GAAG;AAAA,UACH,OAAO,eAAe,WAAW,KAAK;AAAA,QACxC;AAAA,MACF;AACA,4BAAsB,YAAY,EAAE,IAAI,WAAW;AAAA,IACrD,SAAS,OAAO;AACd,UAAI,eAAe,KAAK,GAAG;AACzB,cAAM,cAAuC,EAAE,OAAO,sBAAsB;AAC5E,YAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,sBAAY,gBAAgB,YAAY;AAAA,QAC1C;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,MAAM;AAAA,QACR;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,YAAY;AAAA,QACZ,MAAM,YAAY,YAAY,IAAI,KAAK;AAAA,MACzC;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,SAAS;AAAA,IACT;AAAA,EACF;AACF;AAEA,eAAsB,wBAAwB,MAON;AACtC,QAAM,EAAE,WAAW,QAAQ,QAAQ,IAAI;AACvC,MAAI,OAAgC,EAAE,GAAI,KAAK,SAAS,QAAQ,CAAC,EAAG;AACpE,MAAI,UAAkC,EAAE,GAAI,KAAK,SAAS,WAAW,CAAC,EAAG;AAEzE,QAAM,eAAe,2BAA2B,WAAW,MAAM;AACjE,aAAW,SAAS,cAAc;AAChC,UAAM,cAAc,MAAM;AAC1B,QAAI,CAAC,YAAY,MAAO;AACxB,QAAI,CAAC,oBAAoB,YAAY,UAAU,QAAQ,YAAY,EAAG;AAEtE,QAAI;AACF,YAAM,YAAY,YAAY,aAAa;AAC3C,YAAM,SAAS,MAAM;AAAA,QACnB,YAAY;AAAA,UACV,KAAK;AAAA,UACL,EAAE,YAAY,KAAK,SAAS,YAAY,MAAM,QAAQ;AAAA,UACtD,EAAE,GAAG,SAAS,UAAU,KAAK,wBAAwB,YAAY,EAAE,EAAE;AAAA,QACvE;AAAA,QACA;AAAA,QACA,YAAY;AAAA,MACd;AACA,UAAI,CAAC,OAAQ;AACb,UAAI,OAAO,WAAW,OAAO,OAAO,YAAY,UAAU;AACxD,eAAO,EAAE,GAAG,OAAO,QAAQ;AAAA,MAC7B,WAAW,OAAO,SAAS,OAAO,OAAO,UAAU,UAAU;AAC3D,eAAO,EAAE,GAAG,MAAM,GAAG,OAAO,MAAM;AAAA,MACpC;AAAA,IACF,SAAS,OAAO;AACd,UAAI,eAAe,KAAK,GAAG;AACzB,cAAM,cAAuC,EAAE,OAAO,sBAAsB;AAC5E,YAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,sBAAY,gBAAgB,YAAY;AAAA,QAC1C;AACA,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,YAAY;AAAA,UACZ,MAAM;AAAA,UACN;AAAA,QACF;AAAA,MACF;AACA,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,YAAY;AAAA,QACZ,MAAM,YAAY,YAAY,IAAI,KAAK;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,YAAY,KAAK,SAAS;AAAA,IAC1B;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.4.6-develop-af28b566dd";
+const APP_VERSION = "0.4.6-develop-4d77832982";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.6-develop-af28b566dd'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.6-develop-4d77832982'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/widgets/component-registry.js

@@ -0,0 +1,79 @@
+import * as React from "react";
+import { hasAllFeatures } from "../../security/features.js";
+const GLOBAL_COMPONENT_REGISTRY_KEY = "__openMercatoComponentRegistry__";
+function getState() {
+  const globalValue = globalThis[GLOBAL_COMPONENT_REGISTRY_KEY];
+  if (globalValue && typeof globalValue === "object") {
+    const typed = globalValue;
+    if (typed.components instanceof Map && Array.isArray(typed.overrides)) {
+      return typed;
+    }
+  }
+  const initial = {
+    components: /* @__PURE__ */ new Map(),
+    overrides: []
+  };
+  globalThis[GLOBAL_COMPONENT_REGISTRY_KEY] = initial;
+  return initial;
+}
+function registerComponent(entry) {
+  const state = getState();
+  state.components.set(entry.id, entry);
+}
+function registerComponentOverrides(overrides) {
+  const state = getState();
+  state.overrides = [...overrides];
+}
+function getComponentEntry(componentId) {
+  const state = getState();
+  return state.components.get(componentId) ?? null;
+}
+function getComponentOverrides(componentId, userFeatures) {
+  const state = getState();
+  const relevant = state.overrides.filter((override) => {
+    if (override.target.componentId !== componentId) return false;
+    if (override.features && override.features.length > 0) {
+      if (!hasAllFeatures(userFeatures, override.features)) return false;
+    }
+    return true;
+  });
+  return relevant.sort((a, b) => a.priority - b.priority);
+}
+function resolveRegisteredComponent(componentId, fallback, userFeatures) {
+  const overrides = getComponentOverrides(componentId, userFeatures);
+  let resolved = fallback;
+  for (const override of overrides) {
+    if ("replacement" in override) {
+      resolved = override.replacement;
+      continue;
+    }
+    if ("wrapper" in override) {
+      resolved = override.wrapper(resolved);
+      continue;
+    }
+    if ("propsTransform" in override) {
+      const transform = override.propsTransform;
+      const Current = resolved;
+      resolved = ((props) => {
+        const transformed = transform(props);
+        return React.createElement(Current, transformed);
+      });
+    }
+  }
+  return resolved;
+}
+const ComponentReplacementHandles = {
+  page: (path) => `page:${path}`,
+  dataTable: (tableId) => `data-table:${tableId}`,
+  crudForm: (entityId) => `crud-form:${entityId}`,
+  section: (scope, sectionId) => `section:${scope}.${sectionId}`
+};
+export {
+  ComponentReplacementHandles,
+  getComponentEntry,
+  getComponentOverrides,
+  registerComponent,
+  registerComponentOverrides,
+  resolveRegisteredComponent
+};
+//# sourceMappingURL=component-registry.js.map

package/dist/modules/widgets/component-registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/widgets/component-registry.ts"],
+  "sourcesContent": ["import * as React from 'react'\nimport type { ComponentType, LazyExoticComponent } from 'react'\nimport type { ZodType } from 'zod'\nimport { hasAllFeatures } from '../../security/features'\n\nexport type ComponentRegistryEntry<TProps = unknown> = {\n  id: string\n  component: ComponentType<TProps>\n  metadata: {\n    module: string\n    description?: string\n    propsSchema?: ZodType<TProps>\n  }\n}\n\nexport type ComponentOverride<TProps = unknown> = {\n  target: { componentId: string }\n  priority: number\n  features?: string[]\n  metadata?: {\n    module?: string\n  }\n} & (\n  | {\n      replacement: LazyExoticComponent<ComponentType<TProps>> | ComponentType<TProps>\n      propsSchema: ZodType<TProps>\n    }\n  | {\n      wrapper: (Original: ComponentType<TProps>) => ComponentType<TProps>\n    }\n  | {\n      propsTransform: (props: TProps) => TProps\n    }\n)\n\ntype RuntimeState = {\n  components: Map<string, ComponentRegistryEntry>\n  overrides: ComponentOverride[]\n}\n\nconst GLOBAL_COMPONENT_REGISTRY_KEY = '__openMercatoComponentRegistry__'\n\nfunction getState(): RuntimeState {\n  const globalValue = (globalThis as Record<string, unknown>)[GLOBAL_COMPONENT_REGISTRY_KEY]\n  if (globalValue && typeof globalValue === 'object') {\n    const typed = globalValue as RuntimeState\n    if (typed.components instanceof Map && Array.isArray(typed.overrides)) {\n      return typed\n    }\n  }\n  const initial: RuntimeState = {\n    components: new Map<string, ComponentRegistryEntry>(),\n    overrides: [],\n  }\n  ;(globalThis as Record<string, unknown>)[GLOBAL_COMPONENT_REGISTRY_KEY] = initial\n  return initial\n}\n\nexport function registerComponent<TProps = unknown>(entry: ComponentRegistryEntry<TProps>) {\n  const state = getState()\n  state.components.set(entry.id, entry as ComponentRegistryEntry)\n}\n\nexport function registerComponentOverrides(overrides: ComponentOverride[]) {\n  const state = getState()\n  state.overrides = [...overrides]\n}\n\nexport function getComponentEntry(componentId: string): ComponentRegistryEntry | null {\n  const state = getState()\n  return state.components.get(componentId) ?? null\n}\n\nexport function getComponentOverrides(componentId: string, userFeatures?: readonly string[]): ComponentOverride[] {\n  const state = getState()\n  const relevant = state.overrides.filter((override) => {\n    if (override.target.componentId !== componentId) return false\n    if (override.features && override.features.length > 0) {\n      if (!hasAllFeatures(userFeatures, override.features)) return false\n    }\n    return true\n  })\n  return relevant.sort((a, b) => a.priority - b.priority)\n}\n\nexport function resolveRegisteredComponent<TProps>(\n  componentId: string,\n  fallback: ComponentType<TProps>,\n  userFeatures?: readonly string[],\n): ComponentType<TProps> {\n  const overrides = getComponentOverrides(componentId, userFeatures)\n  let resolved: ComponentType<TProps> = fallback\n  for (const override of overrides) {\n    if ('replacement' in override) {\n      resolved = override.replacement as ComponentType<TProps>\n      continue\n    }\n    if ('wrapper' in override) {\n      resolved = override.wrapper(resolved as ComponentType<unknown>) as ComponentType<TProps>\n      continue\n    }\n    if ('propsTransform' in override) {\n      const transform = override.propsTransform as (props: TProps) => TProps\n      const Current = resolved\n      resolved = ((props: TProps) => {\n        const transformed = transform(props)\n        return React.createElement(Current as ComponentType<Record<string, unknown>>, transformed as Record<string, unknown>)\n      }) as ComponentType<TProps>\n    }\n  }\n  return resolved\n}\n\nexport const ComponentReplacementHandles = {\n  page: (path: string) => `page:${path}`,\n  dataTable: (tableId: string) => `data-table:${tableId}`,\n  crudForm: (entityId: string) => `crud-form:${entityId}`,\n  section: (scope: string, sectionId: string) => `section:${scope}.${sectionId}`,\n} as const\n"],
+  "mappings": "AAAA,YAAY,WAAW;AAGvB,SAAS,sBAAsB;AAqC/B,MAAM,gCAAgC;AAEtC,SAAS,WAAyB;AAChC,QAAM,cAAe,WAAuC,6BAA6B;AACzF,MAAI,eAAe,OAAO,gBAAgB,UAAU;AAClD,UAAM,QAAQ;AACd,QAAI,MAAM,sBAAsB,OAAO,MAAM,QAAQ,MAAM,SAAS,GAAG;AACrE,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,UAAwB;AAAA,IAC5B,YAAY,oBAAI,IAAoC;AAAA,IACpD,WAAW,CAAC;AAAA,EACd;AACC,EAAC,WAAuC,6BAA6B,IAAI;AAC1E,SAAO;AACT;AAEO,SAAS,kBAAoC,OAAuC;AACzF,QAAM,QAAQ,SAAS;AACvB,QAAM,WAAW,IAAI,MAAM,IAAI,KAA+B;AAChE;AAEO,SAAS,2BAA2B,WAAgC;AACzE,QAAM,QAAQ,SAAS;AACvB,QAAM,YAAY,CAAC,GAAG,SAAS;AACjC;AAEO,SAAS,kBAAkB,aAAoD;AACpF,QAAM,QAAQ,SAAS;AACvB,SAAO,MAAM,WAAW,IAAI,WAAW,KAAK;AAC9C;AAEO,SAAS,sBAAsB,aAAqB,cAAuD;AAChH,QAAM,QAAQ,SAAS;AACvB,QAAM,WAAW,MAAM,UAAU,OAAO,CAAC,aAAa;AACpD,QAAI,SAAS,OAAO,gBAAgB,YAAa,QAAO;AACxD,QAAI,SAAS,YAAY,SAAS,SAAS,SAAS,GAAG;AACrD,UAAI,CAAC,eAAe,cAAc,SAAS,QAAQ,EAAG,QAAO;AAAA,IAC/D;AACA,WAAO;AAAA,EACT,CAAC;AACD,SAAO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE,WAAW,EAAE,QAAQ;AACxD;AAEO,SAAS,2BACd,aACA,UACA,cACuB;AACvB,QAAM,YAAY,sBAAsB,aAAa,YAAY;AACjE,MAAI,WAAkC;AACtC,aAAW,YAAY,WAAW;AAChC,QAAI,iBAAiB,UAAU;AAC7B,iBAAW,SAAS;AACpB;AAAA,IACF;AACA,QAAI,aAAa,UAAU;AACzB,iBAAW,SAAS,QAAQ,QAAkC;AAC9D;AAAA,IACF;AACA,QAAI,oBAAoB,UAAU;AAChC,YAAM,YAAY,SAAS;AAC3B,YAAM,UAAU;AAChB,kBAAY,CAAC,UAAkB;AAC7B,cAAM,cAAc,UAAU,KAAK;AACnC,eAAO,MAAM,cAAc,SAAmD,WAAsC;AAAA,MACtH;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,8BAA8B;AAAA,EACzC,MAAM,CAAC,SAAiB,QAAQ,IAAI;AAAA,EACpC,WAAW,CAAC,YAAoB,cAAc,OAAO;AAAA,EACrD,UAAU,CAAC,aAAqB,aAAa,QAAQ;AAAA,EACrD,SAAS,CAAC,OAAe,cAAsB,WAAW,KAAK,IAAI,SAAS;AAC9E;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.4.6-develop-af28b566dd",
+  "version": "0.4.6-develop-4d77832982",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {

package/src/lib/bootstrap/dynamicLoader.ts

@@ -155,6 +155,8 @@ export async function loadBootstrapData(appRoot?: string): Promise<BootstrapData
     dashboardWidgetEntries: [],
     injectionWidgetEntries: [],
     injectionTables: [],
+    interceptorEntries: [],
+    componentOverrideEntries: [],
   }
 }
 

package/src/lib/bootstrap/factory.ts

@@ -7,6 +7,8 @@ import { registerEntityFields } from '../encryption/entityFields'
 import { registerSearchModuleConfigs } from '../../modules/search'
 import { registerAnalyticsModuleConfigs } from '../../modules/analytics'
 import { registerResponseEnrichers } from '../crud/enricher-registry'
+import { registerApiInterceptors } from '../crud/interceptor-registry'
+import { registerComponentOverrides } from '../../modules/widgets/component-registry'
 
 let _bootstrapped = false
 
@@ -60,6 +62,17 @@ export function createBootstrap(data: BootstrapData, options: BootstrapOptions =
       registerResponseEnrichers(data.enricherEntries)
     }
 
+    // === 6c. API interceptors (for CRUD route interception) ===
+    if (data.interceptorEntries) {
+      registerApiInterceptors(data.interceptorEntries)
+    }
+
+    // === 6d. Component overrides (for page/component replacement) ===
+    if (data.componentOverrideEntries) {
+      const allOverrides = data.componentOverrideEntries.flatMap((entry) => entry.componentOverrides ?? [])
+      registerComponentOverrides(allOverrides)
+    }
+
     // === 7-8. UI Widgets and Optional packages (async to avoid circular deps) ===
     // Store the promise so CLI context can await it
     _asyncRegistrationPromise = registerWidgetsAndOptionalPackages(data, options)

package/src/lib/bootstrap/types.ts

@@ -19,6 +19,16 @@ export interface EnricherBootstrapEntry {
   enrichers: import('../../lib/crud/response-enricher').ResponseEnricher[]
 }
 
+export interface InterceptorBootstrapEntry {
+  moduleId: string
+  interceptors: import('../../lib/crud/api-interceptor').ApiInterceptor[]
+}
+
+export interface ComponentOverrideBootstrapEntry {
+  moduleId: string
+  componentOverrides: import('../../modules/widgets/component-registry').ComponentOverride[]
+}
+
 export interface BootstrapData {
   modules: Module[]
   entities: OrmEntity[]
@@ -31,6 +41,8 @@ export interface BootstrapData {
   searchModuleConfigs: SearchModuleConfig[]
   analyticsModuleConfigs?: AnalyticsModuleConfig[]
   enricherEntries?: EnricherBootstrapEntry[]
+  interceptorEntries?: InterceptorBootstrapEntry[]
+  componentOverrideEntries?: ComponentOverrideBootstrapEntry[]
 }
 
 export interface BootstrapOptions {

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -1,4 +1,5 @@
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
+import { registerApiInterceptors } from '@open-mercato/shared/lib/crud/interceptor-registry'
 import { z } from 'zod'
 
 // ---- Mocks ----
@@ -127,6 +128,7 @@ describe('CRUD Factory', () => {
       execute: jest.fn(async () => ({ result: {}, logEntry: { id: 'log-1' } })),
     }
     crudMutationGuardService = null
+    registerApiInterceptors([])
   })
 
   const querySchema = z.object({
@@ -368,4 +370,68 @@ describe('CRUD Factory', () => {
     // to avoid duplicates (see commit 3f999f35).
     expect(mockDataEngine.emitOrmEntityEvent).not.toHaveBeenCalled()
   })
+
+  it('POST is blocked by interceptor before hook', async () => {
+    registerApiInterceptors([
+      {
+        moduleId: 'example',
+        interceptors: [
+          {
+            id: 'example.block-title',
+            targetRoute: 'example/todos',
+            methods: ['POST'],
+            async before(request) {
+              const title = request.body?.title
+              if (typeof title === 'string' && title.includes('BLOCKED')) {
+                return { ok: false, statusCode: 422, message: 'Blocked by interceptor' }
+              }
+              return { ok: true }
+            },
+          },
+        ],
+      },
+    ])
+
+    const res = await route.POST(new Request('http://x/api/example/todos', {
+      method: 'POST',
+      body: JSON.stringify({ title: 'BLOCKED item', is_done: false }),
+      headers: { 'content-type': 'application/json' },
+    }))
+    expect(res.status).toBe(422)
+    const payload = await res.json()
+    expect(payload).toMatchObject({
+      error: 'Blocked by interceptor',
+      interceptorId: 'example.block-title',
+    })
+  })
+
+  it('GET response is augmented by interceptor after hook', async () => {
+    registerApiInterceptors([
+      {
+        moduleId: 'example',
+        interceptors: [
+          {
+            id: 'example.add-response-flag',
+            targetRoute: 'example/todos',
+            methods: ['GET'],
+            async after(_request, response) {
+              return {
+                merge: {
+                  _interceptor: {
+                    ok: true,
+                    count: Array.isArray(response.body.items) ? response.body.items.length : 0,
+                  },
+                },
+              }
+            },
+          },
+        ],
+      },
+    ])
+
+    const res = await route.GET(new Request('http://x/api/example/todos?page=1&pageSize=10&sortField=id&sortDir=asc'))
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body._interceptor).toEqual({ ok: true, count: 1 })
+  })
 })

package/src/lib/crud/api-interceptor.ts

@@ -0,0 +1,65 @@
+import type { AwilixContainer } from 'awilix'
+import type { EntityManager } from '@mikro-orm/postgresql'
+
+export type ApiInterceptorMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'
+
+export type InterceptorRequest = {
+  method: ApiInterceptorMethod
+  url: string
+  body?: Record<string, unknown>
+  query?: Record<string, unknown>
+  headers: Record<string, string>
+}
+
+export type InterceptorResponse = {
+  statusCode: number
+  body: Record<string, unknown>
+  headers: Record<string, string>
+}
+
+export type InterceptorContext = {
+  userId: string
+  organizationId: string
+  tenantId: string
+  em: EntityManager
+  container: AwilixContainer
+  userFeatures?: string[]
+  metadata?: Record<string, unknown>
+}
+
+export type InterceptorBeforeResult = {
+  ok: boolean
+  body?: Record<string, unknown>
+  query?: Record<string, unknown>
+  headers?: Record<string, string>
+  message?: string
+  statusCode?: number
+  metadata?: Record<string, unknown>
+}
+
+export type InterceptorAfterResult = {
+  merge?: Record<string, unknown>
+  replace?: Record<string, unknown>
+}
+
+export type ApiInterceptor = {
+  id: string
+  targetRoute: string
+  methods: ApiInterceptorMethod[]
+  priority?: number
+  features?: string[]
+  timeoutMs?: number
+  before?: (request: InterceptorRequest, context: InterceptorContext) => Promise<InterceptorBeforeResult>
+  after?: (
+    request: InterceptorRequest,
+    response: InterceptorResponse,
+    context: InterceptorContext,
+  ) => Promise<InterceptorAfterResult>
+}
+
+export type ApiInterceptorRegistryEntry = {
+  moduleId: string
+  interceptor: ApiInterceptor
+  moduleOrder: number
+  interceptorOrder: number
+}