@open-mercato/shared 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6784.1.f80b9afce5

package/dist/security/enabledModulesRegistry.js

@@ -6,21 +6,57 @@ function buildRegistry(modules) {
   const enabledModuleSet = new Set(enabledModuleIds);
   const featureToModule = /* @__PURE__ */ new Map();
   const prefixToModule = /* @__PURE__ */ new Map();
+  const concreteFeatureIds = [];
+  const concreteFeatureSet = /* @__PURE__ */ new Set();
+  const addConcreteFeature = (featureId, owningModule, authoritative) => {
+    if (!featureId || featureId === "*" || featureId.endsWith(".*")) return;
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId);
+      concreteFeatureIds.push(featureId);
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule);
+    }
+    const dot = featureId.indexOf(".");
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot);
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule);
+    }
+  };
   for (const mod of modules) {
     const features = mod.features;
-    if (!Array.isArray(features)) continue;
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== "string" || !feature.id) continue;
-      const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
-      featureToModule.set(feature.id, declared);
-      const dot = feature.id.indexOf(".");
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot);
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared);
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== "string" || !feature.id) continue;
+        const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
+        addConcreteFeature(feature.id, declared, true);
+      }
+    }
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures;
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue;
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
+      }
+    }
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue;
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
       }
     }
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule };
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds
+  };
 }
 function getRegistry() {
   try {
@@ -52,6 +88,13 @@ function getEnabledModuleIds() {
   const registry = getRegistry();
   return registry ? [...registry.enabledModuleIds] : [];
 }
+function getConcreteFeatureIds() {
+  const registry = getRegistry();
+  return registry ? [...registry.concreteFeatureIds] : [];
+}
+function hasEnabledModulesRegistry() {
+  return getRegistry() !== null;
+}
 function filterGrantsByEnabledModules(granted) {
   const registry = getRegistry();
   if (!registry) return [...granted];
@@ -73,7 +116,9 @@ function filterGrantsByEnabledModules(granted) {
 }
 export {
   filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
   getEnabledModuleIds,
-  getOwningModuleId
+  getOwningModuleId,
+  hasEnabledModulesRegistry
 };
 //# sourceMappingURL=enabledModulesRegistry.js.map

package/dist/security/enabledModulesRegistry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/enabledModulesRegistry.ts"],
-  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  for (const mod of modules) {\n    const features = mod.features\n    if (!Array.isArray(features)) continue\n    for (const feature of features) {\n      if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n      const declared = typeof feature.module === 'string' && feature.module.length > 0\n        ? feature.module\n        : mod.id\n      featureToModule.set(feature.id, declared)\n      const dot = feature.id.indexOf('.')\n      if (dot > 0) {\n        const prefix = feature.id.slice(0, dot)\n        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)\n      }\n    }\n  }\n  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
-  "mappings": "AAyBA,SAAS,kBAAkB;AAU3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,YAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,sBAAgB,IAAI,QAAQ,IAAI,QAAQ;AACxC,YAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAI,MAAM,GAAG;AACX,cAAM,SAAS,QAAQ,GAAG,MAAM,GAAG,GAAG;AACtC,YAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,QAAQ;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,kBAAkB,kBAAkB,iBAAiB,eAAe;AAC/E;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n  concreteFeatureIds: string[]\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  const concreteFeatureIds: string[] = []\n  const concreteFeatureSet = new Set<string>()\n\n  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {\n    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return\n    if (!concreteFeatureSet.has(featureId)) {\n      concreteFeatureSet.add(featureId)\n      concreteFeatureIds.push(featureId)\n    }\n    if (authoritative || !featureToModule.has(featureId)) {\n      featureToModule.set(featureId, owningModule)\n    }\n    const dot = featureId.indexOf('.')\n    if (dot > 0) {\n      const prefix = featureId.slice(0, dot)\n      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)\n    }\n  }\n\n  for (const mod of modules) {\n    const features = mod.features\n    if (Array.isArray(features)) {\n      for (const feature of features) {\n        if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n        const declared = typeof feature.module === 'string' && feature.module.length > 0\n          ? feature.module\n          : mod.id\n        addConcreteFeature(feature.id, declared, true)\n      }\n    }\n\n    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures\n    if (customerDefaults) {\n      for (const roleFeatures of Object.values(customerDefaults)) {\n        if (!Array.isArray(roleFeatures)) continue\n        for (const featureId of roleFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n\n    if (Array.isArray(mod.frontendRoutes)) {\n      for (const route of mod.frontendRoutes) {\n        if (!Array.isArray(route.requireCustomerFeatures)) continue\n        for (const featureId of route.requireCustomerFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n  }\n  return {\n    enabledModuleIds,\n    enabledModuleSet,\n    featureToModule,\n    prefixToModule,\n    concreteFeatureIds,\n  }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/** @internal Infrastructure input for concrete feature-policy projection. */\nexport function getConcreteFeatureIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.concreteFeatureIds] : []\n}\n\n/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */\nexport function hasEnabledModulesRegistry(): boolean {\n  return getRegistry() !== null\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
+  "mappings": "AAyBA,SAAS,kBAAkB;AAW3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,qBAA+B,CAAC;AACtC,QAAM,qBAAqB,oBAAI,IAAY;AAE3C,QAAM,qBAAqB,CAAC,WAAmB,cAAsB,kBAA2B;AAC9F,QAAI,CAAC,aAAa,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACjE,QAAI,CAAC,mBAAmB,IAAI,SAAS,GAAG;AACtC,yBAAmB,IAAI,SAAS;AAChC,yBAAmB,KAAK,SAAS;AAAA,IACnC;AACA,QAAI,iBAAiB,CAAC,gBAAgB,IAAI,SAAS,GAAG;AACpD,sBAAgB,IAAI,WAAW,YAAY;AAAA,IAC7C;AACA,UAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,QAAI,MAAM,GAAG;AACX,YAAM,SAAS,UAAU,MAAM,GAAG,GAAG;AACrC,UAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,YAAY;AAAA,IAC1E;AAAA,EACF;AAEA,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,iBAAW,WAAW,UAAU;AAC9B,YAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,cAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,2BAAmB,QAAQ,IAAI,UAAU,IAAI;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,mBAAmB,IAAI,OAAO;AACpC,QAAI,kBAAkB;AACpB,iBAAW,gBAAgB,OAAO,OAAO,gBAAgB,GAAG;AAC1D,YAAI,CAAC,MAAM,QAAQ,YAAY,EAAG;AAClC,mBAAW,aAAa,cAAc;AACpC,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,IAAI,cAAc,GAAG;AACrC,iBAAW,SAAS,IAAI,gBAAgB;AACtC,YAAI,CAAC,MAAM,QAAQ,MAAM,uBAAuB,EAAG;AACnD,mBAAW,aAAa,MAAM,yBAAyB;AACrD,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAGO,SAAS,wBAAkC;AAChD,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,kBAAkB,IAAI,CAAC;AACxD;AAGO,SAAS,4BAAqC;AACnD,SAAO,YAAY,MAAM;AAC3B;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/security/featurePolicy.js

@@ -0,0 +1,62 @@
+import { hasAllFeatures as matchesAllFeatures } from "./features.js";
+import {
+  filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
+  getEnabledModuleIds,
+  getOwningModuleId,
+  hasEnabledModulesRegistry
+} from "./enabledModulesRegistry.js";
+import { composeAclFeatureOverrides } from "../modules/overrides.js";
+function getRemovedAclFeatureIds() {
+  return Object.entries(composeAclFeatureOverrides()).filter(([, override]) => override === null).map(([featureId]) => featureId);
+}
+function isAclFeatureRemoved(featureId) {
+  return composeAclFeatureOverrides()[featureId] === null;
+}
+function isFeatureEnabled(featureId) {
+  if (!hasEnabledModulesRegistry()) return true;
+  const enabledModuleIds = getEnabledModuleIds();
+  return enabledModuleIds.includes(getOwningModuleId(featureId));
+}
+function authorizeFeatures(required, subject) {
+  if (required.length === 0) return true;
+  if (subject.scopeAllowed === false) return false;
+  if (required.some((featureId) => isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId))) {
+    return false;
+  }
+  if (subject.unrestricted === true) return true;
+  return matchesAllFeatures(
+    filterGrantsByEnabledModules(subject.grantedFeatures),
+    required
+  );
+}
+function resolveEffectiveFeatures(grantedFeatures) {
+  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures).filter((featureId) => !isAclFeatureRemoved(featureId));
+  if (!hasEnabledModulesRegistry()) {
+    return filteredGrants.filter((featureId, index, features) => featureId !== "*" && !featureId.endsWith(".*") && features.indexOf(featureId) === index);
+  }
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addFeature = (featureId) => {
+    if (seen.has(featureId) || isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)) {
+      return;
+    }
+    seen.add(featureId);
+    result.push(featureId);
+  };
+  for (const featureId of getConcreteFeatureIds()) {
+    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId);
+  }
+  for (const featureId of filteredGrants) {
+    if (featureId === "*" || featureId.endsWith(".*")) continue;
+    addFeature(featureId);
+  }
+  return result;
+}
+export {
+  authorizeFeatures,
+  getRemovedAclFeatureIds,
+  isAclFeatureRemoved,
+  resolveEffectiveFeatures
+};
+//# sourceMappingURL=featurePolicy.js.map

package/dist/security/featurePolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/featurePolicy.ts"],
+  "sourcesContent": ["import { hasAllFeatures as matchesAllFeatures } from './features'\nimport {\n  filterGrantsByEnabledModules,\n  getConcreteFeatureIds,\n  getEnabledModuleIds,\n  getOwningModuleId,\n  hasEnabledModulesRegistry,\n} from './enabledModulesRegistry'\nimport { composeAclFeatureOverrides } from '../modules/overrides'\n\nexport type FeaturePolicySubject = {\n  grantedFeatures: readonly string[]\n  unrestricted?: boolean\n  scopeAllowed?: boolean\n}\n\nexport function getRemovedAclFeatureIds(): string[] {\n  return Object.entries(composeAclFeatureOverrides())\n    .filter(([, override]) => override === null)\n    .map(([featureId]) => featureId)\n}\n\nexport function isAclFeatureRemoved(featureId: string): boolean {\n  return composeAclFeatureOverrides()[featureId] === null\n}\n\nfunction isFeatureEnabled(featureId: string): boolean {\n  if (!hasEnabledModulesRegistry()) return true\n  const enabledModuleIds = getEnabledModuleIds()\n  return enabledModuleIds.includes(getOwningModuleId(featureId))\n}\n\nexport function authorizeFeatures(\n  required: readonly string[],\n  subject: FeaturePolicySubject,\n): boolean {\n  if (required.length === 0) return true\n  if (subject.scopeAllowed === false) return false\n  if (required.some((featureId) => (\n    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)\n  ))) {\n    return false\n  }\n  if (subject.unrestricted === true) return true\n  return matchesAllFeatures(\n    filterGrantsByEnabledModules(subject.grantedFeatures),\n    required,\n  )\n}\n\nexport function resolveEffectiveFeatures(\n  grantedFeatures: readonly string[],\n): string[] {\n  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)\n    .filter((featureId) => !isAclFeatureRemoved(featureId))\n\n  if (!hasEnabledModulesRegistry()) {\n    return filteredGrants.filter((featureId, index, features) => (\n      featureId !== '*'\n      && !featureId.endsWith('.*')\n      && features.indexOf(featureId) === index\n    ))\n  }\n\n  const result: string[] = []\n  const seen = new Set<string>()\n  const addFeature = (featureId: string) => {\n    if (\n      seen.has(featureId)\n      || isAclFeatureRemoved(featureId)\n      || !isFeatureEnabled(featureId)\n    ) {\n      return\n    }\n    seen.add(featureId)\n    result.push(featureId)\n  }\n\n  for (const featureId of getConcreteFeatureIds()) {\n    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)\n  }\n\n  for (const featureId of filteredGrants) {\n    if (featureId === '*' || featureId.endsWith('.*')) continue\n    addFeature(featureId)\n  }\n\n  return result\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB,0BAA0B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAQpC,SAAS,0BAAoC;AAClD,SAAO,OAAO,QAAQ,2BAA2B,CAAC,EAC/C,OAAO,CAAC,CAAC,EAAE,QAAQ,MAAM,aAAa,IAAI,EAC1C,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACnC;AAEO,SAAS,oBAAoB,WAA4B;AAC9D,SAAO,2BAA2B,EAAE,SAAS,MAAM;AACrD;AAEA,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,0BAA0B,EAAG,QAAO;AACzC,QAAM,mBAAmB,oBAAoB;AAC7C,SAAO,iBAAiB,SAAS,kBAAkB,SAAS,CAAC;AAC/D;AAEO,SAAS,kBACd,UACA,SACS;AACT,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI,QAAQ,iBAAiB,MAAO,QAAO;AAC3C,MAAI,SAAS,KAAK,CAAC,cACjB,oBAAoB,SAAS,KAAK,CAAC,iBAAiB,SAAS,CAC9D,GAAG;AACF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,6BAA6B,QAAQ,eAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,yBACd,iBACU;AACV,QAAM,iBAAiB,6BAA6B,eAAe,EAChE,OAAO,CAAC,cAAc,CAAC,oBAAoB,SAAS,CAAC;AAExD,MAAI,CAAC,0BAA0B,GAAG;AAChC,WAAO,eAAe,OAAO,CAAC,WAAW,OAAO,aAC9C,cAAc,OACX,CAAC,UAAU,SAAS,IAAI,KACxB,SAAS,QAAQ,SAAS,MAAM,KACpC;AAAA,EACH;AAEA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,aAAa,CAAC,cAAsB;AACxC,QACE,KAAK,IAAI,SAAS,KACf,oBAAoB,SAAS,KAC7B,CAAC,iBAAiB,SAAS,GAC9B;AACA;AAAA,IACF;AACA,SAAK,IAAI,SAAS;AAClB,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,aAAW,aAAa,sBAAsB,GAAG;AAC/C,QAAI,mBAAmB,gBAAgB,CAAC,SAAS,CAAC,EAAG,YAAW,SAAS;AAAA,EAC3E;AAEA,aAAW,aAAa,gBAAgB;AACtC,QAAI,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACnD,eAAW,SAAS;AAAA,EACtB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6775.1.c2313bb8a3",
+  "version": "0.6.7-develop.6784.1.f80b9afce5",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,6 +48,10 @@
       "types": "./src/lib/events/patterns.ts",
       "default": "./dist/lib/events/patterns.js"
     },
+    "./lib/data/consistency": {
+      "types": "./src/lib/data/consistency.ts",
+      "default": "./dist/lib/data/consistency.js"
+    },
     "./lib/logger": {
       "types": "./src/lib/logger/index.ts",
       "default": "./dist/lib/logger/index.js"
@@ -101,7 +105,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6775.1.c2313bb8a3",
+    "@open-mercato/cache": "0.6.7-develop.6784.1.f80b9afce5",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/commands/__tests__/command-interceptor-runner.test.ts

@@ -7,6 +7,10 @@ import {
 } from '../command-interceptor-runner'
 import type { CommandInterceptor, CommandInterceptorContext, CommandInterceptorUndoContext } from '../command-interceptor'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '@open-mercato/shared/modules/overrides'
 
 jest.mock('@open-mercato/shared/lib/logger', () => {
   const mocked = {
@@ -59,6 +63,10 @@ describe('matchesCommandPattern', () => {
 })
 
 describe('runCommandInterceptorsBefore', () => {
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+  })
+
   it('returns ok when no interceptors match', async () => {
     const interceptor = makeInterceptor({
       id: 'i1',
@@ -158,6 +166,26 @@ describe('runCommandInterceptorsBefore', () => {
     expect(withWildcard.ok).toBe(false)
     expect(withWildcard.error?.message).toBe('Blocked by wildcard')
   })
+
+  it('does not run an interceptor gated by a nulled ACL feature', async () => {
+    applyAclFeatureOverrides({ 'premium.audit': null })
+    const interceptor = makeInterceptor({
+      id: 'i1',
+      features: ['premium.audit'],
+      beforeExecute: jest.fn().mockResolvedValue({ ok: false }),
+    })
+
+    const result = await runCommandInterceptorsBefore(
+      [interceptor],
+      'customers.create-person',
+      {},
+      baseContext,
+      ['*', 'premium.audit'],
+    )
+
+    expect(result.ok).toBe(true)
+    expect(interceptor.beforeExecute).not.toHaveBeenCalled()
+  })
 })
 
 describe('runCommandInterceptorsAfter', () => {

package/src/lib/commands/command-bus.ts

@@ -31,6 +31,7 @@ import {
 } from './command-interceptor-runner'
 import type { CommandInterceptorContext } from './command-interceptor'
 import { CommandInterceptorError } from './errors'
+import { isReadProjectionAlwaysConsistent } from '@open-mercato/shared/lib/data/consistency'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'commands' })
@@ -697,7 +698,10 @@ export class CommandBus {
     try {
       const dataEngine = (container.resolve('dataEngine') as DataEngine)
       await dataEngine.flushOrmEntityChanges(suppress)
-    } catch {
+    } catch (error) {
+      if (isReadProjectionAlwaysConsistent()) {
+        throw error
+      }
       // best-effort: failures should not block command execution
     }
   }

package/src/lib/commands/command-interceptor-runner.ts

@@ -3,7 +3,7 @@ import type {
   CommandInterceptorContext,
   CommandInterceptorUndoContext,
 } from './command-interceptor'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'commands' })
@@ -33,7 +33,7 @@ function collectMatching(
 ): CommandInterceptor[] {
   return interceptors
     .filter((i) => matchesCommandPattern(i.targetCommand, commandId))
-    .filter((i) => hasAllFeatures(userFeatures, i.features))
+    .filter((i) => authorizeFeatures(i.features ?? [], { grantedFeatures: userFeatures }))
     .sort((a, b) => (a.priority ?? 50) - (b.priority ?? 50))
 }
 

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -545,6 +545,7 @@ describe('CRUD Factory', () => {
     const data = await res.json()
     expect(data.id).toBeDefined()
     // CF saved
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
     expect(setRecordCustomFields).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ entityId: 'example.todo', values: { priority: 3 } }))
     // Event + indexer delegated to data engine
     expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
@@ -571,6 +572,7 @@ describe('CRUD Factory', () => {
     await em.persist(created).flush()
     const res = await route.PUT(new Request('http://x/api/example/todos', { method: 'PUT', body: JSON.stringify({ id: created.id, title: 'X2', cf_priority: 5 }), headers: { 'content-type': 'application/json' } }))
     expect(res.status).toBe(200)
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
     expect(setRecordCustomFields).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ values: { priority: 5 } }))
     expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
     const updatedCall = mockDataEngine.emitOrmEntityEvent.mock.calls.at(0)
@@ -592,6 +594,22 @@ describe('CRUD Factory', () => {
     expect(mockDataEngine.emitOrmEntityEvent).not.toHaveBeenCalled()
   })
 
+  it('POST surfaces CRUD side-effect failures after custom field writes', async () => {
+    mockDataEngine.emitOrmEntityEvent.mockImplementationOnce(async () => {
+      throw new Error('index write failed')
+    })
+
+    const res = await route.POST(new Request('http://x/api/example/todos', {
+      method: 'POST',
+      body: JSON.stringify({ title: 'Indexed', is_done: true, cf_priority: 3 }),
+      headers: { 'content-type': 'application/json' },
+    }))
+
+    expect(res.status).toBe(500)
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
+    expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
+  })
+
   it('PUT rolls back the entity update when the custom field write fails', async () => {
     const created = em.create(Todo, { title: 'Before', organizationId: defaultOrganizationId, tenantId: defaultTenantId }) as Rec
     created.id = '123e4567-e89b-12d3-a456-426614174003'

package/src/lib/crud/__tests__/mutation-guard-registry.test.ts

@@ -1,5 +1,9 @@
 import { matchesEntity, runMutationGuards } from '../mutation-guard-registry'
 import type { MutationGuard, MutationGuardInput } from '../mutation-guard-registry'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '../../../modules/overrides'
 
 describe('matchesEntity', () => {
   it('matches wildcard "*" against any entity', () => {
@@ -24,6 +28,10 @@ describe('matchesEntity', () => {
 })
 
 describe('runMutationGuards', () => {
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+  })
+
   const baseInput: MutationGuardInput = {
     tenantId: 'tenant-1',
     organizationId: 'org-1',
@@ -159,6 +167,24 @@ describe('runMutationGuards', () => {
     expect(resultWithWildcard.errorBody).toEqual({ error: 'Blocked by wildcard', guardId: 'g1' })
   })
 
+  it('does not run a guard gated by a nulled ACL feature', async () => {
+    applyAclFeatureOverrides({ 'premium.locks': null })
+    const guard = makeGuard({
+      id: 'g1',
+      features: ['premium.locks'],
+      validate: jest.fn().mockResolvedValue({ ok: false }),
+    })
+
+    const result = await runMutationGuards(
+      [guard],
+      baseInput,
+      { userFeatures: ['*', 'premium.locks'] },
+    )
+
+    expect(result.ok).toBe(true)
+    expect(guard.validate).not.toHaveBeenCalled()
+  })
+
   it('uses custom error body when provided', async () => {
     const guard = makeGuard({
       id: 'g1',

package/src/lib/crud/enricher-runner.ts

@@ -15,6 +15,7 @@ import type {
 import { getEnrichersForEntity } from './enricher-registry'
 import { logEnricherTiming } from '../umes/enricher-timing'
 import { createLogger } from '../logger'
+import { authorizeFeatures } from '../../security/featurePolicy'
 
 const logger = createLogger('shared').child({ component: 'umes' })
 
@@ -35,17 +36,7 @@ function hasRequiredFeatures(
 ): boolean {
   if (!enricher.features || enricher.features.length === 0) return true
   if (!userFeatures) return false
-  const hasFeature = (required: string): boolean => {
-    for (const granted of userFeatures) {
-      if (granted === '*' || granted === required) return true
-      if (granted.endsWith('.*')) {
-        const prefix = granted.slice(0, -1)
-        if (required.startsWith(prefix)) return true
-      }
-    }
-    return false
-  }
-  return enricher.features.every((feature) => hasFeature(feature))
+  return authorizeFeatures(enricher.features, { grantedFeatures: userFeatures })
 }
 
 function filterByACLAndTenant(

package/src/lib/crud/factory.ts

@@ -2333,6 +2333,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
               organizationId: targetOrgId,
               tenantId: writeTenantId,
               values,
+              notify: false,
             })
           }
         }
@@ -2670,6 +2671,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
               organizationId: targetOrgId,
               tenantId: writeTenantId,
               values,
+              notify: false,
             })
           }
         }

package/src/lib/crud/interceptor-runner.ts

@@ -6,7 +6,7 @@ import type {
   InterceptorBeforeResult,
 } from './api-interceptor'
 import { getApiInterceptorsForRoute } from './interceptor-registry'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { logInterceptorActivity } from '../umes/interceptor-activity'
 
 const DEFAULT_TIMEOUT_MS = 5000
@@ -39,7 +39,7 @@ function sanitizeObject(input?: Record<string, unknown>): Record<string, unknown
 }
 
 function hasRequiredFeatures(features: string[] | undefined, userFeatures: string[] | undefined): boolean {
-  return hasAllFeatures(userFeatures, features)
+  return authorizeFeatures(features ?? [], { grantedFeatures: userFeatures ?? [] })
 }
 
 function timeoutPromise(ms: number, interceptorId: string): Promise<never> {

package/src/lib/crud/mutation-guard-registry.ts

@@ -1,5 +1,5 @@
 import type { AwilixContainer } from 'awilix'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { resolveCrudMutationGuardService } from './mutation-guard-service'
 
 // ---------------------------------------------------------------------------
@@ -101,7 +101,7 @@ export async function runMutationGuards(
   const matching = guards
     .filter((g) => matchesEntity(g.targetEntity, input.resourceKind))
     .filter((g) => g.operations.includes(input.operation))
-    .filter((g) => hasAllFeatures(context.userFeatures, g.features))
+    .filter((g) => authorizeFeatures(g.features ?? [], { grantedFeatures: context.userFeatures }))
     .sort((a, b) => (a.priority ?? 50) - (b.priority ?? 50))
 
   let payload = input.mutationPayload

package/src/lib/crud/types.ts

@@ -1,5 +1,8 @@
 export type CrudEventAction = 'created' | 'updated' | 'deleted'
 
+/** Internal payload marker: the data engine owns this CRUD event's query-index decision. */
+export const CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY = '__omQueryIndexManaged' as const
+
 export type CrudEntityIdentifiers = {
   id: string
   organizationId: string | null

package/src/lib/data/__tests__/consistency.test.ts

@@ -0,0 +1,38 @@
+import {
+  __resetAlwaysConsistentCacheForTests,
+  isReadProjectionAlwaysConsistent,
+  parseAlwaysConsistentEnv,
+} from '../consistency'
+
+describe('read projection consistency flag', () => {
+  const originalEnv = process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT
+    } else {
+      process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = originalEnv
+    }
+    __resetAlwaysConsistentCacheForTests()
+  })
+
+  it.each([undefined, null, '', ' ', 'off', 'false', '0', 'no', 'disabled', 'none', 'unexpected'])(
+    'parses %p as OFF',
+    (raw) => {
+      expect(parseAlwaysConsistentEnv(raw)).toBe(false)
+    },
+  )
+
+  it.each(['on', 'true', '1', 'yes', 'enabled'])('parses %p as ON', (raw) => {
+    expect(parseAlwaysConsistentEnv(raw)).toBe(true)
+  })
+
+  it('memoizes the env value until reset for tests', () => {
+    process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = 'on'
+    expect(isReadProjectionAlwaysConsistent()).toBe(true)
+    process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = 'off'
+    expect(isReadProjectionAlwaysConsistent()).toBe(true)
+    __resetAlwaysConsistentCacheForTests()
+    expect(isReadProjectionAlwaysConsistent()).toBe(false)
+  })
+})

package/src/lib/data/__tests__/engine.bulk-suppress.test.ts

@@ -1,7 +1,11 @@
 import type { AwilixContainer } from 'awilix'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { DefaultDataEngine } from '../engine'
-import type { CrudEventsConfig, CrudIndexerConfig } from '../../crud/types'
+import {
+  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+  type CrudEventsConfig,
+  type CrudIndexerConfig,
+} from '../../crud/types'
 
 // The bulk-import deferral (`suppress`) must gate the two per-record side effects `emitOrmEntityEvent`
 // fans out — the `<module>.<entity>.<action>` domain event and the inline `query_index.upsert_one`
@@ -25,6 +29,15 @@ function buildEngine() {
   return { engine, emitEvent, emittedNames }
 }
 
+function expectManagedDomainPayload(emitEvent: jest.Mock, eventName: string): void {
+  const call = emitEvent.mock.calls.find(([name]) => name === eventName)
+  expect(call).toBeDefined()
+  const payload = call?.[1] as Record<string, unknown>
+  expect(payload[CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY]).toBe(true)
+  expect(Object.keys(payload)).not.toContain(CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY)
+  expect(JSON.stringify(payload)).not.toContain(CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY)
+}
+
 describe('DefaultDataEngine bulk-import suppression', () => {
   // The test events are intentionally not registered in the event registry; silence the
   // one-time "undeclared event" warning so it doesn't clutter the suite output.
@@ -33,9 +46,10 @@ describe('DefaultDataEngine bulk-import suppression', () => {
   afterAll(() => { warnSpy.mockRestore() })
 
   it('emits both the domain event and the reindex when unsuppressed', async () => {
-    const { engine, emittedNames } = buildEngine()
+    const { engine, emitEvent, emittedNames } = buildEngine()
     await engine.emitOrmEntityEvent({ action: 'created', entity: {}, events: EVENTS, indexer: INDEXER, identifiers: IDENTIFIERS })
     expect(emittedNames()).toEqual(expect.arrayContaining(['sales.order.created', 'query_index.upsert_one']))
+    expectManagedDomainPayload(emitEvent, 'sales.order.created')
   })
 
   it('skips the domain event but keeps the reindex with skipEvents', async () => {
@@ -47,11 +61,12 @@ describe('DefaultDataEngine bulk-import suppression', () => {
   })
 
   it('skips the reindex but keeps the domain event with skipReindex', async () => {
-    const { engine, emittedNames } = buildEngine()
+    const { engine, emitEvent, emittedNames } = buildEngine()
     await engine.emitOrmEntityEvent({ action: 'created', entity: {}, events: EVENTS, indexer: INDEXER, identifiers: IDENTIFIERS, suppress: { skipReindex: true } })
     const names = emittedNames()
     expect(names).toContain('sales.order.created')
     expect(names).not.toContain('query_index.upsert_one')
+    expectManagedDomainPayload(emitEvent, 'sales.order.created')
   })
 
   it('emits nothing when both are suppressed', async () => {

package/src/lib/data/consistency.ts

@@ -0,0 +1,17 @@
+import { parseBooleanWithDefault } from '../boolean'
+
+let alwaysConsistentFlag: boolean | null = null
+
+export function parseAlwaysConsistentEnv(raw: string | undefined | null): boolean {
+  return parseBooleanWithDefault(raw, false)
+}
+
+export function isReadProjectionAlwaysConsistent(): boolean {
+  if (alwaysConsistentFlag !== null) return alwaysConsistentFlag
+  alwaysConsistentFlag = parseAlwaysConsistentEnv(process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT)
+  return alwaysConsistentFlag
+}
+
+export function __resetAlwaysConsistentCacheForTests(): void {
+  alwaysConsistentFlag = null
+}