@naisys/erp 3.0.0-beta.45 → 3.0.0-beta.47

package/dist/routes/{step-run-transitions.js → steps/step-run-transitions.js}

@@ -1,11 +1,11 @@
 import { ErrorResponseSchema, StepRunTransitionSlimSchema, TransitionNoteSchema, } from "@naisys/erp-shared";
 import { z } from "zod/v4";
-import { requirePermission } from "../auth-middleware.js";
-import { conflict, notFound, unprocessable } from "../error-handler.js";
-import { checkOpRunInProgress, checkOrderRunStarted, checkWorkCenterAccess, mutationResult, resolveStepRun, } from "../route-helpers.js";
-import { validateCompletionFields } from "../services/field-value-service.js";
-import { isUserClockedIn } from "../services/labor-ticket-service.js";
-import { getStepRunWithFields, updateStepRun, } from "../services/step-run-service.js";
+import { conflict, notFound, unprocessable } from "../../error-handler.js";
+import { requirePermission } from "../../middleware/auth-middleware.js";
+import { checkOpRunInProgress, checkOrderRunStarted, checkWorkCenterAccess, mutationResult, resolveStepRun, } from "../../route-helpers.js";
+import { getStepRunWithFields, updateStepRun, } from "../../services/operations/step-run-service.js";
+import { validateCompletionFields } from "../../services/production/field-value-service.js";
+import { isUserClockedIn } from "../../services/production/labor-ticket-service.js";
 import { formatStepRunTransition } from "./step-runs.js";
 const StepSeqNoParamsSchema = z.object({
     orderKey: z.string(),

package/dist/routes/{step-runs.js → steps/step-runs.js}

@@ -1,12 +1,12 @@
 import { ErrorResponseSchema, fieldTypeString, getValueFormatHint, OperationRunStatus, StepRunListQuerySchema, StepRunListResponseSchema, StepRunSchema, } from "@naisys/erp-shared";
 import { z } from "zod/v4";
-import { hasPermission } from "../auth-middleware.js";
-import { notFound } from "../error-handler.js";
-import { API_PREFIX, selfLink } from "../hateoas.js";
-import { checkWorkCenterAccess, childItemLinks, formatAuditFields, resolveActions, resolveOpRun, resolveStepRun, } from "../route-helpers.js";
-import { deserializeFieldValue, validateCompletionFields, validateFieldValue, } from "../services/field-value-service.js";
-import { isUserClockedIn } from "../services/labor-ticket-service.js";
-import { getStepRunWithFields, listStepRuns, listStepRunsWithFields, } from "../services/step-run-service.js";
+import { notFound } from "../../error-handler.js";
+import { API_PREFIX, selfLink } from "../../hateoas.js";
+import { hasPermission } from "../../middleware/auth-middleware.js";
+import { checkWorkCenterAccess, childItemLinks, formatAuditFields, resolveActions, resolveOpRun, resolveStepRun, } from "../../route-helpers.js";
+import { getStepRunWithFields, listStepRuns, listStepRunsWithFields, } from "../../services/operations/step-run-service.js";
+import { deserializeFieldValue, validateCompletionFields, validateFieldValue, } from "../../services/production/field-value-service.js";
+import { isUserClockedIn } from "../../services/production/labor-ticket-service.js";
 export function stepRunResource(orderKey, runNo, seqNo) {
     return `orders/${orderKey}/runs/${runNo}/ops/${seqNo}/steps`;
 }

package/dist/routes/{steps.js → steps/steps.js}

@@ -1,10 +1,10 @@
 import { BatchCreateStepSchema, BatchSeqNoCreateResponseSchema, CreateStepSchema, ErrorResponseSchema, MutateResponseSchema, RevisionStatus, SeqNoCreateResponseSchema, StepListResponseSchema, StepSchema, UpdateStepSchema, } from "@naisys/erp-shared";
 import { z } from "zod/v4";
-import { requirePermission } from "../auth-middleware.js";
-import { conflict, notFound } from "../error-handler.js";
-import { API_PREFIX, selfLink } from "../hateoas.js";
-import { calcNextSeqNo, childItemLinks, draftCrudActions, formatAuditFields, mutationResult, resolveActions, resolveOperation, } from "../route-helpers.js";
-import { createStep, createSteps, deleteStep, findExisting, getStep, listSteps, updateStep, } from "../services/step-service.js";
+import { conflict, notFound } from "../../error-handler.js";
+import { API_PREFIX, selfLink } from "../../hateoas.js";
+import { requirePermission } from "../../middleware/auth-middleware.js";
+import { calcNextSeqNo, childItemLinks, draftCrudActions, formatAuditFields, mutationResult, resolveActions, resolveOperation, } from "../../route-helpers.js";
+import { createStep, createSteps, deleteStep, findExisting, getStep, listSteps, updateStep, } from "../../services/operations/step-service.js";
 import { formatFieldListResponse } from "./step-fields.js";
 const ParamsSchema = z.object({
     orderKey: z.string(),

package/dist/routes/{auth.js → users/auth.js}

@@ -3,10 +3,10 @@ import { AuthUserSchema, ErrorResponseSchema, LoginRequestSchema, LoginResponseS
 import { deleteSession } from "@naisys/supervisor-database";
 import bcrypt from "bcryptjs";
 import { randomUUID } from "crypto";
-import { authCache } from "../auth-middleware.js";
-import erpDb from "../erpDb.js";
-import { unauthorized } from "../error-handler.js";
-import { isSupervisorAuth } from "../supervisorAuth.js";
+import erpDb from "../../database/erpDb.js";
+import { unauthorized } from "../../error-handler.js";
+import { authCache } from "../../middleware/auth-middleware.js";
+import { isSupervisorAuth } from "../../middleware/supervisorAuth.js";
 const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
 export default function authRoutes(fastify) {
     const app = fastify.withTypeProvider();

package/dist/routes/{user-permissions.js → users/user-permissions.js}

@@ -1,9 +1,9 @@
 import { ErpPermissionEnum, GrantPermissionSchema } from "@naisys/erp-shared";
 import { z } from "zod/v4";
-import { authCache, requirePermission } from "../auth-middleware.js";
-import { mutationResult } from "../route-helpers.js";
-import { getUserById, getUserByUsername, grantPermission, hasUserApiKey, revokePermission, rotateUserApiKey, } from "../services/user-service.js";
-import { isSupervisorAuth } from "../supervisorAuth.js";
+import { authCache, requirePermission, } from "../../middleware/auth-middleware.js";
+import { isSupervisorAuth } from "../../middleware/supervisorAuth.js";
+import { mutationResult } from "../../route-helpers.js";
+import { getUserById, getUserByUsername, grantPermission, hasUserApiKey, revokePermission, rotateUserApiKey, } from "../../services/user-service.js";
 import { formatUser } from "./users.js";
 export default function userPermissionRoutes(fastify) {
     const app = fastify.withTypeProvider();

package/dist/routes/{users.js → users/users.js}

@@ -1,11 +1,11 @@
 import { ChangePasswordSchema, CreateAgentUserSchema, CreateUserSchema, UpdateUserSchema, } from "@naisys/erp-shared";
 import { getHubAgentById } from "@naisys/hub-database";
 import { z } from "zod/v4";
-import { authCache, hasPermission, requirePermission, } from "../auth-middleware.js";
-import { API_PREFIX, collectionLink, paginationLinks, schemaLink, selfLink, } from "../hateoas.js";
-import { mutationResult } from "../route-helpers.js";
-import { createUserForAgent, createUserWithPassword, deleteUser, getUserByUsername, getUserByUuid, hasUserApiKey, listUsers, updateUser, } from "../services/user-service.js";
-import { isSupervisorAuth } from "../supervisorAuth.js";
+import { API_PREFIX, collectionLink, paginationLinks, schemaLink, selfLink, } from "../../hateoas.js";
+import { authCache, hasPermission, requirePermission, } from "../../middleware/auth-middleware.js";
+import { isSupervisorAuth } from "../../middleware/supervisorAuth.js";
+import { mutationResult } from "../../route-helpers.js";
+import { createUserForAgent, createUserWithPassword, deleteUser, getUserByUsername, getUserByUuid, hasUserApiKey, listUsers, updateUser, } from "../../services/user-service.js";
 function userItemLinks(username) {
     return [
         selfLink(`/users/${username}`),

package/dist/services/attachment-service.js

@@ -2,7 +2,7 @@ import { MAX_ATTACHMENT_SIZE } from "@naisys/common";
 import { createHash, randomBytes } from "crypto";
 import { createWriteStream, existsSync, mkdirSync, renameSync, unlinkSync, } from "fs";
 import { join } from "path";
-import erpDb from "../erpDb.js";
+import erpDb from "../database/erpDb.js";
 function attachmentsDir() {
     return join(process.env.NAISYS_FOLDER || "", "attachments");
 }

package/dist/services/{item-instance-service.js → inventory/item-instance-service.js}

@@ -1,5 +1,5 @@
-import erpDb from "../erpDb.js";
-import { includeUsers } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { includeUsers } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 export const includeItemInstanceRelations = {
     ...includeUsers,

package/dist/services/{item-service.js → inventory/item-service.js}

@@ -1,5 +1,5 @@
-import erpDb from "../erpDb.js";
-import { includeUsers } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { includeUsers } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 export const includeUsersAndFieldSet = {
     ...includeUsers,

package/dist/services/{operation-dependency-service.js → operations/operation-dependency-service.js}

@@ -1,4 +1,4 @@
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 const depInclude = {
     predecessor: { select: { seqNo: true, title: true } },
     createdBy: { select: { username: true } },

package/dist/services/{operation-run-comment-service.js → operations/operation-run-comment-service.js}

@@ -1,4 +1,4 @@
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 // --- Prisma include & result type ---
 export const includeComment = {
     createdBy: { select: { username: true } },

package/dist/services/{operation-run-service.js → operations/operation-run-service.js}

@@ -1,9 +1,9 @@
 import { OperationRunStatus as OperationRunStatusValues, } from "@naisys/erp-shared";
 import { fieldTypeString, getValueFormatHint, } from "@naisys/erp-shared";
+import erpDb from "../../database/erpDb.js";
+import { API_PREFIX } from "../../hateoas.js";
 import { writeAuditEntry } from "../audit.js";
-import erpDb from "../erpDb.js";
-import { API_PREFIX } from "../hateoas.js";
-import { deserializeFieldValue, validateFieldValue, } from "./field-value-service.js";
+import { deserializeFieldValue, validateFieldValue, } from "../production/field-value-service.js";
 // --- Prisma include & result type ---
 export const includeOp = {
     operation: {

package/dist/services/{operation-service.js → operations/operation-service.js}

@@ -1,5 +1,5 @@
-import erpDb from "../erpDb.js";
-import { calcNextSeqNo, includeUsers, } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { calcNextSeqNo, includeUsers, } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 const includeWorkCenter = {
     workCenter: { select: { key: true } },

package/dist/services/{step-run-service.js → operations/step-run-service.js}

@@ -1,4 +1,4 @@
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 // --- Prisma include & result type ---
 export const includeStepRunWithFields = {
     step: {

package/dist/services/{step-service.js → operations/step-service.js}

@@ -1,5 +1,5 @@
-import erpDb from "../erpDb.js";
-import { calcNextSeqNo, includeUsers, } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { calcNextSeqNo, includeUsers, } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 export const includeUsersAndFields = {
     ...includeUsers,

package/dist/services/{order-revision-service.js → orders/order-revision-service.js}

@@ -1,7 +1,7 @@
 import { RevisionStatus as RevisionStatusValues, } from "@naisys/erp-shared";
+import erpDb from "../../database/erpDb.js";
+import { includeUsers } from "../../route-helpers.js";
 import { writeAuditEntry } from "../audit.js";
-import erpDb from "../erpDb.js";
-import { includeUsers } from "../route-helpers.js";
 // --- Prisma include & result type ---
 const includeRevisionRelations = {
     ...includeUsers,

package/dist/services/{order-run-service.js → orders/order-run-service.js}

@@ -1,7 +1,7 @@
 import { OperationRunStatus as OperationRunStatusValues, OrderRunStatus as OrderRunStatusValues, } from "@naisys/erp-shared";
+import erpDb from "../../database/erpDb.js";
 import { writeAuditEntry } from "../audit.js";
-import erpDb from "../erpDb.js";
-import { deserializeFieldValue, upsertFieldValue, validateFieldSet, } from "./field-value-service.js";
+import { deserializeFieldValue, upsertFieldValue, validateFieldSet, } from "../production/field-value-service.js";
 // --- Prisma include & result type ---
 export const includeRev = {
     orderRev: { select: { revNo: true, description: true } },

package/dist/services/{order-service.js → orders/order-service.js}

@@ -1,6 +1,6 @@
 import { RevisionStatus } from "@naisys/erp-shared";
-import erpDb from "../erpDb.js";
-import { includeUsers } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { includeUsers } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 const includeOrderRelations = {
     ...includeUsers,

package/dist/services/{revision-diff-service.js → orders/revision-diff-service.js}

@@ -1,4 +1,4 @@
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 // --- Prisma deep include for full revision tree ---
 const includeFullTree = {
     operations: {

package/dist/services/{field-ref-service.js → production/field-ref-service.js}

@@ -1,4 +1,4 @@
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 const includeFieldRef = {
     sourceStep: {
         select: {

package/dist/services/{field-service.js → production/field-service.js}

@@ -1,6 +1,6 @@
 import { FieldType } from "@naisys/erp-shared";
-import erpDb from "../erpDb.js";
-import { calcNextSeqNo, includeUsers, } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { calcNextSeqNo, includeUsers, } from "../../route-helpers.js";
 // --- Lookups ---
 export async function listFields(fieldSetId) {
     return erpDb.field.findMany({

package/dist/services/{field-value-service.js → production/field-value-service.js}

@@ -1,6 +1,6 @@
 import { formatFileSize } from "@naisys/common";
 import { FieldType, } from "@naisys/erp-shared";
-import erpDb from "../erpDb.js";
+import erpDb from "../../database/erpDb.js";
 // --- Lookups ---
 export async function findStepRunWithField(id, opRunId, fieldSeqNo) {
     const stepRun = await erpDb.stepRun.findUnique({

package/dist/services/{labor-ticket-service.js → production/labor-ticket-service.js}

@@ -1,6 +1,6 @@
 import { getLatestRunInfoByUuid, sumCostsByUuid } from "@naisys/hub-database";
+import erpDb from "../../database/erpDb.js";
 import { writeAuditEntry } from "../audit.js";
-import erpDb from "../erpDb.js";
 // --- Prisma include & result type ---
 export const includeLaborTicket = {
     user: { select: { username: true } },

package/dist/services/{work-center-service.js → production/work-center-service.js}

@@ -1,5 +1,5 @@
-import erpDb from "../erpDb.js";
-import { includeUsers } from "../route-helpers.js";
+import erpDb from "../../database/erpDb.js";
+import { includeUsers } from "../../route-helpers.js";
 // --- Prisma include & result type ---
 const includeDetail = {
     ...includeUsers,

package/dist/services/user-service.js

@@ -1,7 +1,9 @@
+import { SUPER_ADMIN_USERNAME } from "@naisys/common";
 import { generatePersistentUserApiKey } from "@naisys/common-node";
+import { ensureSuperAdmin } from "@naisys/supervisor-database";
 import bcrypt from "bcryptjs";
 import { randomUUID } from "crypto";
-import erpDb from "../erpDb.js";
+import erpDb from "../database/erpDb.js";
 // --- Prisma include & result type ---
 export const includePermissions = {
     permissions: true,
@@ -112,4 +114,85 @@ export async function rotateUserApiKey(id) {
         }),
     });
 }
+// --- Superadmin bootstrap ---
+/**
+ * Ensure a superadmin user exists in the local ERP database.
+ * If a password is supplied, it is used on create and updates the existing one if present.
+ * For standalone mode (no supervisor auth).
+ */
+export async function ensureLocalSuperAdmin(password) {
+    const existing = await erpDb.user.findUnique({
+        where: { username: SUPER_ADMIN_USERNAME },
+    });
+    if (existing) {
+        await ensureErpAdminPermission(existing.id);
+        if (password) {
+            const hash = await bcrypt.hash(password, SALT_ROUNDS);
+            await erpDb.user.update({
+                where: { id: existing.id },
+                data: { passwordHash: hash },
+            });
+        }
+    }
+    else {
+        const finalPassword = password || randomUUID().slice(0, 8);
+        const hash = await bcrypt.hash(finalPassword, SALT_ROUNDS);
+        const user = await erpDb.user.create({
+            data: {
+                uuid: randomUUID(),
+                username: SUPER_ADMIN_USERNAME,
+                passwordHash: hash,
+            },
+        });
+        await ensureErpAdminPermission(user.id);
+        if (!password) {
+            console.log(`\n  ${SUPER_ADMIN_USERNAME} user created. Password: ${finalPassword}`);
+            console.log(`  Change it via the admin UI or with --setup\n`);
+        }
+    }
+    // Warn if agent users exist without supervisor auth
+    const agentCount = await erpDb.user.count({ where: { isAgent: true } });
+    if (agentCount > 0) {
+        console.warn(`[ERP] Warning: ${agentCount} agent user(s) found but supervisor auth is disabled. ` +
+            `Agent API key lookups and authentication will not work. ` +
+            `Set SUPERVISOR_AUTH=true to enable.`);
+    }
+}
+/**
+ * Sync superadmin from supervisor into ERP DB and ensure permissions.
+ * For supervisor auth mode. Supervisor uses passkey-only auth — the
+ * mirrored ERP row has no passwordHash.
+ */
+export async function ensureSupervisorSuperAdmin() {
+    const result = await ensureSuperAdmin();
+    await erpDb.user.upsert({
+        where: { uuid: result.user.uuid },
+        create: {
+            uuid: result.user.uuid,
+            username: result.user.username,
+        },
+        update: {
+            username: result.user.username,
+        },
+    });
+    const localSuperAdmin = await erpDb.user.findUnique({
+        where: { uuid: result.user.uuid },
+    });
+    if (localSuperAdmin) {
+        await ensureErpAdminPermission(localSuperAdmin.id);
+    }
+}
+/**
+ * Ensure a user has the erp_admin permission.
+ */
+export async function ensureErpAdminPermission(userId) {
+    const existing = await erpDb.userPermission.findUnique({
+        where: { userId_permission: { userId, permission: "erp_admin" } },
+    });
+    if (!existing) {
+        await erpDb.userPermission.create({
+            data: { userId, permission: "erp_admin" },
+        });
+    }
+}
 //# sourceMappingURL=user-service.js.map

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@naisys/erp",
-  "version": "3.0.0-beta.45",
+  "version": "3.0.0-beta.47",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@naisys/erp",
-      "version": "3.0.0-beta.45",
+      "version": "3.0.0-beta.47",
       "dependencies": {
         "@fastify/cookie": "^11.0.2",
         "@fastify/cors": "^11.2.0",
@@ -14,11 +14,11 @@
         "@fastify/rate-limit": "^10.3.0",
         "@fastify/static": "^9.0.0",
         "@fastify/swagger": "^9.7.0",
-        "@naisys/common": "3.0.0-beta.45",
-        "@naisys/common-node": "3.0.0-beta.45",
-        "@naisys/erp-shared": "3.0.0-beta.45",
-        "@naisys/hub-database": "3.0.0-beta.45",
-        "@naisys/supervisor-database": "3.0.0-beta.45",
+        "@naisys/common": "3.0.0-beta.47",
+        "@naisys/common-node": "3.0.0-beta.47",
+        "@naisys/erp-shared": "3.0.0-beta.47",
+        "@naisys/hub-database": "3.0.0-beta.47",
+        "@naisys/supervisor-database": "3.0.0-beta.47",
         "@prisma/adapter-better-sqlite3": "^7.5.0",
         "@prisma/client": "^7.5.0",
         "@scalar/fastify-api-reference": "^1.48.7",
@@ -394,41 +394,41 @@
       }
     },
     "node_modules/@naisys/common": {
-      "version": "3.0.0-beta.45",
-      "resolved": "https://registry.npmjs.org/@naisys/common/-/common-3.0.0-beta.45.tgz",
-      "integrity": "sha512-n4UXc1hbmnBOfrsyQmilCh1tFnqEh+X3L0qnoP2OGewUd/AMEk5cMFQPgUi4xZIeDe0MnFuoR/HPJpo0W5S4Xw==",
+      "version": "3.0.0-beta.47",
+      "resolved": "https://registry.npmjs.org/@naisys/common/-/common-3.0.0-beta.47.tgz",
+      "integrity": "sha512-jRtyDq2GMcCEiuiG6yQAMuMERPzrfQUmTVjUmwXfPakwjNVQyn8Tbz05m2WjB1YRqVXjRCY/SNGjTtrb55TJ5A==",
       "dependencies": {
         "semver": "^7.7.4",
         "zod": "^4.3.6"
       }
     },
     "node_modules/@naisys/common-node": {
-      "version": "3.0.0-beta.45",
-      "resolved": "https://registry.npmjs.org/@naisys/common-node/-/common-node-3.0.0-beta.45.tgz",
-      "integrity": "sha512-7xSlPv+3LyIE1bvjXNCFPrK0R3Fw2uLDtbAq1HNtjzvjuH0YErwKYlSGgH1wVK6oTvjljmemSRSkA3K0DfIb6A==",
+      "version": "3.0.0-beta.47",
+      "resolved": "https://registry.npmjs.org/@naisys/common-node/-/common-node-3.0.0-beta.47.tgz",
+      "integrity": "sha512-FCwX+ESUI/U9vk1amldCahfMiosxXIWXqvfihCeN1P7B97WZ3bFgJgn7JogXCNRD4axuUMAXPOWSTSjHJSDeWw==",
       "dependencies": {
-        "@naisys/common": "3.0.0-beta.45",
+        "@naisys/common": "3.0.0-beta.47",
         "better-sqlite3": "^12.6.2",
         "js-yaml": "^4.1.1",
         "pino": "^10.3.1"
       }
     },
     "node_modules/@naisys/erp-shared": {
-      "version": "3.0.0-beta.45",
-      "resolved": "https://registry.npmjs.org/@naisys/erp-shared/-/erp-shared-3.0.0-beta.45.tgz",
-      "integrity": "sha512-gjOCteWeUWi638yOMBnGFGwXZRDnWmagZKEEmJCmqbQEEJ+tZ4hbJs8gajGbYLlidVh41vTEVttdqgAKDw7d7w==",
+      "version": "3.0.0-beta.47",
+      "resolved": "https://registry.npmjs.org/@naisys/erp-shared/-/erp-shared-3.0.0-beta.47.tgz",
+      "integrity": "sha512-MlTnJ9gA8m366yqEmRFhMXXBO39i3PqqTfW/TNXdyVnWls8vHLU/GjhbPlhjas13J+yXc2Hpukj2eezQ5LIgBA==",
       "dependencies": {
-        "@naisys/common": "3.0.0-beta.45",
+        "@naisys/common": "3.0.0-beta.47",
         "zod": "^4.3.6"
       }
     },
     "node_modules/@naisys/hub-database": {
-      "version": "3.0.0-beta.45",
-      "resolved": "https://registry.npmjs.org/@naisys/hub-database/-/hub-database-3.0.0-beta.45.tgz",
-      "integrity": "sha512-jEY0Z0yjy2pUTsNgJ9Gq0pppjR64SuOLHnZfqPvK+5FB73MLkcYyR77qlSD11mHBWtlx4w8EjWAYQfCj+GZ37Q==",
+      "version": "3.0.0-beta.47",
+      "resolved": "https://registry.npmjs.org/@naisys/hub-database/-/hub-database-3.0.0-beta.47.tgz",
+      "integrity": "sha512-eagwn0cYNsuu2rqLuWRr/D0Se8QvqYa+R8khDtMahb5RjN6q/L4YkLTxEf4RBqw2dfee3kTQbACxwlN27CsL2A==",
       "dependencies": {
-        "@naisys/common": "3.0.0-beta.45",
-        "@naisys/common-node": "3.0.0-beta.45",
+        "@naisys/common": "3.0.0-beta.47",
+        "@naisys/common-node": "3.0.0-beta.47",
         "@prisma/adapter-better-sqlite3": "^7.5.0",
         "@prisma/client": "^7.5.0",
         "better-sqlite3": "^12.6.2",
@@ -436,12 +436,12 @@
       }
     },
     "node_modules/@naisys/supervisor-database": {
-      "version": "3.0.0-beta.45",
-      "resolved": "https://registry.npmjs.org/@naisys/supervisor-database/-/supervisor-database-3.0.0-beta.45.tgz",
-      "integrity": "sha512-9gBuvEJAicHEOpr3021bHAeN31iEd53oU6ba1hlhqqkCvvNabomFYjfnixUB3YO1L0ZLp0UayWGzS9e8t3LM8g==",
+      "version": "3.0.0-beta.47",
+      "resolved": "https://registry.npmjs.org/@naisys/supervisor-database/-/supervisor-database-3.0.0-beta.47.tgz",
+      "integrity": "sha512-64tzBp/Xj2IN6bqc5NPfszqhjungaADHG1hyxBuu/TDSD8dquUQczV6eLEGWOXRImU8u2LnfkAPkyv2jfta88A==",
       "dependencies": {
-        "@naisys/common": "3.0.0-beta.45",
-        "@naisys/common-node": "3.0.0-beta.45",
+        "@naisys/common": "3.0.0-beta.47",
+        "@naisys/common-node": "3.0.0-beta.47",
         "@prisma/adapter-better-sqlite3": "^7.5.0",
         "@prisma/client": "^7.5.0",
         "bcryptjs": "^3.0.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naisys/erp",
-  "version": "3.0.0-beta.45",
+  "version": "3.0.0-beta.47",
   "description": "NAISYS ERP - Web UI for AI-driven order and work management",
   "type": "module",
   "main": "dist/erpServer.js",
@@ -46,11 +46,11 @@
     "@fastify/rate-limit": "^10.3.0",
     "@fastify/static": "^9.0.0",
     "@fastify/swagger": "^9.7.0",
-    "@naisys/common": "3.0.0-beta.45",
-    "@naisys/common-node": "3.0.0-beta.45",
-    "@naisys/erp-shared": "3.0.0-beta.45",
-    "@naisys/hub-database": "3.0.0-beta.45",
-    "@naisys/supervisor-database": "3.0.0-beta.45",
+    "@naisys/common": "3.0.0-beta.47",
+    "@naisys/common-node": "3.0.0-beta.47",
+    "@naisys/erp-shared": "3.0.0-beta.47",
+    "@naisys/hub-database": "3.0.0-beta.47",
+    "@naisys/supervisor-database": "3.0.0-beta.47",
     "@prisma/adapter-better-sqlite3": "^7.5.0",
     "@prisma/client": "^7.5.0",
     "@scalar/fastify-api-reference": "^1.48.7",

package/dist/userService.js

@@ -1,87 +0,0 @@
-import { SUPER_ADMIN_USERNAME } from "@naisys/common";
-import { ensureSuperAdmin } from "@naisys/supervisor-database";
-import bcrypt from "bcryptjs";
-import { randomUUID } from "crypto";
-import erpDb from "./erpDb.js";
-const SALT_ROUNDS = 10;
-/**
- * Ensure a superadmin user exists in the local ERP database.
- * If a password is supplied, it is used on create and updates the existing one if present.
- * For standalone mode (no supervisor auth).
- */
-export async function ensureLocalSuperAdmin(password) {
-    const existing = await erpDb.user.findUnique({
-        where: { username: SUPER_ADMIN_USERNAME },
-    });
-    if (existing) {
-        await ensureErpAdminPermission(existing.id);
-        if (password) {
-            const hash = await bcrypt.hash(password, SALT_ROUNDS);
-            await erpDb.user.update({
-                where: { id: existing.id },
-                data: { passwordHash: hash },
-            });
-        }
-    }
-    else {
-        const finalPassword = password || randomUUID().slice(0, 8);
-        const hash = await bcrypt.hash(finalPassword, SALT_ROUNDS);
-        const user = await erpDb.user.create({
-            data: {
-                uuid: randomUUID(),
-                username: SUPER_ADMIN_USERNAME,
-                passwordHash: hash,
-            },
-        });
-        await ensureErpAdminPermission(user.id);
-        if (!password) {
-            console.log(`\n  ${SUPER_ADMIN_USERNAME} user created. Password: ${finalPassword}`);
-            console.log(`  Change it via the admin UI or with --setup\n`);
-        }
-    }
-    // Warn if agent users exist without supervisor auth
-    const agentCount = await erpDb.user.count({ where: { isAgent: true } });
-    if (agentCount > 0) {
-        console.warn(`[ERP] Warning: ${agentCount} agent user(s) found but supervisor auth is disabled. ` +
-            `Agent API key lookups and authentication will not work. ` +
-            `Set SUPERVISOR_AUTH=true to enable.`);
-    }
-}
-/**
- * Sync superadmin from supervisor into ERP DB and ensure permissions.
- * For supervisor auth mode. Supervisor uses passkey-only auth — the
- * mirrored ERP row has no passwordHash.
- */
-export async function ensureSupervisorSuperAdmin() {
-    const result = await ensureSuperAdmin();
-    await erpDb.user.upsert({
-        where: { uuid: result.user.uuid },
-        create: {
-            uuid: result.user.uuid,
-            username: result.user.username,
-        },
-        update: {
-            username: result.user.username,
-        },
-    });
-    const localSuperAdmin = await erpDb.user.findUnique({
-        where: { uuid: result.user.uuid },
-    });
-    if (localSuperAdmin) {
-        await ensureErpAdminPermission(localSuperAdmin.id);
-    }
-}
-/**
- * Ensure a user has the erp_admin permission.
- */
-export async function ensureErpAdminPermission(userId) {
-    const existing = await erpDb.userPermission.findUnique({
-        where: { userId_permission: { userId, permission: "erp_admin" } },
-    });
-    if (!existing) {
-        await erpDb.userPermission.create({
-            data: { userId, permission: "erp_admin" },
-        });
-    }
-}
-//# sourceMappingURL=userService.js.map