@spinekit/purchase 0.1.0

package/dist/resources/purchase-order/purchase-order.resource.mjs

@@ -0,0 +1,193 @@
+import { n as asRecord, r as asRecordRepository, t as asEntityModel } from "../../entity-model-D-03ovSg.mjs";
+import { BaseController, defineResource } from "@classytic/arc";
+import { permissionMatrix } from "@classytic/arc/permissions";
+import { getUserId, scopeFirstCtx } from "@classytic/arc/scope";
+import { createDomainError } from "@classytic/arc/utils";
+import { createMongooseAdapter } from "@classytic/mongokit/adapter";
+import { QueryParser } from "@classytic/mongokit";
+import { CreateOrderSchema, UpdateOrderSchema } from "@classytic/purchase/schemas";
+//#region src/resources/purchase-order/purchase-order.resource.ts
+/**
+* Purchase Orders — supplier procurement over the `@classytic/purchase`
+* kernel (draft → approved → received, cancel), inheriting the kernel's
+* hard-won semantics for free:
+*
+*   - `receive()`: FSM-guarded CAS, bridge compensation, and the
+*     `pendingStockReceipt` CRASH HEAL — a retry after a crashed receive
+*     re-fires the idempotent stockReceipt bridge instead of stranding the
+*     order (or silently losing WMS stock).
+*   - Money is PAISA end-to-end (`costPrice`, discounts, taxes, totals —
+*     integer minor units). The wire passes through untouched.
+*   - `expectedDeliveryDate` = the OTIF baseline for supplier scoring.
+*
+* THE MODULE OWNS HTTP — there are no controller/repository/schema bypass
+* seams. CREATE and UPDATE route through the kernel verbs (`createOrder`,
+* `updateDraft`: numbering, catalog cost lookup, FX pairing, totals, FSM
+* guard); the wire contract is the kernel's own Zod schemas; DELETE is a
+* hard 405 (purchases are an immutable audit trail — corrections post a
+* new order, cancel is the verb). Hosts extend via `extraActions` /
+* `extraRoutes` (which ADD behavior) and `readPopulate` (display joins on
+* HTTP read paths) — none of which can bypass the kernel.
+*
+* Branch scoping: the kernel owns a required `branch` field and be-prod runs
+* engine tenancy OFF (arc's RequestScope is the boundary) — mirrored here
+* with `tenantField: false` + `branch` filterable.
+*/
+function ctx(req) {
+	const organizationId = scopeFirstCtx(req).organizationId;
+	const actorId = getUserId(req.scope);
+	return {
+		...organizationId ? { organizationId } : {},
+		...actorId ? { actorId } : {}
+	};
+}
+function ctxFromController(context) {
+	const organizationId = context.scope?.organizationId;
+	const actorId = String(context.user?._id ?? context.user?.id ?? "") || void 0;
+	return {
+		...organizationId ? { organizationId } : {},
+		...actorId ? { actorId } : {}
+	};
+}
+const SYSTEM_MANAGED_FIELD_RULES = {
+	invoiceNumber: { systemManaged: true },
+	status: { systemManaged: true },
+	grandTotal: { systemManaged: true },
+	dueAmount: { systemManaged: true },
+	paymentStatus: { systemManaged: true },
+	statusHistory: { systemManaged: true },
+	pendingStockReceipt: { systemManaged: true },
+	approvals: { systemManaged: true },
+	approvalPolicyId: { systemManaged: true },
+	approvalPolicyVersion: { systemManaged: true }
+};
+function createPurchaseOrderResource(args) {
+	const { engine, permissions, prefix = "/inventory/purchase-orders", extraActions, extraRoutes, readPopulate } = args;
+	const orders = engine.repositories.purchaseOrder;
+	if (readPopulate?.length) {
+		const inject = (payload) => {
+			const c = payload;
+			if (c.populate) return;
+			c.populate = readPopulate;
+		};
+		orders.on("before:getAll", inject);
+		orders.on("before:getByQuery", inject);
+		orders.on("before:getOne", inject);
+	}
+	class PurchaseOrderModuleController extends BaseController {
+		constructor() {
+			super(engine.repositories.purchaseOrder, {
+				resourceName: "purchase-order",
+				tenantField: false,
+				schemaOptions: { fieldRules: SYSTEM_MANAGED_FIELD_RULES }
+			});
+		}
+		/**
+		* `create` and `update` are NOT overridden — they are declared as `writes`
+		* on the resource below (arc 2.34+).
+		*
+		* They used to be overrides, and an override replaces arc's whole write
+		* pipeline: `context.body` went to the kernel verb RAW, so every rule in
+		* `SYSTEM_MANAGED_FIELD_RULES` above — `grandTotal`, `dueAmount`,
+		* `paymentStatus`, `approvals`, `statusHistory`, `approvalPolicyId` —
+		* was declared and enforced nowhere. On a document that carries money and
+		* an approval chain, that is the approval gate itself being writable by
+		* the request it gates. The identical shape was measured live on the
+		* invoice resource: a `PATCH` on a draft wrote `status: "posted"` and a
+		* forged document `number`, answering `200`.
+		*
+		* `writes` keeps the kernel verb AND the pipeline.
+		*/
+		/** Purchases are an immutable audit trail — corrections post a new
+		*  order; `action: cancel` is the lifecycle verb (kernel FSM). */
+		async delete() {
+			throw createDomainError("purchase.delete_forbidden", "Deleting purchase orders is not allowed — use action:cancel (immutable audit trail)", 405);
+		}
+		/** Detail-path display joins (see `readPopulate`). */
+		async executeGetQuery(id, options, req) {
+			const withPopulate = readPopulate?.length ? {
+				...options,
+				populate: options.populate ?? readPopulate
+			} : options;
+			return super.executeGetQuery(id, withPopulate, req);
+		}
+	}
+	return defineResource({
+		name: "purchase-order",
+		displayName: "Purchase Orders",
+		tag: "Inventory",
+		prefix,
+		audit: true,
+		tenantField: false,
+		adapter: createMongooseAdapter({
+			model: asEntityModel(engine.models.PurchaseOrder),
+			repository: asRecordRepository(engine.repositories.purchaseOrder)
+		}),
+		controller: new PurchaseOrderModuleController(),
+		/**
+		* The write slots ARE the kernel verbs — document numbering
+		* (SequenceBridge), pricelist cost lookup, FX pairing, paisa totals and the
+		* FSM guards all live there, and a raw adapter write can never be correct.
+		*
+		* Declared rather than overridden so arc still sanitizes the body against
+		* `SYSTEM_MANAGED_FIELD_RULES` first. `delete` stays a controller override:
+		* it blocks the op outright with a typed 405 and never touches a body.
+		*/
+		writes: {
+			create: async (data, wctx) => asRecord(await orders.createOrder(data, ctxFromController(wctx.req))),
+			update: async (id, data, wctx) => asRecord(await orders.updateDraft(id, data, ctxFromController(wctx.req)))
+		},
+		queryParser: new QueryParser({
+			maxLimit: 100,
+			allowedFilterFields: [
+				"status",
+				"paymentStatus",
+				"invoiceNumber",
+				"branch",
+				"supplier",
+				"paymentTerms",
+				"expectedDeliveryDate",
+				"reference"
+			],
+			allowedSortFields: [
+				"createdAt",
+				"updatedAt",
+				"invoiceDate",
+				"dueDate",
+				"grandTotal",
+				"invoiceNumber",
+				"status",
+				"expectedDeliveryDate",
+				"receivedAt"
+			]
+		}),
+		permissions: permissionMatrix({
+			read: permissions.view,
+			write: permissions.manage,
+			delete: permissions.manage
+		}),
+		schemaOptions: { fieldRules: SYSTEM_MANAGED_FIELD_RULES },
+		customSchemas: {
+			create: { body: CreateOrderSchema },
+			update: { body: UpdateOrderSchema }
+		},
+		routes: [...extraRoutes ?? []],
+		actions: {
+			approve: {
+				permissions: permissions.operate,
+				handler: async (id, _d, req) => orders.approve(id, ctx(req))
+			},
+			receive: {
+				permissions: permissions.operate,
+				handler: async (id, _d, req) => orders.receive(id, ctx(req))
+			},
+			cancel: {
+				permissions: permissions.cancel,
+				handler: async (id, data, req) => orders.cancel(id, data?.reason ?? "cancelled", ctx(req))
+			},
+			...extraActions ?? {}
+		}
+	});
+}
+//#endregion
+export { createPurchaseOrderResource };

package/dist/resources/supplier/supplier.model.d.mts

@@ -0,0 +1,2 @@
+import { n as SUPPLIER_TYPES, r as createSupplierModel, t as SUPPLIER_PAYMENT_TERMS } from "../../supplier.model-BcAfgyHu.mjs";
+export { SUPPLIER_PAYMENT_TERMS, SUPPLIER_TYPES, createSupplierModel };

package/dist/resources/supplier/supplier.model.mjs

@@ -0,0 +1,178 @@
+import { defineModel } from "@classytic/mongokit";
+import { Schema } from "mongoose";
+//#region src/resources/supplier/supplier.model.ts
+/**
+* Supplier — the PROCUREMENT / A-P facet of a business partner.
+*
+* Lifted from be-prod. Identity belongs to `@classytic/party`: this document carries `partyId`
+* and the party owns the name, the contacts and the `supplier` role. What lives here is what
+* only procurement cares about — a code, payment terms, a credit line, an opening balance.
+*
+* ## Jurisdiction lives in `extraFields`, not in this file
+*
+* be-prod's version declared a block of Bangladesh NBR fields inline (BIN, VDS withholding rate,
+* TDS payee category, bonded-warehouse flag, fiscal position). Those are a COUNTRY PACK's
+* vocabulary, and a package that names them can only ever serve one country — so the pack
+* contributes them through `extraFields` / `extraIndexes`, and the generic facet stays generic.
+* Nothing about the shape changed; only who declares it.
+*
+* ## Registration goes through `defineModel`
+*
+* The host had `mongoose.models.Supplier || mongoose.model('Supplier', schema)`. That guard is
+* the one mongokit's `defineModel` replaced, and its failure mode is the reason: mongoose LOCKS a
+* schema on the first `model()` call, so a second caller contributing fields or indexes has them
+* **silently dropped**. `onExisting: 'reuse'` states that this registration adds nothing new; a
+* caller that does contribute must pass `'throw'` and find out.
+*/
+/** Sourcing relationship — generic enough for any jurisdiction. */
+const SUPPLIER_TYPES = [
+	"local",
+	"import",
+	"manufacturer",
+	"wholesaler"
+];
+/** Settlement basis. Terms in DAYS live on `creditDays`, so this stays a two-value axis. */
+const SUPPLIER_PAYMENT_TERMS = ["cash", "credit"];
+function createSupplierModel(deps) {
+	const { connection, refs, extraFields, extraIndexes, modelName = "Supplier" } = deps;
+	return defineModel(modelName, () => {
+		const schema = new Schema({
+			/**
+			* Canonical identity link, stamped by the host's party linker on create. The facet
+			* never owns identity — see `createPartyLinker`.
+			*/
+			partyId: {
+				type: Schema.Types.ObjectId,
+				ref: refs.party,
+				index: true
+			},
+			name: {
+				type: String,
+				required: true,
+				trim: true
+			},
+			/**
+			* Lower-cased, trimmed name backing the unique-among-active index below. Maintained by
+			* the repository's create/update hooks — a write that bypasses them leaves it unset,
+			* which is why the partial index is on `isActive` rather than on the whole collection.
+			*/
+			nameNormalized: {
+				type: String,
+				trim: true,
+				lowercase: true
+			},
+			code: {
+				type: String,
+				trim: true,
+				uppercase: true
+			},
+			type: {
+				type: String,
+				enum: [...SUPPLIER_TYPES],
+				default: "local"
+			},
+			contactPerson: {
+				type: String,
+				trim: true
+			},
+			phone: {
+				type: String,
+				trim: true
+			},
+			email: {
+				type: String,
+				trim: true,
+				lowercase: true
+			},
+			address: {
+				type: String,
+				trim: true
+			},
+			/** Generic tax registration id. A jurisdiction's OWN identifiers go in `extraFields`. */
+			taxId: {
+				type: String,
+				trim: true
+			},
+			paymentTerms: {
+				type: String,
+				enum: [...SUPPLIER_PAYMENT_TERMS],
+				default: "cash"
+			},
+			creditDays: {
+				type: Number,
+				default: 0,
+				min: 0
+			},
+			creditLimit: {
+				type: Number,
+				min: 0,
+				default: 0
+			},
+			openingBalance: {
+				type: Number,
+				default: 0
+			},
+			/** Business flag for "temporarily not ordering" — distinct from `deletedAt`. */
+			isActive: {
+				type: Boolean,
+				default: true,
+				index: true
+			},
+			notes: {
+				type: String,
+				trim: true
+			},
+			tags: {
+				type: [String],
+				default: []
+			},
+			createdBy: {
+				type: Schema.Types.ObjectId,
+				ref: refs.user
+			},
+			updatedBy: {
+				type: Schema.Types.ObjectId,
+				ref: refs.user
+			},
+			/**
+			* Soft-delete marker for mongokit's `softDeletePlugin`. Declared with `default: null`
+			* so a new document matches the plugin's `{ deletedAt: null }` filter — without the
+			* default, every freshly created supplier is invisible to its own list.
+			*/
+			deletedAt: {
+				type: Date,
+				default: null,
+				index: true
+			},
+			...extraFields ?? {}
+		}, { timestamps: true });
+		schema.index({
+			name: 1,
+			isActive: 1
+		});
+		schema.index({ code: 1 }, {
+			unique: true,
+			sparse: true
+		});
+		/**
+		* One ACTIVE supplier per normalized name. Partial rather than plain-unique so an
+		* archived or deactivated supplier does not block re-onboarding the same vendor.
+		*/
+		schema.index({ nameNormalized: 1 }, {
+			unique: true,
+			partialFilterExpression: { isActive: true }
+		});
+		for (const [fields, options] of extraIndexes ?? []) schema.index(fields, options);
+		return schema;
+	}, {
+		connection,
+		/**
+		* This factory is the ONLY declaration of the collection, so re-entry adds nothing. A pack
+		* that needs more fields passes them here via `extraFields` — reaching for a second
+		* `defineModel` call on the same name would drop them.
+		*/
+		onExisting: "reuse"
+	});
+}
+//#endregion
+export { SUPPLIER_PAYMENT_TERMS, SUPPLIER_TYPES, createSupplierModel };

package/dist/resources/supplier/supplier.repository.d.mts

@@ -0,0 +1,20 @@
+import { a as SupplierFacet, l as SupplierRepositoryDeps } from "../../supplier.model-BcAfgyHu.mjs";
+import { Repository } from "@classytic/mongokit";
+import { Model } from "mongoose";
+//#region src/resources/supplier/supplier.repository.d.ts
+declare class SupplierRepository<TSupplier extends SupplierFacet = SupplierFacet> extends Repository<TSupplier> {
+  constructor(model: Model<TSupplier>, deps?: SupplierRepositoryDeps);
+  /**
+   * One-time migration for rows written before `nameNormalized` existed.
+   *
+   * A pipeline update, so the value is derived from each document's own `name` in the database
+   * rather than read-modify-written per row. Rows that already carry a value are left alone: the
+   * filter is the guard, so a re-run is a no-op rather than a rewrite.
+   */
+  backfillNameNormalized(): Promise<{
+    modifiedCount: number;
+  }>;
+}
+declare function createSupplierRepository<TSupplier extends SupplierFacet = SupplierFacet>(model: Model<TSupplier>, deps?: SupplierRepositoryDeps): SupplierRepository<TSupplier>;
+//#endregion
+export { SupplierRepository, createSupplierRepository };

package/dist/resources/supplier/supplier.repository.mjs

@@ -0,0 +1,62 @@
+import { Repository, requireField, softDeletePlugin, uniqueField, validationChainPlugin } from "@classytic/mongokit";
+//#region src/resources/supplier/supplier.repository.ts
+/**
+* Supplier repository — mongokit `Repository` plus the two write-time invariants.
+*
+* Lifted from be-prod.
+*
+*  - **`validationChainPlugin`** — `name` required on create, `code` unique with a readable
+*    message instead of a raw duplicate-key error.
+*  - **`softDeletePlugin`** — DELETE archives. Historical purchase documents still render the
+*    vendor name because a direct mongoose `populate` bypasses the plugin's filter, which is
+*    deliberate: the A/P ledger must stay readable after a vendor is archived.
+*  - **normalization hooks** — trim the name and maintain `nameNormalized`, which the
+*    unique-among-active index depends on. They run on create AND update because a rename that
+*    skipped the update hook would leave the index entry pointing at the old name, and the
+*    duplicate it then permits surfaces months later as two live suppliers with one name.
+*/
+function normalizeName(name) {
+	return name == null ? null : String(name).trim().toLowerCase();
+}
+var SupplierRepository = class extends Repository {
+	constructor(model, deps = {}) {
+		super(model, [validationChainPlugin([requireField("name", ["create"]), uniqueField("code", "Supplier code already exists")]), softDeletePlugin()], {
+			defaultLimit: deps.defaultLimit ?? 20,
+			maxLimit: deps.maxLimit ?? 100
+		});
+		this.on("before:create", async (context) => {
+			if (!context?.data) return;
+			if (!context.data.code && deps.codeGenerator) context.data.code = await deps.codeGenerator.nextCode();
+			if (context.data.name) {
+				context.data.name = String(context.data.name).trim();
+				context.data.nameNormalized = normalizeName(context.data.name);
+			}
+		});
+		this.on("before:update", async (context) => {
+			if (!context?.data) return;
+			if (context.data.name) {
+				context.data.name = String(context.data.name).trim();
+				context.data.nameNormalized = normalizeName(context.data.name);
+			}
+		});
+	}
+	/**
+	* One-time migration for rows written before `nameNormalized` existed.
+	*
+	* A pipeline update, so the value is derived from each document's own `name` in the database
+	* rather than read-modify-written per row. Rows that already carry a value are left alone: the
+	* filter is the guard, so a re-run is a no-op rather than a rewrite.
+	*/
+	async backfillNameNormalized() {
+		return { modifiedCount: (await this.Model.updateMany({ $or: [
+			{ nameNormalized: { $exists: false } },
+			{ nameNormalized: null },
+			{ nameNormalized: "" }
+		] }, [{ $set: { nameNormalized: { $toLower: { $trim: { input: "$name" } } } } }])).modifiedCount || 0 };
+	}
+};
+function createSupplierRepository(model, deps = {}) {
+	return new SupplierRepository(model, deps);
+}
+//#endregion
+export { SupplierRepository, createSupplierRepository };

package/dist/resources/supplier/supplier.resource.d.mts

@@ -0,0 +1,34 @@
+import { a as SupplierFacet, s as SupplierPermissions } from "../../supplier.model-BcAfgyHu.mjs";
+import { SupplierRepository } from "./supplier.repository.mjs";
+import { AnyRecord, defineResource } from "@classytic/arc";
+import { Model } from "mongoose";
+//#region src/resources/supplier/supplier.resource.d.ts
+interface SupplierResourceDeps<TSupplier extends SupplierFacet = SupplierFacet> {
+  model: Model<TSupplier>;
+  repository: SupplierRepository<TSupplier>;
+  permissions: SupplierPermissions;
+  /** Mount point. Default `/inventory/suppliers`. */
+  prefix?: string;
+  /** Extra filterable fields a country pack contributes (e.g. a tax-registration flag). */
+  extraFilterableFields?: Record<string, 'string' | 'boolean' | 'number'>;
+  /**
+   * The parser that ENFORCES which URL filter keys are accepted.
+   *
+   * `schemaOptions.query.filterableFields` below documents the filterable
+   * surface (OpenAPI, MCP tool schemas) — it does NOT reject anything. Measured
+   * on a live deployment: `GET /inventory/suppliers?nonsenseField=1` returned
+   * the full unfiltered page, HTTP 200, exactly like the request without it.
+   *
+   * That is the widening shape: an unrecognised filter key is dropped, so the
+   * caller asks for a narrower set and is answered with a broader one, with
+   * nothing to distinguish "nothing matched" from "your filter was discarded".
+   *
+   * Supply a parser with `allowedFilterFields` (mongokit's `invalidInput`
+   * defaults to `'throw'`) to turn an unlisted key into a 400 naming the field.
+   * Absent, behaviour is unchanged — this is additive.
+   */
+  queryParser?: Parameters<typeof defineResource>[0]['queryParser'];
+}
+declare function createSupplierResource<TSupplier extends SupplierFacet = SupplierFacet>(deps: SupplierResourceDeps<TSupplier>): import("@classytic/arc").ResourceDefinition<AnyRecord>;
+//#endregion
+export { SupplierResourceDeps, createSupplierResource };

package/dist/resources/supplier/supplier.resource.mjs

@@ -0,0 +1,129 @@
+import { r as asRecordRepository } from "../../entity-model-D-03ovSg.mjs";
+import { defineResource } from "@classytic/arc";
+import { ValidationError } from "@classytic/arc/utils";
+import { createMongooseAdapter } from "@classytic/mongokit/adapter";
+import { buildCrudSchemasFromModel } from "@classytic/mongokit/utils";
+//#region src/resources/supplier/supplier.resource.ts
+/**
+* Supplier resource — arc CRUD over the facet, plus the go-live bulk import.
+*
+* Lifted from be-prod. CRUD is entirely arc's: `create`/`update` stamp the actor and run the
+* sanitizer and hooks, `delete` soft-deletes through the repository plugin, and a subsequent GET
+* 404s on its own. There is no controller override — the previous host controller was a
+* `BaseController` subclass with an empty body whose only purpose was to carry
+* `schemaOptions` + `tenantField`, both of which belong on the resource.
+*
+* ## `tenantField: false` is load-bearing
+*
+* Suppliers are company-wide (the shared-partner rule), and the schema has no `organizationId`.
+* Without this, arc injects one on CREATE, mongoose's `strict: true` drops it, and every
+* subsequent read filters on the missing field — a 404 on every GET/PATCH/DELETE of a document
+* that was written successfully.
+*/
+/** Import batch ceiling. Row-by-row work is linear, so the cap bounds the request, not the loop. */
+const IMPORT_MAX_ROWS = 500;
+function createSupplierResource(deps) {
+	const { model, repository, permissions, prefix = "/inventory/suppliers", extraFilterableFields, queryParser } = deps;
+	/**
+	* Wire schemas derived FROM THE MODEL, so a country pack's `extraFields` are accepted without
+	* anyone remembering to widen a hand-written schema — and `strictAdditionalProperties` still
+	* refuses anything the schema does not declare.
+	*/
+	const parts = buildCrudSchemasFromModel(model, {
+		strictAdditionalProperties: true,
+		fieldRules: {
+			createdBy: { systemManaged: true },
+			updatedBy: { systemManaged: true },
+			nameNormalized: { systemManaged: true }
+		}
+	});
+	const crudSchemas = parts.crudSchemas ?? {
+		create: { body: parts.createBody },
+		update: { body: parts.updateBody },
+		get: { params: parts.params },
+		list: { querystring: parts.listQuery },
+		delete: { params: parts.params }
+	};
+	/**
+	* Bulk onboarding — row by row, with a per-row error report (Odoo `base_import` semantics).
+	*
+	* NOT arc's bulk preset, and the reason is specific: `createMany` / `insertMany` skip mongoose
+	* middleware and the repository hooks, so `nameNormalized` would be unset for every row and the
+	* FIRST batch would trip the partial unique index. Row-by-row also keeps the `uniqueField`
+	* validation and code generation live per row, and lets one bad row fail alone instead of
+	* aborting an operator's whole spreadsheet.
+	*/
+	const importHandler = async (req, reply) => {
+		const items = req.body?.items;
+		if (!Array.isArray(items) || items.length === 0) throw new ValidationError("Provide a non-empty items array");
+		if (items.length > IMPORT_MAX_ROWS) throw new ValidationError(`Maximum ${IMPORT_MAX_ROWS} items per import — split larger batches`);
+		const created = [];
+		const failed = [];
+		for (const [index, item] of items.entries()) try {
+			const doc = await repository.create(item);
+			created.push({
+				index,
+				_id: doc._id,
+				code: doc.code
+			});
+		} catch (error) {
+			failed.push({
+				index,
+				name: item?.name,
+				error: error.message
+			});
+		}
+		/**
+		* `400` only when EVERY row failed — that is a bad request. A partial success is a `201`
+		* carrying the failure list, because rows were in fact created and reporting the whole call
+		* as a failure would invite the operator to re-import the ones that already exist.
+		*/
+		return reply.code(failed.length === items.length ? 400 : 201).send({
+			createdCount: created.length,
+			failedCount: failed.length,
+			created,
+			failed
+		});
+	};
+	return defineResource({
+		...queryParser ? { queryParser } : {},
+		name: "supplier",
+		displayName: "Suppliers",
+		tag: "Inventory - Suppliers",
+		prefix,
+		audit: true,
+		tenantField: false,
+		adapter: createMongooseAdapter({
+			model,
+			repository: asRecordRepository(repository)
+		}),
+		customSchemas: {
+			...crudSchemas,
+			entity: parts.entitySchema ?? { type: "object" }
+		},
+		schemaOptions: { query: { filterableFields: {
+			name: "string",
+			code: "string",
+			type: "string",
+			paymentTerms: "string",
+			isActive: "boolean",
+			...extraFilterableFields ?? {}
+		} } },
+		permissions: {
+			list: permissions.view,
+			get: permissions.view,
+			create: permissions.manage,
+			update: permissions.manage,
+			delete: permissions.delete ?? permissions.manage
+		},
+		routes: [{
+			method: "POST",
+			path: "/import",
+			summary: `Bulk supplier import — per-row error report (max ${IMPORT_MAX_ROWS}/batch)`,
+			permissions: permissions.manage,
+			rawHandler: importHandler
+		}]
+	});
+}
+//#endregion
+export { createSupplierResource };

package/dist/resources/supplier/supplier.types.d.mts

@@ -0,0 +1,2 @@
+import { a as SupplierFacet, c as SupplierRefs, i as SupplierCodeGenerator, l as SupplierRepositoryDeps, o as SupplierModelDeps, s as SupplierPermissions } from "../../supplier.model-BcAfgyHu.mjs";
+export { SupplierCodeGenerator, SupplierFacet, SupplierModelDeps, SupplierPermissions, SupplierRefs, SupplierRepositoryDeps };

package/dist/resources/supplier/supplier.types.mjs

@@ -0,0 +1 @@
+export {};