@atlashub/smartstack-cli 3.8.0 → 3.10.0

package/templates/skills/application/references/test-frontend.md

@@ -0,0 +1,73 @@
+# Frontend Test Infrastructure & Generation
+
+> Reference for step-07-tests.md — Vitest + Testing Library + MSW setup and component test generation.
+
+## 1. Check Frontend Test Infrastructure
+
+Verify that the frontend project has Vitest + Testing Library configured:
+
+```bash
+# Check if vitest.config.ts exists in the web/frontend project
+ls {WebProjectPath}/vitest.config.ts 2>/dev/null
+```
+
+If NOT found, deploy the test infrastructure:
+
+### Install packages
+
+```bash
+cd {WebProjectPath}
+npm install -D vitest @testing-library/react @testing-library/jest-dom @testing-library/user-event jsdom msw
+```
+
+### Copy infrastructure files from SmartStack templates
+
+| Template Source | Destination |
+|----------------|-------------|
+| `templates/project/test-frontend/vitest.config.ts` | `{WebProjectPath}/vitest.config.ts` |
+| `templates/project/test-frontend/setup.ts` | `{WebProjectPath}/src/test/setup.ts` |
+| `templates/project/test-frontend/test-utils.tsx` | `{WebProjectPath}/src/test/test-utils.tsx` |
+| `templates/project/test-frontend/msw/server.ts` | `{WebProjectPath}/src/test/msw/server.ts` |
+| `templates/project/test-frontend/msw/handlers.ts` | `{WebProjectPath}/src/test/msw/handlers.ts` |
+
+### Add test scripts to `package.json` (if missing)
+
+```json
+{
+  "scripts": {
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "test:coverage": "vitest run --coverage"
+  }
+}
+```
+
+## 2. Generate Frontend Tests
+
+```
+Tool: mcp__smartstack__scaffold_frontend_tests
+Args:
+  name: "{entity_name}"
+  components: ["all"]
+  apiRoute: "/api/{entity_code}"
+```
+
+This generates:
+- `src/pages/{context}/{application}/__tests__/{EntityName}Page.test.tsx` - Page rendering, loading, error states
+- `src/pages/{context}/{application}/__tests__/{EntityName}ListView.test.tsx` - List display, pagination, view toggle
+- `src/pages/{context}/{application}/__tests__/{EntityName}DetailPage.test.tsx` - Detail view, tabs, back navigation
+- `src/hooks/__tests__/use{EntityName}Preferences.test.ts` - Preference get/set
+- `src/services/api/__tests__/{entityName}Api.test.ts` - API client calls with MSW
+
+## 3. Run Frontend Tests (BLOCKING)
+
+```bash
+cd {WebProjectPath}
+npx vitest run --reporter=default
+```
+
+**ALL frontend tests MUST pass.** If tests fail:
+1. Read the failure output carefully
+2. Fix the failing tests or the components they test
+3. Re-run until all tests pass
+4. Do NOT proceed to the next step until all tests are green

package/templates/skills/application/references/test-prerequisites.md

@@ -0,0 +1,72 @@
+# Test Infrastructure Prerequisites
+
+> Reference for step-07-tests.md — verify and scaffold test project before generating tests.
+
+## 1. Verify Test Project Exists
+
+```bash
+# Look for existing test project
+ls *Tests*/*.csproj 2>/dev/null || ls tests/*/*.csproj 2>/dev/null
+```
+
+If NO test project exists, create one:
+
+```bash
+dotnet new xunit -n {SolutionName}.Tests -o tests/{SolutionName}.Tests
+dotnet sln add tests/{SolutionName}.Tests/{SolutionName}.Tests.csproj
+```
+
+## 2. Required NuGet Packages
+
+| Package | Purpose |
+|---------|---------|
+| `xunit` | Test framework |
+| `FluentAssertions` | Assertion library |
+| `Moq` | Mocking framework |
+| `Microsoft.AspNetCore.Mvc.Testing` | Integration test support |
+| `Microsoft.EntityFrameworkCore.Sqlite` | SQLite in-memory for REAL integration tests |
+| `Microsoft.Data.Sqlite` | SQLite connection support |
+| `Microsoft.EntityFrameworkCore.InMemory` | In-memory DB for repository tests |
+| `FluentValidation.TestHelper` | Validator testing support |
+
+```bash
+cd tests/{SolutionName}.Tests
+dotnet add package FluentAssertions
+dotnet add package Moq
+dotnet add package Microsoft.AspNetCore.Mvc.Testing
+dotnet add package Microsoft.EntityFrameworkCore.Sqlite
+dotnet add package Microsoft.Data.Sqlite
+dotnet add package Microsoft.EntityFrameworkCore.InMemory
+dotnet add package FluentValidation.TestHelper
+```
+
+## 3. Project References
+
+The test project MUST reference the API project (for WebApplicationFactory):
+
+```bash
+cd tests/{SolutionName}.Tests
+dotnet add reference ../../src/{SolutionName}.Api/{SolutionName}.Api.csproj
+dotnet add reference ../../src/{SolutionName}.Application/{SolutionName}.Application.csproj
+dotnet add reference ../../src/{SolutionName}.Domain/{SolutionName}.Domain.csproj
+dotnet add reference ../../src/{SolutionName}.Infrastructure/{SolutionName}.Infrastructure.csproj
+```
+
+## 4. Program.cs Accessibility (BLOCKING)
+
+The API project's `Program` class must be accessible for `WebApplicationFactory<Program>`.
+
+Check if `Program.cs` ends with `public partial class Program { }`. If not, add it:
+
+```csharp
+// At the very end of Program.cs
+public partial class Program { }
+```
+
+**Alternatively**, add to the API `.csproj`:
+
+```xml
+<ItemGroup>
+  <InternalsVisibleTo Include="{SolutionName}.Tests" />
+</ItemGroup>
+```

package/templates/skills/application/steps/step-01-navigation.md

@@ -138,204 +138,13 @@ The SeedData files will be consumed by the `IClientSeedDataProvider` generated a
 
 ## FALLBACK PROCEDURE (When MCP Unavailable)
 
-> This procedure generates navigation seeds following SmartStack.app patterns.
-> Reference: `templates-seed.md` for code templates.
->
-> **Branch by Project Type:**
-> - If `{seeding_strategy}` = "hasdata" (core project): Follow F1-F8 below (existing pattern)
-> - If `{seeding_strategy}` = "provider" (client project): Follow **CLIENT PROJECT HANDLING** above (create SeedData classes only, no HasData)
-
-### F1. Read Existing Configuration Files
-
-**CRITICAL:** Before generating any code, read existing files to determine state:
-
-1. **Find the Navigation Configuration directory:**
-   ```
-   Glob: **/Persistence/Configurations/Navigation/Navigation*Configuration.cs
-   ```
-
-2. **Read NavigationTranslationConfiguration.cs** - Find the last GUID index:
-   ```
-   Search for: the last call to GenerateGuid(index++)
-   The index variable starts at 1 and increments per translation entry.
-   Your new translations MUST continue from the next index value.
-   ```
-
-3. **Read Navigation{Level}Configuration.cs** - Check existing entities:
-   ```
-   Read the Configuration for the target level (Context, Application, Module, Section).
-   Check if it already references a SeedData class: builder.HasData(Navigation{Level}SeedData.GetSeedData())
-   If yes: Read the corresponding SeedData class to find existing entries.
-   If no: You will need to add HasData() call.
-   ```
-
-4. **Read existing SeedData files** (if they exist):
-   ```
-   Glob: **/Seeding/Data/Navigation/Navigation{Level}SeedData.cs
-   Check for existing entity IDs to avoid collisions.
-   ```
-
-### F2. Determine Parent GUID
-
-For non-context levels, find the parent entity GUID:
-
-| Level | Parent | Where to Find Parent GUID |
-|-------|--------|---------------------------|
-| application | context | `NavigationContextSeedData.cs` → e.g. `PlatformContextId` |
-| module | application | `NavigationApplicationSeedData.cs` → e.g. `AdministrationAppId` |
-| section | module | `NavigationModuleSeedData.cs` → e.g. `UsersModuleId` |
-
-Read the parent SeedData class and find the GUID matching `{parent_path}`.
-
-### F3. Generate Navigation Entity GUID
-
-Generate a deterministic GUID for the new navigation entity:
-
-```csharp
-// Use SHA256 hash of the full_path for deterministic generation
-using var sha256 = System.Security.Cryptography.SHA256.Create();
-var hash = sha256.ComputeHash(Encoding.UTF8.GetBytes("navigation-{level}-{full_path}"));
-var guid = new Guid(hash.Take(16).ToArray());
-```
-
-**Rules:**
-- NEVER use `Guid.NewGuid()`
-- Read existing SeedData GUIDs to verify no collision
-- Store result as `{navigation_guid}`
-
-### F4. Write Navigation Entity Seed
-
-Based on `{level}`, write the seed entry.
-
-**Option A: Project uses SeedData classes (SmartStack.app pattern)**
-
-If `Navigation{Level}SeedData.cs` exists, add the new entity:
-
-```csharp
-// In Infrastructure/Persistence/Seeding/Data/Navigation/Navigation{Level}SeedData.cs
-
-// Add static GUID field
-public static readonly Guid {PascalCode}Id = Guid.Parse("{navigation_guid}");
-
-// Add to GetSeedData() return array
-new {
-    Id = {PascalCode}Id,
-    ParentFk = Navigation{ParentLevel}SeedData.{ParentPascalCode}Id,  // FK varies by level
-    Code = "{code}",
-    Label = "{labels.en}",
-    Description = "{descriptions.en}",
-    Icon = "{icon}",
-    IconType = IconType.Lucide,
-    Route = "/{full_path_with_slashes}",
-    DisplayOrder = {display_order},
-    IsActive = true,
-    CreatedAt = SeedConstants.SeedDate
-}
-```
-
-**FK property by level:**
-
-| Level | FK Property | References |
-|-------|-------------|------------|
-| context | (none) | - |
-| application | `ContextId` | NavigationContextSeedData.{Parent}Id |
-| module | `ApplicationId` | NavigationApplicationSeedData.{Parent}Id |
-| section | `ModuleId` | NavigationModuleSeedData.{Parent}Id |
-
-**Option B: Project uses inline HasData**
-
-If no SeedData class exists, add directly to `Navigation{Level}Configuration.cs`:
-
-```csharp
-// In Configure method, add:
-builder.HasData(new {
-    Id = Guid.Parse("{navigation_guid}"),
-    // ... same properties as Option A
-});
-```
-
-### F5. Write Translation Entries
-
-Add 4 translation entries to `NavigationTranslationConfiguration.cs`:
-
-1. Read the file to find the current highest `index` value
-2. Continue from `index + 1`
-3. Use the SAME `GenerateGuid` method already defined in the file:
-
-```csharp
-// In GetSeedData() method, add at the end before return:
-
-// {level}: {code} translations
-translations.Add(new {
-    Id = GenerateGuid(index++),
-    EntityType = NavigationEntityType.{Level},
-    EntityId = Navigation{Level}SeedData.{PascalCode}Id,  // or Guid.Parse("{navigation_guid}")
-    LanguageCode = "fr",
-    Label = "{labels.fr}",
-    Description = "{descriptions.fr}",
-    CreatedAt = seedDate
-});
-translations.Add(new {
-    Id = GenerateGuid(index++),
-    EntityType = NavigationEntityType.{Level},
-    EntityId = Navigation{Level}SeedData.{PascalCode}Id,
-    LanguageCode = "en",
-    Label = "{labels.en}",
-    Description = "{descriptions.en}",
-    CreatedAt = seedDate
-});
-translations.Add(new {
-    Id = GenerateGuid(index++),
-    EntityType = NavigationEntityType.{Level},
-    EntityId = Navigation{Level}SeedData.{PascalCode}Id,
-    LanguageCode = "it",
-    Label = "{labels.it}",
-    Description = "{descriptions.it}",
-    CreatedAt = seedDate
-});
-translations.Add(new {
-    Id = GenerateGuid(index++),
-    EntityType = NavigationEntityType.{Level},
-    EntityId = Navigation{Level}SeedData.{PascalCode}Id,
-    LanguageCode = "de",
-    Label = "{labels.de}",
-    Description = "{descriptions.de}",
-    CreatedAt = seedDate
-});
-```
-
-### F6. Store Result
-
-```
-{navigation_guid} = [generated GUID]
-{seed_method} = "fallback"  // Indicates MCP was not used
-```
-
-### F7. Validation Checklist
-
-Before proceeding, verify:
-- [ ] Deterministic GUID generated (not NewGuid())
-- [ ] 4 languages present (fr, en, it, de)
-- [ ] Translation index continues existing sequence (no gaps, no collisions)
-- [ ] Parent GUID correctly references existing entity
-- [ ] Route path matches `/{context}/{app}/{module}` pattern
-- [ ] DisplayOrder is consistent with existing entities
-- [ ] Code is WRITTEN to files, not just displayed
-
-### F8. Present Summary
-
-```markdown
-## Navigation Seeds Generated (Fallback)
-
-**Entity:** {level} - {code}
-**GUID:** {navigation_guid}
-**Path:** {full_path}
-
-### Files Updated
-
-1. **Navigation{Level}SeedData.cs** (or Configuration.cs) - New entity entry
-2. **NavigationTranslationConfiguration.cs** - 4 translation entries added
-```
+See [references/nav-fallback-procedure.md](../references/nav-fallback-procedure.md) for the complete 8-step fallback:
+- **F1:** Read existing Configuration/SeedData files to determine state
+- **F2:** Determine parent GUID by level
+- **F3:** Generate deterministic GUID (SHA256, never NewGuid())
+- **F4:** Write navigation entity seed (SeedData class or inline HasData)
+- **F5:** Write 4 translation entries (continue existing index sequence)
+- **F6-F8:** Store result, validation checklist, summary
 
 ---
 

package/templates/skills/application/steps/step-03-roles.md

@@ -1,23 +1,29 @@
 ---
 name: step-03-roles
-description: Generate role-permission mappings using MCP scaffold_role_permissions (with fallback)
+description: Generate application roles and role-permission mappings using MCP scaffold_role_permissions (with fallback)
 prev_step: steps/step-02-permissions.md
 next_step: steps/step-03b-provider.md
 ---
 
-# Step 3: Role-Permission Mapping
+# Step 3: Application Roles & Role-Permission Mapping
 
 ## MANDATORY EXECUTION RULES
 
+- For **client projects** (`seeding_strategy = "provider"`): Generate ApplicationRolesSeedData.cs and module role mappings
+- For **core projects** (`seeding_strategy = "hasdata"`): Use RolePermissionConfiguration.cs
 - PREFER MCP `scaffold_role_permissions` tool as the primary method
 - If MCP is unavailable or the call fails, use the FALLBACK PROCEDURE below
 - ALWAYS assign permissions to default roles
 - NEVER leave permissions without role assignments
-- ALWAYS WRITE generated code to the actual RolePermissionConfiguration.cs file
+- ALWAYS WRITE generated code to the actual files
 
 ## YOUR TASK
 
-Generate role-permission mappings:
+For **client projects**:
+1. **ApplicationRolesSeedData.cs** (once per application) — defines the 4 application-scoped roles
+2. **{Module}RolePermissionSeedData.cs** (per module) — maps permissions to roles by Code
+
+For **core projects**:
 1. RolePermissionConfiguration.cs HasData() entries
 2. Default role assignments (SuperAdmin, PlatformAdmin, TenantAdmin, StandardUser)
 3. Application-scoped role assignments (Admin, Manager, Contributor, Viewer)
@@ -131,13 +137,38 @@ If MCP call fails or `{mcp_available}` = false:
 **For core (`{seeding_strategy}` = "hasdata"):** Write in RolePermissionConfiguration.cs (existing pattern)
 
 **For client (`{seeding_strategy}` = "provider"):** DO NOT write in RolePermissionConfiguration.cs (does not exist in client projects).
-Instead, create:
-- `Infrastructure/Persistence/Seeding/Data/{Domain}/{Module}RolePermissionSeedData.cs`
+
+Instead, create TWO files:
+
+### 1. ApplicationRolesSeedData.cs (ONCE per application)
+
+**File:** `Infrastructure/Persistence/Seeding/Data/ApplicationRolesSeedData.cs`
+
+**Purpose:** Defines the 4 standard application-scoped roles (Admin, Manager, Contributor, Viewer) with valid `Code` values.
+
+**CRITICAL:** Without this file, role-permission mappings in `SeedRolePermissionsAsync()` will fail silently because `roles.FirstOrDefault(r => r.Code == mapping.RoleCode)` will return null.
+
+See [references/application-roles-template.md](../references/application-roles-template.md) for the complete template.
+
+**Key requirements:**
+- Deterministic GUIDs based on `role-{applicationId}-{roleType}`
+- 4 roles: Admin, Manager, Contributor, Viewer
+- Each role has a valid `Code` property ("admin", "manager", "contributor", "viewer")
+- `ApplicationId` references the navigation application GUID
+- `IsSystem = false` (application-scoped, not system roles)
+
+**Detection:** Check if ApplicationRolesSeedData.cs exists. If yes, skip creation (already exists from Module 1). If no, create it.
+
+### 2. {Module}RolePermissionSeedData.cs (PER module)
+
+**File:** `Infrastructure/Persistence/Seeding/Data/{Domain}/{Module}RolePermissionSeedData.cs`
+
+**Purpose:** Maps permissions to roles by Code (e.g., "admin" → "{navRoute}.*").
 
 Content: static class with method `GetRolePermissionEntries()` that returns the role-permission mapping data.
 These entries will be consumed by the `IClientSeedDataProvider` at step 03b.
 
-**After creating RolePermission SeedData:** Proceed to step-03b-provider.md (which will skip for core projects).
+**After creating both files:** Proceed to step-03b-provider.md (which will skip for core projects).
 
 ---
 
@@ -280,6 +311,13 @@ If user selects "Custom adjustments", ask which roles/permissions to change and
 
 ## SUCCESS METRICS
 
+**For client projects:**
+- ApplicationRolesSeedData.cs created (once per application)
+- {Module}RolePermissionSeedData.cs created with role-permission mappings
+- All 4 application roles defined with valid Code values
+- Proceeded to step-03b-provider.md
+
+**For core projects:**
 - Role-permission mappings generated (via MCP or fallback)
 - RolePermissionConfiguration.cs WRITTEN with new entries
 - All default roles have appropriate access

package/templates/skills/application/steps/step-03b-provider.md

@@ -49,134 +49,11 @@ From previous steps:
 
 ## FILES TO GENERATE
 
-### 1. The Provider Class
-
-**Location:** `Infrastructure/Persistence/Seeding/{AppPascalName}SeedDataProvider.cs`
-
-Where `{AppPascalName}` is derived from the application code (e.g., `free-bike` -> `FreeBike`).
-
-**Pattern:**
-
-```csharp
-using Microsoft.EntityFrameworkCore;
-using SmartStack.Application.Common.Interfaces;
-using SmartStack.Domain.Navigation;
-using SmartStack.Domain.Platform.Administration.Roles;
-
-namespace {BaseNamespace}.Infrastructure.Persistence.Seeding;
-
-/// <summary>
-/// Seeds {AppLabel} navigation, permissions, and role-permission data
-/// into the SmartStack Core schema at application startup.
-/// Implements <see cref="IClientSeedDataProvider"/> for runtime seeding
-/// (no Core migrations required).
-/// </summary>
-public class {AppPascalName}SeedDataProvider : IClientSeedDataProvider
-{
-    public int Order => 100;
-
-    public async Task SeedNavigationAsync(ICoreDbContext context, CancellationToken ct)
-    {
-        // Check idempotence
-        var exists = await context.NavigationApplications
-            .AnyAsync(a => a.Code == "{app_code}", ct);
-        if (exists) return;
-
-        // 1. Retrieve the parent context ("business", "platform", etc.)
-        var parentContext = await context.NavigationContexts
-            .FirstAsync(c => c.Code == "{context_code}", ct);
-
-        // 2. Create the application
-        var app = NavigationApplication.Create(
-            parentContext.Id,
-            "{app_code}",
-            "{app_label_en}",
-            "{app_desc_en}",
-            "{app_icon}",
-            IconType.Lucide,
-            "/{context_code}/{app_code}",
-            {display_order});
-        context.NavigationApplications.Add(app);
-        await ((DbContext)context).SaveChangesAsync(ct);
-
-        // 3. Create modules
-        // Use GUIDs and data from {Module}NavigationSeedData.cs
-        foreach (var moduleData in GetModuleSeedEntries(app.Id))
-        {
-            var module = NavigationModule.Create(
-                moduleData.ApplicationId,
-                moduleData.Code,
-                moduleData.Label,
-                moduleData.Description,
-                moduleData.Icon,
-                IconType.Lucide,
-                moduleData.Route,
-                moduleData.DisplayOrder);
-            context.NavigationModules.Add(module);
-        }
-        await ((DbContext)context).SaveChangesAsync(ct);
-
-        // 4. Create translations (4 languages per entity)
-        // Use data from {Module}NavigationTranslationSeedData.cs
-        // ...
-        await ((DbContext)context).SaveChangesAsync(ct);
-    }
-
-    public async Task SeedPermissionsAsync(ICoreDbContext context, CancellationToken ct)
-    {
-        // Check idempotence
-        var exists = await context.Permissions
-            .AnyAsync(p => p.Path == "{full_path}.*", ct);
-        if (exists) return;
-
-        // Retrieve modules by Code for FK resolution
-        // Use data from {Module}PermissionSeedData.cs
-        // Create via Permission.CreateForModule(...) and Permission.CreateWildcard(...)
-        // ...
-        await ((DbContext)context).SaveChangesAsync(ct);
-    }
-
-    public async Task SeedRolePermissionsAsync(ICoreDbContext context, CancellationToken ct)
-    {
-        // Check idempotence
-        var exists = await context.RolePermissions
-            .AnyAsync(rp => rp.Permission!.Path.StartsWith("{full_path}."), ct);
-        if (exists) return;
-
-        // Retrieve existing roles and created permissions
-        // Use data from {Module}RolePermissionSeedData.cs
-        // Create via RolePermission.Create(roleId, permissionId, "system")
-        // ...
-        await ((DbContext)context).SaveChangesAsync(ct);
-    }
-
-    // Private helper methods fed by SeedData classes
-    // ...
-}
-```
-
-### 2. DI Registration
-
-Modify `Infrastructure/DependencyInjection.cs` of the client project:
-
-```csharp
-// Add using:
-using SmartStack.Application.Common.Interfaces;
-
-// In the registration method:
-services.AddScoped<IClientSeedDataProvider, {AppPascalName}SeedDataProvider>();
-```
-
----
-
-## CRITICAL RULES
-
-1. **Factory methods mandatory**: `NavigationModule.Create(...)`, `Permission.CreateForModule(...)`, `RolePermission.Create(...)` - NEVER `new Entity()`
-2. **Idempotence**: Each Seed method checks existence before inserting
-3. **SaveChangesAsync per group**: Navigation -> save -> Permissions -> save -> RolePermissions -> save
-4. **Deterministic GUIDs**: Use IDs from SeedData classes (not Guid.NewGuid())
-5. **Resolve FK by Code**: Parent modules are found by `Code`, not hardcoded GUID
-6. **Order property**: Use `100` as default. If multiple providers exist, they run in Order sequence
+See [references/provider-template.md](../references/provider-template.md) for the complete implementation:
+- **ApplicationRolesSeedData.cs** (once per application) — defines application-scoped roles (Admin, Manager, Contributor, Viewer)
+- **Provider class** (`{AppPascalName}SeedDataProvider.cs`) with 4 seed methods (Navigation, Roles, Permissions, RolePermissions)
+- **DI registration** pattern for `Infrastructure/DependencyInjection.cs`
+- **7 critical rules** (factory methods, idempotence, execution order, SaveChangesAsync order, deterministic GUIDs, FK by Code, Order property)
 
 ---
 
@@ -188,9 +65,11 @@ Identify all SeedData files created in previous steps:
 
 ```
 Glob: **/Persistence/Seeding/Data/{Domain}/*SeedData.cs
+Glob: **/Persistence/Seeding/Data/ApplicationRolesSeedData.cs
 ```
 
 Expected files:
+- `ApplicationRolesSeedData.cs` (application-level, once per app)
 - `{Module}NavigationSeedData.cs` (from step 01)
 - `{Module}NavigationTranslationSeedData.cs` (from step 01)
 - `{Module}PermissionSeedData.cs` (from step 02)
@@ -220,9 +99,11 @@ Add the `IClientSeedDataProvider` registration.
 ### 4. Verify
 
 Before proceeding to step-04, verify:
-- [ ] Provider generated with 3 methods (SeedNavigationAsync, SeedPermissionsAsync, SeedRolePermissionsAsync)
+- [ ] ApplicationRolesSeedData.cs created (once per application)
+- [ ] Provider generated with 4 methods (SeedNavigationAsync, SeedRolesAsync, SeedPermissionsAsync, SeedRolePermissionsAsync)
+- [ ] Execution order: Navigation → Roles → Permissions → RolePermissions
 - [ ] Registered in DI (`services.AddScoped<IClientSeedDataProvider, ...>()`)
-- [ ] Consumes SeedData classes from steps 01-03
+- [ ] Consumes SeedData classes from steps 01-03 + ApplicationRolesSeedData
 - [ ] Idempotent (check existence before insert)
 - [ ] Uses factory methods (no `new Entity()`)
 
@@ -230,9 +111,11 @@ Before proceeding to step-04, verify:
 
 ## SUCCESS METRICS
 
-- Provider class generated with all 3 seed methods
+- ApplicationRolesSeedData.cs created (application-level)
+- Provider class generated with all 4 seed methods (Navigation, Roles, Permissions, RolePermissions)
+- Correct execution order enforced
 - DI registration added
-- SeedData classes from steps 01-03 properly consumed
+- SeedData classes from steps 01-03 + ApplicationRolesSeedData properly consumed
 - All methods are idempotent
 - Factory methods used throughout
 - Proceeded to step-04-backend.md