@open-mercato/shared 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6785.1.1dd7cfac55

package/dist/security/enabledModulesRegistry.js

@@ -6,21 +6,57 @@ function buildRegistry(modules) {
   const enabledModuleSet = new Set(enabledModuleIds);
   const featureToModule = /* @__PURE__ */ new Map();
   const prefixToModule = /* @__PURE__ */ new Map();
+  const concreteFeatureIds = [];
+  const concreteFeatureSet = /* @__PURE__ */ new Set();
+  const addConcreteFeature = (featureId, owningModule, authoritative) => {
+    if (!featureId || featureId === "*" || featureId.endsWith(".*")) return;
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId);
+      concreteFeatureIds.push(featureId);
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule);
+    }
+    const dot = featureId.indexOf(".");
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot);
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule);
+    }
+  };
   for (const mod of modules) {
     const features = mod.features;
-    if (!Array.isArray(features)) continue;
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== "string" || !feature.id) continue;
-      const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
-      featureToModule.set(feature.id, declared);
-      const dot = feature.id.indexOf(".");
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot);
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared);
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== "string" || !feature.id) continue;
+        const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
+        addConcreteFeature(feature.id, declared, true);
+      }
+    }
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures;
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue;
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
+      }
+    }
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue;
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
       }
     }
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule };
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds
+  };
 }
 function getRegistry() {
   try {
@@ -52,6 +88,13 @@ function getEnabledModuleIds() {
   const registry = getRegistry();
   return registry ? [...registry.enabledModuleIds] : [];
 }
+function getConcreteFeatureIds() {
+  const registry = getRegistry();
+  return registry ? [...registry.concreteFeatureIds] : [];
+}
+function hasEnabledModulesRegistry() {
+  return getRegistry() !== null;
+}
 function filterGrantsByEnabledModules(granted) {
   const registry = getRegistry();
   if (!registry) return [...granted];
@@ -73,7 +116,9 @@ function filterGrantsByEnabledModules(granted) {
 }
 export {
   filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
   getEnabledModuleIds,
-  getOwningModuleId
+  getOwningModuleId,
+  hasEnabledModulesRegistry
 };
 //# sourceMappingURL=enabledModulesRegistry.js.map

package/dist/security/enabledModulesRegistry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/enabledModulesRegistry.ts"],
-  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  for (const mod of modules) {\n    const features = mod.features\n    if (!Array.isArray(features)) continue\n    for (const feature of features) {\n      if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n      const declared = typeof feature.module === 'string' && feature.module.length > 0\n        ? feature.module\n        : mod.id\n      featureToModule.set(feature.id, declared)\n      const dot = feature.id.indexOf('.')\n      if (dot > 0) {\n        const prefix = feature.id.slice(0, dot)\n        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)\n      }\n    }\n  }\n  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
-  "mappings": "AAyBA,SAAS,kBAAkB;AAU3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,YAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,sBAAgB,IAAI,QAAQ,IAAI,QAAQ;AACxC,YAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAI,MAAM,GAAG;AACX,cAAM,SAAS,QAAQ,GAAG,MAAM,GAAG,GAAG;AACtC,YAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,QAAQ;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,kBAAkB,kBAAkB,iBAAiB,eAAe;AAC/E;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n  concreteFeatureIds: string[]\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  const concreteFeatureIds: string[] = []\n  const concreteFeatureSet = new Set<string>()\n\n  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {\n    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return\n    if (!concreteFeatureSet.has(featureId)) {\n      concreteFeatureSet.add(featureId)\n      concreteFeatureIds.push(featureId)\n    }\n    if (authoritative || !featureToModule.has(featureId)) {\n      featureToModule.set(featureId, owningModule)\n    }\n    const dot = featureId.indexOf('.')\n    if (dot > 0) {\n      const prefix = featureId.slice(0, dot)\n      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)\n    }\n  }\n\n  for (const mod of modules) {\n    const features = mod.features\n    if (Array.isArray(features)) {\n      for (const feature of features) {\n        if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n        const declared = typeof feature.module === 'string' && feature.module.length > 0\n          ? feature.module\n          : mod.id\n        addConcreteFeature(feature.id, declared, true)\n      }\n    }\n\n    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures\n    if (customerDefaults) {\n      for (const roleFeatures of Object.values(customerDefaults)) {\n        if (!Array.isArray(roleFeatures)) continue\n        for (const featureId of roleFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n\n    if (Array.isArray(mod.frontendRoutes)) {\n      for (const route of mod.frontendRoutes) {\n        if (!Array.isArray(route.requireCustomerFeatures)) continue\n        for (const featureId of route.requireCustomerFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n  }\n  return {\n    enabledModuleIds,\n    enabledModuleSet,\n    featureToModule,\n    prefixToModule,\n    concreteFeatureIds,\n  }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/** @internal Infrastructure input for concrete feature-policy projection. */\nexport function getConcreteFeatureIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.concreteFeatureIds] : []\n}\n\n/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */\nexport function hasEnabledModulesRegistry(): boolean {\n  return getRegistry() !== null\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
+  "mappings": "AAyBA,SAAS,kBAAkB;AAW3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,qBAA+B,CAAC;AACtC,QAAM,qBAAqB,oBAAI,IAAY;AAE3C,QAAM,qBAAqB,CAAC,WAAmB,cAAsB,kBAA2B;AAC9F,QAAI,CAAC,aAAa,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACjE,QAAI,CAAC,mBAAmB,IAAI,SAAS,GAAG;AACtC,yBAAmB,IAAI,SAAS;AAChC,yBAAmB,KAAK,SAAS;AAAA,IACnC;AACA,QAAI,iBAAiB,CAAC,gBAAgB,IAAI,SAAS,GAAG;AACpD,sBAAgB,IAAI,WAAW,YAAY;AAAA,IAC7C;AACA,UAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,QAAI,MAAM,GAAG;AACX,YAAM,SAAS,UAAU,MAAM,GAAG,GAAG;AACrC,UAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,YAAY;AAAA,IAC1E;AAAA,EACF;AAEA,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,iBAAW,WAAW,UAAU;AAC9B,YAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,cAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,2BAAmB,QAAQ,IAAI,UAAU,IAAI;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,mBAAmB,IAAI,OAAO;AACpC,QAAI,kBAAkB;AACpB,iBAAW,gBAAgB,OAAO,OAAO,gBAAgB,GAAG;AAC1D,YAAI,CAAC,MAAM,QAAQ,YAAY,EAAG;AAClC,mBAAW,aAAa,cAAc;AACpC,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,IAAI,cAAc,GAAG;AACrC,iBAAW,SAAS,IAAI,gBAAgB;AACtC,YAAI,CAAC,MAAM,QAAQ,MAAM,uBAAuB,EAAG;AACnD,mBAAW,aAAa,MAAM,yBAAyB;AACrD,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAGO,SAAS,wBAAkC;AAChD,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,kBAAkB,IAAI,CAAC;AACxD;AAGO,SAAS,4BAAqC;AACnD,SAAO,YAAY,MAAM;AAC3B;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/security/featurePolicy.js

@@ -0,0 +1,62 @@
+import { hasAllFeatures as matchesAllFeatures } from "./features.js";
+import {
+  filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
+  getEnabledModuleIds,
+  getOwningModuleId,
+  hasEnabledModulesRegistry
+} from "./enabledModulesRegistry.js";
+import { composeAclFeatureOverrides } from "../modules/overrides.js";
+function getRemovedAclFeatureIds() {
+  return Object.entries(composeAclFeatureOverrides()).filter(([, override]) => override === null).map(([featureId]) => featureId);
+}
+function isAclFeatureRemoved(featureId) {
+  return composeAclFeatureOverrides()[featureId] === null;
+}
+function isFeatureEnabled(featureId) {
+  if (!hasEnabledModulesRegistry()) return true;
+  const enabledModuleIds = getEnabledModuleIds();
+  return enabledModuleIds.includes(getOwningModuleId(featureId));
+}
+function authorizeFeatures(required, subject) {
+  if (required.length === 0) return true;
+  if (subject.scopeAllowed === false) return false;
+  if (required.some((featureId) => isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId))) {
+    return false;
+  }
+  if (subject.unrestricted === true) return true;
+  return matchesAllFeatures(
+    filterGrantsByEnabledModules(subject.grantedFeatures),
+    required
+  );
+}
+function resolveEffectiveFeatures(grantedFeatures) {
+  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures).filter((featureId) => !isAclFeatureRemoved(featureId));
+  if (!hasEnabledModulesRegistry()) {
+    return filteredGrants.filter((featureId, index, features) => featureId !== "*" && !featureId.endsWith(".*") && features.indexOf(featureId) === index);
+  }
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addFeature = (featureId) => {
+    if (seen.has(featureId) || isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)) {
+      return;
+    }
+    seen.add(featureId);
+    result.push(featureId);
+  };
+  for (const featureId of getConcreteFeatureIds()) {
+    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId);
+  }
+  for (const featureId of filteredGrants) {
+    if (featureId === "*" || featureId.endsWith(".*")) continue;
+    addFeature(featureId);
+  }
+  return result;
+}
+export {
+  authorizeFeatures,
+  getRemovedAclFeatureIds,
+  isAclFeatureRemoved,
+  resolveEffectiveFeatures
+};
+//# sourceMappingURL=featurePolicy.js.map

package/dist/security/featurePolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/featurePolicy.ts"],
+  "sourcesContent": ["import { hasAllFeatures as matchesAllFeatures } from './features'\nimport {\n  filterGrantsByEnabledModules,\n  getConcreteFeatureIds,\n  getEnabledModuleIds,\n  getOwningModuleId,\n  hasEnabledModulesRegistry,\n} from './enabledModulesRegistry'\nimport { composeAclFeatureOverrides } from '../modules/overrides'\n\nexport type FeaturePolicySubject = {\n  grantedFeatures: readonly string[]\n  unrestricted?: boolean\n  scopeAllowed?: boolean\n}\n\nexport function getRemovedAclFeatureIds(): string[] {\n  return Object.entries(composeAclFeatureOverrides())\n    .filter(([, override]) => override === null)\n    .map(([featureId]) => featureId)\n}\n\nexport function isAclFeatureRemoved(featureId: string): boolean {\n  return composeAclFeatureOverrides()[featureId] === null\n}\n\nfunction isFeatureEnabled(featureId: string): boolean {\n  if (!hasEnabledModulesRegistry()) return true\n  const enabledModuleIds = getEnabledModuleIds()\n  return enabledModuleIds.includes(getOwningModuleId(featureId))\n}\n\nexport function authorizeFeatures(\n  required: readonly string[],\n  subject: FeaturePolicySubject,\n): boolean {\n  if (required.length === 0) return true\n  if (subject.scopeAllowed === false) return false\n  if (required.some((featureId) => (\n    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)\n  ))) {\n    return false\n  }\n  if (subject.unrestricted === true) return true\n  return matchesAllFeatures(\n    filterGrantsByEnabledModules(subject.grantedFeatures),\n    required,\n  )\n}\n\nexport function resolveEffectiveFeatures(\n  grantedFeatures: readonly string[],\n): string[] {\n  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)\n    .filter((featureId) => !isAclFeatureRemoved(featureId))\n\n  if (!hasEnabledModulesRegistry()) {\n    return filteredGrants.filter((featureId, index, features) => (\n      featureId !== '*'\n      && !featureId.endsWith('.*')\n      && features.indexOf(featureId) === index\n    ))\n  }\n\n  const result: string[] = []\n  const seen = new Set<string>()\n  const addFeature = (featureId: string) => {\n    if (\n      seen.has(featureId)\n      || isAclFeatureRemoved(featureId)\n      || !isFeatureEnabled(featureId)\n    ) {\n      return\n    }\n    seen.add(featureId)\n    result.push(featureId)\n  }\n\n  for (const featureId of getConcreteFeatureIds()) {\n    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)\n  }\n\n  for (const featureId of filteredGrants) {\n    if (featureId === '*' || featureId.endsWith('.*')) continue\n    addFeature(featureId)\n  }\n\n  return result\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB,0BAA0B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAQpC,SAAS,0BAAoC;AAClD,SAAO,OAAO,QAAQ,2BAA2B,CAAC,EAC/C,OAAO,CAAC,CAAC,EAAE,QAAQ,MAAM,aAAa,IAAI,EAC1C,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACnC;AAEO,SAAS,oBAAoB,WAA4B;AAC9D,SAAO,2BAA2B,EAAE,SAAS,MAAM;AACrD;AAEA,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,0BAA0B,EAAG,QAAO;AACzC,QAAM,mBAAmB,oBAAoB;AAC7C,SAAO,iBAAiB,SAAS,kBAAkB,SAAS,CAAC;AAC/D;AAEO,SAAS,kBACd,UACA,SACS;AACT,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI,QAAQ,iBAAiB,MAAO,QAAO;AAC3C,MAAI,SAAS,KAAK,CAAC,cACjB,oBAAoB,SAAS,KAAK,CAAC,iBAAiB,SAAS,CAC9D,GAAG;AACF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,6BAA6B,QAAQ,eAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,yBACd,iBACU;AACV,QAAM,iBAAiB,6BAA6B,eAAe,EAChE,OAAO,CAAC,cAAc,CAAC,oBAAoB,SAAS,CAAC;AAExD,MAAI,CAAC,0BAA0B,GAAG;AAChC,WAAO,eAAe,OAAO,CAAC,WAAW,OAAO,aAC9C,cAAc,OACX,CAAC,UAAU,SAAS,IAAI,KACxB,SAAS,QAAQ,SAAS,MAAM,KACpC;AAAA,EACH;AAEA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,aAAa,CAAC,cAAsB;AACxC,QACE,KAAK,IAAI,SAAS,KACf,oBAAoB,SAAS,KAC7B,CAAC,iBAAiB,SAAS,GAC9B;AACA;AAAA,IACF;AACA,SAAK,IAAI,SAAS;AAClB,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,aAAW,aAAa,sBAAsB,GAAG;AAC/C,QAAI,mBAAmB,gBAAgB,CAAC,SAAS,CAAC,EAAG,YAAW,SAAS;AAAA,EAC3E;AAEA,aAAW,aAAa,gBAAgB;AACtC,QAAI,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACnD,eAAW,SAAS;AAAA,EACtB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6775.1.c2313bb8a3",
+  "version": "0.6.7-develop.6785.1.1dd7cfac55",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,6 +48,10 @@
       "types": "./src/lib/events/patterns.ts",
       "default": "./dist/lib/events/patterns.js"
     },
+    "./lib/data/consistency": {
+      "types": "./src/lib/data/consistency.ts",
+      "default": "./dist/lib/data/consistency.js"
+    },
     "./lib/logger": {
       "types": "./src/lib/logger/index.ts",
       "default": "./dist/lib/logger/index.js"
@@ -101,7 +105,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6775.1.c2313bb8a3",
+    "@open-mercato/cache": "0.6.7-develop.6785.1.1dd7cfac55",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/ai/__tests__/llm-provider-contract.test.ts

@@ -0,0 +1,59 @@
+import type { EnvLookup, LlmProvider, LlmCreateModelOptions } from '../llm-provider'
+
+function makeBaseProvider(overrides: Partial<LlmProvider> = {}): LlmProvider {
+  const id = overrides.id ?? 'contract-provider'
+  const envKeys = overrides.envKeys ?? [`${id.toUpperCase()}_API_KEY`]
+  const base: LlmProvider = {
+    id,
+    name: `Contract Provider ${id}`,
+    envKeys,
+    defaultModel: 'contract-model',
+    defaultModels: [{ id: 'contract-model', name: 'Contract Model', contextWindow: 8192 }],
+    isConfigured(env?: EnvLookup): boolean {
+      const lookup = env ?? process.env
+      return envKeys.some((key) => {
+        const value = lookup[key]
+        return typeof value === 'string' && value.trim().length > 0
+      })
+    },
+    resolveApiKey(): string | null {
+      return null
+    },
+    getConfiguredEnvKey(): string {
+      return envKeys[0]
+    },
+    createModel(options: LlmCreateModelOptions) {
+      return { __kind: 'contract-model', modelId: options.modelId }
+    },
+  }
+  return { ...base, ...overrides }
+}
+
+describe('LlmProvider contract — moderation/safety-identifier additive members', () => {
+  it('treats mapEndUserIdentifier and supportsInputModeration as optional (legacy adapters)', () => {
+    const provider = makeBaseProvider()
+    expect(provider.mapEndUserIdentifier).toBeUndefined()
+    expect(provider.supportsInputModeration).toBeUndefined()
+  })
+
+  it('accepts an optional endUserIdentifier on createModel options without changing behavior', () => {
+    const provider = makeBaseProvider()
+    const withIdentifier: LlmCreateModelOptions = {
+      modelId: 'contract-model',
+      apiKey: 'sk-test',
+      endUserIdentifier: 'hashed-identifier',
+    }
+    expect(provider.createModel(withIdentifier)).toEqual({ __kind: 'contract-model', modelId: 'contract-model' })
+  })
+
+  it('exposes a providerOptions fragment when mapEndUserIdentifier is implemented', () => {
+    const provider = makeBaseProvider({
+      mapEndUserIdentifier(identifier: string) {
+        return { contract: { user_id: identifier } }
+      },
+      supportsInputModeration: true,
+    })
+    expect(provider.supportsInputModeration).toBe(true)
+    expect(provider.mapEndUserIdentifier?.('abc123')).toEqual({ contract: { user_id: 'abc123' } })
+  })
+})

package/src/lib/ai/__tests__/safety-identifier.test.ts

@@ -0,0 +1,71 @@
+import { computeEndUserIdentifier, deriveAiSafetyIdentifierSecret } from '../safety-identifier'
+
+const BASE_SECRET = 'unit-test-base-secret'
+const HEX_64 = /^[0-9a-f]{64}$/
+
+describe('safety-identifier', () => {
+  describe('deriveAiSafetyIdentifierSecret', () => {
+    it('is deterministic and memoized for a given base secret', () => {
+      const first = deriveAiSafetyIdentifierSecret(BASE_SECRET)
+      const second = deriveAiSafetyIdentifierSecret(BASE_SECRET)
+      expect(first).toBe(second)
+      expect(first).toMatch(HEX_64)
+    })
+
+    it('produces a different key for a different base secret', () => {
+      expect(deriveAiSafetyIdentifierSecret(BASE_SECRET)).not.toBe(
+        deriveAiSafetyIdentifierSecret('other-base-secret'),
+      )
+    })
+
+    it('throws when no base secret is available', () => {
+      const previous = process.env.JWT_SECRET
+      delete process.env.JWT_SECRET
+      try {
+        expect(() => deriveAiSafetyIdentifierSecret()).toThrow(/JWT_SECRET/)
+      } finally {
+        if (previous !== undefined) process.env.JWT_SECRET = previous
+      }
+    })
+  })
+
+  describe('computeEndUserIdentifier', () => {
+    it('is stable for the same (tenant, user) pair', () => {
+      const a = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const b = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      expect(a).toBe(b)
+      expect(a).toMatch(HEX_64)
+    })
+
+    it('separates the same user across tenants (tenant-salted)', () => {
+      const t1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const t2 = computeEndUserIdentifier('tenant-2', 'user-1', { baseSecret: BASE_SECRET })
+      expect(t1).not.toBe(t2)
+    })
+
+    it('separates different users within the same tenant', () => {
+      const u1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const u2 = computeEndUserIdentifier('tenant-1', 'user-2', { baseSecret: BASE_SECRET })
+      expect(u1).not.toBe(u2)
+    })
+
+    it('never leaks the raw tenant or user id', () => {
+      const id = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      expect(id).not.toContain('tenant-1')
+      expect(id).not.toContain('user-1')
+    })
+
+    it('treats a null tenant as an empty salt without throwing', () => {
+      const withNull = computeEndUserIdentifier(null, 'user-1', { baseSecret: BASE_SECRET })
+      const withEmpty = computeEndUserIdentifier('', 'user-1', { baseSecret: BASE_SECRET })
+      expect(withNull).toMatch(HEX_64)
+      expect(withNull).toBe(withEmpty)
+    })
+
+    it('throws when userId is empty', () => {
+      expect(() => computeEndUserIdentifier('tenant-1', '   ', { baseSecret: BASE_SECRET })).toThrow(
+        /userId/,
+      )
+    })
+  })
+})

package/src/lib/ai/llm-provider.ts

@@ -62,6 +62,16 @@ export interface LlmCreateModelOptions {
    * proxy); Google honors it when the SDK supports it (@ai-sdk/google ≥3.0).
    */
   baseURL?: string
+  /**
+   * Optional opaque, non-reversible end-user identifier attached to the model
+   * call so provider-side abuse enforcement can target a single end user
+   * instead of the whole API-key organization. The runtime computes this as a
+   * tenant-salted HMAC (no PII leaves the platform); the adapter decides how to
+   * map it into per-call `providerOptions` via
+   * {@link LlmProvider.mapEndUserIdentifier}. Adapters without a mapping ignore
+   * it. Always optional — absent identifiers reproduce today's behavior.
+   */
+  endUserIdentifier?: string
 }
 
 /**
@@ -146,4 +156,27 @@ export interface LlmProvider {
    * behavior at `packages/ai-assistant/src/modules/ai_assistant/api/route/route.ts`.
    */
   createModel(options: LlmCreateModelOptions): unknown
+
+  /**
+   * Optional. Maps a runtime-computed end-user identifier (see
+   * {@link LlmCreateModelOptions.endUserIdentifier}) into the AI SDK
+   * `providerOptions` fragment this provider understands — e.g. OpenAI returns
+   * `{ openai: { safetyIdentifier } }`, Anthropic returns
+   * `{ anthropic: { metadata: { userId } } }`. Keys MUST be the AI SDK
+   * provider-option names (camelCase); the SDK translates them to the
+   * provider's request-body fields and strips unknown keys. The runtime merges
+   * the returned fragment into the per-call `providerOptions`. Adapters that
+   * omit this method send no identifier (today's behavior). Implementations
+   * MUST be pure and stateless.
+   */
+  mapEndUserIdentifier?(identifier: string): Record<string, unknown>
+
+  /**
+   * Optional. When `true`, the runtime may run input pre-moderation through
+   * this provider's moderation endpoint before the model call. Only providers
+   * that actually expose a moderation API (initially the OpenAI adapter) set
+   * this. Absent/`false` means the moderation gate is skipped for this provider
+   * and the surface relies on the provider's own server-side filtering.
+   */
+  readonly supportsInputModeration?: boolean
 }

package/src/lib/ai/safety-identifier.ts

@@ -0,0 +1,73 @@
+/**
+ * End-user safety identifiers for AI provider calls.
+ *
+ * Providers such as OpenAI let developers attach an opaque per-end-user
+ * identifier to each request so abuse enforcement can target one user instead
+ * of suspending the whole API-key organization. We never send a reversible id:
+ * the value is a tenant-salted HMAC computed from the platform's existing auth
+ * secret, so no PII or internal id leaves the platform and the same end user in
+ * two tenants produces two unrelated hashes.
+ *
+ * The per-process secret derivation mirrors `deriveJwtAudienceSecret`
+ * (`@open-mercato/shared/lib/auth/jwt`): one HMAC from the base `JWT_SECRET`
+ * under a versioned purpose label, memoized for the process lifetime. No new
+ * secret to provision.
+ *
+ * @see .ai/specs/2026-06-04-ai-input-moderation-and-safety-identifiers.md
+ */
+
+import crypto from 'node:crypto'
+
+const SAFETY_IDENTIFIER_SECRET_LABEL = 'open-mercato:ai-safety-identifier:v1'
+
+const derivedSecretCache = new Map<string, string>()
+
+function readBaseSecret(explicit?: string): string {
+  const secret = explicit ?? process.env.JWT_SECRET
+  if (!secret) {
+    throw new Error('[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret')
+  }
+  return secret
+}
+
+/**
+ * Derive the per-process safety-identifier HMAC key from the base auth secret.
+ *
+ * Deterministic HMAC-SHA256 of a versioned purpose label keyed by the base
+ * secret, memoized per base secret. Rotating the base secret rotates every
+ * derived identifier — documented as accepted (identifiers are advisory
+ * provider-side metadata, not an in-platform security control).
+ */
+export function deriveAiSafetyIdentifierSecret(baseSecret?: string): string {
+  const base = readBaseSecret(baseSecret)
+  const cached = derivedSecretCache.get(base)
+  if (cached !== undefined) return cached
+  const derived = crypto
+    .createHmac('sha256', base)
+    .update(SAFETY_IDENTIFIER_SECRET_LABEL)
+    .digest('hex')
+  derivedSecretCache.set(base, derived)
+  return derived
+}
+
+/**
+ * Compute the opaque end-user safety identifier for a (tenant, user) pair.
+ *
+ * Returns a 64-char lowercase hex HMAC-SHA256 of `${tenantId}:${userId}` keyed
+ * by the derived secret. Throws (with an `[internal]` message) when the base
+ * secret is missing or `userId` is empty — callers in the runtime wrap this in
+ * a best-effort try/catch so identifier-derivation failures never break chat.
+ */
+export function computeEndUserIdentifier(
+  tenantId: string | null | undefined,
+  userId: string,
+  options?: { baseSecret?: string },
+): string {
+  const normalizedUser = (userId ?? '').trim()
+  if (!normalizedUser) {
+    throw new Error('[internal] computeEndUserIdentifier requires a non-empty userId')
+  }
+  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret)
+  const salt = (tenantId ?? '').trim()
+  return crypto.createHmac('sha256', key).update(`${salt}:${normalizedUser}`).digest('hex')
+}

package/src/lib/commands/__tests__/command-interceptor-runner.test.ts

@@ -7,6 +7,10 @@ import {
 } from '../command-interceptor-runner'
 import type { CommandInterceptor, CommandInterceptorContext, CommandInterceptorUndoContext } from '../command-interceptor'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '@open-mercato/shared/modules/overrides'
 
 jest.mock('@open-mercato/shared/lib/logger', () => {
   const mocked = {
@@ -59,6 +63,10 @@ describe('matchesCommandPattern', () => {
 })
 
 describe('runCommandInterceptorsBefore', () => {
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+  })
+
   it('returns ok when no interceptors match', async () => {
     const interceptor = makeInterceptor({
       id: 'i1',
@@ -158,6 +166,26 @@ describe('runCommandInterceptorsBefore', () => {
     expect(withWildcard.ok).toBe(false)
     expect(withWildcard.error?.message).toBe('Blocked by wildcard')
   })
+
+  it('does not run an interceptor gated by a nulled ACL feature', async () => {
+    applyAclFeatureOverrides({ 'premium.audit': null })
+    const interceptor = makeInterceptor({
+      id: 'i1',
+      features: ['premium.audit'],
+      beforeExecute: jest.fn().mockResolvedValue({ ok: false }),
+    })
+
+    const result = await runCommandInterceptorsBefore(
+      [interceptor],
+      'customers.create-person',
+      {},
+      baseContext,
+      ['*', 'premium.audit'],
+    )
+
+    expect(result.ok).toBe(true)
+    expect(interceptor.beforeExecute).not.toHaveBeenCalled()
+  })
 })
 
 describe('runCommandInterceptorsAfter', () => {

package/src/lib/commands/command-bus.ts

@@ -31,6 +31,7 @@ import {
 } from './command-interceptor-runner'
 import type { CommandInterceptorContext } from './command-interceptor'
 import { CommandInterceptorError } from './errors'
+import { isReadProjectionAlwaysConsistent } from '@open-mercato/shared/lib/data/consistency'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'commands' })
@@ -697,7 +698,10 @@ export class CommandBus {
     try {
       const dataEngine = (container.resolve('dataEngine') as DataEngine)
       await dataEngine.flushOrmEntityChanges(suppress)
-    } catch {
+    } catch (error) {
+      if (isReadProjectionAlwaysConsistent()) {
+        throw error
+      }
       // best-effort: failures should not block command execution
     }
   }

package/src/lib/commands/command-interceptor-runner.ts

@@ -3,7 +3,7 @@ import type {
   CommandInterceptorContext,
   CommandInterceptorUndoContext,
 } from './command-interceptor'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { createLogger } from '../logger'
 
 const logger = createLogger('shared').child({ component: 'commands' })
@@ -33,7 +33,7 @@ function collectMatching(
 ): CommandInterceptor[] {
   return interceptors
     .filter((i) => matchesCommandPattern(i.targetCommand, commandId))
-    .filter((i) => hasAllFeatures(userFeatures, i.features))
+    .filter((i) => authorizeFeatures(i.features ?? [], { grantedFeatures: userFeatures }))
     .sort((a, b) => (a.priority ?? 50) - (b.priority ?? 50))
 }
 

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -545,6 +545,7 @@ describe('CRUD Factory', () => {
     const data = await res.json()
     expect(data.id).toBeDefined()
     // CF saved
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
     expect(setRecordCustomFields).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ entityId: 'example.todo', values: { priority: 3 } }))
     // Event + indexer delegated to data engine
     expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
@@ -571,6 +572,7 @@ describe('CRUD Factory', () => {
     await em.persist(created).flush()
     const res = await route.PUT(new Request('http://x/api/example/todos', { method: 'PUT', body: JSON.stringify({ id: created.id, title: 'X2', cf_priority: 5 }), headers: { 'content-type': 'application/json' } }))
     expect(res.status).toBe(200)
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
     expect(setRecordCustomFields).toHaveBeenCalledWith(expect.anything(), expect.objectContaining({ values: { priority: 5 } }))
     expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
     const updatedCall = mockDataEngine.emitOrmEntityEvent.mock.calls.at(0)
@@ -592,6 +594,22 @@ describe('CRUD Factory', () => {
     expect(mockDataEngine.emitOrmEntityEvent).not.toHaveBeenCalled()
   })
 
+  it('POST surfaces CRUD side-effect failures after custom field writes', async () => {
+    mockDataEngine.emitOrmEntityEvent.mockImplementationOnce(async () => {
+      throw new Error('index write failed')
+    })
+
+    const res = await route.POST(new Request('http://x/api/example/todos', {
+      method: 'POST',
+      body: JSON.stringify({ title: 'Indexed', is_done: true, cf_priority: 3 }),
+      headers: { 'content-type': 'application/json' },
+    }))
+
+    expect(res.status).toBe(500)
+    expect(mockDataEngine.setCustomFields).toHaveBeenCalledWith(expect.objectContaining({ notify: false }))
+    expect(mockDataEngine.emitOrmEntityEvent).toHaveBeenCalledTimes(1)
+  })
+
   it('PUT rolls back the entity update when the custom field write fails', async () => {
     const created = em.create(Todo, { title: 'Before', organizationId: defaultOrganizationId, tenantId: defaultTenantId }) as Rec
     created.id = '123e4567-e89b-12d3-a456-426614174003'