@open-mercato/ai-assistant 0.6.5-develop.4498.1.55dc06a57c → 0.6.5-develop.4534.1.b459babe6d

package/dist/modules/ai_assistant/__integration__/TC-AI-PARTICIPANTS-002-add-remove-participants.spec.js

@@ -0,0 +1,132 @@
+import { test, expect } from "@playwright/test";
+import { randomUUID } from "node:crypto";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  createRoleFixture,
+  deleteRoleIfExists,
+  createUserFixture,
+  deleteUserIfExists,
+  setUserAclVisibility
+} from "@open-mercato/core/helpers/integration/authFixtures";
+import {
+  createOrganizationInDb,
+  deleteOrganizationInDb,
+  deleteUserAclInDb
+} from "@open-mercato/core/helpers/integration/dbFixtures";
+import { getTokenScope, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { deleteConversationCascadeInDb } from "./helpers/aiAssistantFixtures.js";
+const CONVERSATIONS = "/api/ai_assistant/ai/conversations";
+test.describe("TC-AI-PARTICIPANTS-002: Conversation participants", () => {
+  test("add -> list -> remove lifecycle plus owner/duplicate/self/cross-org/RBAC guards", async ({ request }) => {
+    test.slow();
+    const adminToken = await getAuthToken(request, "admin");
+    const { tenantId, organizationId: orgAId, userId: ownerId } = getTokenScope(adminToken);
+    const stamp = randomUUID().slice(0, 8);
+    const password = "Secret123!";
+    const agentId = `it_part.agent_${stamp}`;
+    const conversationId = `it-part-${randomUUID()}`;
+    let roleId = null;
+    let memberId = null;
+    let foreignOrgId = null;
+    let foreignUserId = null;
+    try {
+      roleId = await createRoleFixture(request, adminToken, { name: `IT Part Role ${stamp}` });
+      memberId = await createUserFixture(request, adminToken, {
+        email: `it-part-member-${stamp}@example.com`,
+        password,
+        organizationId: orgAId,
+        roles: [roleId]
+      });
+      await setUserAclVisibility(request, adminToken, {
+        userId: memberId,
+        features: ["ai_assistant.view"],
+        organizations: [orgAId]
+      });
+      foreignOrgId = await createOrganizationInDb({ name: `IT Part OrgB ${stamp}`, tenantId });
+      foreignUserId = await createUserFixture(request, adminToken, {
+        email: `it-part-foreign-${stamp}@example.com`,
+        password,
+        organizationId: foreignOrgId,
+        roles: [roleId]
+      });
+      const createRes = await apiRequest(request, "POST", CONVERSATIONS, {
+        token: adminToken,
+        data: { agentId, conversationId, title: "Shareable conversation" }
+      });
+      expect(createRes.status()).toBe(201);
+      const participantsPath = `${CONVERSATIONS}/${encodeURIComponent(conversationId)}/participants`;
+      const addRes = await apiRequest(request, "POST", participantsPath, {
+        token: adminToken,
+        data: { userId: memberId }
+      });
+      expect(addRes.status(), "add participant returns 201").toBe(201);
+      const added = await readJsonSafe(addRes);
+      expect(added?.participant.userId).toBe(memberId);
+      expect(added?.participant.role).toBe("viewer");
+      const listRes = await apiRequest(request, "GET", participantsPath, { token: adminToken });
+      expect(listRes.status()).toBe(200);
+      const list = await readJsonSafe(listRes);
+      expect(list?.ownerUserId).toBe(ownerId);
+      expect(list?.participants.some((p) => p.userId === ownerId && p.role === "owner")).toBe(true);
+      expect(list?.participants.some((p) => p.userId === memberId && p.role === "viewer")).toBe(true);
+      const selfAdd = await apiRequest(request, "POST", participantsPath, {
+        token: adminToken,
+        data: { userId: ownerId }
+      });
+      expect(selfAdd.status()).toBe(400);
+      expect((await readJsonSafe(selfAdd))?.code).toBe("self_share_not_allowed");
+      const dup = await apiRequest(request, "POST", participantsPath, {
+        token: adminToken,
+        data: { userId: memberId }
+      });
+      expect(dup.status()).toBe(409);
+      expect((await readJsonSafe(dup))?.code).toBe("duplicate_participant");
+      const foreign = await apiRequest(request, "POST", participantsPath, {
+        token: adminToken,
+        data: { userId: foreignUserId }
+      });
+      expect(foreign.status()).toBe(400);
+      expect((await readJsonSafe(foreign))?.code).toBe("user_not_found");
+      const memberToken = await getAuthToken(request, `it-part-member-${stamp}@example.com`, password);
+      const denied = await apiRequest(request, "POST", participantsPath, {
+        token: memberToken,
+        data: { userId: randomUUID() }
+      });
+      expect(denied.status(), "caller without conversations.share is 403").toBe(403);
+      const removeOwner = await apiRequest(
+        request,
+        "DELETE",
+        `${participantsPath}/${encodeURIComponent(ownerId)}`,
+        { token: adminToken }
+      );
+      expect(removeOwner.status(), "cannot revoke the owner").toBe(403);
+      const removeMember = await apiRequest(
+        request,
+        "DELETE",
+        `${participantsPath}/${encodeURIComponent(memberId)}`,
+        { token: adminToken }
+      );
+      expect(removeMember.status(), "revoke participant returns 204").toBe(204);
+      const listAfter = await apiRequest(request, "GET", participantsPath, { token: adminToken });
+      expect(listAfter.status()).toBe(200);
+      const after = await readJsonSafe(listAfter);
+      expect(after?.participants.some((p) => p.userId === memberId)).toBe(false);
+      const removeAgain = await apiRequest(
+        request,
+        "DELETE",
+        `${participantsPath}/${encodeURIComponent(memberId)}`,
+        { token: adminToken }
+      );
+      expect(removeAgain.status()).toBe(404);
+      expect((await readJsonSafe(removeAgain))?.code).toBe("participant_not_found");
+    } finally {
+      await deleteConversationCascadeInDb({ tenantId, conversationId }).catch(() => void 0);
+      await deleteUserAclInDb(memberId ?? "").catch(() => void 0);
+      await deleteUserIfExists(request, adminToken, memberId);
+      await deleteUserIfExists(request, adminToken, foreignUserId);
+      await deleteRoleIfExists(request, adminToken, roleId);
+      await deleteOrganizationInDb(foreignOrgId).catch(() => void 0);
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-PARTICIPANTS-002-add-remove-participants.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-PARTICIPANTS-002-add-remove-participants.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-PARTICIPANTS-002-add-remove-participants.spec.ts"],
+  "sourcesContent": ["import { test, expect } from '@playwright/test';\nimport { randomUUID } from 'node:crypto';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  createRoleFixture,\n  deleteRoleIfExists,\n  createUserFixture,\n  deleteUserIfExists,\n  setUserAclVisibility,\n} from '@open-mercato/core/helpers/integration/authFixtures';\nimport {\n  createOrganizationInDb,\n  deleteOrganizationInDb,\n  deleteUserAclInDb,\n} from '@open-mercato/core/helpers/integration/dbFixtures';\nimport { getTokenScope, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport { deleteConversationCascadeInDb } from './helpers/aiAssistantFixtures';\n\n/**\n * TC-AI-PARTICIPANTS-002 \u2014 Conversation participants (add / list / remove).\n * Source: GitHub issue #2495.\n *\n * Surfaces under test:\n *   - /api/ai_assistant/ai/conversations/{id}/participants            (POST, GET)\n *   - /api/ai_assistant/ai/conversations/{id}/participants/{userId}    (DELETE)\n *\n * Contract notes verified against the route handlers:\n *   - add requires `ai_assistant.conversations.share`; only the owner may add.\n *   - the only wire role is `viewer` (the owner row is implicit).\n *   - add returns 201 `{ participant: { userId, role, lastReadAt, addedAt } }`.\n *   - removing a participant returns 204; removing the OWNER is 403; a missing\n *     participant is 404 `participant_not_found`.\n *   - self-add is 400 `self_share_not_allowed`; a duplicate is 409\n *     `duplicate_participant`; a target in another org is 400 `user_not_found`.\n */\n\nconst CONVERSATIONS = '/api/ai_assistant/ai/conversations';\n\ninterface ParticipantRow {\n  userId: string;\n  role: string;\n  lastReadAt: string | null;\n  addedAt: string;\n}\n\ntest.describe('TC-AI-PARTICIPANTS-002: Conversation participants', () => {\n  test('add -> list -> remove lifecycle plus owner/duplicate/self/cross-org/RBAC guards', async ({ request }) => {\n    test.slow();\n    const adminToken = await getAuthToken(request, 'admin');\n    const { tenantId, organizationId: orgAId, userId: ownerId } = getTokenScope(adminToken);\n    const stamp = randomUUID().slice(0, 8);\n    const password = 'Secret123!';\n    const agentId = `it_part.agent_${stamp}`;\n    const conversationId = `it-part-${randomUUID()}`;\n\n    let roleId: string | null = null;\n    let memberId: string | null = null;\n    let foreignOrgId: string | null = null;\n    let foreignUserId: string | null = null;\n    try {\n      roleId = await createRoleFixture(request, adminToken, { name: `IT Part Role ${stamp}` });\n      // Member lives in the SAME org as the owner and carries only view -> valid\n      // share target AND a deterministic \"lacks conversations.share\" caller.\n      memberId = await createUserFixture(request, adminToken, {\n        email: `it-part-member-${stamp}@example.com`,\n        password,\n        organizationId: orgAId,\n        roles: [roleId],\n      });\n      await setUserAclVisibility(request, adminToken, {\n        userId: memberId,\n        features: ['ai_assistant.view'],\n        organizations: [orgAId],\n      });\n      // Foreign user lives in another org -> cannot be shared into this conversation.\n      foreignOrgId = await createOrganizationInDb({ name: `IT Part OrgB ${stamp}`, tenantId });\n      foreignUserId = await createUserFixture(request, adminToken, {\n        email: `it-part-foreign-${stamp}@example.com`,\n        password,\n        organizationId: foreignOrgId,\n        roles: [roleId],\n      });\n\n      const createRes = await apiRequest(request, 'POST', CONVERSATIONS, {\n        token: adminToken,\n        data: { agentId, conversationId, title: 'Shareable conversation' },\n      });\n      expect(createRes.status()).toBe(201);\n\n      const participantsPath = `${CONVERSATIONS}/${encodeURIComponent(conversationId)}/participants`;\n\n      // Add member -> 201 viewer\n      const addRes = await apiRequest(request, 'POST', participantsPath, {\n        token: adminToken,\n        data: { userId: memberId },\n      });\n      expect(addRes.status(), 'add participant returns 201').toBe(201);\n      const added = await readJsonSafe<{ participant: ParticipantRow }>(addRes);\n      expect(added?.participant.userId).toBe(memberId);\n      expect(added?.participant.role).toBe('viewer');\n\n      // List -> owner + member\n      const listRes = await apiRequest(request, 'GET', participantsPath, { token: adminToken });\n      expect(listRes.status()).toBe(200);\n      const list = await readJsonSafe<{ ownerUserId: string; participants: ParticipantRow[] }>(listRes);\n      expect(list?.ownerUserId).toBe(ownerId);\n      expect(list?.participants.some((p) => p.userId === ownerId && p.role === 'owner')).toBe(true);\n      expect(list?.participants.some((p) => p.userId === memberId && p.role === 'viewer')).toBe(true);\n\n      // Self-add -> 400 self_share_not_allowed\n      const selfAdd = await apiRequest(request, 'POST', participantsPath, {\n        token: adminToken,\n        data: { userId: ownerId },\n      });\n      expect(selfAdd.status()).toBe(400);\n      expect((await readJsonSafe<{ code?: string }>(selfAdd))?.code).toBe('self_share_not_allowed');\n\n      // Duplicate -> 409 duplicate_participant\n      const dup = await apiRequest(request, 'POST', participantsPath, {\n        token: adminToken,\n        data: { userId: memberId },\n      });\n      expect(dup.status()).toBe(409);\n      expect((await readJsonSafe<{ code?: string }>(dup))?.code).toBe('duplicate_participant');\n\n      // Foreign-org target -> 400 user_not_found\n      const foreign = await apiRequest(request, 'POST', participantsPath, {\n        token: adminToken,\n        data: { userId: foreignUserId },\n      });\n      expect(foreign.status()).toBe(400);\n      expect((await readJsonSafe<{ code?: string }>(foreign))?.code).toBe('user_not_found');\n\n      // Caller lacking conversations.share -> 403 (feature gate fires first)\n      const memberToken = await getAuthToken(request, `it-part-member-${stamp}@example.com`, password);\n      const denied = await apiRequest(request, 'POST', participantsPath, {\n        token: memberToken,\n        data: { userId: randomUUID() },\n      });\n      expect(denied.status(), 'caller without conversations.share is 403').toBe(403);\n\n      // Remove the OWNER -> 403\n      const removeOwner = await apiRequest(\n        request,\n        'DELETE',\n        `${participantsPath}/${encodeURIComponent(ownerId)}`,\n        { token: adminToken },\n      );\n      expect(removeOwner.status(), 'cannot revoke the owner').toBe(403);\n\n      // Remove the member -> 204\n      const removeMember = await apiRequest(\n        request,\n        'DELETE',\n        `${participantsPath}/${encodeURIComponent(memberId)}`,\n        { token: adminToken },\n      );\n      expect(removeMember.status(), 'revoke participant returns 204').toBe(204);\n\n      // List -> member gone\n      const listAfter = await apiRequest(request, 'GET', participantsPath, { token: adminToken });\n      expect(listAfter.status()).toBe(200);\n      const after = await readJsonSafe<{ participants: ParticipantRow[] }>(listAfter);\n      expect(after?.participants.some((p) => p.userId === memberId)).toBe(false);\n\n      // Remove again -> 404 participant_not_found\n      const removeAgain = await apiRequest(\n        request,\n        'DELETE',\n        `${participantsPath}/${encodeURIComponent(memberId)}`,\n        { token: adminToken },\n      );\n      expect(removeAgain.status()).toBe(404);\n      expect((await readJsonSafe<{ code?: string }>(removeAgain))?.code).toBe('participant_not_found');\n    } finally {\n      await deleteConversationCascadeInDb({ tenantId, conversationId }).catch(() => undefined);\n      await deleteUserAclInDb(memberId ?? '').catch(() => undefined);\n      await deleteUserIfExists(request, adminToken, memberId);\n      await deleteUserIfExists(request, adminToken, foreignUserId);\n      await deleteRoleIfExists(request, adminToken, roleId);\n      await deleteOrganizationInDb(foreignOrgId).catch(() => undefined);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,cAAc;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe,oBAAoB;AAC5C,SAAS,qCAAqC;AAoB9C,MAAM,gBAAgB;AAStB,KAAK,SAAS,qDAAqD,MAAM;AACvE,OAAK,mFAAmF,OAAO,EAAE,QAAQ,MAAM;AAC7G,SAAK,KAAK;AACV,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,UAAM,EAAE,UAAU,gBAAgB,QAAQ,QAAQ,QAAQ,IAAI,cAAc,UAAU;AACtF,UAAM,QAAQ,WAAW,EAAE,MAAM,GAAG,CAAC;AACrC,UAAM,WAAW;AACjB,UAAM,UAAU,iBAAiB,KAAK;AACtC,UAAM,iBAAiB,WAAW,WAAW,CAAC;AAE9C,QAAI,SAAwB;AAC5B,QAAI,WAA0B;AAC9B,QAAI,eAA8B;AAClC,QAAI,gBAA+B;AACnC,QAAI;AACF,eAAS,MAAM,kBAAkB,SAAS,YAAY,EAAE,MAAM,gBAAgB,KAAK,GAAG,CAAC;AAGvF,iBAAW,MAAM,kBAAkB,SAAS,YAAY;AAAA,QACtD,OAAO,kBAAkB,KAAK;AAAA,QAC9B;AAAA,QACA,gBAAgB;AAAA,QAChB,OAAO,CAAC,MAAM;AAAA,MAChB,CAAC;AACD,YAAM,qBAAqB,SAAS,YAAY;AAAA,QAC9C,QAAQ;AAAA,QACR,UAAU,CAAC,mBAAmB;AAAA,QAC9B,eAAe,CAAC,MAAM;AAAA,MACxB,CAAC;AAED,qBAAe,MAAM,uBAAuB,EAAE,MAAM,gBAAgB,KAAK,IAAI,SAAS,CAAC;AACvF,sBAAgB,MAAM,kBAAkB,SAAS,YAAY;AAAA,QAC3D,OAAO,mBAAmB,KAAK;AAAA,QAC/B;AAAA,QACA,gBAAgB;AAAA,QAChB,OAAO,CAAC,MAAM;AAAA,MAChB,CAAC;AAED,YAAM,YAAY,MAAM,WAAW,SAAS,QAAQ,eAAe;AAAA,QACjE,OAAO;AAAA,QACP,MAAM,EAAE,SAAS,gBAAgB,OAAO,yBAAyB;AAAA,MACnE,CAAC;AACD,aAAO,UAAU,OAAO,CAAC,EAAE,KAAK,GAAG;AAEnC,YAAM,mBAAmB,GAAG,aAAa,IAAI,mBAAmB,cAAc,CAAC;AAG/E,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,QACjE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,aAAO,OAAO,OAAO,GAAG,6BAA6B,EAAE,KAAK,GAAG;AAC/D,YAAM,QAAQ,MAAM,aAA8C,MAAM;AACxE,aAAO,OAAO,YAAY,MAAM,EAAE,KAAK,QAAQ;AAC/C,aAAO,OAAO,YAAY,IAAI,EAAE,KAAK,QAAQ;AAG7C,YAAM,UAAU,MAAM,WAAW,SAAS,OAAO,kBAAkB,EAAE,OAAO,WAAW,CAAC;AACxF,aAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,YAAM,OAAO,MAAM,aAAsE,OAAO;AAChG,aAAO,MAAM,WAAW,EAAE,KAAK,OAAO;AACtC,aAAO,MAAM,aAAa,KAAK,CAAC,MAAM,EAAE,WAAW,WAAW,EAAE,SAAS,OAAO,CAAC,EAAE,KAAK,IAAI;AAC5F,aAAO,MAAM,aAAa,KAAK,CAAC,MAAM,EAAE,WAAW,YAAY,EAAE,SAAS,QAAQ,CAAC,EAAE,KAAK,IAAI;AAG9F,YAAM,UAAU,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,QAClE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,QAAQ;AAAA,MAC1B,CAAC;AACD,aAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,cAAQ,MAAM,aAAgC,OAAO,IAAI,IAAI,EAAE,KAAK,wBAAwB;AAG5F,YAAM,MAAM,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,QAC9D,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,aAAO,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAC7B,cAAQ,MAAM,aAAgC,GAAG,IAAI,IAAI,EAAE,KAAK,uBAAuB;AAGvF,YAAM,UAAU,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,QAClE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,cAAc;AAAA,MAChC,CAAC;AACD,aAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,cAAQ,MAAM,aAAgC,OAAO,IAAI,IAAI,EAAE,KAAK,gBAAgB;AAGpF,YAAM,cAAc,MAAM,aAAa,SAAS,kBAAkB,KAAK,gBAAgB,QAAQ;AAC/F,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,kBAAkB;AAAA,QACjE,OAAO;AAAA,QACP,MAAM,EAAE,QAAQ,WAAW,EAAE;AAAA,MAC/B,CAAC;AACD,aAAO,OAAO,OAAO,GAAG,2CAA2C,EAAE,KAAK,GAAG;AAG7E,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,GAAG,gBAAgB,IAAI,mBAAmB,OAAO,CAAC;AAAA,QAClD,EAAE,OAAO,WAAW;AAAA,MACtB;AACA,aAAO,YAAY,OAAO,GAAG,yBAAyB,EAAE,KAAK,GAAG;AAGhE,YAAM,eAAe,MAAM;AAAA,QACzB;AAAA,QACA;AAAA,QACA,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,QACnD,EAAE,OAAO,WAAW;AAAA,MACtB;AACA,aAAO,aAAa,OAAO,GAAG,gCAAgC,EAAE,KAAK,GAAG;AAGxE,YAAM,YAAY,MAAM,WAAW,SAAS,OAAO,kBAAkB,EAAE,OAAO,WAAW,CAAC;AAC1F,aAAO,UAAU,OAAO,CAAC,EAAE,KAAK,GAAG;AACnC,YAAM,QAAQ,MAAM,aAAiD,SAAS;AAC9E,aAAO,OAAO,aAAa,KAAK,CAAC,MAAM,EAAE,WAAW,QAAQ,CAAC,EAAE,KAAK,KAAK;AAGzE,YAAM,cAAc,MAAM;AAAA,QACxB;AAAA,QACA;AAAA,QACA,GAAG,gBAAgB,IAAI,mBAAmB,QAAQ,CAAC;AAAA,QACnD,EAAE,OAAO,WAAW;AAAA,MACtB;AACA,aAAO,YAAY,OAAO,CAAC,EAAE,KAAK,GAAG;AACrC,cAAQ,MAAM,aAAgC,WAAW,IAAI,IAAI,EAAE,KAAK,uBAAuB;AAAA,IACjG,UAAE;AACA,YAAM,8BAA8B,EAAE,UAAU,eAAe,CAAC,EAAE,MAAM,MAAM,MAAS;AACvF,YAAM,kBAAkB,YAAY,EAAE,EAAE,MAAM,MAAM,MAAS;AAC7D,YAAM,mBAAmB,SAAS,YAAY,QAAQ;AACtD,YAAM,mBAAmB,SAAS,YAAY,aAAa;AAC3D,YAAM,mBAAmB,SAAS,YAAY,MAAM;AACpD,YAAM,uBAAuB,YAAY,EAAE,MAAM,MAAM,MAAS;AAAA,IAClE;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/ai_assistant/__integration__/TC-AI-SESSION-KEY-006-create-session-token.spec.js

@@ -0,0 +1,68 @@
+import { test, expect, request as playwrightRequest } from "@playwright/test";
+import { randomUUID } from "node:crypto";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import {
+  createRoleFixture,
+  deleteRoleIfExists,
+  createUserFixture,
+  deleteUserIfExists,
+  setUserAclVisibility
+} from "@open-mercato/core/helpers/integration/authFixtures";
+import { deleteUserAclInDb } from "@open-mercato/core/helpers/integration/dbFixtures";
+import { getTokenScope, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+const SESSION_KEY = "/api/ai_assistant/session-key";
+const SESSION_TOKEN_RE = /^sess_[0-9a-f]{32}$/;
+const TTL_MINUTES = 120;
+test.describe("TC-AI-SESSION-KEY-006: Session key generation", () => {
+  test("POST mints a unique sess_ token with a ~120 minute TTL", async ({ request }) => {
+    const adminToken = await getAuthToken(request, "admin");
+    const first = await apiRequest(request, "POST", SESSION_KEY, { token: adminToken, data: {} });
+    expect(first.status(), "session-key POST returns 200").toBe(200);
+    const body = await readJsonSafe(first);
+    expect(body?.sessionToken).toMatch(SESSION_TOKEN_RE);
+    const now = Date.now();
+    const expiresAt = Date.parse(body.expiresAt);
+    expect(Number.isNaN(expiresAt)).toBe(false);
+    expect(expiresAt).toBeGreaterThan(now + (TTL_MINUTES - 5) * 60 * 1e3);
+    expect(expiresAt).toBeLessThan(now + (TTL_MINUTES + 5) * 60 * 1e3);
+    const second = await apiRequest(request, "POST", SESSION_KEY, { token: adminToken, data: {} });
+    expect(second.status()).toBe(200);
+    const secondBody = await readJsonSafe(second);
+    expect(secondBody?.sessionToken).toMatch(SESSION_TOKEN_RE);
+    expect(secondBody?.sessionToken, "each call mints a distinct token").not.toBe(body?.sessionToken);
+  });
+  test("auth gates: unauthenticated 401 and missing ai_assistant.view 403", async ({ request, baseURL }) => {
+    test.slow();
+    const adminToken = await getAuthToken(request, "admin");
+    const { organizationId } = getTokenScope(adminToken);
+    const stamp = randomUUID().slice(0, 8);
+    const password = "Secret123!";
+    const anon = await playwrightRequest.newContext({ baseURL });
+    try {
+      const res = await anon.fetch(SESSION_KEY, { method: "POST", data: "{}" });
+      expect(res.status(), "unauthenticated POST is 401").toBe(401);
+    } finally {
+      await anon.dispose();
+    }
+    let roleId = null;
+    let userId = null;
+    try {
+      roleId = await createRoleFixture(request, adminToken, { name: `IT Session Role ${stamp}` });
+      userId = await createUserFixture(request, adminToken, {
+        email: `it-session-${stamp}@example.com`,
+        password,
+        organizationId,
+        roles: [roleId]
+      });
+      await setUserAclVisibility(request, adminToken, { userId, features: [], organizations: null });
+      const viewlessToken = await getAuthToken(request, `it-session-${stamp}@example.com`, password);
+      const denied = await apiRequest(request, "POST", SESSION_KEY, { token: viewlessToken, data: {} });
+      expect(denied.status(), "caller without ai_assistant.view is 403").toBe(403);
+    } finally {
+      await deleteUserAclInDb(userId ?? "").catch(() => void 0);
+      await deleteUserIfExists(request, adminToken, userId);
+      await deleteRoleIfExists(request, adminToken, roleId);
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-SESSION-KEY-006-create-session-token.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-SESSION-KEY-006-create-session-token.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-SESSION-KEY-006-create-session-token.spec.ts"],
+  "sourcesContent": ["import { test, expect, request as playwrightRequest } from '@playwright/test';\nimport { randomUUID } from 'node:crypto';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport {\n  createRoleFixture,\n  deleteRoleIfExists,\n  createUserFixture,\n  deleteUserIfExists,\n  setUserAclVisibility,\n} from '@open-mercato/core/helpers/integration/authFixtures';\nimport { deleteUserAclInDb } from '@open-mercato/core/helpers/integration/dbFixtures';\nimport { getTokenScope, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\n\n/**\n * TC-AI-SESSION-KEY-006 \u2014 Session key generation.\n * Source: GitHub issue #2495.\n *\n * Surface under test:\n *   - /api/ai_assistant/session-key   (POST)\n *\n * Contract notes verified against the route handler (the issue's guesses were wrong):\n *   - the response body is EXACTLY `{ sessionToken, expiresAt }` \u2014 it does NOT\n *     include userId / tenantId / organizationId.\n *   - token format is `sess_` + 32 lowercase hex chars; TTL is 120 minutes.\n *   - requires `ai_assistant.view`; unauthenticated -> 401; missing feature -> 403.\n *\n * NOTE: the returned `sess_...` token is consumed only as the MCP `_sessionToken`\n * tool-call argument \u2014 it is NOT accepted by the Next.js HTTP auth resolver as a\n * Bearer/header, so the issue's \"use the token to call /tools\" step is invalid\n * and intentionally omitted here.\n */\n\nconst SESSION_KEY = '/api/ai_assistant/session-key';\nconst SESSION_TOKEN_RE = /^sess_[0-9a-f]{32}$/;\nconst TTL_MINUTES = 120;\n\ntest.describe('TC-AI-SESSION-KEY-006: Session key generation', () => {\n  test('POST mints a unique sess_ token with a ~120 minute TTL', async ({ request }) => {\n    const adminToken = await getAuthToken(request, 'admin');\n\n    const first = await apiRequest(request, 'POST', SESSION_KEY, { token: adminToken, data: {} });\n    expect(first.status(), 'session-key POST returns 200').toBe(200);\n    const body = await readJsonSafe<{ sessionToken: string; expiresAt: string }>(first);\n    expect(body?.sessionToken).toMatch(SESSION_TOKEN_RE);\n\n    const now = Date.now();\n    const expiresAt = Date.parse(body!.expiresAt);\n    expect(Number.isNaN(expiresAt)).toBe(false);\n    // Allow generous slop for clock + request latency around the 120-minute TTL.\n    expect(expiresAt).toBeGreaterThan(now + (TTL_MINUTES - 5) * 60 * 1000);\n    expect(expiresAt).toBeLessThan(now + (TTL_MINUTES + 5) * 60 * 1000);\n\n    const second = await apiRequest(request, 'POST', SESSION_KEY, { token: adminToken, data: {} });\n    expect(second.status()).toBe(200);\n    const secondBody = await readJsonSafe<{ sessionToken: string }>(second);\n    expect(secondBody?.sessionToken).toMatch(SESSION_TOKEN_RE);\n    expect(secondBody?.sessionToken, 'each call mints a distinct token').not.toBe(body?.sessionToken);\n  });\n\n  test('auth gates: unauthenticated 401 and missing ai_assistant.view 403', async ({ request, baseURL }) => {\n    test.slow();\n    const adminToken = await getAuthToken(request, 'admin');\n    const { organizationId } = getTokenScope(adminToken);\n    const stamp = randomUUID().slice(0, 8);\n    const password = 'Secret123!';\n\n    const anon = await playwrightRequest.newContext({ baseURL });\n    try {\n      const res = await anon.fetch(SESSION_KEY, { method: 'POST', data: '{}' });\n      expect(res.status(), 'unauthenticated POST is 401').toBe(401);\n    } finally {\n      await anon.dispose();\n    }\n\n    let roleId: string | null = null;\n    let userId: string | null = null;\n    try {\n      roleId = await createRoleFixture(request, adminToken, { name: `IT Session Role ${stamp}` });\n      userId = await createUserFixture(request, adminToken, {\n        email: `it-session-${stamp}@example.com`,\n        password,\n        organizationId,\n        roles: [roleId],\n      });\n      await setUserAclVisibility(request, adminToken, { userId, features: [], organizations: null });\n      const viewlessToken = await getAuthToken(request, `it-session-${stamp}@example.com`, password);\n      const denied = await apiRequest(request, 'POST', SESSION_KEY, { token: viewlessToken, data: {} });\n      expect(denied.status(), 'caller without ai_assistant.view is 403').toBe(403);\n    } finally {\n      await deleteUserAclInDb(userId ?? '').catch(() => undefined);\n      await deleteUserIfExists(request, adminToken, userId);\n      await deleteRoleIfExists(request, adminToken, roleId);\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,QAAQ,WAAW,yBAAyB;AAC3D,SAAS,kBAAkB;AAC3B,SAAS,YAAY,oBAAoB;AACzC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC,SAAS,eAAe,oBAAoB;AAqB5C,MAAM,cAAc;AACpB,MAAM,mBAAmB;AACzB,MAAM,cAAc;AAEpB,KAAK,SAAS,iDAAiD,MAAM;AACnE,OAAK,0DAA0D,OAAO,EAAE,QAAQ,MAAM;AACpF,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AAEtD,UAAM,QAAQ,MAAM,WAAW,SAAS,QAAQ,aAAa,EAAE,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC;AAC5F,WAAO,MAAM,OAAO,GAAG,8BAA8B,EAAE,KAAK,GAAG;AAC/D,UAAM,OAAO,MAAM,aAA0D,KAAK;AAClF,WAAO,MAAM,YAAY,EAAE,QAAQ,gBAAgB;AAEnD,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAY,KAAK,MAAM,KAAM,SAAS;AAC5C,WAAO,OAAO,MAAM,SAAS,CAAC,EAAE,KAAK,KAAK;AAE1C,WAAO,SAAS,EAAE,gBAAgB,OAAO,cAAc,KAAK,KAAK,GAAI;AACrE,WAAO,SAAS,EAAE,aAAa,OAAO,cAAc,KAAK,KAAK,GAAI;AAElE,UAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,aAAa,EAAE,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC;AAC7F,WAAO,OAAO,OAAO,CAAC,EAAE,KAAK,GAAG;AAChC,UAAM,aAAa,MAAM,aAAuC,MAAM;AACtE,WAAO,YAAY,YAAY,EAAE,QAAQ,gBAAgB;AACzD,WAAO,YAAY,cAAc,kCAAkC,EAAE,IAAI,KAAK,MAAM,YAAY;AAAA,EAClG,CAAC;AAED,OAAK,qEAAqE,OAAO,EAAE,SAAS,QAAQ,MAAM;AACxG,SAAK,KAAK;AACV,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,UAAM,EAAE,eAAe,IAAI,cAAc,UAAU;AACnD,UAAM,QAAQ,WAAW,EAAE,MAAM,GAAG,CAAC;AACrC,UAAM,WAAW;AAEjB,UAAM,OAAO,MAAM,kBAAkB,WAAW,EAAE,QAAQ,CAAC;AAC3D,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,MAAM,aAAa,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACxE,aAAO,IAAI,OAAO,GAAG,6BAA6B,EAAE,KAAK,GAAG;AAAA,IAC9D,UAAE;AACA,YAAM,KAAK,QAAQ;AAAA,IACrB;AAEA,QAAI,SAAwB;AAC5B,QAAI,SAAwB;AAC5B,QAAI;AACF,eAAS,MAAM,kBAAkB,SAAS,YAAY,EAAE,MAAM,mBAAmB,KAAK,GAAG,CAAC;AAC1F,eAAS,MAAM,kBAAkB,SAAS,YAAY;AAAA,QACpD,OAAO,cAAc,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,OAAO,CAAC,MAAM;AAAA,MAChB,CAAC;AACD,YAAM,qBAAqB,SAAS,YAAY,EAAE,QAAQ,UAAU,CAAC,GAAG,eAAe,KAAK,CAAC;AAC7F,YAAM,gBAAgB,MAAM,aAAa,SAAS,cAAc,KAAK,gBAAgB,QAAQ;AAC7F,YAAM,SAAS,MAAM,WAAW,SAAS,QAAQ,aAAa,EAAE,OAAO,eAAe,MAAM,CAAC,EAAE,CAAC;AAChG,aAAO,OAAO,OAAO,GAAG,yCAAyC,EAAE,KAAK,GAAG;AAAA,IAC7E,UAAE;AACA,YAAM,kBAAkB,UAAU,EAAE,EAAE,MAAM,MAAM,MAAS;AAC3D,YAAM,mBAAmB,SAAS,YAAY,MAAM;AACpD,YAAM,mBAAmB,SAAS,YAAY,MAAM;AAAA,IACtD;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/ai_assistant/__integration__/TC-AI-SETTINGS-ALLOWLIST-003-put-delete-allowlist.spec.js

@@ -0,0 +1,74 @@
+import { test, expect, request as playwrightRequest } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { getTokenScope, readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+import { deleteTenantAllowlistInDb } from "./helpers/aiAssistantFixtures.js";
+const ALLOWLIST = "/api/ai_assistant/settings/allowlist";
+const SETTINGS = "/api/ai_assistant/settings";
+test.describe("TC-AI-SETTINGS-ALLOWLIST-003: Tenant model allowlist", () => {
+  test("PUT persists, GET reflects, DELETE clears + is idempotent", async ({ request }) => {
+    test.slow();
+    const adminToken = await getAuthToken(request, "admin");
+    const { tenantId } = getTokenScope(adminToken);
+    try {
+      const reset = await apiRequest(request, "DELETE", ALLOWLIST, { token: adminToken });
+      expect(reset.status()).toBe(200);
+      const settingsBefore = await apiRequest(request, "GET", SETTINGS, { token: adminToken });
+      expect(settingsBefore.status()).toBe(200);
+      const before = await readJsonSafe(
+        settingsBefore
+      );
+      expect(before?.tenantAllowlist).toBeNull();
+      expect(before?.effectiveAllowlist).toBeTruthy();
+      const put = await apiRequest(request, "PUT", ALLOWLIST, {
+        token: adminToken,
+        data: { allowedProviders: ["openai"], allowedModelsByProvider: { openai: ["gpt-5-mini"] } }
+      });
+      expect(put.status(), "PUT allowlist returns 200").toBe(200);
+      const saved = await readJsonSafe(put);
+      expect(saved?.allowedProviders).toContain("openai");
+      expect(saved?.allowedModelsByProvider?.openai).toContain("gpt-5-mini");
+      const settingsAfter = await apiRequest(request, "GET", SETTINGS, { token: adminToken });
+      expect(settingsAfter.status()).toBe(200);
+      const after = await readJsonSafe(settingsAfter);
+      expect(after?.tenantAllowlist?.allowedProviders).toContain("openai");
+      const del = await apiRequest(request, "DELETE", ALLOWLIST, { token: adminToken });
+      expect(del.status()).toBe(200);
+      expect((await readJsonSafe(del))?.cleared).toBe(true);
+      const settingsCleared = await apiRequest(request, "GET", SETTINGS, { token: adminToken });
+      const cleared = await readJsonSafe(settingsCleared);
+      expect(cleared?.tenantAllowlist).toBeNull();
+      const delAgain = await apiRequest(request, "DELETE", ALLOWLIST, { token: adminToken });
+      expect(delAgain.status()).toBe(200);
+      expect((await readJsonSafe(delAgain))?.cleared, "DELETE is idempotent").toBe(false);
+    } finally {
+      await deleteTenantAllowlistInDb(tenantId).catch(() => void 0);
+    }
+  });
+  test("validation + RBAC gates: bad body 400, employee 403, unauthenticated 401", async ({ request, baseURL }) => {
+    const adminToken = await getAuthToken(request, "admin");
+    const badType = await apiRequest(request, "PUT", ALLOWLIST, {
+      token: adminToken,
+      data: { allowedProviders: 123 }
+    });
+    expect(badType.status()).toBe(400);
+    expect((await readJsonSafe(badType))?.code).toBe("validation_error");
+    const employeeToken = await getAuthToken(request, "employee");
+    const denied = await apiRequest(request, "PUT", ALLOWLIST, {
+      token: employeeToken,
+      data: { allowedProviders: ["openai"] }
+    });
+    expect(denied.status(), "employee lacks settings.manage -> 403").toBe(403);
+    const anon = await playwrightRequest.newContext({ baseURL });
+    try {
+      const res = await anon.fetch(ALLOWLIST, {
+        method: "PUT",
+        headers: { "Content-Type": "application/json" },
+        data: JSON.stringify({ allowedProviders: ["openai"] })
+      });
+      expect(res.status(), "unauthenticated PUT is 401").toBe(401);
+    } finally {
+      await anon.dispose();
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-SETTINGS-ALLOWLIST-003-put-delete-allowlist.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-SETTINGS-ALLOWLIST-003-put-delete-allowlist.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-SETTINGS-ALLOWLIST-003-put-delete-allowlist.spec.ts"],
+  "sourcesContent": ["import { test, expect, request as playwrightRequest } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { getTokenScope, readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\nimport { deleteTenantAllowlistInDb } from './helpers/aiAssistantFixtures';\n\n/**\n * TC-AI-SETTINGS-ALLOWLIST-003 \u2014 Tenant model allowlist (PUT/DELETE) + settings reflection.\n * Source: GitHub issue #2495.\n *\n * Surfaces under test:\n *   - /api/ai_assistant/settings/allowlist   (PUT, DELETE)\n *   - /api/ai_assistant/settings             (GET \u2014 reflects the snapshot)\n *\n * Contract notes verified against the route handlers:\n *   - PUT body fields are `allowedProviders` / `allowedModelsByProvider`\n *     (NOT `providers` / `models`); success is 200 returning the saved snapshot.\n *   - DELETE returns 200 `{ cleared: boolean }` and is idempotent\n *     (`cleared: false` when no active row exists).\n *   - GET /settings exposes `tenantAllowlist` (null when unset) + `effectiveAllowlist`.\n *   - PUT/DELETE require `ai_assistant.settings.manage`.\n *\n * Out of scope (documented): the `provider_not_in_env_allowlist` 400 branch only\n * fires when the APP process has `OM_AI_AVAILABLE_PROVIDERS` set to exclude the\n * provider. The deterministic harness does not control the app's env, so that\n * branch is covered by the module's unit tests; here we assert the env-agnostic\n * Zod validation (wrong type -> 400 validation_error) instead.\n */\n\nconst ALLOWLIST = '/api/ai_assistant/settings/allowlist';\nconst SETTINGS = '/api/ai_assistant/settings';\n\ninterface TenantAllowlistSnapshot {\n  allowedProviders: string[] | null;\n  allowedModelsByProvider: Record<string, string[]>;\n}\n\ntest.describe('TC-AI-SETTINGS-ALLOWLIST-003: Tenant model allowlist', () => {\n  test('PUT persists, GET reflects, DELETE clears + is idempotent', async ({ request }) => {\n    test.slow();\n    const adminToken = await getAuthToken(request, 'admin');\n    const { tenantId } = getTokenScope(adminToken);\n    try {\n      // Start from a known-clean state.\n      const reset = await apiRequest(request, 'DELETE', ALLOWLIST, { token: adminToken });\n      expect(reset.status()).toBe(200);\n\n      const settingsBefore = await apiRequest(request, 'GET', SETTINGS, { token: adminToken });\n      expect(settingsBefore.status()).toBe(200);\n      const before = await readJsonSafe<{ tenantAllowlist: TenantAllowlistSnapshot | null; effectiveAllowlist: unknown }>(\n        settingsBefore,\n      );\n      expect(before?.tenantAllowlist).toBeNull();\n      expect(before?.effectiveAllowlist).toBeTruthy();\n\n      const put = await apiRequest(request, 'PUT', ALLOWLIST, {\n        token: adminToken,\n        data: { allowedProviders: ['openai'], allowedModelsByProvider: { openai: ['gpt-5-mini'] } },\n      });\n      expect(put.status(), 'PUT allowlist returns 200').toBe(200);\n      const saved = await readJsonSafe<TenantAllowlistSnapshot>(put);\n      expect(saved?.allowedProviders).toContain('openai');\n      expect(saved?.allowedModelsByProvider?.openai).toContain('gpt-5-mini');\n\n      const settingsAfter = await apiRequest(request, 'GET', SETTINGS, { token: adminToken });\n      expect(settingsAfter.status()).toBe(200);\n      const after = await readJsonSafe<{ tenantAllowlist: TenantAllowlistSnapshot | null }>(settingsAfter);\n      expect(after?.tenantAllowlist?.allowedProviders).toContain('openai');\n\n      const del = await apiRequest(request, 'DELETE', ALLOWLIST, { token: adminToken });\n      expect(del.status()).toBe(200);\n      expect((await readJsonSafe<{ cleared: boolean }>(del))?.cleared).toBe(true);\n\n      const settingsCleared = await apiRequest(request, 'GET', SETTINGS, { token: adminToken });\n      const cleared = await readJsonSafe<{ tenantAllowlist: TenantAllowlistSnapshot | null }>(settingsCleared);\n      expect(cleared?.tenantAllowlist).toBeNull();\n\n      const delAgain = await apiRequest(request, 'DELETE', ALLOWLIST, { token: adminToken });\n      expect(delAgain.status()).toBe(200);\n      expect((await readJsonSafe<{ cleared: boolean }>(delAgain))?.cleared, 'DELETE is idempotent').toBe(false);\n    } finally {\n      await deleteTenantAllowlistInDb(tenantId).catch(() => undefined);\n    }\n  });\n\n  test('validation + RBAC gates: bad body 400, employee 403, unauthenticated 401', async ({ request, baseURL }) => {\n    const adminToken = await getAuthToken(request, 'admin');\n\n    const badType = await apiRequest(request, 'PUT', ALLOWLIST, {\n      token: adminToken,\n      data: { allowedProviders: 123 },\n    });\n    expect(badType.status()).toBe(400);\n    expect((await readJsonSafe<{ code?: string }>(badType))?.code).toBe('validation_error');\n\n    // Employee carries ai_assistant.view but NOT ai_assistant.settings.manage.\n    const employeeToken = await getAuthToken(request, 'employee');\n    const denied = await apiRequest(request, 'PUT', ALLOWLIST, {\n      token: employeeToken,\n      data: { allowedProviders: ['openai'] },\n    });\n    expect(denied.status(), 'employee lacks settings.manage -> 403').toBe(403);\n\n    const anon = await playwrightRequest.newContext({ baseURL });\n    try {\n      const res = await anon.fetch(ALLOWLIST, {\n        method: 'PUT',\n        headers: { 'Content-Type': 'application/json' },\n        data: JSON.stringify({ allowedProviders: ['openai'] }),\n      });\n      expect(res.status(), 'unauthenticated PUT is 401').toBe(401);\n    } finally {\n      await anon.dispose();\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,QAAQ,WAAW,yBAAyB;AAC3D,SAAS,YAAY,oBAAoB;AACzC,SAAS,eAAe,oBAAoB;AAC5C,SAAS,iCAAiC;AAyB1C,MAAM,YAAY;AAClB,MAAM,WAAW;AAOjB,KAAK,SAAS,wDAAwD,MAAM;AAC1E,OAAK,6DAA6D,OAAO,EAAE,QAAQ,MAAM;AACvF,SAAK,KAAK;AACV,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AACtD,UAAM,EAAE,SAAS,IAAI,cAAc,UAAU;AAC7C,QAAI;AAEF,YAAM,QAAQ,MAAM,WAAW,SAAS,UAAU,WAAW,EAAE,OAAO,WAAW,CAAC;AAClF,aAAO,MAAM,OAAO,CAAC,EAAE,KAAK,GAAG;AAE/B,YAAM,iBAAiB,MAAM,WAAW,SAAS,OAAO,UAAU,EAAE,OAAO,WAAW,CAAC;AACvF,aAAO,eAAe,OAAO,CAAC,EAAE,KAAK,GAAG;AACxC,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,MACF;AACA,aAAO,QAAQ,eAAe,EAAE,SAAS;AACzC,aAAO,QAAQ,kBAAkB,EAAE,WAAW;AAE9C,YAAM,MAAM,MAAM,WAAW,SAAS,OAAO,WAAW;AAAA,QACtD,OAAO;AAAA,QACP,MAAM,EAAE,kBAAkB,CAAC,QAAQ,GAAG,yBAAyB,EAAE,QAAQ,CAAC,YAAY,EAAE,EAAE;AAAA,MAC5F,CAAC;AACD,aAAO,IAAI,OAAO,GAAG,2BAA2B,EAAE,KAAK,GAAG;AAC1D,YAAM,QAAQ,MAAM,aAAsC,GAAG;AAC7D,aAAO,OAAO,gBAAgB,EAAE,UAAU,QAAQ;AAClD,aAAO,OAAO,yBAAyB,MAAM,EAAE,UAAU,YAAY;AAErE,YAAM,gBAAgB,MAAM,WAAW,SAAS,OAAO,UAAU,EAAE,OAAO,WAAW,CAAC;AACtF,aAAO,cAAc,OAAO,CAAC,EAAE,KAAK,GAAG;AACvC,YAAM,QAAQ,MAAM,aAAkE,aAAa;AACnG,aAAO,OAAO,iBAAiB,gBAAgB,EAAE,UAAU,QAAQ;AAEnE,YAAM,MAAM,MAAM,WAAW,SAAS,UAAU,WAAW,EAAE,OAAO,WAAW,CAAC;AAChF,aAAO,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAC7B,cAAQ,MAAM,aAAmC,GAAG,IAAI,OAAO,EAAE,KAAK,IAAI;AAE1E,YAAM,kBAAkB,MAAM,WAAW,SAAS,OAAO,UAAU,EAAE,OAAO,WAAW,CAAC;AACxF,YAAM,UAAU,MAAM,aAAkE,eAAe;AACvG,aAAO,SAAS,eAAe,EAAE,SAAS;AAE1C,YAAM,WAAW,MAAM,WAAW,SAAS,UAAU,WAAW,EAAE,OAAO,WAAW,CAAC;AACrF,aAAO,SAAS,OAAO,CAAC,EAAE,KAAK,GAAG;AAClC,cAAQ,MAAM,aAAmC,QAAQ,IAAI,SAAS,sBAAsB,EAAE,KAAK,KAAK;AAAA,IAC1G,UAAE;AACA,YAAM,0BAA0B,QAAQ,EAAE,MAAM,MAAM,MAAS;AAAA,IACjE;AAAA,EACF,CAAC;AAED,OAAK,4EAA4E,OAAO,EAAE,SAAS,QAAQ,MAAM;AAC/G,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AAEtD,UAAM,UAAU,MAAM,WAAW,SAAS,OAAO,WAAW;AAAA,MAC1D,OAAO;AAAA,MACP,MAAM,EAAE,kBAAkB,IAAI;AAAA,IAChC,CAAC;AACD,WAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,YAAQ,MAAM,aAAgC,OAAO,IAAI,IAAI,EAAE,KAAK,kBAAkB;AAGtF,UAAM,gBAAgB,MAAM,aAAa,SAAS,UAAU;AAC5D,UAAM,SAAS,MAAM,WAAW,SAAS,OAAO,WAAW;AAAA,MACzD,OAAO;AAAA,MACP,MAAM,EAAE,kBAAkB,CAAC,QAAQ,EAAE;AAAA,IACvC,CAAC;AACD,WAAO,OAAO,OAAO,GAAG,uCAAuC,EAAE,KAAK,GAAG;AAEzE,UAAM,OAAO,MAAM,kBAAkB,WAAW,EAAE,QAAQ,CAAC;AAC3D,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,MAAM,WAAW;AAAA,QACtC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,kBAAkB,CAAC,QAAQ,EAAE,CAAC;AAAA,MACvD,CAAC;AACD,aAAO,IAAI,OAAO,GAAG,4BAA4B,EAAE,KAAK,GAAG;AAAA,IAC7D,UAAE;AACA,YAAM,KAAK,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/ai_assistant/__integration__/TC-AI-TOOLS-EXECUTE-007-direct-tool-execution.spec.js

@@ -0,0 +1,57 @@
+import { test, expect, request as playwrightRequest } from "@playwright/test";
+import { apiRequest, getAuthToken } from "@open-mercato/core/helpers/integration/api";
+import { readJsonSafe } from "@open-mercato/core/helpers/integration/generalFixtures";
+const TOOLS = "/api/ai_assistant/tools";
+const EXECUTE = "/api/ai_assistant/tools/execute";
+test.describe("TC-AI-TOOLS-EXECUTE-007: Direct tool execution", () => {
+  test("list tools, validate + reject unknown tools, and exercise a no-arg tool", async ({ request }) => {
+    test.slow();
+    const adminToken = await getAuthToken(request, "admin");
+    const listRes = await apiRequest(request, "GET", TOOLS, { token: adminToken });
+    expect(listRes.status()).toBe(200);
+    const list = await readJsonSafe(listRes);
+    expect(Array.isArray(list?.tools)).toBe(true);
+    expect((list?.tools.length ?? 0) > 0, "at least one tool is visible to admin").toBe(true);
+    const sample = list.tools[0];
+    expect(typeof sample.name).toBe("string");
+    expect(typeof sample.inputSchema).toBe("object");
+    const missing = await apiRequest(request, "POST", EXECUTE, { token: adminToken, data: {} });
+    expect(missing.status()).toBe(400);
+    expect((await readJsonSafe(missing))?.error).toBe("toolName is required");
+    const unknown = await apiRequest(request, "POST", EXECUTE, {
+      token: adminToken,
+      data: { toolName: "does.not_exist_tool", args: {} }
+    });
+    expect(unknown.status()).toBe(400);
+    const unknownBody = await readJsonSafe(unknown);
+    expect(unknownBody?.success).toBe(false);
+    expect(unknownBody?.error ?? "").toContain("not found");
+    const noArgTool = list.tools.find((tool) => {
+      const required = tool.inputSchema?.required;
+      return !Array.isArray(required) || required.length === 0;
+    });
+    if (noArgTool) {
+      const exec = await apiRequest(request, "POST", EXECUTE, {
+        token: adminToken,
+        data: { toolName: noArgTool.name, args: {} }
+      });
+      if (exec.status() === 200) {
+        expect((await readJsonSafe(exec))?.success).toBe(true);
+      }
+    }
+  });
+  test("unauthenticated execute is rejected with 401", async ({ baseURL }) => {
+    const anon = await playwrightRequest.newContext({ baseURL });
+    try {
+      const res = await anon.fetch(EXECUTE, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        data: JSON.stringify({ toolName: "does.not_exist_tool", args: {} })
+      });
+      expect(res.status()).toBe(401);
+    } finally {
+      await anon.dispose();
+    }
+  });
+});
+//# sourceMappingURL=TC-AI-TOOLS-EXECUTE-007-direct-tool-execution.spec.js.map

package/dist/modules/ai_assistant/__integration__/TC-AI-TOOLS-EXECUTE-007-direct-tool-execution.spec.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/ai_assistant/__integration__/TC-AI-TOOLS-EXECUTE-007-direct-tool-execution.spec.ts"],
+  "sourcesContent": ["import { test, expect, request as playwrightRequest } from '@playwright/test';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/helpers/integration/api';\nimport { readJsonSafe } from '@open-mercato/core/helpers/integration/generalFixtures';\n\n/**\n * TC-AI-TOOLS-EXECUTE-007 \u2014 Direct tool execution + tool listing.\n * Source: GitHub issue #2495.\n *\n * Surfaces under test:\n *   - /api/ai_assistant/tools          (GET)\n *   - /api/ai_assistant/tools/execute   (POST)\n *\n * Contract notes verified against the route handlers (the issue's guesses were wrong):\n *   - execute body fields are `toolName` + `args` (NOT `name` / `input`);\n *     success is 200 `{ success: true, result }`.\n *   - a missing `toolName` -> 400 `{ error: 'toolName is required' }`.\n *   - an unknown tool -> 400 `{ success: false, error: 'Tool \"<n>\" not found' }`\n *     (NOT a typed `code`; the errorCode only selects 400 vs 403 internally).\n *   - both routes require `ai_assistant.view`; the per-tool `requiredFeatures` are\n *     enforced separately inside the executor.\n */\n\nconst TOOLS = '/api/ai_assistant/tools';\nconst EXECUTE = '/api/ai_assistant/tools/execute';\n\ninterface ToolSummary {\n  name: string;\n  description: string;\n  inputSchema: { required?: unknown } & Record<string, unknown>;\n  module: string;\n}\n\ntest.describe('TC-AI-TOOLS-EXECUTE-007: Direct tool execution', () => {\n  test('list tools, validate + reject unknown tools, and exercise a no-arg tool', async ({ request }) => {\n    test.slow();\n    const adminToken = await getAuthToken(request, 'admin');\n\n    const listRes = await apiRequest(request, 'GET', TOOLS, { token: adminToken });\n    expect(listRes.status()).toBe(200);\n    const list = await readJsonSafe<{ tools: ToolSummary[] }>(listRes);\n    expect(Array.isArray(list?.tools)).toBe(true);\n    expect((list?.tools.length ?? 0) > 0, 'at least one tool is visible to admin').toBe(true);\n    const sample = list!.tools[0];\n    expect(typeof sample.name).toBe('string');\n    expect(typeof sample.inputSchema).toBe('object');\n\n    // Missing toolName -> 400 with the route-level message.\n    const missing = await apiRequest(request, 'POST', EXECUTE, { token: adminToken, data: {} });\n    expect(missing.status()).toBe(400);\n    expect((await readJsonSafe<{ error?: string }>(missing))?.error).toBe('toolName is required');\n\n    // Unknown tool -> 400 { success: false, error: '... not found' }.\n    const unknown = await apiRequest(request, 'POST', EXECUTE, {\n      token: adminToken,\n      data: { toolName: 'does.not_exist_tool', args: {} },\n    });\n    expect(unknown.status()).toBe(400);\n    const unknownBody = await readJsonSafe<{ success?: boolean; error?: string }>(unknown);\n    expect(unknownBody?.success).toBe(false);\n    expect(unknownBody?.error ?? '').toContain('not found');\n\n    // Best-effort happy path: a tool whose input schema has no required fields can\n    // be invoked with empty args. The execute route runs the handler and returns\n    // 200 `{ success }`; assert the envelope only when such a tool is available.\n    const noArgTool = list!.tools.find((tool) => {\n      const required = tool.inputSchema?.required;\n      return !Array.isArray(required) || required.length === 0;\n    });\n    if (noArgTool) {\n      const exec = await apiRequest(request, 'POST', EXECUTE, {\n        token: adminToken,\n        data: { toolName: noArgTool.name, args: {} },\n      });\n      // A 200 from the execute route always carries `success: true` (only a\n      // thrown handler yields 400 `{ success: false }`), so assert the real\n      // value rather than mere presence. A no-arg tool that rejects empty input\n      // legitimately returns 400, which this guard intentionally tolerates.\n      if (exec.status() === 200) {\n        expect((await readJsonSafe<{ success?: boolean }>(exec))?.success).toBe(true);\n      }\n    }\n  });\n\n  test('unauthenticated execute is rejected with 401', async ({ baseURL }) => {\n    const anon = await playwrightRequest.newContext({ baseURL });\n    try {\n      const res = await anon.fetch(EXECUTE, {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        data: JSON.stringify({ toolName: 'does.not_exist_tool', args: {} }),\n      });\n      expect(res.status()).toBe(401);\n    } finally {\n      await anon.dispose();\n    }\n  });\n});\n"],
+  "mappings": "AAAA,SAAS,MAAM,QAAQ,WAAW,yBAAyB;AAC3D,SAAS,YAAY,oBAAoB;AACzC,SAAS,oBAAoB;AAoB7B,MAAM,QAAQ;AACd,MAAM,UAAU;AAShB,KAAK,SAAS,kDAAkD,MAAM;AACpE,OAAK,2EAA2E,OAAO,EAAE,QAAQ,MAAM;AACrG,SAAK,KAAK;AACV,UAAM,aAAa,MAAM,aAAa,SAAS,OAAO;AAEtD,UAAM,UAAU,MAAM,WAAW,SAAS,OAAO,OAAO,EAAE,OAAO,WAAW,CAAC;AAC7E,WAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,UAAM,OAAO,MAAM,aAAuC,OAAO;AACjE,WAAO,MAAM,QAAQ,MAAM,KAAK,CAAC,EAAE,KAAK,IAAI;AAC5C,YAAQ,MAAM,MAAM,UAAU,KAAK,GAAG,uCAAuC,EAAE,KAAK,IAAI;AACxF,UAAM,SAAS,KAAM,MAAM,CAAC;AAC5B,WAAO,OAAO,OAAO,IAAI,EAAE,KAAK,QAAQ;AACxC,WAAO,OAAO,OAAO,WAAW,EAAE,KAAK,QAAQ;AAG/C,UAAM,UAAU,MAAM,WAAW,SAAS,QAAQ,SAAS,EAAE,OAAO,YAAY,MAAM,CAAC,EAAE,CAAC;AAC1F,WAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,YAAQ,MAAM,aAAiC,OAAO,IAAI,KAAK,EAAE,KAAK,sBAAsB;AAG5F,UAAM,UAAU,MAAM,WAAW,SAAS,QAAQ,SAAS;AAAA,MACzD,OAAO;AAAA,MACP,MAAM,EAAE,UAAU,uBAAuB,MAAM,CAAC,EAAE;AAAA,IACpD,CAAC;AACD,WAAO,QAAQ,OAAO,CAAC,EAAE,KAAK,GAAG;AACjC,UAAM,cAAc,MAAM,aAAoD,OAAO;AACrF,WAAO,aAAa,OAAO,EAAE,KAAK,KAAK;AACvC,WAAO,aAAa,SAAS,EAAE,EAAE,UAAU,WAAW;AAKtD,UAAM,YAAY,KAAM,MAAM,KAAK,CAAC,SAAS;AAC3C,YAAM,WAAW,KAAK,aAAa;AACnC,aAAO,CAAC,MAAM,QAAQ,QAAQ,KAAK,SAAS,WAAW;AAAA,IACzD,CAAC;AACD,QAAI,WAAW;AACb,YAAM,OAAO,MAAM,WAAW,SAAS,QAAQ,SAAS;AAAA,QACtD,OAAO;AAAA,QACP,MAAM,EAAE,UAAU,UAAU,MAAM,MAAM,CAAC,EAAE;AAAA,MAC7C,CAAC;AAKD,UAAI,KAAK,OAAO,MAAM,KAAK;AACzB,gBAAQ,MAAM,aAAoC,IAAI,IAAI,OAAO,EAAE,KAAK,IAAI;AAAA,MAC9E;AAAA,IACF;AAAA,EACF,CAAC;AAED,OAAK,gDAAgD,OAAO,EAAE,QAAQ,MAAM;AAC1E,UAAM,OAAO,MAAM,kBAAkB,WAAW,EAAE,QAAQ,CAAC;AAC3D,QAAI;AACF,YAAM,MAAM,MAAM,KAAK,MAAM,SAAS;AAAA,QACpC,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,uBAAuB,MAAM,CAAC,EAAE,CAAC;AAAA,MACpE,CAAC;AACD,aAAO,IAAI,OAAO,CAAC,EAAE,KAAK,GAAG;AAAA,IAC/B,UAAE;AACA,YAAM,KAAK,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AACH,CAAC;",
+  "names": []
+}

package/dist/modules/ai_assistant/__integration__/helpers/aiAssistantFixtures.js

@@ -0,0 +1,127 @@
+import { readFileSync } from "node:fs";
+import { randomUUID } from "node:crypto";
+import path from "node:path";
+import { Client } from "pg";
+function resolveAppRoot() {
+  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();
+  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), "apps/mercato");
+}
+function readEnvValue(key) {
+  if (process.env[key]) return process.env[key];
+  const candidatePaths = [
+    path.resolve(resolveAppRoot(), ".env"),
+    path.resolve(process.cwd(), "apps/mercato/.env"),
+    path.resolve(process.cwd(), ".env")
+  ];
+  for (const envPath of candidatePaths) {
+    try {
+      const content = readFileSync(envPath, "utf-8");
+      const match = content.match(new RegExp(`^${key}=(.+)$`, "m"));
+      if (match?.[1]) return match[1].trim();
+    } catch {
+      continue;
+    }
+  }
+  return void 0;
+}
+function resolveDatabaseUrl() {
+  const url = readEnvValue("DATABASE_URL");
+  if (!url) throw new Error("[internal] DATABASE_URL is not configured for AI Assistant integration DB fixtures");
+  return url;
+}
+async function withClient(run) {
+  const client = new Client({ connectionString: resolveDatabaseUrl() });
+  await client.connect();
+  try {
+    return await run(client);
+  } finally {
+    await client.end();
+  }
+}
+async function seedPendingActionInDb(input) {
+  const idempotencyKey = input.idempotencyKey ?? `it-pending-${randomUUID()}`;
+  const status = input.status ?? "pending";
+  const expiresInMinutes = input.expiresInMinutes ?? 60;
+  const normalizedInput = JSON.stringify(input.normalizedInput ?? {});
+  const executionResult = input.executionResult === void 0 || input.executionResult === null ? null : JSON.stringify(input.executionResult);
+  return withClient(async (client) => {
+    const result = await client.query(
+      `insert into ai_pending_actions
+         (id, tenant_id, organization_id, agent_id, tool_name, normalized_input,
+          field_diff, attachment_ids, idempotency_key, created_by_user_id, status,
+          queue_mode, execution_result, created_at, expires_at)
+       values
+         (gen_random_uuid(), $1, $2, $3, $4, $5::jsonb,
+          '[]'::jsonb, '[]'::jsonb, $6, $7, $8,
+          'inline', $9::jsonb, now(), now() + make_interval(mins => $10::int))
+       returning id`,
+      [
+        input.tenantId,
+        input.organizationId ?? null,
+        input.agentId ?? "it_agent.pending_fixture",
+        input.toolName ?? "it_tool.noop",
+        normalizedInput,
+        idempotencyKey,
+        input.createdByUserId,
+        status,
+        executionResult,
+        expiresInMinutes
+      ]
+    );
+    return { id: result.rows[0].id, idempotencyKey };
+  });
+}
+async function deletePendingActionInDb(id) {
+  if (!id) return;
+  await withClient(async (client) => {
+    await client.query("delete from ai_pending_actions where id = $1", [id]);
+  });
+}
+async function deleteAgentOverridesInDb(input) {
+  if (!input.tenantId || !input.agentId) return;
+  await withClient(async (client) => {
+    await client.query("delete from ai_agent_prompt_overrides where tenant_id = $1 and agent_id = $2", [
+      input.tenantId,
+      input.agentId
+    ]);
+    await client.query("delete from ai_agent_mutation_policy_overrides where tenant_id = $1 and agent_id = $2", [
+      input.tenantId,
+      input.agentId
+    ]);
+    await client.query("delete from ai_agent_runtime_overrides where tenant_id = $1 and agent_id = $2", [
+      input.tenantId,
+      input.agentId
+    ]);
+  });
+}
+async function deleteTenantAllowlistInDb(tenantId) {
+  if (!tenantId) return;
+  await withClient(async (client) => {
+    await client.query("delete from ai_tenant_model_allowlists where tenant_id = $1", [tenantId]);
+  });
+}
+async function deleteConversationCascadeInDb(input) {
+  if (!input.tenantId || !input.conversationId) return;
+  await withClient(async (client) => {
+    await client.query("delete from ai_chat_messages where tenant_id = $1 and conversation_id = $2", [
+      input.tenantId,
+      input.conversationId
+    ]);
+    await client.query(
+      "delete from ai_chat_conversation_participants where tenant_id = $1 and conversation_id = $2",
+      [input.tenantId, input.conversationId]
+    );
+    await client.query("delete from ai_chat_conversations where tenant_id = $1 and conversation_id = $2", [
+      input.tenantId,
+      input.conversationId
+    ]);
+  });
+}
+export {
+  deleteAgentOverridesInDb,
+  deleteConversationCascadeInDb,
+  deletePendingActionInDb,
+  deleteTenantAllowlistInDb,
+  seedPendingActionInDb
+};
+//# sourceMappingURL=aiAssistantFixtures.js.map

package/dist/modules/ai_assistant/__integration__/helpers/aiAssistantFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/ai_assistant/__integration__/helpers/aiAssistantFixtures.ts"],
+  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport { randomUUID } from 'node:crypto';\nimport path from 'node:path';\nimport { Client } from 'pg';\n\n/**\n * Direct-Postgres fixtures for AI Assistant integration specs.\n *\n * Mirrors the sanctioned pattern in\n * `@open-mercato/core/helpers/integration/dbFixtures` (raw SQL against\n * `DATABASE_URL`) for the surfaces that have NO public create route:\n *  - `ai_pending_actions`: a pending mutation approval is only ever born from\n *    the internal `prepareMutation` path during a real LLM agent turn. Seeding\n *    the row directly keeps confirm/cancel/GET coverage deterministic and\n *    provider-free.\n *  - prompt overrides: the `prompt-override` route exposes no DELETE, so\n *    versioned rows must be swept via SQL after a test.\n *\n * The app server and this helper MUST share one `DATABASE_URL`, so specs using\n * these helpers only run under the coherent app+DB harness\n * (`yarn test:integration` / `:ephemeral`), never against an arbitrary dev\n * server whose `DATABASE_URL` differs from `apps/mercato/.env`.\n */\n\nfunction resolveAppRoot(): string {\n  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();\n  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), 'apps/mercato');\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const candidatePaths = [\n    path.resolve(resolveAppRoot(), '.env'),\n    path.resolve(process.cwd(), 'apps/mercato/.env'),\n    path.resolve(process.cwd(), '.env'),\n  ];\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n      if (match?.[1]) return match[1].trim();\n    } catch {\n      continue;\n    }\n  }\n  return undefined;\n}\n\nfunction resolveDatabaseUrl(): string {\n  const url = readEnvValue('DATABASE_URL');\n  if (!url) throw new Error('[internal] DATABASE_URL is not configured for AI Assistant integration DB fixtures');\n  return url;\n}\n\nasync function withClient<T>(run: (client: Client) => Promise<T>): Promise<T> {\n  const client = new Client({ connectionString: resolveDatabaseUrl() });\n  await client.connect();\n  try {\n    return await run(client);\n  } finally {\n    await client.end();\n  }\n}\n\nexport type SeededPendingActionStatus =\n  | 'pending'\n  | 'confirmed'\n  | 'cancelled'\n  | 'expired'\n  | 'executing'\n  | 'failed';\n\nexport interface SeedPendingActionInput {\n  tenantId: string;\n  organizationId?: string | null;\n  createdByUserId: string;\n  status?: SeededPendingActionStatus;\n  agentId?: string;\n  toolName?: string;\n  /** Minutes from now until expiry. Negative => the row is already expired. */\n  expiresInMinutes?: number;\n  normalizedInput?: Record<string, unknown>;\n  executionResult?: Record<string, unknown> | null;\n  idempotencyKey?: string;\n}\n\nexport interface SeededPendingAction {\n  id: string;\n  idempotencyKey: string;\n}\n\n/**\n * Inserts an `ai_pending_actions` row directly. Returns the new id so the test\n * can act on it and clean it up. Defaults produce an actionable `pending` row\n * with a future TTL; override `status`/`expiresInMinutes`/`executionResult` to\n * cover the idempotency short-circuit and 409 error branches.\n */\nexport async function seedPendingActionInDb(input: SeedPendingActionInput): Promise<SeededPendingAction> {\n  const idempotencyKey = input.idempotencyKey ?? `it-pending-${randomUUID()}`;\n  const status = input.status ?? 'pending';\n  const expiresInMinutes = input.expiresInMinutes ?? 60;\n  const normalizedInput = JSON.stringify(input.normalizedInput ?? {});\n  const executionResult =\n    input.executionResult === undefined || input.executionResult === null\n      ? null\n      : JSON.stringify(input.executionResult);\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `insert into ai_pending_actions\n         (id, tenant_id, organization_id, agent_id, tool_name, normalized_input,\n          field_diff, attachment_ids, idempotency_key, created_by_user_id, status,\n          queue_mode, execution_result, created_at, expires_at)\n       values\n         (gen_random_uuid(), $1, $2, $3, $4, $5::jsonb,\n          '[]'::jsonb, '[]'::jsonb, $6, $7, $8,\n          'inline', $9::jsonb, now(), now() + make_interval(mins => $10::int))\n       returning id`,\n      [\n        input.tenantId,\n        input.organizationId ?? null,\n        input.agentId ?? 'it_agent.pending_fixture',\n        input.toolName ?? 'it_tool.noop',\n        normalizedInput,\n        idempotencyKey,\n        input.createdByUserId,\n        status,\n        executionResult,\n        expiresInMinutes,\n      ],\n    );\n    return { id: result.rows[0].id, idempotencyKey };\n  });\n}\n\n/** Hard-deletes a seeded pending action row (best-effort test cleanup). */\nexport async function deletePendingActionInDb(id: string | null): Promise<void> {\n  if (!id) return;\n  await withClient(async (client) => {\n    await client.query('delete from ai_pending_actions where id = $1', [id]);\n  });\n}\n\n/**\n * Sweeps every per-agent override row for a tenant across the three override\n * tables. Required for `prompt-override` cleanup (no DELETE route) and used as a\n * belt-and-braces teardown for mutation-policy / loop overrides.\n */\nexport async function deleteAgentOverridesInDb(input: { tenantId: string; agentId: string }): Promise<void> {\n  if (!input.tenantId || !input.agentId) return;\n  await withClient(async (client) => {\n    await client.query('delete from ai_agent_prompt_overrides where tenant_id = $1 and agent_id = $2', [\n      input.tenantId,\n      input.agentId,\n    ]);\n    await client.query('delete from ai_agent_mutation_policy_overrides where tenant_id = $1 and agent_id = $2', [\n      input.tenantId,\n      input.agentId,\n    ]);\n    await client.query('delete from ai_agent_runtime_overrides where tenant_id = $1 and agent_id = $2', [\n      input.tenantId,\n      input.agentId,\n    ]);\n  });\n}\n\n/** Hard-deletes any tenant model-allowlist rows (best-effort cleanup). */\nexport async function deleteTenantAllowlistInDb(tenantId: string | null): Promise<void> {\n  if (!tenantId) return;\n  await withClient(async (client) => {\n    await client.query('delete from ai_tenant_model_allowlists where tenant_id = $1', [tenantId]);\n  });\n}\n\n/**\n * Hard-deletes a conversation and its participant + message rows by the\n * client-facing `conversation_id`. The DELETE route only soft-deletes, so this\n * gives specs a true teardown for the rows they created.\n */\nexport async function deleteConversationCascadeInDb(input: {\n  tenantId: string;\n  conversationId: string;\n}): Promise<void> {\n  if (!input.tenantId || !input.conversationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from ai_chat_messages where tenant_id = $1 and conversation_id = $2', [\n      input.tenantId,\n      input.conversationId,\n    ]);\n    await client.query(\n      'delete from ai_chat_conversation_participants where tenant_id = $1 and conversation_id = $2',\n      [input.tenantId, input.conversationId],\n    );\n    await client.query('delete from ai_chat_conversations where tenant_id = $1 and conversation_id = $2', [\n      input.tenantId,\n      input.conversationId,\n    ]);\n  });\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,OAAO,UAAU;AACjB,SAAS,cAAc;AAqBvB,SAAS,iBAAyB;AAChC,QAAM,UAAU,QAAQ,IAAI,kBAAkB,KAAK;AACnD,SAAO,UAAU,KAAK,QAAQ,OAAO,IAAI,KAAK,QAAQ,QAAQ,IAAI,GAAG,cAAc;AACrF;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,iBAAiB;AAAA,IACrB,KAAK,QAAQ,eAAe,GAAG,MAAM;AAAA,IACrC,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC/C,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACpC;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,YAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,UAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvC,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAA6B;AACpC,QAAM,MAAM,aAAa,cAAc;AACvC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,oFAAoF;AAC9G,SAAO;AACT;AAEA,eAAe,WAAc,KAAiD;AAC5E,QAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,mBAAmB,EAAE,CAAC;AACpE,QAAM,OAAO,QAAQ;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,MAAM;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,IAAI;AAAA,EACnB;AACF;AAmCA,eAAsB,sBAAsB,OAA6D;AACvG,QAAM,iBAAiB,MAAM,kBAAkB,cAAc,WAAW,CAAC;AACzE,QAAM,SAAS,MAAM,UAAU;AAC/B,QAAM,mBAAmB,MAAM,oBAAoB;AACnD,QAAM,kBAAkB,KAAK,UAAU,MAAM,mBAAmB,CAAC,CAAC;AAClE,QAAM,kBACJ,MAAM,oBAAoB,UAAa,MAAM,oBAAoB,OAC7D,OACA,KAAK,UAAU,MAAM,eAAe;AAC1C,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASA;AAAA,QACE,MAAM;AAAA,QACN,MAAM,kBAAkB;AAAA,QACxB,MAAM,WAAW;AAAA,QACjB,MAAM,YAAY;AAAA,QAClB;AAAA,QACA;AAAA,QACA,MAAM;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,IAAI,OAAO,KAAK,CAAC,EAAE,IAAI,eAAe;AAAA,EACjD,CAAC;AACH;AAGA,eAAsB,wBAAwB,IAAkC;AAC9E,MAAI,CAAC,GAAI;AACT,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,gDAAgD,CAAC,EAAE,CAAC;AAAA,EACzE,CAAC;AACH;AAOA,eAAsB,yBAAyB,OAA6D;AAC1G,MAAI,CAAC,MAAM,YAAY,CAAC,MAAM,QAAS;AACvC,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,gFAAgF;AAAA,MACjG,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AACD,UAAM,OAAO,MAAM,yFAAyF;AAAA,MAC1G,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AACD,UAAM,OAAO,MAAM,iFAAiF;AAAA,MAClG,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACH;AAGA,eAAsB,0BAA0B,UAAwC;AACtF,MAAI,CAAC,SAAU;AACf,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,+DAA+D,CAAC,QAAQ,CAAC;AAAA,EAC9F,CAAC;AACH;AAOA,eAAsB,8BAA8B,OAGlC;AAChB,MAAI,CAAC,MAAM,YAAY,CAAC,MAAM,eAAgB;AAC9C,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,8EAA8E;AAAA,MAC/F,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AACD,UAAM,OAAO;AAAA,MACX;AAAA,MACA,CAAC,MAAM,UAAU,MAAM,cAAc;AAAA,IACvC;AACA,UAAM,OAAO,MAAM,mFAAmF;AAAA,MACpG,MAAM;AAAA,MACN,MAAM;AAAA,IACR,CAAC;AAAA,EACH,CAAC;AACH;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/ai-assistant",
-  "version": "0.6.5-develop.4498.1.55dc06a57c",
+  "version": "0.6.5-develop.4534.1.b459babe6d",
   "type": "module",
   "engines": {
     "node": ">=22.0.0"
@@ -98,16 +98,16 @@
     "zod-to-json-schema": "^3.25.2"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.6.5-develop.4498.1.55dc06a57c",
-    "@open-mercato/ui": "0.6.5-develop.4498.1.55dc06a57c",
+    "@open-mercato/shared": "0.6.5-develop.4534.1.b459babe6d",
+    "@open-mercato/ui": "0.6.5-develop.4534.1.b459babe6d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0",
     "zod": ">=3.23.0"
   },
   "devDependencies": {
-    "@open-mercato/cli": "0.6.5-develop.4498.1.55dc06a57c",
-    "@open-mercato/shared": "0.6.5-develop.4498.1.55dc06a57c",
-    "@open-mercato/ui": "0.6.5-develop.4498.1.55dc06a57c",
+    "@open-mercato/cli": "0.6.5-develop.4534.1.b459babe6d",
+    "@open-mercato/shared": "0.6.5-develop.4534.1.b459babe6d",
+    "@open-mercato/ui": "0.6.5-develop.4534.1.b459babe6d",
     "@types/react": "^19.2.16",
     "@types/react-dom": "^19.2.3",
     "react": "19.2.7",