@open-mercato/ai-assistant 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/dist/modules/ai_assistant/__integration__/TC-AI-002-agent-policy.spec.js

@@ -0,0 +1,73 @@
+import { test, expect, request as playwrightRequest } from "@playwright/test";
+import { getAuthToken } from "@open-mercato/core/modules/core/__integration__/helpers/api";
+test.describe("TC-AI-002: AI agent dispatcher policy gate", () => {
+  const chatPath = "/api/ai_assistant/ai/chat";
+  test("unknown agent returns 404 agent_unknown", async ({ request }) => {
+    const token = await getAuthToken(request, "superadmin");
+    const response = await request.fetch(`${chatPath}?agent=does.not_exist`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      data: JSON.stringify({
+        messages: [{ role: "user", content: "hello" }]
+      })
+    });
+    expect(response.status()).toBe(404);
+    const body = await response.json();
+    expect(body.code).toBe("agent_unknown");
+  });
+  test("malformed agent query param returns 400 validation_error", async ({ request }) => {
+    const token = await getAuthToken(request, "superadmin");
+    const response = await request.fetch(`${chatPath}?agent=BadAgent`, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      data: JSON.stringify({
+        messages: [{ role: "user", content: "hello" }]
+      })
+    });
+    expect(response.status()).toBe(400);
+    const body = await response.json();
+    expect(body.code).toBe("validation_error");
+  });
+  test("missing agent query param returns 400 validation_error", async ({ request }) => {
+    const token = await getAuthToken(request, "superadmin");
+    const response = await request.fetch(chatPath, {
+      method: "POST",
+      headers: {
+        Authorization: `Bearer ${token}`,
+        "Content-Type": "application/json"
+      },
+      data: JSON.stringify({
+        messages: [{ role: "user", content: "hello" }]
+      })
+    });
+    expect(response.status()).toBe(400);
+    const body = await response.json();
+    expect(body.code).toBe("validation_error");
+  });
+  test("unauthenticated caller returns 401", async ({ baseURL }) => {
+    const context = await playwrightRequest.newContext({ baseURL });
+    try {
+      const response = await context.fetch(`${chatPath}?agent=does.not_exist`, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json"
+        },
+        data: JSON.stringify({
+          messages: [{ role: "user", content: "hello" }]
+        })
+      });
+      expect(response.status()).toBe(401);
+      const body = await response.json();
+      expect(body.code === "unauthenticated" || body.error === "Unauthorized").toBe(true);
+    } finally {
+      await context.dispose();
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-002-agent-policy.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-002-agent-policy.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-002-agent-policy.spec.ts"],
+  "sourcesContent": ["import { test, expect, request as playwrightRequest } from '@playwright/test';\nimport { getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';\n\n/**\n * TC-AI-002: AI agent dispatcher policy gate (Step 3.13 / Phase 3 WS-C).\n *\n * Exercises the HTTP surface of the Step 3.2 / 3.3 runtime policy gate end-to-end\n * against the authenticated superadmin session. The dispatcher is\n * `POST /api/ai_assistant/ai/chat?agent=<module>.<agent>` (see\n * `packages/ai-assistant/src/modules/ai_assistant/lib/agent-transport.ts`).\n *\n * Asserted:\n *   - Unknown agent id -> 404 + `{ code: 'agent_unknown' }` \u2014 verified against\n *     `packages/ai-assistant/src/modules/ai_assistant/lib/agent-policy.ts`.\n *   - Malformed agent query param -> 400 + `{ code: 'validation_error' }`.\n *   - Missing agent query param -> 400 + `{ code: 'validation_error' }`.\n *   - Unauthenticated caller -> 401 + `{ code: 'unauthenticated' }`.\n *\n * The chat dispatcher requires `ai_assistant.view` \u2014 superadmin always carries it.\n * The \"forbidden agent\" branch (`agent_features_denied`) is exercised at the\n * runtime-helper layer by the Jest integration suite at\n * `packages/ai-assistant/src/modules/ai_assistant/__tests__/integration/\n * ws-c-policy-and-tools.test.ts` because no seeded non-superadmin role has the\n * shape required to create a deterministic forbidden-agent fixture without\n * touching ACL tables.\n */\ntest.describe('TC-AI-002: AI agent dispatcher policy gate', () => {\n  const chatPath = '/api/ai_assistant/ai/chat';\n\n  test('unknown agent returns 404 agent_unknown', async ({ request }) => {\n    const token = await getAuthToken(request, 'superadmin');\n\n    const response = await request.fetch(`${chatPath}?agent=does.not_exist`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n      data: JSON.stringify({\n        messages: [{ role: 'user', content: 'hello' }],\n      }),\n    });\n\n    expect(response.status()).toBe(404);\n    const body = (await response.json()) as { code?: unknown; error?: unknown };\n    expect(body.code).toBe('agent_unknown');\n  });\n\n  test('malformed agent query param returns 400 validation_error', async ({ request }) => {\n    const token = await getAuthToken(request, 'superadmin');\n\n    const response = await request.fetch(`${chatPath}?agent=BadAgent`, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n      data: JSON.stringify({\n        messages: [{ role: 'user', content: 'hello' }],\n      }),\n    });\n\n    expect(response.status()).toBe(400);\n    const body = (await response.json()) as { code?: unknown };\n    expect(body.code).toBe('validation_error');\n  });\n\n  test('missing agent query param returns 400 validation_error', async ({ request }) => {\n    const token = await getAuthToken(request, 'superadmin');\n\n    const response = await request.fetch(chatPath, {\n      method: 'POST',\n      headers: {\n        Authorization: `Bearer ${token}`,\n        'Content-Type': 'application/json',\n      },\n      data: JSON.stringify({\n        messages: [{ role: 'user', content: 'hello' }],\n      }),\n    });\n\n    expect(response.status()).toBe(400);\n    const body = (await response.json()) as { code?: unknown };\n    expect(body.code).toBe('validation_error');\n  });\n\n  test('unauthenticated caller returns 401', async ({ baseURL }) => {\n    // Use a fresh request context with no cookies \u2014 shared `request` fixture\n    // accumulates the superadmin session cookie from prior getAuthToken calls.\n    const context = await playwrightRequest.newContext({ baseURL });\n    try {\n      const response = await context.fetch(`${chatPath}?agent=does.not_exist`, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/json',\n        },\n        data: JSON.stringify({\n          messages: [{ role: 'user', content: 'hello' }],\n        }),\n      });\n\n      expect(response.status()).toBe(401);\n      // The framework-level `requireAuth` guard (page metadata) short-circuits\n      // unauthenticated POSTs before the route handler runs, so the response\n      // carries the framework's `{ error: 'Unauthorized' }` envelope rather\n      // than the route-local `{ code: 'unauthenticated' }` envelope. Either\n      // shape satisfies the contract \"unauth callers cannot invoke the\n      // dispatcher\"; we accept whichever one the framework actually returns.\n      const body = (await response.json()) as { code?: unknown; error?: unknown };\n      expect(body.code === 'unauthenticated' || body.error === 'Unauthorized').toBe(true);\n    } finally {\n      await context.dispose();\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,QAAQ,WAAW,yBAAyB;AAC3D,SAAS,oBAAoB;AAyB7B,KAAK,SAAS,8CAA8C,MAAM;AAChE,QAAM,WAAW;AAEjB,OAAK,2CAA2C,OAAO,EAAE,QAAQ,MAAM;AACrE,UAAM,QAAQ,MAAM,aAAa,SAAS,YAAY;AAEtD,UAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,yBAAyB;AAAA,MACvE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,CAAC;AAED,WAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,IAAI,EAAE,KAAK,eAAe;AAAA,EACxC,CAAC;AAED,OAAK,4DAA4D,OAAO,EAAE,QAAQ,MAAM;AACtF,UAAM,QAAQ,MAAM,aAAa,SAAS,YAAY;AAEtD,UAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,mBAAmB;AAAA,MACjE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,CAAC;AAED,WAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,IAAI,EAAE,KAAK,kBAAkB;AAAA,EAC3C,CAAC;AAED,OAAK,0DAA0D,OAAO,EAAE,QAAQ,MAAM;AACpF,UAAM,QAAQ,MAAM,aAAa,SAAS,YAAY;AAEtD,UAAM,WAAW,MAAM,QAAQ,MAAM,UAAU;AAAA,MAC7C,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK;AAAA,QAC9B,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,CAAC;AAED,WAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,UAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,WAAO,KAAK,IAAI,EAAE,KAAK,kBAAkB;AAAA,EAC3C,CAAC;AAED,OAAK,sCAAsC,OAAO,EAAE,QAAQ,MAAM;AAGhE,UAAM,UAAU,MAAM,kBAAkB,WAAW,EAAE,QAAQ,CAAC;AAC9D,QAAI;AACF,YAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,yBAAyB;AAAA,QACvE,QAAQ;AAAA,QACR,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,UAAU;AAAA,UACnB,UAAU,CAAC,EAAE,MAAM,QAAQ,SAAS,QAAQ,CAAC;AAAA,QAC/C,CAAC;AAAA,MACH,CAAC;AAED,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAOlC,YAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,aAAO,KAAK,SAAS,qBAAqB,KAAK,UAAU,cAAc,EAAE,KAAK,IAAI;AAAA,IACpF,UAAE;AACA,YAAM,QAAQ,QAAQ;AAAA,IACxB;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/ai_assistant/__integration__/TC-AI-AGENT-SETTINGS-005-settings-page.spec.js

@@ -0,0 +1,484 @@
+import { test, expect } from "@playwright/test";
+import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
+test.describe("TC-AI-AGENT-SETTINGS-005: AI Agent settings", () => {
+  const settingsPath = "/backend/config/ai-assistant/agents";
+  test("page loads and renders empty-state for superadmin when no agents are registered", async ({
+    page
+  }) => {
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ agents: [], total: 0 })
+      });
+    });
+    await page.route("**/api/ai_assistant/ai/agents/*/prompt-override", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          pending: true,
+          agentId: "stub.stub",
+          message: "Persistence lands in Phase 3 Step 5.3."
+        })
+      });
+    });
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const emptyState = page.getByText(/No AI agents are registered/i).first();
+    const container = page.locator("[data-ai-agent-settings]");
+    const loadError = page.locator("[data-ai-agent-settings-error]");
+    await expect(emptyState.or(container).or(loadError)).toBeVisible({ timeout: 15e3 });
+    if (await emptyState.isVisible().catch(() => false)) {
+      await expect(emptyState).toBeVisible();
+    } else if (await container.isVisible().catch(() => false)) {
+      const picker = page.locator("[data-ai-agent-settings-picker]");
+      await expect(picker).toBeVisible();
+    } else {
+      await expect(loadError).toBeVisible();
+    }
+  });
+  test("unauthenticated visit redirects to login", async ({ browser }) => {
+    const context = await browser.newContext();
+    const page = await context.newPage();
+    try {
+      await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+      await page.waitForURL(/\/login/, { timeout: 15e3 });
+      expect(page.url()).toMatch(/\/login/);
+    } finally {
+      await context.close();
+    }
+  });
+  test("Cmd/Ctrl+Enter inside a prompt-override textarea triggers the placeholder save", async ({
+    page
+  }) => {
+    test.setTimeout(12e4);
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agents: [
+            {
+              id: "customers.assistant",
+              moduleId: "customers",
+              label: "Customers assistant",
+              description: "Answers questions about customer records.",
+              systemPrompt: "You are a customers assistant.",
+              executionMode: "chat",
+              mutationPolicy: "read-only",
+              readOnly: true,
+              maxSteps: 10,
+              allowedTools: ["customers.list_people"],
+              tools: [
+                {
+                  name: "customers.list_people",
+                  displayName: "List people",
+                  isMutation: false,
+                  registered: true
+                }
+              ],
+              requiredFeatures: [],
+              acceptedMediaTypes: [],
+              hasOutputSchema: false
+            }
+          ],
+          total: 1
+        })
+      });
+    });
+    let saveCalls = 0;
+    await page.route("**/api/ai_assistant/ai/agents/*/prompt-override", async (route) => {
+      const method = route.request().method();
+      if (method === "GET") {
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({
+            agentId: "customers.assistant",
+            override: null,
+            versions: []
+          })
+        });
+        return;
+      }
+      saveCalls += 1;
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          pending: true,
+          agentId: "customers.assistant",
+          message: "Persistence lands in Phase 3 Step 5.3."
+        })
+      });
+    });
+    await page.route("**/api/ai_assistant/ai/agents/*/mutation-policy", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agentId: "customers.assistant",
+          codeDeclared: "read-only",
+          override: null
+        })
+      });
+    });
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const container = page.locator("[data-ai-agent-settings]");
+    await expect(container).toBeVisible({ timeout: 6e4 });
+    const toggle = page.locator('[data-ai-agent-prompt-toggle="role"]');
+    await toggle.click({ timeout: 3e4 });
+    const textarea = page.locator('[data-ai-agent-prompt-override="role"]');
+    await expect(textarea).toBeVisible();
+    await textarea.fill("Custom role text.");
+    await textarea.press("Meta+Enter");
+    await page.waitForTimeout(250);
+    if (saveCalls === 0) {
+      await textarea.press("Control+Enter");
+      await page.waitForTimeout(250);
+    }
+    expect(saveCalls).toBeGreaterThanOrEqual(1);
+  });
+  test("selecting an agent renders detail panel with meta badges, tool toggles, and attachment policy", async ({
+    page
+  }) => {
+    test.setTimeout(12e4);
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agents: [
+            {
+              id: "customers.account_assistant",
+              moduleId: "customers",
+              label: "Customers account assistant",
+              description: "Answers questions about customer records.",
+              systemPrompt: "You are a helpful read-only customers assistant.",
+              executionMode: "chat",
+              mutationPolicy: "read-only",
+              readOnly: true,
+              maxSteps: 10,
+              allowedTools: ["customers.list_people", "customers.get_person"],
+              tools: [
+                {
+                  name: "customers.list_people",
+                  displayName: "List people",
+                  isMutation: false,
+                  registered: true
+                },
+                {
+                  name: "customers.get_person",
+                  displayName: "Get person",
+                  isMutation: false,
+                  registered: true
+                }
+              ],
+              requiredFeatures: ["customers.people.view"],
+              acceptedMediaTypes: ["image/png", "application/pdf"],
+              hasOutputSchema: false
+            }
+          ],
+          total: 1
+        })
+      });
+    });
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const container = page.locator("[data-ai-agent-settings]");
+    await expect(container).toBeVisible({ timeout: 6e4 });
+    const detailPanel = page.locator('[data-ai-agent-detail="customers.account_assistant"]');
+    await expect(detailPanel).toBeVisible();
+    const listRow = page.locator('[data-ai-agent-tool-row="customers.list_people"]');
+    await expect(listRow).toBeVisible();
+    const listSwitch = page.locator('[data-ai-agent-tool-switch="customers.list_people"]');
+    const ariaDisabled = await listSwitch.getAttribute("aria-disabled");
+    const dataDisabled = await listSwitch.getAttribute("data-disabled");
+    const disabledAttr = await listSwitch.getAttribute("disabled");
+    expect(
+      ariaDisabled === "true" || dataDisabled !== null || disabledAttr !== null
+    ).toBe(true);
+    const pngBadge = page.locator('[data-ai-agent-attachment-badge="image/png"]');
+    await expect(pngBadge).toBeVisible();
+    const pdfBadge = page.locator('[data-ai-agent-attachment-badge="application/pdf"]');
+    await expect(pdfBadge).toBeVisible();
+  });
+  test("saving a valid override surfaces the new version in the history panel (Step 5.3)", async ({
+    page
+  }) => {
+    test.setTimeout(12e4);
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agents: [
+            {
+              id: "customers.account_assistant",
+              moduleId: "customers",
+              label: "Customers account assistant",
+              description: "Answers questions about customer records.",
+              systemPrompt: "You are a read-only customers assistant.",
+              executionMode: "chat",
+              mutationPolicy: "read-only",
+              readOnly: true,
+              maxSteps: 10,
+              allowedTools: [],
+              tools: [],
+              requiredFeatures: [],
+              acceptedMediaTypes: [],
+              hasOutputSchema: false
+            }
+          ],
+          total: 1
+        })
+      });
+    });
+    let overrideState = null;
+    await page.route("**/api/ai_assistant/ai/agents/*/prompt-override", async (route) => {
+      const request = route.request();
+      if (request.method() === "GET") {
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify(
+            overrideState ? {
+              agentId: "customers.account_assistant",
+              override: {
+                id: "row-1",
+                agentId: "customers.account_assistant",
+                version: overrideState.version,
+                sections: overrideState.sections,
+                notes: null,
+                createdByUserId: null,
+                createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+                updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+              },
+              versions: [
+                {
+                  id: "row-1",
+                  agentId: "customers.account_assistant",
+                  version: overrideState.version,
+                  sections: overrideState.sections,
+                  notes: null,
+                  createdByUserId: null,
+                  createdAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+                }
+              ]
+            } : {
+              agentId: "customers.account_assistant",
+              override: null,
+              versions: []
+            }
+          )
+        });
+        return;
+      }
+      const body = JSON.parse(request.postData() || "{}");
+      const sections = body.sections ?? body.overrides ?? {};
+      overrideState = { version: (overrideState?.version ?? 0) + 1, sections };
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          ok: true,
+          agentId: "customers.account_assistant",
+          version: overrideState.version,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        })
+      });
+    });
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const container = page.locator("[data-ai-agent-settings]");
+    await expect(container).toBeVisible({ timeout: 6e4 });
+    const toggle = page.locator('[data-ai-agent-prompt-toggle="role"]');
+    await toggle.click();
+    const textarea = page.locator('[data-ai-agent-prompt-override="role"]');
+    await textarea.fill("Tenant-specific tone.");
+    const saveButton = page.locator("[data-ai-agent-prompt-save]");
+    await saveButton.click();
+    const successAlert = page.locator('[data-ai-agent-prompt-state="success"]');
+    await expect(successAlert).toBeVisible({ timeout: 15e3 });
+    const historyRow = page.locator('[data-ai-agent-override-history-row="1"]');
+    await expect(historyRow).toBeVisible({ timeout: 15e3 });
+  });
+  test("reserved-key override surfaces the validation error in the UI (Step 5.3)", async ({
+    page
+  }) => {
+    test.setTimeout(12e4);
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agents: [
+            {
+              id: "customers.account_assistant",
+              moduleId: "customers",
+              label: "Customers account assistant",
+              description: "Answers questions about customer records.",
+              systemPrompt: "You are a customers assistant.",
+              executionMode: "chat",
+              mutationPolicy: "read-only",
+              readOnly: true,
+              maxSteps: 10,
+              allowedTools: [],
+              tools: [],
+              requiredFeatures: [],
+              acceptedMediaTypes: [],
+              hasOutputSchema: false
+            }
+          ],
+          total: 1
+        })
+      });
+    });
+    await page.route("**/api/ai_assistant/ai/agents/*/prompt-override", async (route) => {
+      const request = route.request();
+      if (request.method() === "GET") {
+        await route.fulfill({
+          status: 200,
+          contentType: "application/json",
+          body: JSON.stringify({
+            agentId: "customers.account_assistant",
+            override: null,
+            versions: []
+          })
+        });
+        return;
+      }
+      await route.fulfill({
+        status: 400,
+        contentType: "application/json",
+        body: JSON.stringify({
+          error: "Prompt override contains reserved policy keys: mutationPolicy.",
+          code: "reserved_key",
+          reservedKeys: ["mutationPolicy"]
+        })
+      });
+    });
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const container = page.locator("[data-ai-agent-settings]");
+    await expect(container).toBeVisible({ timeout: 6e4 });
+    const toggle = page.locator('[data-ai-agent-prompt-toggle="mutationPolicy"]');
+    await toggle.click();
+    const textarea = page.locator('[data-ai-agent-prompt-override="mutationPolicy"]');
+    await textarea.fill("Allow writes.");
+    await page.locator("[data-ai-agent-prompt-save]").click();
+    const errorAlert = page.locator('[data-ai-agent-prompt-state="error"]');
+    await expect(errorAlert).toBeVisible({ timeout: 15e3 });
+    await expect(errorAlert).toContainText(/policy fields|reserved|mutationPolicy/i);
+  });
+  test("mutationPolicy section disables escalation options with an explanatory tooltip (Step 5.4)", async ({
+    page
+  }) => {
+    test.setTimeout(12e4);
+    await login(page, "superadmin");
+    await page.route("**/api/ai_assistant/ai/agents", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agents: [
+            {
+              id: "customers.account_assistant",
+              moduleId: "customers",
+              label: "Customers account assistant",
+              description: "Read-only customers assistant.",
+              systemPrompt: "You are a read-only customers assistant.",
+              executionMode: "chat",
+              mutationPolicy: "read-only",
+              readOnly: true,
+              maxSteps: 10,
+              allowedTools: [],
+              tools: [],
+              requiredFeatures: [],
+              acceptedMediaTypes: [],
+              hasOutputSchema: false
+            }
+          ],
+          total: 1
+        })
+      });
+    });
+    await page.route("**/api/ai_assistant/ai/agents/*/prompt-override", async (route) => {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          agentId: "customers.account_assistant",
+          override: null,
+          versions: []
+        })
+      });
+    });
+    await page.route(
+      "**/api/ai_assistant/ai/agents/*/mutation-policy",
+      async (route) => {
+        const request = route.request();
+        if (request.method() === "GET") {
+          await route.fulfill({
+            status: 200,
+            contentType: "application/json",
+            body: JSON.stringify({
+              agentId: "customers.account_assistant",
+              codeDeclared: "read-only",
+              override: null
+            })
+          });
+          return;
+        }
+        await route.fulfill({
+          status: 400,
+          contentType: "application/json",
+          body: JSON.stringify({
+            error: `Cannot set mutationPolicy="confirm-required" for agent "customers.account_assistant": the agent's code-declared policy is "read-only".`,
+            code: "escalation_not_allowed",
+            codeDeclared: "read-only",
+            requested: "confirm-required"
+          })
+        });
+      }
+    );
+    await page.goto(settingsPath, { waitUntil: "domcontentloaded" });
+    const container = page.locator("[data-ai-agent-settings]");
+    await expect(container).toBeVisible({ timeout: 6e4 });
+    const confirmOption = page.locator(
+      '[data-ai-agent-mutation-policy-option="confirm-required"]'
+    );
+    await expect(confirmOption).toBeVisible({ timeout: 15e3 });
+    const disabledAttr = await confirmOption.getAttribute(
+      "data-ai-agent-mutation-policy-option-disabled"
+    );
+    expect(disabledAttr).toBe("true");
+    const readOnlyOption = page.locator(
+      '[data-ai-agent-mutation-policy-option="read-only"]'
+    );
+    const readOnlyDisabled = await readOnlyOption.getAttribute(
+      "data-ai-agent-mutation-policy-option-disabled"
+    );
+    expect(readOnlyDisabled).toBe("false");
+  });
+  test("mutationPolicy escalation attempts are rejected by the server with 400 + escalation_not_allowed (Step 5.4)", async ({
+    request
+  }) => {
+    const response = await request.post(
+      "/api/ai_assistant/ai/agents/customers.account_assistant/mutation-policy",
+      {
+        data: { mutationPolicy: "confirm-required" },
+        headers: { "content-type": "application/json" }
+      }
+    );
+    expect([400, 401, 403]).toContain(response.status());
+    if (response.status() === 400) {
+      const body = await response.json();
+      expect(body.code).toBe("escalation_not_allowed");
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-AGENT-SETTINGS-005-settings-page.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-AGENT-SETTINGS-005-settings-page.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-AGENT-SETTINGS-005-settings-page.spec.ts"],
+  "sourcesContent": ["import { test, expect } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AI-AGENT-SETTINGS-005: AI Agent settings page smoke (Step 4.5 / Phase 2 WS-B).\n *\n * Covers the backend agent settings route at\n * `/backend/config/ai-assistant/agents`. The page is guarded by\n * `ai_assistant.settings.manage`; superadmin always holds it. The agent\n * registry is empty by default in CI (first production agent lands in Step 4.7),\n * so the primary assertion is that the empty-state renders.\n *\n * We also assert that an unauthenticated visit redirects to `/login`.\n * The `POST /api/ai_assistant/ai/agents/:agentId/prompt-override` route is\n * stubbed so the \"save overrides\" path is exercisable end-to-end when an\n * agent happens to be present in the registry.\n */\ntest.describe('TC-AI-AGENT-SETTINGS-005: AI Agent settings', () => {\n  const settingsPath = '/backend/config/ai-assistant/agents';\n\n  test('page loads and renders empty-state for superadmin when no agents are registered', async ({\n    page,\n  }) => {\n    await login(page, 'superadmin');\n\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({ agents: [], total: 0 }),\n      });\n    });\n\n    await page.route('**/api/ai_assistant/ai/agents/*/prompt-override', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          pending: true,\n          agentId: 'stub.stub',\n          message: 'Persistence lands in Phase 3 Step 5.3.',\n        }),\n      });\n    });\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const emptyState = page.getByText(/No AI agents are registered/i).first();\n    const container = page.locator('[data-ai-agent-settings]');\n    const loadError = page.locator('[data-ai-agent-settings-error]');\n\n    await expect(emptyState.or(container).or(loadError)).toBeVisible({ timeout: 15_000 });\n\n    if (await emptyState.isVisible().catch(() => false)) {\n      await expect(emptyState).toBeVisible();\n    } else if (await container.isVisible().catch(() => false)) {\n      // Registry non-empty in this env \u2014 the detail panel should have rendered.\n      const picker = page.locator('[data-ai-agent-settings-picker]');\n      await expect(picker).toBeVisible();\n    } else {\n      await expect(loadError).toBeVisible();\n    }\n  });\n\n  test('unauthenticated visit redirects to login', async ({ browser }) => {\n    const context = await browser.newContext();\n    const page = await context.newPage();\n    try {\n      await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n      await page.waitForURL(/\\/login/, { timeout: 15_000 });\n      expect(page.url()).toMatch(/\\/login/);\n    } finally {\n      await context.close();\n    }\n  });\n\n  test('Cmd/Ctrl+Enter inside a prompt-override textarea triggers the placeholder save', async ({\n    page,\n  }) => {\n    // CI cold-compile of the settings page + stubbed agents fetch can exceed\n    // the default 20s test timeout; give this test 2 minutes.\n    test.setTimeout(120_000);\n    await login(page, 'superadmin');\n\n    // Non-empty registry so the detail panel renders and the textareas exist.\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agents: [\n            {\n              id: 'customers.assistant',\n              moduleId: 'customers',\n              label: 'Customers assistant',\n              description: 'Answers questions about customer records.',\n              systemPrompt: 'You are a customers assistant.',\n              executionMode: 'chat',\n              mutationPolicy: 'read-only',\n              readOnly: true,\n              maxSteps: 10,\n              allowedTools: ['customers.list_people'],\n              tools: [\n                {\n                  name: 'customers.list_people',\n                  displayName: 'List people',\n                  isMutation: false,\n                  registered: true,\n                },\n              ],\n              requiredFeatures: [],\n              acceptedMediaTypes: [],\n              hasOutputSchema: false,\n            },\n          ],\n          total: 1,\n        }),\n      });\n    });\n\n    let saveCalls = 0;\n    await page.route('**/api/ai_assistant/ai/agents/*/prompt-override', async (route) => {\n      const method = route.request().method();\n      if (method === 'GET') {\n        await route.fulfill({\n          status: 200,\n          contentType: 'application/json',\n          body: JSON.stringify({\n            agentId: 'customers.assistant',\n            override: null,\n            versions: [],\n          }),\n        });\n        return;\n      }\n      saveCalls += 1;\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          pending: true,\n          agentId: 'customers.assistant',\n          message: 'Persistence lands in Phase 3 Step 5.3.',\n        }),\n      });\n    });\n\n    // Also stub the mutation-policy GET so selecting the fake agent doesn't\n    // 404 into an error panel on CI (the real route doesn't know our fake id).\n    await page.route('**/api/ai_assistant/ai/agents/*/mutation-policy', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agentId: 'customers.assistant',\n          codeDeclared: 'read-only',\n          override: null,\n        }),\n      });\n    });\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const container = page.locator('[data-ai-agent-settings]');\n    await expect(container).toBeVisible({ timeout: 60_000 });\n\n    // Flip the `role` section into override mode so a textarea is present.\n    const toggle = page.locator('[data-ai-agent-prompt-toggle=\"role\"]');\n    await toggle.click({ timeout: 30_000 });\n\n    const textarea = page.locator('[data-ai-agent-prompt-override=\"role\"]');\n    await expect(textarea).toBeVisible();\n    await textarea.fill('Custom role text.');\n\n    // Cmd+Enter (mac) / Ctrl+Enter (others) \u2014 Playwright supports both.\n    await textarea.press('Meta+Enter');\n    await page.waitForTimeout(250);\n    if (saveCalls === 0) {\n      await textarea.press('Control+Enter');\n      await page.waitForTimeout(250);\n    }\n\n    expect(saveCalls).toBeGreaterThanOrEqual(1);\n  });\n\n  test('selecting an agent renders detail panel with meta badges, tool toggles, and attachment policy', async ({\n    page,\n  }) => {\n    test.setTimeout(120_000);\n    await login(page, 'superadmin');\n\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agents: [\n            {\n              id: 'customers.account_assistant',\n              moduleId: 'customers',\n              label: 'Customers account assistant',\n              description: 'Answers questions about customer records.',\n              systemPrompt: 'You are a helpful read-only customers assistant.',\n              executionMode: 'chat',\n              mutationPolicy: 'read-only',\n              readOnly: true,\n              maxSteps: 10,\n              allowedTools: ['customers.list_people', 'customers.get_person'],\n              tools: [\n                {\n                  name: 'customers.list_people',\n                  displayName: 'List people',\n                  isMutation: false,\n                  registered: true,\n                },\n                {\n                  name: 'customers.get_person',\n                  displayName: 'Get person',\n                  isMutation: false,\n                  registered: true,\n                },\n              ],\n              requiredFeatures: ['customers.people.view'],\n              acceptedMediaTypes: ['image/png', 'application/pdf'],\n              hasOutputSchema: false,\n            },\n          ],\n          total: 1,\n        }),\n      });\n    });\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const container = page.locator('[data-ai-agent-settings]');\n    await expect(container).toBeVisible({ timeout: 60_000 });\n\n    // Detail panel renders for the first (only) agent.\n    const detailPanel = page.locator('[data-ai-agent-detail=\"customers.account_assistant\"]');\n    await expect(detailPanel).toBeVisible();\n\n    // Tool rows render for every declared tool, with disabled switches.\n    const listRow = page.locator('[data-ai-agent-tool-row=\"customers.list_people\"]');\n    await expect(listRow).toBeVisible();\n    const listSwitch = page.locator('[data-ai-agent-tool-switch=\"customers.list_people\"]');\n    // Radix `Switch` primitives surface the disabled state via\n    // `aria-disabled`/`data-disabled` rather than the native attribute,\n    // so assert both. Either one is sufficient evidence the switch is\n    // read-only in Phase 2.\n    const ariaDisabled = await listSwitch.getAttribute('aria-disabled');\n    const dataDisabled = await listSwitch.getAttribute('data-disabled');\n    const disabledAttr = await listSwitch.getAttribute('disabled');\n    expect(\n      ariaDisabled === 'true' || dataDisabled !== null || disabledAttr !== null,\n    ).toBe(true);\n\n    // Attachment policy badges surface for each declared media type.\n    const pngBadge = page.locator('[data-ai-agent-attachment-badge=\"image/png\"]');\n    await expect(pngBadge).toBeVisible();\n    const pdfBadge = page.locator('[data-ai-agent-attachment-badge=\"application/pdf\"]');\n    await expect(pdfBadge).toBeVisible();\n  });\n\n  test('saving a valid override surfaces the new version in the history panel (Step 5.3)', async ({\n    page,\n  }) => {\n    test.setTimeout(120_000);\n    await login(page, 'superadmin');\n\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agents: [\n            {\n              id: 'customers.account_assistant',\n              moduleId: 'customers',\n              label: 'Customers account assistant',\n              description: 'Answers questions about customer records.',\n              systemPrompt: 'You are a read-only customers assistant.',\n              executionMode: 'chat',\n              mutationPolicy: 'read-only',\n              readOnly: true,\n              maxSteps: 10,\n              allowedTools: [],\n              tools: [],\n              requiredFeatures: [],\n              acceptedMediaTypes: [],\n              hasOutputSchema: false,\n            },\n          ],\n          total: 1,\n        }),\n      });\n    });\n\n    let overrideState: { version: number; sections: Record<string, string> } | null = null;\n    await page.route('**/api/ai_assistant/ai/agents/*/prompt-override', async (route) => {\n      const request = route.request();\n      if (request.method() === 'GET') {\n        await route.fulfill({\n          status: 200,\n          contentType: 'application/json',\n          body: JSON.stringify(\n            overrideState\n              ? {\n                  agentId: 'customers.account_assistant',\n                  override: {\n                    id: 'row-1',\n                    agentId: 'customers.account_assistant',\n                    version: overrideState.version,\n                    sections: overrideState.sections,\n                    notes: null,\n                    createdByUserId: null,\n                    createdAt: new Date().toISOString(),\n                    updatedAt: new Date().toISOString(),\n                  },\n                  versions: [\n                    {\n                      id: 'row-1',\n                      agentId: 'customers.account_assistant',\n                      version: overrideState.version,\n                      sections: overrideState.sections,\n                      notes: null,\n                      createdByUserId: null,\n                      createdAt: new Date().toISOString(),\n                      updatedAt: new Date().toISOString(),\n                    },\n                  ],\n                }\n              : {\n                  agentId: 'customers.account_assistant',\n                  override: null,\n                  versions: [],\n                },\n          ),\n        });\n        return;\n      }\n      const body = JSON.parse(request.postData() || '{}');\n      const sections = body.sections ?? body.overrides ?? {};\n      overrideState = { version: (overrideState?.version ?? 0) + 1, sections };\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          ok: true,\n          agentId: 'customers.account_assistant',\n          version: overrideState.version,\n          updatedAt: new Date().toISOString(),\n        }),\n      });\n    });\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const container = page.locator('[data-ai-agent-settings]');\n    await expect(container).toBeVisible({ timeout: 60_000 });\n\n    const toggle = page.locator('[data-ai-agent-prompt-toggle=\"role\"]');\n    await toggle.click();\n    const textarea = page.locator('[data-ai-agent-prompt-override=\"role\"]');\n    await textarea.fill('Tenant-specific tone.');\n\n    const saveButton = page.locator('[data-ai-agent-prompt-save]');\n    await saveButton.click();\n\n    // Success alert surfaces.\n    const successAlert = page.locator('[data-ai-agent-prompt-state=\"success\"]');\n    await expect(successAlert).toBeVisible({ timeout: 15_000 });\n\n    // History panel shows version 1.\n    const historyRow = page.locator('[data-ai-agent-override-history-row=\"1\"]');\n    await expect(historyRow).toBeVisible({ timeout: 15_000 });\n  });\n\n  test('reserved-key override surfaces the validation error in the UI (Step 5.3)', async ({\n    page,\n  }) => {\n    test.setTimeout(120_000);\n    await login(page, 'superadmin');\n\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agents: [\n            {\n              id: 'customers.account_assistant',\n              moduleId: 'customers',\n              label: 'Customers account assistant',\n              description: 'Answers questions about customer records.',\n              systemPrompt: 'You are a customers assistant.',\n              executionMode: 'chat',\n              mutationPolicy: 'read-only',\n              readOnly: true,\n              maxSteps: 10,\n              allowedTools: [],\n              tools: [],\n              requiredFeatures: [],\n              acceptedMediaTypes: [],\n              hasOutputSchema: false,\n            },\n          ],\n          total: 1,\n        }),\n      });\n    });\n\n    await page.route('**/api/ai_assistant/ai/agents/*/prompt-override', async (route) => {\n      const request = route.request();\n      if (request.method() === 'GET') {\n        await route.fulfill({\n          status: 200,\n          contentType: 'application/json',\n          body: JSON.stringify({\n            agentId: 'customers.account_assistant',\n            override: null,\n            versions: [],\n          }),\n        });\n        return;\n      }\n      await route.fulfill({\n        status: 400,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          error: 'Prompt override contains reserved policy keys: mutationPolicy.',\n          code: 'reserved_key',\n          reservedKeys: ['mutationPolicy'],\n        }),\n      });\n    });\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const container = page.locator('[data-ai-agent-settings]');\n    await expect(container).toBeVisible({ timeout: 60_000 });\n\n    const toggle = page.locator('[data-ai-agent-prompt-toggle=\"mutationPolicy\"]');\n    await toggle.click();\n    const textarea = page.locator('[data-ai-agent-prompt-override=\"mutationPolicy\"]');\n    await textarea.fill('Allow writes.');\n    await page.locator('[data-ai-agent-prompt-save]').click();\n\n    const errorAlert = page.locator('[data-ai-agent-prompt-state=\"error\"]');\n    await expect(errorAlert).toBeVisible({ timeout: 15_000 });\n    await expect(errorAlert).toContainText(/policy fields|reserved|mutationPolicy/i);\n  });\n\n  test('mutationPolicy section disables escalation options with an explanatory tooltip (Step 5.4)', async ({\n    page,\n  }) => {\n    test.setTimeout(120_000);\n    await login(page, 'superadmin');\n\n    await page.route('**/api/ai_assistant/ai/agents', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agents: [\n            {\n              id: 'customers.account_assistant',\n              moduleId: 'customers',\n              label: 'Customers account assistant',\n              description: 'Read-only customers assistant.',\n              systemPrompt: 'You are a read-only customers assistant.',\n              executionMode: 'chat',\n              mutationPolicy: 'read-only',\n              readOnly: true,\n              maxSteps: 10,\n              allowedTools: [],\n              tools: [],\n              requiredFeatures: [],\n              acceptedMediaTypes: [],\n              hasOutputSchema: false,\n            },\n          ],\n          total: 1,\n        }),\n      });\n    });\n\n    await page.route('**/api/ai_assistant/ai/agents/*/prompt-override', async (route) => {\n      await route.fulfill({\n        status: 200,\n        contentType: 'application/json',\n        body: JSON.stringify({\n          agentId: 'customers.account_assistant',\n          override: null,\n          versions: [],\n        }),\n      });\n    });\n\n    await page.route(\n      '**/api/ai_assistant/ai/agents/*/mutation-policy',\n      async (route) => {\n        const request = route.request();\n        if (request.method() === 'GET') {\n          await route.fulfill({\n            status: 200,\n            contentType: 'application/json',\n            body: JSON.stringify({\n              agentId: 'customers.account_assistant',\n              codeDeclared: 'read-only',\n              override: null,\n            }),\n          });\n          return;\n        }\n        await route.fulfill({\n          status: 400,\n          contentType: 'application/json',\n          body: JSON.stringify({\n            error:\n              'Cannot set mutationPolicy=\"confirm-required\" for agent \"customers.account_assistant\": the agent\\'s code-declared policy is \"read-only\".',\n            code: 'escalation_not_allowed',\n            codeDeclared: 'read-only',\n            requested: 'confirm-required',\n          }),\n        });\n      },\n    );\n\n    await page.goto(settingsPath, { waitUntil: 'domcontentloaded' });\n\n    const container = page.locator('[data-ai-agent-settings]');\n    await expect(container).toBeVisible({ timeout: 60_000 });\n\n    const confirmOption = page.locator(\n      '[data-ai-agent-mutation-policy-option=\"confirm-required\"]',\n    );\n    await expect(confirmOption).toBeVisible({ timeout: 15_000 });\n    const disabledAttr = await confirmOption.getAttribute(\n      'data-ai-agent-mutation-policy-option-disabled',\n    );\n    expect(disabledAttr).toBe('true');\n\n    // The read-only option (matching code-declared) is selectable.\n    const readOnlyOption = page.locator(\n      '[data-ai-agent-mutation-policy-option=\"read-only\"]',\n    );\n    const readOnlyDisabled = await readOnlyOption.getAttribute(\n      'data-ai-agent-mutation-policy-option-disabled',\n    );\n    expect(readOnlyDisabled).toBe('false');\n  });\n\n  test('mutationPolicy escalation attempts are rejected by the server with 400 + escalation_not_allowed (Step 5.4)', async ({\n    request,\n  }) => {\n    // Use request.fetch via the request fixture (auth cookies won't be set, so we\n    // expect 401; the test's primary purpose is to confirm the route is mounted\n    // AND to document the escalation-guard contract surface. When auth is\n    // available in the env the guard returns 400 + escalation_not_allowed.)\n    const response = await request.post(\n      '/api/ai_assistant/ai/agents/customers.account_assistant/mutation-policy',\n      {\n        data: { mutationPolicy: 'confirm-required' },\n        headers: { 'content-type': 'application/json' },\n      },\n    );\n    // Route should exist (never 404 on the path itself).\n    expect([400, 401, 403]).toContain(response.status());\n    if (response.status() === 400) {\n      const body = await response.json();\n      expect(body.code).toBe('escalation_not_allowed');\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,cAAc;AAC7B,SAAS,aAAa;AAgBtB,KAAK,SAAS,+CAA+C,MAAM;AACjE,QAAM,eAAe;AAErB,OAAK,mFAAmF,OAAO;AAAA,IAC7F;AAAA,EACF,MAAM;AACJ,UAAM,MAAM,MAAM,YAAY;AAE9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU,EAAE,QAAQ,CAAC,GAAG,OAAO,EAAE,CAAC;AAAA,MAC/C,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,SAAS;AAAA,UACT,SAAS;AAAA,UACT,SAAS;AAAA,QACX,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,aAAa,KAAK,UAAU,8BAA8B,EAAE,MAAM;AACxE,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,YAAY,KAAK,QAAQ,gCAAgC;AAE/D,UAAM,OAAO,WAAW,GAAG,SAAS,EAAE,GAAG,SAAS,CAAC,EAAE,YAAY,EAAE,SAAS,KAAO,CAAC;AAEpF,QAAI,MAAM,WAAW,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACnD,YAAM,OAAO,UAAU,EAAE,YAAY;AAAA,IACvC,WAAW,MAAM,UAAU,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AAEzD,YAAM,SAAS,KAAK,QAAQ,iCAAiC;AAC7D,YAAM,OAAO,MAAM,EAAE,YAAY;AAAA,IACnC,OAAO;AACL,YAAM,OAAO,SAAS,EAAE,YAAY;AAAA,IACtC;AAAA,EACF,CAAC;AAED,OAAK,4CAA4C,OAAO,EAAE,QAAQ,MAAM;AACtE,UAAM,UAAU,MAAM,QAAQ,WAAW;AACzC,UAAM,OAAO,MAAM,QAAQ,QAAQ;AACnC,QAAI;AACF,YAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAC/D,YAAM,KAAK,WAAW,WAAW,EAAE,SAAS,KAAO,CAAC;AACpD,aAAO,KAAK,IAAI,CAAC,EAAE,QAAQ,SAAS;AAAA,IACtC,UAAE;AACA,YAAM,QAAQ,MAAM;AAAA,IACtB;AAAA,EACF,CAAC;AAED,OAAK,kFAAkF,OAAO;AAAA,IAC5F;AAAA,EACF,MAAM;AAGJ,SAAK,WAAW,IAAO;AACvB,UAAM,MAAM,MAAM,YAAY;AAG9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ;AAAA,YACN;AAAA,cACE,IAAI;AAAA,cACJ,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,cAAc;AAAA,cACd,eAAe;AAAA,cACf,gBAAgB;AAAA,cAChB,UAAU;AAAA,cACV,UAAU;AAAA,cACV,cAAc,CAAC,uBAAuB;AAAA,cACtC,OAAO;AAAA,gBACL;AAAA,kBACE,MAAM;AAAA,kBACN,aAAa;AAAA,kBACb,YAAY;AAAA,kBACZ,YAAY;AAAA,gBACd;AAAA,cACF;AAAA,cACA,kBAAkB,CAAC;AAAA,cACnB,oBAAoB,CAAC;AAAA,cACrB,iBAAiB;AAAA,YACnB;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,QAAI,YAAY;AAChB,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,SAAS,MAAM,QAAQ,EAAE,OAAO;AACtC,UAAI,WAAW,OAAO;AACpB,cAAM,MAAM,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,MAAM,KAAK,UAAU;AAAA,YACnB,SAAS;AAAA,YACT,UAAU;AAAA,YACV,UAAU,CAAC;AAAA,UACb,CAAC;AAAA,QACH,CAAC;AACD;AAAA,MACF;AACA,mBAAa;AACb,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,SAAS;AAAA,UACT,SAAS;AAAA,UACT,SAAS;AAAA,QACX,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAID,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,SAAS;AAAA,UACT,cAAc;AAAA,UACd,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AAGvD,UAAM,SAAS,KAAK,QAAQ,sCAAsC;AAClE,UAAM,OAAO,MAAM,EAAE,SAAS,IAAO,CAAC;AAEtC,UAAM,WAAW,KAAK,QAAQ,wCAAwC;AACtE,UAAM,OAAO,QAAQ,EAAE,YAAY;AACnC,UAAM,SAAS,KAAK,mBAAmB;AAGvC,UAAM,SAAS,MAAM,YAAY;AACjC,UAAM,KAAK,eAAe,GAAG;AAC7B,QAAI,cAAc,GAAG;AACnB,YAAM,SAAS,MAAM,eAAe;AACpC,YAAM,KAAK,eAAe,GAAG;AAAA,IAC/B;AAEA,WAAO,SAAS,EAAE,uBAAuB,CAAC;AAAA,EAC5C,CAAC;AAED,OAAK,iGAAiG,OAAO;AAAA,IAC3G;AAAA,EACF,MAAM;AACJ,SAAK,WAAW,IAAO;AACvB,UAAM,MAAM,MAAM,YAAY;AAE9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ;AAAA,YACN;AAAA,cACE,IAAI;AAAA,cACJ,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,cAAc;AAAA,cACd,eAAe;AAAA,cACf,gBAAgB;AAAA,cAChB,UAAU;AAAA,cACV,UAAU;AAAA,cACV,cAAc,CAAC,yBAAyB,sBAAsB;AAAA,cAC9D,OAAO;AAAA,gBACL;AAAA,kBACE,MAAM;AAAA,kBACN,aAAa;AAAA,kBACb,YAAY;AAAA,kBACZ,YAAY;AAAA,gBACd;AAAA,gBACA;AAAA,kBACE,MAAM;AAAA,kBACN,aAAa;AAAA,kBACb,YAAY;AAAA,kBACZ,YAAY;AAAA,gBACd;AAAA,cACF;AAAA,cACA,kBAAkB,CAAC,uBAAuB;AAAA,cAC1C,oBAAoB,CAAC,aAAa,iBAAiB;AAAA,cACnD,iBAAiB;AAAA,YACnB;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AAGvD,UAAM,cAAc,KAAK,QAAQ,sDAAsD;AACvF,UAAM,OAAO,WAAW,EAAE,YAAY;AAGtC,UAAM,UAAU,KAAK,QAAQ,kDAAkD;AAC/E,UAAM,OAAO,OAAO,EAAE,YAAY;AAClC,UAAM,aAAa,KAAK,QAAQ,qDAAqD;AAKrF,UAAM,eAAe,MAAM,WAAW,aAAa,eAAe;AAClE,UAAM,eAAe,MAAM,WAAW,aAAa,eAAe;AAClE,UAAM,eAAe,MAAM,WAAW,aAAa,UAAU;AAC7D;AAAA,MACE,iBAAiB,UAAU,iBAAiB,QAAQ,iBAAiB;AAAA,IACvE,EAAE,KAAK,IAAI;AAGX,UAAM,WAAW,KAAK,QAAQ,8CAA8C;AAC5E,UAAM,OAAO,QAAQ,EAAE,YAAY;AACnC,UAAM,WAAW,KAAK,QAAQ,oDAAoD;AAClF,UAAM,OAAO,QAAQ,EAAE,YAAY;AAAA,EACrC,CAAC;AAED,OAAK,oFAAoF,OAAO;AAAA,IAC9F;AAAA,EACF,MAAM;AACJ,SAAK,WAAW,IAAO;AACvB,UAAM,MAAM,MAAM,YAAY;AAE9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ;AAAA,YACN;AAAA,cACE,IAAI;AAAA,cACJ,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,cAAc;AAAA,cACd,eAAe;AAAA,cACf,gBAAgB;AAAA,cAChB,UAAU;AAAA,cACV,UAAU;AAAA,cACV,cAAc,CAAC;AAAA,cACf,OAAO,CAAC;AAAA,cACR,kBAAkB,CAAC;AAAA,cACnB,oBAAoB,CAAC;AAAA,cACrB,iBAAiB;AAAA,YACnB;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,QAAI,gBAA8E;AAClF,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,UAAU,MAAM,QAAQ;AAC9B,UAAI,QAAQ,OAAO,MAAM,OAAO;AAC9B,cAAM,MAAM,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,MAAM,KAAK;AAAA,YACT,gBACI;AAAA,cACE,SAAS;AAAA,cACT,UAAU;AAAA,gBACR,IAAI;AAAA,gBACJ,SAAS;AAAA,gBACT,SAAS,cAAc;AAAA,gBACvB,UAAU,cAAc;AAAA,gBACxB,OAAO;AAAA,gBACP,iBAAiB;AAAA,gBACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,gBAClC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,cACpC;AAAA,cACA,UAAU;AAAA,gBACR;AAAA,kBACE,IAAI;AAAA,kBACJ,SAAS;AAAA,kBACT,SAAS,cAAc;AAAA,kBACvB,UAAU,cAAc;AAAA,kBACxB,OAAO;AAAA,kBACP,iBAAiB;AAAA,kBACjB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,kBAClC,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,gBACpC;AAAA,cACF;AAAA,YACF,IACA;AAAA,cACE,SAAS;AAAA,cACT,UAAU;AAAA,cACV,UAAU,CAAC;AAAA,YACb;AAAA,UACN;AAAA,QACF,CAAC;AACD;AAAA,MACF;AACA,YAAM,OAAO,KAAK,MAAM,QAAQ,SAAS,KAAK,IAAI;AAClD,YAAM,WAAW,KAAK,YAAY,KAAK,aAAa,CAAC;AACrD,sBAAgB,EAAE,UAAU,eAAe,WAAW,KAAK,GAAG,SAAS;AACvE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,IAAI;AAAA,UACJ,SAAS;AAAA,UACT,SAAS,cAAc;AAAA,UACvB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AAEvD,UAAM,SAAS,KAAK,QAAQ,sCAAsC;AAClE,UAAM,OAAO,MAAM;AACnB,UAAM,WAAW,KAAK,QAAQ,wCAAwC;AACtE,UAAM,SAAS,KAAK,uBAAuB;AAE3C,UAAM,aAAa,KAAK,QAAQ,6BAA6B;AAC7D,UAAM,WAAW,MAAM;AAGvB,UAAM,eAAe,KAAK,QAAQ,wCAAwC;AAC1E,UAAM,OAAO,YAAY,EAAE,YAAY,EAAE,SAAS,KAAO,CAAC;AAG1D,UAAM,aAAa,KAAK,QAAQ,0CAA0C;AAC1E,UAAM,OAAO,UAAU,EAAE,YAAY,EAAE,SAAS,KAAO,CAAC;AAAA,EAC1D,CAAC;AAED,OAAK,4EAA4E,OAAO;AAAA,IACtF;AAAA,EACF,MAAM;AACJ,SAAK,WAAW,IAAO;AACvB,UAAM,MAAM,MAAM,YAAY;AAE9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ;AAAA,YACN;AAAA,cACE,IAAI;AAAA,cACJ,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,cAAc;AAAA,cACd,eAAe;AAAA,cACf,gBAAgB;AAAA,cAChB,UAAU;AAAA,cACV,UAAU;AAAA,cACV,cAAc,CAAC;AAAA,cACf,OAAO,CAAC;AAAA,cACR,kBAAkB,CAAC;AAAA,cACnB,oBAAoB,CAAC;AAAA,cACrB,iBAAiB;AAAA,YACnB;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,UAAU,MAAM,QAAQ;AAC9B,UAAI,QAAQ,OAAO,MAAM,OAAO;AAC9B,cAAM,MAAM,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,MAAM,KAAK,UAAU;AAAA,YACnB,SAAS;AAAA,YACT,UAAU;AAAA,YACV,UAAU,CAAC;AAAA,UACb,CAAC;AAAA,QACH,CAAC;AACD;AAAA,MACF;AACA,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,OAAO;AAAA,UACP,MAAM;AAAA,UACN,cAAc,CAAC,gBAAgB;AAAA,QACjC,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AAEvD,UAAM,SAAS,KAAK,QAAQ,gDAAgD;AAC5E,UAAM,OAAO,MAAM;AACnB,UAAM,WAAW,KAAK,QAAQ,kDAAkD;AAChF,UAAM,SAAS,KAAK,eAAe;AACnC,UAAM,KAAK,QAAQ,6BAA6B,EAAE,MAAM;AAExD,UAAM,aAAa,KAAK,QAAQ,sCAAsC;AACtE,UAAM,OAAO,UAAU,EAAE,YAAY,EAAE,SAAS,KAAO,CAAC;AACxD,UAAM,OAAO,UAAU,EAAE,cAAc,wCAAwC;AAAA,EACjF,CAAC;AAED,OAAK,6FAA6F,OAAO;AAAA,IACvG;AAAA,EACF,MAAM;AACJ,SAAK,WAAW,IAAO;AACvB,UAAM,MAAM,MAAM,YAAY;AAE9B,UAAM,KAAK,MAAM,iCAAiC,OAAO,UAAU;AACjE,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,QAAQ;AAAA,YACN;AAAA,cACE,IAAI;AAAA,cACJ,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,cAAc;AAAA,cACd,eAAe;AAAA,cACf,gBAAgB;AAAA,cAChB,UAAU;AAAA,cACV,UAAU;AAAA,cACV,cAAc,CAAC;AAAA,cACf,OAAO,CAAC;AAAA,cACR,kBAAkB,CAAC;AAAA,cACnB,oBAAoB,CAAC;AAAA,cACrB,iBAAiB;AAAA,YACnB;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK,MAAM,mDAAmD,OAAO,UAAU;AACnF,YAAM,MAAM,QAAQ;AAAA,QAClB,QAAQ;AAAA,QACR,aAAa;AAAA,QACb,MAAM,KAAK,UAAU;AAAA,UACnB,SAAS;AAAA,UACT,UAAU;AAAA,UACV,UAAU,CAAC;AAAA,QACb,CAAC;AAAA,MACH,CAAC;AAAA,IACH,CAAC;AAED,UAAM,KAAK;AAAA,MACT;AAAA,MACA,OAAO,UAAU;AACf,cAAM,UAAU,MAAM,QAAQ;AAC9B,YAAI,QAAQ,OAAO,MAAM,OAAO;AAC9B,gBAAM,MAAM,QAAQ;AAAA,YAClB,QAAQ;AAAA,YACR,aAAa;AAAA,YACb,MAAM,KAAK,UAAU;AAAA,cACnB,SAAS;AAAA,cACT,cAAc;AAAA,cACd,UAAU;AAAA,YACZ,CAAC;AAAA,UACH,CAAC;AACD;AAAA,QACF;AACA,cAAM,MAAM,QAAQ;AAAA,UAClB,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,MAAM,KAAK,UAAU;AAAA,YACnB,OACE;AAAA,YACF,MAAM;AAAA,YACN,cAAc;AAAA,YACd,WAAW;AAAA,UACb,CAAC;AAAA,QACH,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,KAAK,KAAK,cAAc,EAAE,WAAW,mBAAmB,CAAC;AAE/D,UAAM,YAAY,KAAK,QAAQ,0BAA0B;AACzD,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AAEvD,UAAM,gBAAgB,KAAK;AAAA,MACzB;AAAA,IACF;AACA,UAAM,OAAO,aAAa,EAAE,YAAY,EAAE,SAAS,KAAO,CAAC;AAC3D,UAAM,eAAe,MAAM,cAAc;AAAA,MACvC;AAAA,IACF;AACA,WAAO,YAAY,EAAE,KAAK,MAAM;AAGhC,UAAM,iBAAiB,KAAK;AAAA,MAC1B;AAAA,IACF;AACA,UAAM,mBAAmB,MAAM,eAAe;AAAA,MAC5C;AAAA,IACF;AACA,WAAO,gBAAgB,EAAE,KAAK,OAAO;AAAA,EACvC,CAAC;AAED,OAAK,8GAA8G,OAAO;AAAA,IACxH;AAAA,EACF,MAAM;AAKJ,UAAM,WAAW,MAAM,QAAQ;AAAA,MAC7B;AAAA,MACA;AAAA,QACE,MAAM,EAAE,gBAAgB,mBAAmB;AAAA,QAC3C,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAChD;AAAA,IACF;AAEA,WAAO,CAAC,KAAK,KAAK,GAAG,CAAC,EAAE,UAAU,SAAS,OAAO,CAAC;AACnD,QAAI,SAAS,OAAO,MAAM,KAAK;AAC7B,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,KAAK,IAAI,EAAE,KAAK,wBAAwB;AAAA,IACjD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}