@porulle/core 0.10.8 → 0.11.0

package/src/interfaces/rest/routes/catalog.ts

@@ -19,6 +19,8 @@ import {
   listEntitiesRoute,
   getEntityRoute,
   getEntityAttributesRoute,
+  listFieldOwnershipRoute,
+  setFieldOwnershipRoute,
   listCategoriesRoute,
   listBrandsRoute,
   deleteEntityRoute,
@@ -34,6 +36,8 @@ import {
   createEntityRoute,
   updateEntityRoute,
   setEntityAttributesRoute,
+  approveCustomFieldRoute,
+  rejectCustomFieldRoute,
   createCategoryRoute,
   archiveCategoryRoute,
   restoreCategoryRoute,
@@ -54,11 +58,58 @@ import {
   parseInclude,
   parsePagination,
   parseSort,
+  requirePerm,
 } from "../utils.js";
 
 export function catalogRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
 
+  router.use("/entities/:id/custom-fields/:fieldName/approve", requirePerm("catalog:update"));
+  router.use("/entities/:id/custom-fields/:fieldName/reject", requirePerm("catalog:update"));
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(listFieldOwnershipRoute, async (c) => {
+    const result = await kernel.services.catalog.listFieldOwnership(
+      c.req.param("id"),
+      c.get("actor"),
+      undefined,
+      c.req.query("storeId"),
+    );
+    if (!result.ok) {
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    }
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(setFieldOwnershipRoute, async (c) => {
+    const body = c.req.valid("json") as {
+      fieldPath: string;
+      owner: "platform" | "store" | "shared";
+      storeId?: string | null;
+      variantId?: string | null;
+    };
+    const result = await kernel.services.catalog.setFieldOwner(
+      c.req.param("id"),
+      body.fieldPath,
+      body.storeId ?? null,
+      body.owner,
+      c.get("actor"),
+      undefined,
+      body.variantId ?? null,
+    );
+    if (!result.ok) {
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    }
+    return c.json({ data: { updated: true } });
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(listEntitiesRoute, async (c) => {
     try {
@@ -101,6 +152,7 @@ export function catalogRoutes(kernel: Kernel) {
           includeMedia: include.has("media"),
           includeInventory: include.has("inventory"),
           includePricing: include.has("pricing"),
+          includeCustomFields: include.has("customFields"),
         };
         const hydrated = await Promise.all(
           result.value.items.map(async (item) => {
@@ -143,6 +195,7 @@ export function catalogRoutes(kernel: Kernel) {
         includeMedia: include.has("media"),
         includeInventory: include.has("inventory"),
         includePricing: include.has("pricing"),
+        includeCustomFields: include.has("customFields"),
       };
 
       const actor = c.get("actor");
@@ -268,6 +321,38 @@ export function catalogRoutes(kernel: Kernel) {
     return c.json({ data: { updated: true } });
   });
 
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(approveCustomFieldRoute, async (c) => {
+    const result = await kernel.services.catalog.approveCustomField(
+      c.req.param("id"),
+      c.req.param("fieldName"),
+      c.req.query("locale") ?? "en",
+      c.get("actor"),
+    );
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({ data: result.value });
+  });
+
+  // @ts-expect-error -- openapi handler union return type
+  router.openapi(rejectCustomFieldRoute, async (c) => {
+    const result = await kernel.services.catalog.rejectCustomField(
+      c.req.param("id"),
+      c.req.param("fieldName"),
+      c.req.query("locale") ?? "en",
+      c.get("actor"),
+    );
+    if (!result.ok)
+      return c.json(
+        mapErrorToResponse(result.error),
+        mapErrorToStatus(result.error),
+      );
+    return c.json({ data: result.value });
+  });
+
   // @ts-expect-error -- openapi handler union return type
   router.openapi(getEntityAttributesRoute, async (c) => {
     const result = await kernel.services.catalog.getAttributes(

package/src/interfaces/rest/routes/search.ts

@@ -3,6 +3,8 @@ import type { Kernel } from "../../../runtime/kernel.js";
 import { searchRoute, suggestRoute } from "../schemas/search.js";
 import { type AppEnv, mapErrorToResponse, mapErrorToStatus } from "../utils.js";
 
+const SAFE_ATTRIBUTE_NAME = /^[A-Za-z0-9_-]+$/;
+
 export function searchRoutes(kernel: Kernel) {
   const router = new OpenAPIHono<AppEnv>();
 
@@ -21,6 +23,19 @@ export function searchRoutes(kernel: Kernel) {
         .map((facet) => facet.trim())
         .filter(Boolean);
 
+      const attributes: Record<string, string | string[]> = {};
+      for (const [key, values] of Object.entries(c.req.queries())) {
+        if (!key.startsWith("attr.")) continue;
+        const name = key.slice("attr.".length);
+        if (!SAFE_ATTRIBUTE_NAME.test(name)) {
+          return c.json(
+            { error: "invalid_argument", field: key, message: `Invalid attribute filter name: ${name}` },
+            422,
+          );
+        }
+        attributes[name] = values.length === 1 ? values[0]! : values;
+      }
+
       const result = await kernel.services.search.query({
         query: q,
         page,
@@ -30,6 +45,7 @@ export function searchRoutes(kernel: Kernel) {
           ...(category ? { category } : {}),
           ...(brand ? { brand } : {}),
           ...(status ? { status } : {}),
+          ...(Object.keys(attributes).length > 0 ? { attributes } : {}),
         },
         ...(facets.length > 0 ? { facets } : {}),
       }, { actor: c.get("actor"), tx: null, requestId: "" });

package/src/interfaces/rest/schemas/admin-custom-field-proposals.ts

@@ -0,0 +1,29 @@
+import { createRoute, z } from "@hono/zod-openapi";
+import { errorResponses } from "./shared.js";
+
+const ProposalResponse = z.object({
+  data: z.object({
+    items: z.array(z.any()),
+    total: z.number(),
+    page: z.number(),
+    limit: z.number(),
+  }),
+});
+
+const ListQuery = z.object({
+  entityType: z.string().min(1).optional(),
+  page: z.string().max(10).optional(),
+  limit: z.string().max(10).optional(),
+});
+
+export const listCustomFieldProposalsRoute = createRoute({
+  method: "get",
+  path: "/custom-field-proposals",
+  tags: ["Admin"],
+  summary: "List proposed custom-field values",
+  request: { query: ListQuery },
+  responses: {
+    200: { content: { "application/json": { schema: ProposalResponse } }, description: "Proposed custom fields." },
+    ...errorResponses,
+  },
+});

package/src/interfaces/rest/schemas/admin-entity-field-definitions.ts

@@ -0,0 +1,120 @@
+import { createRoute, z } from "@hono/zod-openapi";
+import { errorResponses } from "./shared.js";
+
+const FieldType = z.enum([
+  "text",
+  "number",
+  "boolean",
+  "date",
+  "json",
+  "relation",
+  "select",
+]);
+
+const CreateBody = z
+  .object({
+    entityType: z.string().min(1),
+    name: z.string().min(1),
+    type: FieldType,
+    unit: z.string().nullable().optional(),
+    options: z.array(z.string()).nullable().optional(),
+    target: z.string().nullable().optional(),
+    filterable: z.boolean().optional(),
+    localized: z.boolean().optional(),
+    sortOrder: z.number().int().optional(),
+  })
+  .openapi("CreateEntityFieldDefinitionRequest");
+
+const UpdateBody = z
+  .object({
+    entityType: z.string().min(1).optional(),
+    name: z.string().min(1).optional(),
+    type: FieldType.optional(),
+    unit: z.string().nullable().optional(),
+    options: z.array(z.string()).nullable().optional(),
+    target: z.string().nullable().optional(),
+    filterable: z.boolean().optional(),
+    localized: z.boolean().optional(),
+    sortOrder: z.number().int().optional(),
+  })
+  .openapi("UpdateEntityFieldDefinitionRequest");
+
+const IdParam = z.object({ id: z.uuid() });
+const ListQuery = z.object({ entityType: z.string().min(1).optional() });
+const DataResponse = z
+  .object({ data: z.any() })
+  .openapi("EntityFieldDefinitionResponse");
+
+export const createEntityFieldDefinitionRoute = createRoute({
+  method: "post",
+  path: "/entity-field-definitions",
+  tags: ["Admin"],
+  summary: "Create a runtime entity field definition",
+  request: {
+    body: {
+      content: { "application/json": { schema: CreateBody } },
+      required: true,
+    },
+  },
+  responses: {
+    201: {
+      content: { "application/json": { schema: DataResponse } },
+      description: "Definition created.",
+    },
+    ...errorResponses,
+  },
+});
+
+export const listEntityFieldDefinitionsRoute = createRoute({
+  method: "get",
+  path: "/entity-field-definitions",
+  tags: ["Admin"],
+  summary: "List runtime entity field definitions",
+  request: { query: ListQuery },
+  responses: {
+    200: {
+      content: { "application/json": { schema: DataResponse } },
+      description: "Definitions.",
+    },
+    ...errorResponses,
+  },
+});
+
+export const updateEntityFieldDefinitionRoute = createRoute({
+  method: "patch",
+  path: "/entity-field-definitions/{id}",
+  tags: ["Admin"],
+  summary: "Update a runtime entity field definition",
+  request: {
+    params: IdParam,
+    body: {
+      content: { "application/json": { schema: UpdateBody } },
+      required: true,
+    },
+  },
+  responses: {
+    200: {
+      content: { "application/json": { schema: DataResponse } },
+      description: "Definition updated.",
+    },
+    ...errorResponses,
+  },
+});
+
+export const archiveEntityFieldDefinitionRoute = createRoute({
+  method: "post",
+  path: "/entity-field-definitions/{id}/archive",
+  tags: ["Admin"],
+  summary: "Archive a runtime entity field definition",
+  request: { params: IdParam },
+  responses: {
+    200: {
+      content: { "application/json": { schema: DataResponse } },
+      description: "Definition archived.",
+    },
+    ...errorResponses,
+  },
+});
+
+export type CreateEntityFieldDefinitionBody = z.infer<typeof CreateBody>;
+export type UpdateEntityFieldDefinitionBody = z.infer<typeof UpdateBody>;

package/src/interfaces/rest/schemas/catalog.ts

@@ -19,6 +19,17 @@ import {
 
 const DataResponse = CatalogEntityResponse;
 const DataWithPaginationResponse = CatalogEntityListResponse;
+const FieldOwnershipSchema = z.object({
+  id: z.string(),
+  organizationId: z.string(),
+  entityId: z.string(),
+  variantId: z.string().nullable(),
+  storeId: z.string().nullable(),
+  fieldPath: z.string(),
+  owner: z.enum(["platform", "store", "shared"]),
+  updatedAt: z.string(),
+}).openapi("CatalogFieldOwnership");
+const FieldOwnershipListResponse = z.object({ data: z.array(FieldOwnershipSchema) }).openapi("CatalogFieldOwnershipListResponse");
 
 // ─── Path Params ────────────────────────────────────────────────────────────
 
@@ -35,6 +46,15 @@ const EntityIdLocaleParam = z.object({
   locale: z.string().min(1).openapi({ example: "en" }),
 });
 
+const EntityCustomFieldParam = z.object({
+  id: z.uuid().openapi({ example: "550e8400-e29b-41d4-a716-446655440000" }),
+  fieldName: z.string().min(1).openapi({ example: "warranty" }),
+});
+
+const CustomFieldReviewQuery = z.object({
+  locale: z.string().min(1).optional().openapi({ example: "en" }),
+});
+
 const CategoryIdParam = z.object({
   categoryId: z.uuid().openapi({ example: "550e8400-e29b-41d4-a716-446655440000" }),
 });
@@ -104,6 +124,48 @@ export const getEntityAttributesRoute = createRoute({
   },
 });
 
+export const listFieldOwnershipRoute = createRoute({
+  method: "get",
+  path: "/entities/{id}/field-ownership",
+  tags: ["Catalog"],
+  summary: "List field ownership for a catalog entity",
+  request: {
+    params: EntityIdParam,
+    query: z.object({ storeId: z.string().optional() }),
+  },
+  responses: {
+    200: { content: { "application/json": { schema: FieldOwnershipListResponse } }, description: "Success" },
+    ...errorResponses,
+  },
+});
+
+export const setFieldOwnershipRoute = createRoute({
+  method: "put",
+  path: "/entities/{id}/field-ownership",
+  tags: ["Catalog"],
+  summary: "Set field ownership for a catalog entity",
+  request: {
+    params: EntityIdParam,
+    body: {
+      content: {
+        "application/json": {
+          schema: z.object({
+            fieldPath: z.string().min(1),
+            owner: z.enum(["platform", "store", "shared"]),
+            storeId: z.string().min(1).nullable().optional(),
+            variantId: z.uuid().nullable().optional(),
+          }),
+        },
+      },
+      required: true,
+    },
+  },
+  responses: {
+    200: { content: { "application/json": { schema: z.object({ data: z.object({ updated: z.literal(true) }) }) } }, description: "Updated" },
+    ...errorResponses,
+  },
+});
+
 export const listCategoriesRoute = createRoute({
   method: "get",
   path: "/categories",
@@ -312,6 +374,36 @@ export const setEntityAttributesRoute = createRoute({
   },
 });
 
+export const approveCustomFieldRoute = createRoute({
+  method: "post",
+  path: "/entities/{id}/custom-fields/{fieldName}/approve",
+  tags: ["Catalog"],
+  summary: "Approve a proposed custom-field value",
+  request: {
+    params: EntityCustomFieldParam,
+    query: CustomFieldReviewQuery,
+  },
+  responses: {
+    200: { content: { "application/json": { schema: DataResponse } }, description: "Approved" },
+    ...errorResponses,
+  },
+});
+
+export const rejectCustomFieldRoute = createRoute({
+  method: "post",
+  path: "/entities/{id}/custom-fields/{fieldName}/reject",
+  tags: ["Catalog"],
+  summary: "Reject a proposed custom-field value",
+  request: {
+    params: EntityCustomFieldParam,
+    query: CustomFieldReviewQuery,
+  },
+  responses: {
+    200: { content: { "application/json": { schema: DataResponse } }, description: "Rejected" },
+    ...errorResponses,
+  },
+});
+
 export const createCategoryRoute = createRoute({
   method: "post",
   path: "/categories",

package/src/interfaces/rest/schemas/search.ts

@@ -8,6 +8,8 @@ export const searchRoute = createRoute({
   path: "/",
   tags: ["Search"],
   summary: "Search catalog entities",
+  description:
+    "Attribute filters use repeatable `attr.<name>=<value>` query parameters: repeated values for one name are ORed, distinct names are ANDed. Attribute names must match `^[A-Za-z0-9_-]+$`; anything else returns 422. Request attribute facet counts by naming the attribute in `facets`.",
   request: {
     query: z.object({
       q: z.string().max(500).optional(),

package/src/modules/catalog/entity-service.ts

@@ -36,6 +36,7 @@ import type {
   CreateOptionTypeInput,
   CreateOptionValueInput,
   CreateVariantInput,
+  EntityFieldDefinitionResolver,
 } from "./service.js";
 import type {
   SellableEntity,
@@ -69,6 +70,7 @@ function getCustomFieldValue(field: SellableCustomField): unknown {
   switch (field.fieldType) {
     case "text":
     case "relation":
+    case "select":
       return field.textValue;
     case "number":
       return field.numberValue;
@@ -83,8 +85,14 @@ function getCustomFieldValue(field: SellableCustomField): unknown {
   }
 }
 
+type CustomFieldData = Omit<SellableCustomFieldInsert, "entityId" | "fieldName" | "locale">;
+type ValidatedCustomField = { fieldName: string; locale: string; data: CustomFieldData | null };
+
 export class EntityService {
-  constructor(private readonly deps: CatalogServiceDeps) {}
+  constructor(
+    private readonly deps: CatalogServiceDeps,
+    private readonly resolveEntityFieldDefinitions: EntityFieldDefinitionResolver,
+  ) {}
 
   private get repo() {
     return this.deps.repository;
@@ -102,22 +110,38 @@ export class EntityService {
     if (entity.sourceStoreId != null) assertPermission(actor, "catalog:sync");
   }
 
-  private async validateAndCreateCustomFields(entityId: string, entityType: string, customFields: Record<string, unknown> | undefined, ctx?: TxContext): Promise<Result<void>> {
-    if (!customFields) return Ok(undefined);
+  private async validateCustomFields(entityType: string, customFields: Record<string, unknown> | undefined, actor: Actor | null, ctx?: TxContext): Promise<Result<ValidatedCustomField[]>> {
+    if (!customFields) return Ok([]);
     const entityConfig = this.deps.config.entities?.[entityType];
-    if (!entityConfig) return Ok(undefined);
-    const definitionMap = new Map(entityConfig.fields.map((f) => [f.name, f]));
+    const definitions = await this.resolveEntityFieldDefinitions(entityType, actor ?? ctx?.actor ?? null, ctx);
+    if (!entityConfig && definitions.length === 0) return Ok([]);
+    const definitionMap = new Map(definitions.map((f) => [f.name, f]));
+    const validated: ValidatedCustomField[] = [];
     for (const [name, value] of Object.entries(customFields)) {
       const def = definitionMap.get(name);
       if (!def) return Err(new CommerceValidationError(`Unknown custom field: ${name}`));
+      if (value === null) {
+        validated.push({ fieldName: name, locale: "en", data: null });
+        continue;
+      }
       const type = def.type;
+      let normalized = value;
       let valid = false;
       switch (type) {
         case "text":
         case "relation":
-        case "select":
           valid = typeof value === "string";
           break;
+        case "select": {
+          if (typeof value !== "string") break;
+          const trimmed = value.trim();
+          if (def.options && !def.options.includes(trimmed)) {
+            return Err(new CommerceValidationError(`Value "${trimmed}" is not permitted for field ${name}. Allowed: ${def.options.join(", ")}`));
+          }
+          normalized = trimmed;
+          valid = true;
+          break;
+        }
         case "number":
           valid = typeof value === "number";
           break;
@@ -134,29 +158,50 @@ export class EntityService {
           valid = false;
       }
       if (!valid) return Err(new CommerceValidationError(`Custom field ${name} expected type ${type}.`));
-      const fieldType = (type === "select" ? "text" : type) as SellableCustomField["fieldType"];
-      const insertData: SellableCustomFieldInsert = { entityId, fieldName: name, fieldType };
+      const fieldType = type as SellableCustomField["fieldType"];
+      const insertData: CustomFieldData = {
+        fieldType,
+        source: "merchant",
+        status: "approved",
+        confidence: null,
+        evidence: null,
+        approvedAt: null,
+        approvedBy: null,
+      };
       switch (fieldType) {
         case "text":
         case "relation":
-          insertData.textValue = value as string;
+        case "select":
+          insertData.textValue = normalized as string;
           break;
         case "number":
-          insertData.numberValue = value as number;
+          insertData.numberValue = normalized as number;
           break;
         case "boolean":
-          insertData.booleanValue = value as boolean;
+          insertData.booleanValue = normalized as boolean;
           break;
         case "date":
-          insertData.dateValue = value instanceof Date ? value : new Date(value as string);
+          insertData.dateValue = normalized instanceof Date ? normalized : new Date(normalized as string);
           break;
         case "json":
-          insertData.jsonValue = value;
+          insertData.jsonValue = normalized;
           break;
       }
-      await this.repo.createCustomField(insertData, ctx);
+      validated.push({ fieldName: name, locale: "en", data: insertData });
+    }
+    return Ok(validated);
+  }
+
+  private async writeCustomFields(entityId: string, customFields: ValidatedCustomField[], ctx?: TxContext, upsert = false): Promise<void> {
+    for (const customField of customFields) {
+      if (customField.data === null) {
+        await this.repo.deleteCustomField(entityId, customField.fieldName, customField.locale, ctx);
+      } else if (upsert) {
+        await this.repo.upsertCustomField(entityId, customField.fieldName, customField.locale, customField.data, ctx);
+      } else {
+        await this.repo.createCustomField({ ...customField.data, entityId, fieldName: customField.fieldName, locale: customField.locale }, ctx);
+      }
     }
-    return Ok(undefined);
   }
 
   private async hydrateEntity(entity: SellableEntity, options?: GetOptions, ctx?: TxContext): Promise<CatalogEntityHydrated> {
@@ -185,14 +230,16 @@ export class EntityService {
     }
     if (options?.includeCategories) hydrated.categories = await this.repo.findEntityCategories(entity.id, ctx);
     if (options?.includeBrands) hydrated.brands = await this.repo.findEntityBrands(entity.id, ctx);
+    if (options?.includeCustomFields) hydrated.customFields = await this.repo.findCustomFieldsByEntityId(entity.id, ctx);
     if (options?.includeMedia) {
       const mediaService = this.deps.services.media as {
         listEntityMedia?: (
           entityId: string,
           opts?: { orgId?: string },
+          ctx?: TxContext,
         ) => Promise<{ ok: boolean; value?: CatalogEntityHydrated["media"] }>;
       } | undefined;
-      const mediaResult = await mediaService?.listEntityMedia?.(entity.id, { orgId: entity.organizationId });
+      const mediaResult = await mediaService?.listEntityMedia?.(entity.id, { orgId: entity.organizationId }, ctx);
       hydrated.media = mediaResult?.ok && mediaResult.value ? mediaResult.value : [];
     }
     if (options?.includePricing) {
@@ -217,12 +264,15 @@ export class EntityService {
     const context: HookContext = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.create"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
     const processedInput = await runBeforeHooks(beforeHooks, input, "create", context);
     if (processedInput.sourceStoreId != null) assertPermission(actor, "catalog:sync");
-    const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status: "draft", isVisible: false, ...(processedInput.sourceStoreId !== undefined ? { sourceStoreId: processedInput.sourceStoreId } : {}), ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
+    const customFieldsResult = await this.validateCustomFields(processedInput.type, processedInput.customFields, actor, ctx);
+    if (!customFieldsResult.ok) return customFieldsResult;
+    const statuses = ["draft", "active", "archived", "discontinued"] as const;
+    const status = statuses.find((value) => value === processedInput.status) ?? "draft";
+    const entity = await this.repo.createEntity({ organizationId: orgId, type: processedInput.type, slug: processedInput.slug, status, isVisible: status === "active", ...(processedInput.sourceStoreId !== undefined ? { sourceStoreId: processedInput.sourceStoreId } : {}), ...(processedInput.taxClass !== undefined ? { taxClass: processedInput.taxClass } : {}), metadata: processedInput.metadata ?? {} }, ctx);
     if (processedInput.attributes) {
       await this.repo.createAttribute({ entityId: entity.id, locale: processedInput.attributes.locale ?? "en", title: processedInput.attributes.title, subtitle: processedInput.attributes.subtitle, description: processedInput.attributes.description, richDescription: processedInput.attributes.richDescription, seoTitle: processedInput.attributes.seoTitle, seoDescription: processedInput.attributes.seoDescription }, ctx);
     }
-    const customFieldsResult = await this.validateAndCreateCustomFields(entity.id, entity.type, processedInput.customFields, ctx);
-    if (!customFieldsResult.ok) return customFieldsResult;
+    await this.writeCustomFields(entity.id, customFieldsResult.value, ctx);
     const hookReport = await runAfterHooks(afterHooks, null, entity, "create", context);
     const hydrated = await this.hydrateEntity(entity, undefined, ctx);
     return Ok(hydrated, hookReport.hasErrors ? { hookErrors: hookReport.errors } : undefined);
@@ -238,8 +288,11 @@ export class EntityService {
     const afterHooks = this.deps.hooks.resolve("catalog.afterUpdate") as CatalogUpdateAfterHook[];
     const context: HookContext = createHookContext({ actor, tx: ctx?.tx ?? null, logger: createLogger("catalog.update"), services: this.deps.services, context: { moduleName: "catalog" }, ...hookDatabaseArg(this.deps.database) });
     const processed = await runBeforeHooks(beforeHooks, input, "update", context);
+    const customFieldsResult = await this.validateCustomFields(existing.type, processed.customFields, actor, ctx);
+    if (!customFieldsResult.ok) return customFieldsResult;
     const updated = await this.repo.updateEntity(id, { ...(processed.slug !== undefined ? { slug: processed.slug } : {}), ...(processed.status !== undefined ? { status: processed.status as SellableEntity["status"] } : {}), ...(processed.taxClass !== undefined ? { taxClass: processed.taxClass } : {}), ...(processed.metadata !== undefined ? { metadata: processed.metadata } : {}), ...(processed.isVisible !== undefined ? { isVisible: processed.isVisible } : {}) }, ctx);
     if (!updated) return Err(new CommerceNotFoundError("Entity not found."));
+    await this.writeCustomFields(existing.id, customFieldsResult.value, ctx, true);
     const hookReport = await runAfterHooks(afterHooks, existing, updated, "update", context);
     const hydrated = await this.hydrateEntity(updated, undefined, ctx);
     return Ok(hydrated, hookReport.hasErrors ? { hookErrors: hookReport.errors } : undefined);
@@ -467,7 +520,7 @@ export class EntityService {
       if (!ov) return Err(new CommerceValidationError(`Option value "${optVal}" does not exist for option type "${optName}".`));
       optionValueIds.push(ov.id);
     }
-    const variant = await this.repo.createVariant({ entityId: input.entityId, status: "active", sortOrder: 0, metadata: {}, ...(input.sku !== undefined ? { sku: input.sku } : {}), ...(input.taxClass !== undefined ? { taxClass: input.taxClass } : {}) }, ctx);
+    const variant = await this.repo.createVariant({ entityId: input.entityId, status: "active", sortOrder: 0, metadata: {}, ...(input.sku !== undefined ? { sku: input.sku } : {}), ...(input.barcode !== undefined ? { barcode: input.barcode } : {}), ...(input.taxClass !== undefined ? { taxClass: input.taxClass } : {}) }, ctx);
     await this.repo.createVariantOptionValues(optionValueIds.map((optionValueId) => ({ variantId: variant.id, optionValueId })), ctx);
     return Ok(variant);
   }