@open-mercato/shared 0.8.1-develop.7454.1.010095490f → 0.8.1-develop.7455.1.8f7e53badb

package/src/lib/commands/command-bus.ts

@@ -297,6 +297,8 @@ export class CommandBus {
         auth: baseOptions.ctx.auth ?? null,
         selectedOrganizationId: baseOptions.ctx.selectedOrganizationId ?? baseOptions.ctx.auth?.orgId ?? null,
         container: baseOptions.ctx.container,
+        organizationScope: baseOptions.ctx.organizationScope ?? null,
+        request: baseOptions.ctx.request ?? null,
       }
       const beforeResult = await runCommandInterceptorsBefore(
         allInterceptors, commandId, baseOptions.input, interceptorCtx, resolvedUserFeatures,
@@ -338,16 +340,40 @@ export class CommandBus {
     }
 
     const executeCore = async (coreOptions: CommandExecutionOptions<TInput>) => {
-      const sourceLog = coreOptions.redoLogEntry ?? null
-      const snapshots = await this.prepareSnapshots(handler, coreOptions)
+      const snapshots: { before?: unknown } = {}
+      let executionOptions = coreOptions
+      if (handler.prepareSnapshotInsideTransaction && handler.prepare) {
+        const prepare = handler.prepare
+        const originalCtx = coreOptions.ctx
+        const originalBeforeTransactionalWrite = originalCtx.beforeTransactionalWrite
+        let prepared = false
+        let transactionalCtx: CommandRuntimeContext
+        transactionalCtx = {
+          ...originalCtx,
+          beforeTransactionalWrite: async (em, input) => {
+            await originalBeforeTransactionalWrite?.(em, input)
+            if (prepared) return
+            Object.assign(
+              snapshots,
+              (await prepare(coreOptions.input, { ...transactionalCtx, transactionalEm: em })) ?? {},
+            )
+            prepared = true
+          },
+        }
+        executionOptions = { ...coreOptions, ctx: transactionalCtx }
+      } else {
+        Object.assign(snapshots, await this.prepareSnapshots(handler, coreOptions))
+      }
+      effectiveOptions = executionOptions
+      const sourceLog = executionOptions.redoLogEntry ?? null
       const result =
         sourceLog && typeof handler.redo === 'function'
-          ? await handler.redo({ input: coreOptions.input, ctx: coreOptions.ctx, logEntry: sourceLog })
-          : await handler.execute(coreOptions.input, coreOptions.ctx)
-      const afterSnapshot = await this.captureAfter(handler, coreOptions, result)
+          ? await handler.redo({ input: executionOptions.input, ctx: executionOptions.ctx, logEntry: sourceLog })
+          : await handler.execute(executionOptions.input, executionOptions.ctx)
+      const afterSnapshot = await this.captureAfter(handler, executionOptions, result)
       const snapshotsWithAfter = { ...snapshots, after: afterSnapshot }
-      const logMeta = await this.buildLog(handler, coreOptions, result, snapshotsWithAfter)
-      let mergedMeta = this.mergeMetadata(coreOptions.metadata, logMeta)
+      const logMeta = await this.buildLog(handler, executionOptions, result, snapshotsWithAfter)
+      let mergedMeta = this.mergeMetadata(executionOptions.metadata, logMeta)
       // Interceptors opt into audit-log enrichment with a reserved `logContext` key rather
       // than the generic `context` one, so the metadata an interceptor already passes to its
       // own afterExecute hook is never silently promoted into audit storage.
@@ -362,7 +388,7 @@ export class CommandBus {
           ...logContextRecord,
         }
       }
-      const baseContext = asRecord(coreOptions.metadata?.context) ?? {}
+      const baseContext = asRecord(executionOptions.metadata?.context) ?? {}
       const logMetaContext = asRecord(logMeta?.context) ?? {}
       if (Object.keys(interceptorContextMerged).length > 0 || Object.keys(baseContext).length > 0 || Object.keys(logMetaContext).length > 0) {
         mergedMeta = mergedMeta ?? {}
@@ -376,7 +402,7 @@ export class CommandBus {
       if (undoable && mergedMeta?.replayable !== false) {
         mergedMeta = mergedMeta ?? {}
         if (!mergedMeta.undoToken) mergedMeta.undoToken = defaultUndoToken()
-        if (mergedMeta.actorUserId === undefined) mergedMeta.actorUserId = coreOptions.ctx.auth?.sub ?? null
+        if (mergedMeta.actorUserId === undefined) mergedMeta.actorUserId = executionOptions.ctx.auth?.sub ?? null
       } else if (mergedMeta?.replayable === false) {
         mergedMeta.undoToken = null
       }
@@ -405,7 +431,7 @@ export class CommandBus {
           if (inferred) mergedMeta.changes = inferred
         }
       }
-      const logEntry = await this.persistLog(commandId, coreOptions, mergedMeta)
+      const logEntry = await this.persistLog(commandId, executionOptions, mergedMeta)
       return { result, mergedMeta, logEntry }
     }
 
@@ -474,6 +500,8 @@ export class CommandBus {
           auth: effectiveOptions.ctx.auth ?? null,
           selectedOrganizationId: effectiveOptions.ctx.selectedOrganizationId ?? effectiveOptions.ctx.auth?.orgId ?? null,
           container: effectiveOptions.ctx.container,
+          organizationScope: effectiveOptions.ctx.organizationScope ?? null,
+          request: effectiveOptions.ctx.request ?? null,
         }
         const afterResult = await runCommandInterceptorsAfter(
           allInterceptors, commandId, effectiveOptions.input, result, interceptorCtx,
@@ -545,6 +573,8 @@ export class CommandBus {
         auth: replayCtx.auth ?? null,
         selectedOrganizationId: replayCtx.selectedOrganizationId ?? replayCtx.auth?.orgId ?? null,
         container: replayCtx.container,
+        organizationScope: replayCtx.organizationScope ?? null,
+        request: replayCtx.request ?? null,
       }
       const beforeResult = await runCommandInterceptorsBeforeUndo(
         allInterceptors, log.commandId, undoCtx, interceptorCtx, resolvedUserFeatures,
@@ -659,6 +689,8 @@ export class CommandBus {
           auth: ctx.auth ?? null,
           selectedOrganizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
           container: ctx.container,
+          organizationScope: ctx.organizationScope ?? null,
+          request: ctx.request ?? null,
         }
         await runCommandInterceptorsAfterUndo(
           allInterceptors, log.commandId, undoCtx, interceptorCtx,

package/src/lib/commands/command-interceptor.ts

@@ -1,4 +1,5 @@
 import type { AwilixContainer } from 'awilix'
+import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 
 export interface CommandInterceptor {
@@ -47,8 +48,11 @@ export interface CommandInterceptorContext {
   auth: AuthContext | null
   /** Selected organization ID */
   selectedOrganizationId: string | null
+  organizationScope?: OrganizationScope | null
   /** DI container (read-only usage recommended) */
   container: AwilixContainer
+  /** Original request, when the command was called through HTTP. */
+  request?: Request | null
   /** Metadata passthrough from beforeExecute to afterExecute (or beforeUndo to afterUndo) */
   metadata?: Record<string, unknown>
 }

package/src/lib/commands/types.ts

@@ -67,6 +67,14 @@ export type CommandRuntimeContext = {
    * surrounding work as a single atomic, single-locked operation.
    */
   transactionalEm?: EntityManager
+  /**
+   * Optional server-side guard that supported command handlers invoke after
+   * opening their write transaction and before reading or mutating records.
+   * The guard receives that same transaction-bound EntityManager and, when the
+   * handler provides it, the final input after command interceptors. The input
+   * stays optional so existing handlers and callers remain source-compatible.
+   */
+  beforeTransactionalWrite?: (em: EntityManager, input?: unknown) => Promise<void>
   /**
    * Identifies the owner of an already-active {@link transactionalEm} lifetime.
    * Atomic replay accepts an ambient EntityManager only when this is the exact
@@ -243,6 +251,12 @@ export interface CommandHandler<TInput = unknown, TResult = unknown> {
    */
   readonly outputSchema?: ZodTypeAny
   prepare?(input: TInput, ctx: CommandRuntimeContext): Promise<{ before?: unknown } | null> | { before?: unknown } | null
+  /**
+   * Opt in to taking the undo snapshot inside the write transaction. The bus
+   * defers `prepare()` into `ctx.beforeTransactionalWrite`, after the handler's
+   * transaction guard and before its first read or mutation.
+   */
+  readonly prepareSnapshotInsideTransaction?: boolean
   execute(input: TInput, ctx: CommandRuntimeContext): Promise<TResult> | TResult
   buildLog?(args: CommandLogBuilderArgs<TInput, TResult>): Promise<CommandLogMetadata | null | undefined> | CommandLogMetadata | null | undefined
   captureAfter?(input: TInput, result: TResult, ctx: CommandRuntimeContext): Promise<unknown> | unknown

package/src/lib/encryption/__tests__/tenantDataEncryptionService.test.ts

@@ -883,3 +883,26 @@ describe('TenantDataEncryptionService map read failures (issue #6334)', () => {
     expect(execute).toHaveBeenCalledTimes(2)
   })
 })
+
+describe('TenantDataEncryptionService transaction-aware map reads', () => {
+  it('prefers the EntityManager executor over the bare connection', async () => {
+    const entityId = 'test:transaction_aware_map_read'
+    const execute = jest.fn(async () => [{
+      entity_id: entityId,
+      fields_json: [{ field: 'display_name' }],
+    }])
+    const bareExecute = jest.fn(async () => {
+      throw new Error('bare connection must not be used')
+    })
+    const service = new TenantDataEncryptionService({
+      execute,
+      getConnection: () => ({ execute: bareExecute }),
+    } as never)
+    jest.spyOn(service, 'isEnabled').mockReturnValue(true)
+
+    await expect(service.getEncryptedFieldNames(entityId, 'tenant-transaction', 'org-transaction'))
+      .resolves.toEqual(['display_name'])
+    expect(execute).toHaveBeenCalled()
+    expect(bareExecute).not.toHaveBeenCalled()
+  })
+})

package/src/modules/widgets/__tests__/injection-loader.partitioned-registration.test.ts

@@ -0,0 +1,78 @@
+/**
+ * Regression coverage for the partitioned-bootstrap registry contract.
+ *
+ * A Node process can run more than one bootstrap partition: the API-only one
+ * (`skipCoreInjectionWidgets: true`) and the full page one. Two invariants have to hold
+ * together, and skipping registration outright only satisfied the first:
+ *
+ * 1. the partition that registers second must never shrink the registry the first published;
+ * 2. an API-only process must still be able to READ the registry, because module API routes
+ *    resolve widget contributions on the request path.
+ */
+import { describe, it, expect, beforeEach, jest } from '@jest/globals'
+import type { ModuleInjectionWidgetEntry } from '@open-mercato/shared/modules/registry'
+
+const GLOBAL_INJECTION_WIDGETS_KEY = '__openMercatoCoreInjectionWidgetEntries__'
+
+function entry(key: string): ModuleInjectionWidgetEntry {
+  return { moduleId: key.split(':')[0]!, key, source: 'package', widgetId: key, loader: async () => ({}) as never }
+}
+
+type Loader = typeof import('@open-mercato/shared/modules/widgets/injection-loader')
+
+function freshLoader(): Loader {
+  delete (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]
+  let loader!: Loader
+  jest.isolateModules(() => {
+    loader = require('@open-mercato/shared/modules/widgets/injection-loader') as Loader
+  })
+  return loader
+}
+
+describe('core injection widget registration modes', () => {
+  beforeEach(() => {
+    delete (globalThis as Record<string, unknown>)[GLOBAL_INJECTION_WIDGETS_KEY]
+  })
+
+  it('replaces the registry by default', () => {
+    const loader = freshLoader()
+    loader.registerCoreInjectionWidgets([entry('a:one'), entry('b:two')])
+    loader.registerCoreInjectionWidgets([entry('a:one')])
+
+    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one'])
+  })
+
+  it('populates an unregistered registry in merge mode instead of leaving it throwing', () => {
+    const loader = freshLoader()
+    expect(() => loader.getCoreInjectionWidgets()).toThrow(/not registered/)
+
+    loader.registerCoreInjectionWidgets([entry('a:one')], { mode: 'merge' })
+
+    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one'])
+  })
+
+  it('never shrinks a registry a fuller partition already published', () => {
+    const loader = freshLoader()
+    loader.registerCoreInjectionWidgets([entry('a:one'), entry('b:two'), entry('c:three')])
+    loader.registerCoreInjectionWidgets([entry('a:one')], { mode: 'merge' })
+
+    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one', 'b:two', 'c:three'])
+  })
+
+  it('adds only the entries the registry does not already carry', () => {
+    const loader = freshLoader()
+    loader.registerCoreInjectionWidgets([entry('a:one')])
+    loader.registerCoreInjectionWidgets([entry('a:one'), entry('d:four')], { mode: 'merge' })
+
+    expect(loader.getCoreInjectionWidgets().map((it) => it.key)).toEqual(['a:one', 'd:four'])
+  })
+
+  it('leaves an unregistered registry untouched when it has nothing to contribute', () => {
+    const loader = freshLoader()
+    loader.registerCoreInjectionWidgets([], { mode: 'merge' })
+
+    // Publishing an empty array here would turn the loud "not registered" bootstrap error into
+    // silently missing contributions on every request.
+    expect(() => loader.getCoreInjectionWidgets()).toThrow(/not registered/)
+  })
+})

package/src/modules/widgets/injection-loader.ts

@@ -141,11 +141,41 @@ function notifyInjectionRegistryChanged() {
   }))
 }
 
-export function registerCoreInjectionWidgets(entries: ModuleInjectionWidgetEntry[]) {
-  if (_coreInjectionWidgetEntries !== null && process.env.NODE_ENV === 'development') {
+export type RegisterCoreInjectionWidgetsOptions = {
+  /**
+   * `replace` (default) publishes `entries` as the whole registry.
+   *
+   * `merge` adds only the entries the registry does not already carry, keeping whatever a
+   * previous bootstrap published. A process may run more than one bootstrap partition (the
+   * API-only one and the full page one share a Node process in a mixed web host), and the
+   * partition that registers second must not shrink the registry the first one populated.
+   */
+  mode?: 'replace' | 'merge'
+}
+
+export function registerCoreInjectionWidgets(
+  entries: ModuleInjectionWidgetEntry[],
+  options: RegisterCoreInjectionWidgetsOptions = {},
+) {
+  if (_coreInjectionWidgetEntries !== null && process.env.NODE_ENV === 'development' && options.mode !== 'merge') {
     logger.debug('Core injection widgets re-registered (this may occur during HMR)')
   }
-  const finalEntries = applyInjectionWidgetOverridesToEntries(entries)
+  const incoming = applyInjectionWidgetOverridesToEntries(entries)
+  if (options.mode !== 'merge') {
+    _coreInjectionWidgetEntries = incoming
+    writeGlobalInjectionWidgets(incoming)
+    notifyInjectionRegistryChanged()
+    return
+  }
+
+  const existing = readGlobalInjectionWidgets() ?? _coreInjectionWidgetEntries ?? []
+  const known = new Set(existing.map((entry) => entry.key))
+  const added = incoming.filter((entry) => !known.has(entry.key))
+  // Nothing to contribute: leave the registry exactly as it was. Publishing an empty array here
+  // would turn "never registered" into "registered with no widgets", which downgrades the loud
+  // bootstrap error into silently missing contributions.
+  if (!added.length) return
+  const finalEntries = [...existing, ...added]
   _coreInjectionWidgetEntries = finalEntries
   writeGlobalInjectionWidgets(finalEntries)
   notifyInjectionRegistryChanged()