@porulle/core 0.10.8 → 0.13.0

package/dist/interfaces/rest/routes/documents.js

@@ -1,6 +1,6 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { emailInvoiceRoute, invoiceHtmlRoute, invoicePdfRoute, receiptHtmlRoute, } from "../schemas/documents.js";
-import { mapErrorToResponse, mapErrorToStatus } from "../utils.js";
+import { mapErrorToResponse, mapErrorToStatus, requireAnyPerm } from "../utils.js";
 /**
  * Order document rendering (issue #47). Mounted under /orders. Access
  * control rides on OrderService.getById (orders:read, or orders:read:own
@@ -8,8 +8,10 @@ import { mapErrorToResponse, mapErrorToStatus } from "../utils.js";
  */
 export function documentRoutes(kernel) {
     const router = new OpenAPIHono();
+    router.use("/*", requireAnyPerm(["orders:read", "orders:read:own"]));
     router.openapi(invoicePdfRoute, async (c) => {
-        const result = await kernel.services.documents.renderInvoicePdf(c.req.param("id"), c.get("actor"));
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+        const result = await kernel.services.documents.renderInvoicePdf(c.req.param("id"), c.get("actor"), undefined, guestCredential);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.body(result.value.pdf.slice().buffer, 200, {
@@ -18,20 +20,23 @@ export function documentRoutes(kernel) {
         });
     });
     router.openapi(invoiceHtmlRoute, async (c) => {
-        const result = await kernel.services.documents.renderInvoiceHtml(c.req.param("id"), c.get("actor"));
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+        const result = await kernel.services.documents.renderInvoiceHtml(c.req.param("id"), c.get("actor"), undefined, guestCredential);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.html(result.value.html);
     });
     router.openapi(receiptHtmlRoute, async (c) => {
-        const result = await kernel.services.documents.renderReceiptHtml(c.req.param("id"), c.get("actor"));
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+        const result = await kernel.services.documents.renderReceiptHtml(c.req.param("id"), c.get("actor"), undefined, guestCredential);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.html(result.value.html);
     });
     // @ts-expect-error -- openapi handler union return type
     router.openapi(emailInvoiceRoute, async (c) => {
-        const result = await kernel.services.documents.emailInvoice(c.req.param("id"), c.req.valid("json").to, c.get("actor"));
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+        const result = await kernel.services.documents.emailInvoice(c.req.param("id"), c.req.valid("json").to, c.get("actor"), undefined, guestCredential);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.json({ data: result.value });

package/dist/interfaces/rest/routes/inventory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAUzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAE7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCA+F7C"}
+{"version":3,"file":"inventory.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAUzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAE7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCAiG7C"}

package/dist/interfaces/rest/routes/inventory.js

@@ -12,6 +12,8 @@ export function inventoryRoutes(kernel) {
     router.use("/warehouses", requirePerm("inventory:read"));
     router.use("/reserve", requirePerm("inventory:adjust"));
     router.use("/release", requirePerm("inventory:adjust"));
+    router.use("/check", requirePerm("inventory:read"));
+    router.use("/adjust", requirePerm("inventory:adjust"));
     // @ts-expect-error -- openapi handler union return type
     router.openapi(listInventoryLevelsRoute, async (c) => {
         const actor = c.get("actor");

package/dist/interfaces/rest/routes/media.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/media.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAE7F,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCAuFzC"}
+{"version":3,"file":"media.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/media.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EAAE,KAAK,MAAM,EAAwE,MAAM,aAAa,CAAC;AAEhH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCA4FzC"}

package/dist/interfaces/rest/routes/media.js

@@ -1,10 +1,11 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { attachMediaRoute, getMediaRoute, deleteMediaRoute } from "../schemas/media.js";
-import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
+import { mapErrorToResponse, mapErrorToStatus, requireMethodPerm, requirePerm } from "../utils.js";
 export function mediaRoutes(kernel) {
     const router = new OpenAPIHono();
     // Upload requires authentication + media:write permission
     router.use("/upload", requirePerm("media:write"));
+    router.use("/:id", requireMethodPerm(["DELETE"], "media:write"));
     router.post("/upload", async (c) => {
         // No storage configured (the default no-op adapter) → media is disabled.
         if (kernel.config.storage?.providerId === "noop") {
@@ -32,11 +33,14 @@ export function mediaRoutes(kernel) {
     });
     router.openapi(getMediaRoute, async (c) => {
         const signed = c.req.query("signed") === "true";
+        const actor = c.get("actor");
+        if (!actor && !signed) {
+            return c.json({ error: { code: "NOT_FOUND", message: "Media not found." } }, 404);
+        }
         // Signed URLs require authentication
-        if (signed && !c.get("actor")) {
+        if (signed && !actor) {
             return c.json({ error: { code: "UNAUTHORIZED", message: "Authentication required for signed URLs." } }, 401);
         }
-        const actor = c.get("actor");
         const result = signed
             ? await kernel.services.media.getSignedUrl(c.req.param("id"), undefined, actor)
             : await kernel.services.media.getUrl(c.req.param("id"), actor);

package/dist/interfaces/rest/routes/orders.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAiE,MAAM,aAAa,CAAC;AAKzG,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCAkTzC"}
+{"version":3,"file":"orders.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/orders.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAiH,MAAM,aAAa,CAAC;AAKzJ,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,gCAqUzC"}

package/dist/interfaces/rest/routes/orders.js

@@ -1,10 +1,16 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { changeOrderStatusRoute, listOrdersRoute, orderLookupRoute, getOrderRoute, getOrderFulfillmentsRoute, createOrderRoute, quoteOrderRoute, refundOrderRoute, captureOrderRoute, createOrderFulfillmentRoute, addOrderLineItemRoute, updateOrderLineItemRoute, removeOrderLineItemRoute, refundOrderLinesRoute, undoOrderRefundRoute, listOrderRefundsRoute, refundCapStatusRoute, createOrderNoteRoute, listOrderNotesRoute, deleteOrderNoteRoute, orderTimelineRoute } from "../schemas/orders.js";
-import { isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination } from "../utils.js";
+import { isUUID, mapErrorToResponse, mapErrorToStatus, parsePagination, requireAnyPerm, requireMethodPerm, requirePerm } from "../utils.js";
 import { computeOrderPricing } from "../../../modules/orders/quote.js";
 import { assertPermission } from "../../../auth/permissions.js";
 export function orderRoutes(kernel) {
     const router = new OpenAPIHono();
+    router.use("/", requireMethodPerm(["GET"], "orders:read"));
+    router.use("/", requireMethodPerm(["POST"], "orders:create"));
+    router.use("/lookup", requirePerm("orders:read"));
+    router.use("/:idOrNumber", requireAnyPerm(["orders:read", "orders:read:own"]));
+    router.use("/:id/*", requireAnyPerm(["orders:read", "orders:read:own", "orders:update", "orders:manage"]));
+    router.use("/refunds/cap", requirePerm("orders:read"));
     // @ts-expect-error -- openapi handler union return type
     router.openapi(listOrdersRoute, async (c) => {
         const pagination = parsePagination(c.req.query());
@@ -48,9 +54,10 @@ export function orderRoutes(kernel) {
     // @ts-expect-error -- openapi handler union return type
     router.openapi(getOrderRoute, async (c) => {
         const idOrNumber = c.req.param("idOrNumber");
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
         const result = isUUID(idOrNumber)
-            ? await kernel.services.orders.getById(idOrNumber, c.get("actor"))
-            : await kernel.services.orders.getByNumber(idOrNumber, c.get("actor"));
+            ? await kernel.services.orders.getById(idOrNumber, c.get("actor"), undefined, guestCredential)
+            : await kernel.services.orders.getByNumber(idOrNumber, c.get("actor"), undefined, guestCredential);
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.json({ data: result.value });
@@ -58,13 +65,16 @@ export function orderRoutes(kernel) {
     // @ts-expect-error -- openapi handler union return type
     router.openapi(createOrderRoute, async (c) => {
         try {
-            assertPermission(c.get("actor"), "orders:manage");
+            assertPermission(c.get("actor"), "orders:create");
         }
         catch (error) {
             return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
         }
         const body = c.req.valid("json");
-        const result = await kernel.services.orders.create(body, c.get("actor"));
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
+        const result = await kernel.services.orders.create(body, c.get("actor"), undefined, {
+            ...(guestCredential !== undefined ? { guestCredential } : {}),
+        });
         if (!result.ok)
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
         return c.json({ data: result.value }, 201);
@@ -216,8 +226,15 @@ export function orderRoutes(kernel) {
     router.openapi(createOrderFulfillmentRoute, async (c) => {
         const actor = c.get("actor");
         const orderId = c.req.param("id");
+        try {
+            assertPermission(actor, "orders:update");
+        }
+        catch (error) {
+            return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+        }
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
         // Verify the order exists and the actor has access before recording
-        const orderResult = await kernel.services.orders.getById(orderId, actor);
+        const orderResult = await kernel.services.orders.getById(orderId, actor, undefined, guestCredential);
         if (!orderResult.ok)
             return c.json(mapErrorToResponse(orderResult.error), mapErrorToStatus(orderResult.error));
         const body = c.req.valid("json");
@@ -230,10 +247,11 @@ export function orderRoutes(kernel) {
     router.openapi(getOrderFulfillmentsRoute, async (c) => {
         const orderId = c.req.param("id");
         const actor = c.get("actor");
+        const guestCredential = c.req.header("x-cart-secret") ?? c.req.header("X-Cart-Secret") ?? undefined;
         // Verify the order exists and the actor has access before returning fulfillments
         const orderResult = isUUID(orderId)
-            ? await kernel.services.orders.getById(orderId, actor)
-            : await kernel.services.orders.getByNumber(orderId, actor);
+            ? await kernel.services.orders.getById(orderId, actor, undefined, guestCredential)
+            : await kernel.services.orders.getByNumber(orderId, actor, undefined, guestCredential);
         if (!orderResult.ok)
             return c.json(mapErrorToResponse(orderResult.error), mapErrorToStatus(orderResult.error));
         const result = await kernel.services.fulfillment.getByOrderId(orderResult.value.id);

package/dist/interfaces/rest/routes/pricing.js

@@ -1,5 +1,5 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
-import { resolveOrgId } from "../../../auth/org.js";
+import { resolveOrgIdForCommerce } from "../../../auth/org.js";
 import { CommerceValidationError } from "../../../kernel/errors.js";
 import { CatalogRepository } from "../../../modules/catalog/repository/index.js";
 import { setBasePriceRoute, createModifierRoute, listPricesRoute, listModifiersRoute, updateModifierRoute, deleteModifierRoute } from "../schemas/pricing.js";
@@ -80,7 +80,7 @@ export function pricingRoutes(kernel) {
         const input = c.req.valid("json");
         if (input.entityId) {
             const catalogRepo = new CatalogRepository(kernel.database.db);
-            const orgId = resolveOrgId(actor);
+            const orgId = resolveOrgIdForCommerce(actor, kernel.config);
             const entity = await catalogRepo.findEntityById(input.entityId);
             if (!entity || entity.organizationId !== orgId) {
                 return c.json(mapErrorToResponse(new CommerceValidationError("entityId does not belong to this organization.")), 422);

package/dist/interfaces/rest/routes/promotions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"promotions.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/promotions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAG7F,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCAiH7C"}
+{"version":3,"file":"promotions.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/promotions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAGzD,OAAO,EAAE,KAAK,MAAM,EAAwE,MAAM,aAAa,CAAC;AAIhH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,gCAmH7C"}

package/dist/interfaces/rest/routes/promotions.js

@@ -1,8 +1,9 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { rateLimiter } from "hono-rate-limiter";
 import { createPromotionRoute, updatePromotionRoute, validatePromotionRoute, deactivatePromotionRoute, listPromotionsRoute } from "../schemas/promotions.js";
-import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
-import { resolveOrgId } from "../../../auth/org.js";
+import { mapErrorToResponse, mapErrorToStatus, requireMethodPerm, requirePerm } from "../utils.js";
+import { resolveOrgIdForCommerce } from "../../../auth/org.js";
+import { assertPermission } from "../../../auth/permissions.js";
 export function promotionRoutes(kernel) {
     const router = new OpenAPIHono();
     // Rate limit promo code validation — prevents brute-force code enumeration
@@ -45,7 +46,7 @@ export function promotionRoutes(kernel) {
     router.openapi(validatePromotionRoute, async (c) => {
         const payload = c.req.valid("json");
         const actor = c.get("actor");
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, kernel.config);
         // Apply (not just validate) so the response carries the authoritative
         // discount the cart would receive — the same computation checkout runs.
         // Returning only the promotion forces callers to re-derive the amount, which
@@ -66,18 +67,20 @@ export function promotionRoutes(kernel) {
     });
     // Guard inline (not via router.use("/:id")) because a "/:id" middleware
     // would also match single-segment routes like POST /validate.
-    router.use("/:id", async (c, next) => {
-        if (c.req.method !== "PATCH")
-            return next();
-        return requirePerm("promotions:manage")(c, next);
-    });
+    router.use("/:id", requireMethodPerm(["PATCH"], "promotions:manage"));
     // @ts-expect-error -- openapi() enforces strict response typing but our handler
     // returns union responses (200 | 400 | 404 | 422). The route definition
     // documents the contract; the handler returns dynamic status.
     router.openapi(updatePromotionRoute, async (c) => {
         const body = c.req.valid("json");
         const actor = c.get("actor");
-        const orgId = resolveOrgId(actor);
+        try {
+            assertPermission(actor, "promotions:manage");
+        }
+        catch (error) {
+            return c.json(mapErrorToResponse(error), mapErrorToStatus(error));
+        }
+        const orgId = resolveOrgIdForCommerce(actor, kernel.config);
         const result = await kernel.services.promotions.update(orgId, c.req.param("id"), body, actor);
         if (!result.ok) {
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));
@@ -90,7 +93,7 @@ export function promotionRoutes(kernel) {
     // contract; the handler returns dynamic status.
     router.openapi(deactivatePromotionRoute, async (c) => {
         const actor = c.get("actor");
-        const orgId = resolveOrgId(actor);
+        const orgId = resolveOrgIdForCommerce(actor, kernel.config);
         const result = await kernel.services.promotions.deactivate(orgId, c.req.param("id"));
         if (!result.ok) {
             return c.json(mapErrorToResponse(result.error), mapErrorToStatus(result.error));

package/dist/interfaces/rest/routes/search.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAwC,MAAM,aAAa,CAAC;AAEhF,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,gCA2E1C"}
+{"version":3,"file":"search.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/routes/search.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,KAAK,MAAM,EAAqD,MAAM,aAAa,CAAC;AAI7F,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,gCA2F1C"}

package/dist/interfaces/rest/routes/search.js

@@ -1,8 +1,10 @@
 import { OpenAPIHono } from "@hono/zod-openapi";
 import { searchRoute, suggestRoute } from "../schemas/search.js";
-import { mapErrorToResponse, mapErrorToStatus } from "../utils.js";
+import { mapErrorToResponse, mapErrorToStatus, requirePerm } from "../utils.js";
+const SAFE_ATTRIBUTE_NAME = /^[A-Za-z0-9_-]+$/;
 export function searchRoutes(kernel) {
     const router = new OpenAPIHono();
+    router.use("/*", requirePerm("catalog:read"));
     // @ts-expect-error -- openapi handler union return type
     router.openapi(searchRoute, async (c) => {
         try {
@@ -17,6 +19,16 @@ export function searchRoutes(kernel) {
                 .split(",")
                 .map((facet) => facet.trim())
                 .filter(Boolean);
+            const attributes = {};
+            for (const [key, values] of Object.entries(c.req.queries())) {
+                if (!key.startsWith("attr."))
+                    continue;
+                const name = key.slice("attr.".length);
+                if (!SAFE_ATTRIBUTE_NAME.test(name)) {
+                    return c.json({ error: "invalid_argument", field: key, message: `Invalid attribute filter name: ${name}` }, 422);
+                }
+                attributes[name] = values.length === 1 ? values[0] : values;
+            }
             const result = await kernel.services.search.query({
                 query: q,
                 page,
@@ -26,6 +38,7 @@ export function searchRoutes(kernel) {
                     ...(category ? { category } : {}),
                     ...(brand ? { brand } : {}),
                     ...(status ? { status } : {}),
+                    ...(Object.keys(attributes).length > 0 ? { attributes } : {}),
                 },
                 ...(facets.length > 0 ? { facets } : {}),
             }, { actor: c.get("actor"), tx: null, requestId: "" });

package/dist/interfaces/rest/schemas/admin-custom-field-proposals.d.ts

@@ -0,0 +1,134 @@
+import { z } from "@hono/zod-openapi";
+export declare const listCustomFieldProposalsRoute: {
+    method: "get";
+    path: "/custom-field-proposals";
+    tags: string[];
+    summary: string;
+    request: {
+        query: z.ZodObject<{
+            entityType: z.ZodOptional<z.ZodString>;
+            page: z.ZodOptional<z.ZodString>;
+            limit: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>;
+    };
+    responses: {
+        400: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly schema: z.ZodObject<{
+                        error: z.ZodObject<{
+                            code: z.ZodString;
+                            message: z.ZodString;
+                            details: z.ZodOptional<z.ZodObject<{
+                                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                    path: z.ZodString;
+                                    message: z.ZodString;
+                                    code: z.ZodString;
+                                }, z.core.$strip>>>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            readonly description: "Business logic error.";
+        };
+        401: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly schema: z.ZodObject<{
+                        error: z.ZodObject<{
+                            code: z.ZodString;
+                            message: z.ZodString;
+                            details: z.ZodOptional<z.ZodObject<{
+                                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                    path: z.ZodString;
+                                    message: z.ZodString;
+                                    code: z.ZodString;
+                                }, z.core.$strip>>>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            readonly description: "Authentication required.";
+        };
+        403: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly schema: z.ZodObject<{
+                        error: z.ZodObject<{
+                            code: z.ZodString;
+                            message: z.ZodString;
+                            details: z.ZodOptional<z.ZodObject<{
+                                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                    path: z.ZodString;
+                                    message: z.ZodString;
+                                    code: z.ZodString;
+                                }, z.core.$strip>>>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            readonly description: "Insufficient permissions.";
+        };
+        404: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly schema: z.ZodObject<{
+                        error: z.ZodObject<{
+                            code: z.ZodString;
+                            message: z.ZodString;
+                            details: z.ZodOptional<z.ZodObject<{
+                                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                    path: z.ZodString;
+                                    message: z.ZodString;
+                                    code: z.ZodString;
+                                }, z.core.$strip>>>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            readonly description: "Resource not found.";
+        };
+        422: {
+            readonly content: {
+                readonly "application/json": {
+                    readonly schema: z.ZodObject<{
+                        error: z.ZodObject<{
+                            code: z.ZodString;
+                            message: z.ZodString;
+                            details: z.ZodOptional<z.ZodObject<{
+                                issues: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                                    path: z.ZodString;
+                                    message: z.ZodString;
+                                    code: z.ZodString;
+                                }, z.core.$strip>>>;
+                            }, z.core.$strip>>;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            readonly description: "Validation error.";
+        };
+        200: {
+            content: {
+                "application/json": {
+                    schema: z.ZodObject<{
+                        data: z.ZodObject<{
+                            items: z.ZodArray<z.ZodAny>;
+                            total: z.ZodNumber;
+                            page: z.ZodNumber;
+                            limit: z.ZodNumber;
+                        }, z.core.$strip>;
+                    }, z.core.$strip>;
+                };
+            };
+            description: string;
+        };
+    };
+} & {
+    getRoutingPath(): "/custom-field-proposals";
+};
+//# sourceMappingURL=admin-custom-field-proposals.d.ts.map

package/dist/interfaces/rest/schemas/admin-custom-field-proposals.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-custom-field-proposals.d.ts","sourceRoot":"","sources":["../../../../src/interfaces/rest/schemas/admin-custom-field-proposals.ts"],"names":[],"mappings":"AAAA,OAAO,EAAe,CAAC,EAAE,MAAM,mBAAmB,CAAC;AAkBnD,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAUxC,CAAC"}

package/dist/interfaces/rest/schemas/admin-custom-field-proposals.js

@@ -0,0 +1,26 @@
+import { createRoute, z } from "@hono/zod-openapi";
+import { errorResponses } from "./shared.js";
+const ProposalResponse = z.object({
+    data: z.object({
+        items: z.array(z.any()),
+        total: z.number(),
+        page: z.number(),
+        limit: z.number(),
+    }),
+});
+const ListQuery = z.object({
+    entityType: z.string().min(1).optional(),
+    page: z.string().max(10).optional(),
+    limit: z.string().max(10).optional(),
+});
+export const listCustomFieldProposalsRoute = createRoute({
+    method: "get",
+    path: "/custom-field-proposals",
+    tags: ["Admin"],
+    summary: "List proposed custom-field values",
+    request: { query: ListQuery },
+    responses: {
+        200: { content: { "application/json": { schema: ProposalResponse } }, description: "Proposed custom fields." },
+        ...errorResponses,
+    },
+});