@open-mercato/cli 0.7.1-develop.7183.1.db9678eeb8 → 0.7.1-develop.7186.1.6e080a5017

package/dist/agentic/guides/upstream/AGENTS.md

@@ -97,7 +97,7 @@ Guide shorthand: `<pkg>` = `packages/<pkg>/AGENTS.md` (so `core` = `packages/cor
 | New integration provider (adapter, health check, credentials, bundle wiring) | `.ai/skills/om-integration-builder/SKILL.md` + `core:integrations` + `core:data_sync` + `channel-*` |
 | **Packages** | |
 | Reusable utilities, encryption helpers, i18n (`useT`/`resolveTranslations`), boolean parsing, data engine types, request scoping | `shared` |
-| Structured logging / replacing raw `console.*` with the facade (`createLogger`, `child()`, `OM_LOG_LEVEL`), advisory `yarn logger:check-console` | `apps/docs/docs/framework/runtime/logging.mdx` + `.ai/specs/2026-07-02-structured-logging-facade.md` + `shared` |
+| Structured logging (`createLogger`, `child()`, `OM_LOG_LEVEL`, `yarn logger:check-console`); error reporting — a catch that records an error MUST also `reportError` | `apps/docs/docs/framework/runtime/{logging,error-reporting}.mdx` + `telemetry` + `shared` |
 | Forms (`CrudForm`), data tables (`DataTable`), loading/error states, flash messages, `FormHeader`/`FormFooter`, dialog UX | `ui` + `om-backend-ui-design` skill (+ `om-ds-guardian` for DS-token compliance) |
 | Reusing backend component families (charts/KPIs, filters, detail sections, schedule, messages, notifications, page scaffolding, banners) — check BEFORE building any from scratch | [`.ai/ui-backend-components.md`](.ai/ui-backend-components.md) + `ui` |
 | Backend page components, `apiCall` usage, `RowActions` ids, `LoadingMessage`/`ErrorMessage` | `ui:backend` + `om-backend-ui-design` skill |

package/dist/agentic/guides/upstream/BACKWARD_COMPATIBILITY.md

@@ -37,6 +37,7 @@ The following file names, their expected export names, and their role in module
 | `index.ts` | `metadata: ModuleInfo` | MUST NOT rename export or change `ModuleInfo` shape in a breaking way |
 | `acl.ts` | `features: Array<{id,title,module}>` | MUST NOT change array item shape; may add optional fields |
 | `setup.ts` | `setup: ModuleSetupConfig` | MUST NOT remove hooks (`onTenantCreated`, `seedDefaults`, `seedExamples`, `defaultRoleFeatures`); may add optional hooks |
+| `runtime.ts` | `runtime: ModuleRuntime` (or default export) | MUST NOT change `ModuleRuntime` required members (`start`) or the `ModuleRuntimeContext` / `ModuleRuntimeHandle` shape; may add optional fields and additional `ModuleRuntimeRole` values |
 | `ce.ts` | `entities: CustomEntitySpec[]` | MUST NOT change `CustomEntitySpec` required fields; may add optional fields |
 | `search.ts` | `searchConfig: SearchModuleConfig` | MUST NOT change `SearchEntityConfig` required fields; may add optional fields |
 | `events.ts` | `eventsConfig` via `createModuleEvents()` | MUST NOT change `EventDefinition` required fields (`id`, `label`); may add optional fields |
@@ -99,6 +100,8 @@ These exported types are consumed by module developers. Required fields MUST NOT
 - `ModuleOverrides`: `overrides.ai.agents`, `overrides.ai.tools`, and `overrides.ai.extensions` shapes are STABLE; other domain keys are reserved by the unified override contract and may be wired additively. `nav` was wired 2026-07-30 under that clause (see [spec](.ai/specs/2026-07-30-nav-group-order-override-domain.md)): `overrides.nav.groupOrder` **prepends** sidebar nav group ids ahead of the built-in `defaultGroupOrder`, and ids it does not name keep their existing position. It is a default applied *beneath* role and per-user sidebar preferences, so an operator's own arrangement still wins. With no override configured, group ordering is byte-identical to before — that guarantee MUST hold for any future change to this domain.
 - `ModulesRegisteredListener` (`@open-mercato/shared/lib/modules/registry`): added 2026-08-12 as `(modules: Module[]) => void | PromiseLike<void>` (see [spec](.ai/specs/2026-08-12-module-registry-registration-listeners.md)). The listener MUST keep receiving the reconciled module list, and the return type MUST NOT be narrowed back to `void` — a subscriber returning a promise is supported and its rejection is observed and logged rather than escaping into bootstrap.
 - `WorkerMeta`: `queue` — MUST NOT remove
+- `TelemetryProvider` (`@open-mercato/telemetry`): `name`, `supports`, `start`, `shutdown`, `runInSpan`, `activeSpan`, `activeTraceContext`, `inject`, `runInRemoteSpan`, `emitLog`, `recordMetric` — MUST NOT remove. `reportError?()` was added 2026-09-08 as an additive OPTIONAL method (see [spec](.ai/specs/2026-09-08-error-reporting-policy.md)); it **MUST stay optional** — third parties implement this interface and a required method would break every existing provider. The facade calls it as `provider.reportError?.(…)` *in addition to* the span/log/metric path, so a provider that omits it loses nothing.
+- `ReportErrorContext` (`@open-mercato/telemetry`) and the `reportError` context of `TelemetryRuntime` (`@open-mercato/shared/lib/telemetry/runtime`): `module?` and `attributes?` — MUST NOT remove. `code?: string` was added 2026-09-08 as an additive optional field carrying the enumerated `module.reason` fingerprint the backend groups on; it MUST stay optional so existing callers (the API dispatcher, the CRUD factory) keep compiling and keep emitting exactly what they emit today. `om.errors` gains an `error.code` label only when a caller supplies one — the same attribute name the span and the log record use, so one query works against all three.
 - `RefreshCredentialsInput` (communication_channels hub): `channelId`, `credentials`, `scope` — MUST NOT remove. `oauthClient?` was added 2026-05-27 as an additive optional field (see [Spec A](.ai/specs/implemented/2026-05-27-email-integration-inbound-reliability-and-threading.md)). The legacy `credentials._client` read path in the Gmail adapter is **deprecated and slated for removal in the next minor release** — pass OAuth client config via `RefreshCredentialsInput.oauthClient` instead.
 - `OAuthClientConfig` (communication_channels hub): added 2026-05-27 with `clientId` required; optional `clientSecret`, `tenantId`, `scopes`. New optional fields may be added; required `clientId` MUST NOT be removed.
 - `BackendChromePayload`: `groups`, `settingsSections`, `settingsPathPrefixes`, `profileSections`, `profilePathPrefixes`, `grantedFeatures`, `roles` — MUST NOT remove. `currentOrganization?` (`BackendChromeCurrentOrganization | null`) was added 2026-07-30 as an additive optional field (see [spec](.ai/specs/2026-07-30-backend-chrome-current-organization.md)); it is `null` under an all-organizations selection, when no organization is in scope, and when the lookup fails, so consumers MUST treat `null` as "unknown" rather than "no organization". `brand?` is **unchanged** and remains the branding channel — it populates only when the organization has a `logoUrl`, and `currentOrganization` does not supersede it.
@@ -430,3 +433,24 @@ Issue #3852 removed the non-cryptographic passkey verification shape from `Passk
 **Contract commitments**: only an explicit `false` removes a control, so an adapter that declares nothing — or whose predicate returns anything else — renders the same form and sends the same request body as before. A predicate that throws is treated as *applies*, because `api/options.ts` resolves every registered adapter in one response and one broken predicate must not take the dashboard down for the rest. The `startControls` map is sparse and keyed only by the adapter's own `supportedEntities`; a missing entry means every control applies, so a client that ignores the field behaves exactly as today. The declaration governs what the dashboard **offers**, never what the run API **accepts** — that separation MUST hold for any future change here, or an API client posting `fullSync: true` would silently stop getting a full run.
 
 **Migration path for existing adapters**: none. The method is optional and defaults to prior behaviour.
+
+## Error Reporting Policy (2026-09-08)
+
+Spec: [`.ai/specs/2026-09-08-error-reporting-policy.md`](.ai/specs/2026-09-08-error-reporting-policy.md). Every change is additive; no existing path emits less than it did before.
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| `TelemetryProvider` | Optional `reportError?()` added, called in addition to the span/log/metric path. MUST stay optional — third parties implement this interface | ✓ ADDITIVE |
+| `ReportErrorContext` / `TelemetryRuntime['reportError']` context | Optional `code?: string` fingerprint added | ✓ ADDITIVE |
+| `data_sync.run.completed` payload | Optional `createdCount`, `updatedCount`, `skippedCount`, `failedCount` added; no existing field changed (§5 permits additive payload fields) | ✓ ADDITIVE |
+| `integration_logs` rows at `level: 'error'` | Also reported to the active telemetry backend (message, `code`, ids — never `payload`). With telemetry off, one global lookup and no behaviour change | ✓ ADDITIVE |
+| `queue` failure paths, `data_sync` engine | Existing `logger.error` lines keep their text and gain a `reportError` call with a `code` | ✓ ADDITIVE |
+| `reportError`'s `code` | A value that is not shaped `module.reason` is dropped rather than published, so it cannot become an unbounded, unredacted metric label. No in-repo caller passes one; a caller that did reported exactly as one passing no `code`, which is the pre-PR behaviour | ✓ ADDITIVE |
+| `integration_logs` message text for the payment status poller and the Stripe webhook processor | The failure cause moves from `payload` **into** the message (`Payment status polling failed: {cause}`), because the payload is deliberately never reported. `payload` keeps the same fields | ✓ ADDITIVE (row content, no schema or field change) |
+| `integration_logs.code` for the payment status poller | Previously `null`, now `payment_gateways.status_poll_failed`, so it groups apart from the `integrations.log_error` catch-all. The column and its API field already existed | ✓ ADDITIVE (a value where there was none) |
+| `IntegrationLogError` (`core:integrations`), `SyncRunPartialFailureError` (`core:data_sync`) | New exported error classes | ✓ ADDITIVE |
+| API route URLs, response schemas, database schema, event IDs, ACL features, DI names, CLI commands, env vars | No change — the policy adds no configuration | ✓ n/a |
+
+**Operator note — terminal queue failures.** Not a contract break, but visible in an alert rule: on the **local** strategy a job's final attempt previously emitted both `queue.job_failed` and `queue.job_exhausted`; it now emits only `queue.job_exhausted`, matching the `async` strategy. An alert thresholding on `queue.job_failed` alone stops seeing terminal failures — page on `queue.job_exhausted`.
+
+**Volume note for operators.** Reported error *volume* rises where errors were previously only recorded: an integration that writes 115 error rows now also reports 115 errors, grouped by `error.code` at the backend. This is deliberate — see the spec's §S3 — and the controls are the collector's filtering/sampling and the backend's own quotas, not a framework switch.

package/dist/agentic/guides/upstream/manifest.json

@@ -1,8 +1,8 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.7.1-develop.7183.1.db9678eeb8",
+  "generator": "@open-mercato/cli@0.7.1-develop.7186.1.6e080a5017",
   "files": {
-    "AGENTS.md": "1f54610cebc4fd7e42b56d1c18859edc7ed7d3165c9af72c4530b6feaf76e457",
-    "BACKWARD_COMPATIBILITY.md": "cf387f5407340082f2915119c35fda86420eb9687ee0269d21a374d4bd1ec8de"
+    "AGENTS.md": "daa3d6b384da85bf926c4a1dd6448f8776fca4956203769bc6f590f0338495b6",
+    "BACKWARD_COMPATIBILITY.md": "89a54c0b08f043967f284052d2e1d9f16e406e4a70dd68078749831334e3dcc2"
   }
 }

package/dist/lib/generate-watch-structure.js

@@ -13,6 +13,7 @@ const STRUCTURAL_CONVENTION_FILES = [
   "di.ts",
   "acl.ts",
   "setup.ts",
+  "runtime.ts",
   "encryption.ts",
   "ce.ts",
   "search.ts",

package/dist/lib/generate-watch-structure.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/generate-watch-structure.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport {\n  MODULE_CODE_EXTENSIONS,\n  SCAN_CONFIGS,\n  scanModuleDir,\n  stripModuleCodeExtension,\n  type ModuleRoots,\n} from './generators/scanner'\n\nconst STRUCTURAL_CONVENTION_FILES = [\n  'index.ts',\n  'cli.ts',\n  'di.ts',\n  'acl.ts',\n  'setup.ts',\n  'encryption.ts',\n  'ce.ts',\n  'search.ts',\n  'events.ts',\n  'notifications.ts',\n  'notifications.client.ts',\n  'notifications.handlers.ts',\n  'translations.ts',\n  'generators.ts',\n  'ai-tools.ts',\n  'ai-agents.ts',\n  'analytics.ts',\n  'workflows.ts',\n  'inbox-actions.ts',\n  'message-types.ts',\n  'message-objects.ts',\n  'integration.ts',\n  'security.mfa-providers.ts',\n  'security.sudo.ts',\n  'data/entities.ts',\n  'data/extensions.ts',\n  'data/fields.ts',\n  'data/enrichers.ts',\n  'data/guards.ts',\n  'api/interceptors.ts',\n  'commands/interceptors.ts',\n  'widgets/components.ts',\n  'widgets/injection-table.ts',\n  'frontend/middleware.ts',\n  'backend/middleware.ts',\n] as const\n\nconst CONTENT_SENSITIVE_SCAN_CONFIGS = [\n  SCAN_CONFIGS.apiRoutes,\n  SCAN_CONFIGS.apiPlainFiles,\n  SCAN_CONFIGS.subscribers,\n  SCAN_CONFIGS.workers,\n  SCAN_CONFIGS.dashboardWidgets,\n  SCAN_CONFIGS.injectionWidgets,\n] as const\n\nconst ROUTE_SHAPE_SCAN_CONFIGS = [\n  SCAN_CONFIGS.frontendPages,\n  SCAN_CONFIGS.backendPages,\n] as const\n\nfunction checksum(value: string): string {\n  return crypto.createHash('md5').update(value).digest('hex')\n}\n\nfunction fileRecord(filePath: string, base: string, mode: 'content' | 'shape'): string | null {\n  if (!fs.existsSync(filePath)) return null\n  let stat: fs.Stats\n  try {\n    stat = fs.statSync(filePath)\n  } catch {\n    return null\n  }\n  if (!stat.isFile()) return null\n  const rel = path.relative(base, filePath).replace(/\\\\/g, '/')\n  if (mode === 'shape') {\n    return `file:${rel}`\n  }\n  try {\n    return `file:${rel}:${stat.size}:${checksum(fs.readFileSync(filePath, 'utf8'))}`\n  } catch {\n    return `file:${rel}:unreadable`\n  }\n}\n\nfunction resolveCodeFile(base: string, relativePath: string): string | null {\n  const stripped = stripModuleCodeExtension(relativePath)\n  const candidates = MODULE_CODE_EXTENSIONS.map((extension) => `${stripped}${extension}`)\n  for (const candidate of candidates) {\n    const filePath = path.join(base, ...candidate.split('/'))\n    if (fs.existsSync(filePath)) return filePath\n  }\n  return null\n}\n\nfunction hasInlinePageMetadata(filePath: string): boolean {\n  try {\n    const source = fs.readFileSync(filePath, 'utf8')\n    return /\\bexport\\s+(?:const|let|var|function|class)\\s+metadata\\b/.test(source)\n      || /\\bexport\\s+\\{[^}]*\\bmetadata\\b[^}]*\\}/.test(source)\n  } catch {\n    return false\n  }\n}\n\nfunction addConventionRecords(records: string[], roots: ModuleRoots): void {\n  for (const base of [roots.pkgBase, roots.appBase]) {\n    records.push(`module-root:${base}:${fs.existsSync(base) ? 'present' : 'missing'}`)\n    for (const relativePath of STRUCTURAL_CONVENTION_FILES) {\n      const filePath = resolveCodeFile(base, relativePath)\n      if (!filePath) {\n        records.push(`missing:${base}:${relativePath}`)\n        continue\n      }\n      const record = fileRecord(filePath, base, 'content')\n      if (record) records.push(record)\n    }\n  }\n}\n\nfunction addScannedRecords(records: string[], roots: ModuleRoots): void {\n  for (const config of CONTENT_SENSITIVE_SCAN_CONFIGS) {\n    for (const scanned of scanModuleDir(roots, config)) {\n      const base = scanned.fromApp ? roots.appBase : roots.pkgBase\n      const filePath = path.join(base, ...config.folder.split('/'), ...scanned.relPath.split('/'))\n      const record = fileRecord(filePath, base, 'content')\n      if (record) records.push(`${config.folder}:${record}`)\n    }\n  }\n\n  for (const config of ROUTE_SHAPE_SCAN_CONFIGS) {\n    for (const scanned of scanModuleDir(roots, config)) {\n      const base = scanned.fromApp ? roots.appBase : roots.pkgBase\n      const folderPath = path.join(base, ...config.folder.split('/'))\n      const filePath = path.join(folderPath, ...scanned.relPath.split('/'))\n      const pageRecord = fileRecord(filePath, base, hasInlinePageMetadata(filePath) ? 'content' : 'shape')\n      if (pageRecord) records.push(`${config.folder}:${pageRecord}`)\n\n      const dir = path.dirname(filePath)\n      const stem = stripModuleCodeExtension(path.basename(filePath))\n      const metaCandidates = stem === 'page'\n        ? ['page.meta', 'meta']\n        : [`${stem}.meta`, 'meta']\n      for (const candidate of metaCandidates) {\n        const metaPath = resolveCodeFile(dir, candidate)\n        if (!metaPath) continue\n        const record = fileRecord(metaPath, base, 'content')\n        if (record) records.push(`${config.folder}:meta:${record}`)\n      }\n    }\n  }\n}\n\nexport function calculateGenerateWatchStructureChecksum(options: {\n  modulesFile: string\n  moduleRoots: ModuleRoots[]\n}): string {\n  const records: string[] = []\n  const modulesRecord = fileRecord(options.modulesFile, path.dirname(options.modulesFile), 'content')\n  records.push(modulesRecord ?? `missing:${options.modulesFile}`)\n\n  for (const roots of options.moduleRoots) {\n    addConventionRecords(records, roots)\n    addScannedRecords(records, roots)\n  }\n\n  return checksum(records.sort((a, b) => a.localeCompare(b)).join('\\n'))\n}\n"],
-  "mappings": "AAAA,OAAO,YAAY;AACnB,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf;AAEA,MAAM,2BAA2B;AAAA,EAC/B,aAAa;AAAA,EACb,aAAa;AACf;AAEA,SAAS,SAAS,OAAuB;AACvC,SAAO,OAAO,WAAW,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAC5D;AAEA,SAAS,WAAW,UAAkB,MAAc,MAA0C;AAC5F,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,MAAI;AACJ,MAAI;AACF,WAAO,GAAG,SAAS,QAAQ;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAC3B,QAAM,MAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,MAAI,SAAS,SAAS;AACpB,WAAO,QAAQ,GAAG;AAAA,EACpB;AACA,MAAI;AACF,WAAO,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,SAAS,GAAG,aAAa,UAAU,MAAM,CAAC,CAAC;AAAA,EAChF,QAAQ;AACN,WAAO,QAAQ,GAAG;AAAA,EACpB;AACF;AAEA,SAAS,gBAAgB,MAAc,cAAqC;AAC1E,QAAM,WAAW,yBAAyB,YAAY;AACtD,QAAM,aAAa,uBAAuB,IAAI,CAAC,cAAc,GAAG,QAAQ,GAAG,SAAS,EAAE;AACtF,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,KAAK,KAAK,MAAM,GAAG,UAAU,MAAM,GAAG,CAAC;AACxD,QAAI,GAAG,WAAW,QAAQ,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAA2B;AACxD,MAAI;AACF,UAAM,SAAS,GAAG,aAAa,UAAU,MAAM;AAC/C,WAAO,2DAA2D,KAAK,MAAM,KACxE,wCAAwC,KAAK,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,SAAmB,OAA0B;AACzE,aAAW,QAAQ,CAAC,MAAM,SAAS,MAAM,OAAO,GAAG;AACjD,YAAQ,KAAK,eAAe,IAAI,IAAI,GAAG,WAAW,IAAI,IAAI,YAAY,SAAS,EAAE;AACjF,eAAW,gBAAgB,6BAA6B;AACtD,YAAM,WAAW,gBAAgB,MAAM,YAAY;AACnD,UAAI,CAAC,UAAU;AACb,gBAAQ,KAAK,WAAW,IAAI,IAAI,YAAY,EAAE;AAC9C;AAAA,MACF;AACA,YAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,UAAI,OAAQ,SAAQ,KAAK,MAAM;AAAA,IACjC;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,SAAmB,OAA0B;AACtE,aAAW,UAAU,gCAAgC;AACnD,eAAW,WAAW,cAAc,OAAO,MAAM,GAAG;AAClD,YAAM,OAAO,QAAQ,UAAU,MAAM,UAAU,MAAM;AACrD,YAAM,WAAW,KAAK,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,MAAM,GAAG,CAAC;AAC3F,YAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,UAAI,OAAQ,SAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,MAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,aAAW,UAAU,0BAA0B;AAC7C,eAAW,WAAW,cAAc,OAAO,MAAM,GAAG;AAClD,YAAM,OAAO,QAAQ,UAAU,MAAM,UAAU,MAAM;AACrD,YAAM,aAAa,KAAK,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM,GAAG,CAAC;AAC9D,YAAM,WAAW,KAAK,KAAK,YAAY,GAAG,QAAQ,QAAQ,MAAM,GAAG,CAAC;AACpE,YAAM,aAAa,WAAW,UAAU,MAAM,sBAAsB,QAAQ,IAAI,YAAY,OAAO;AACnG,UAAI,WAAY,SAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,UAAU,EAAE;AAE7D,YAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,YAAM,OAAO,yBAAyB,KAAK,SAAS,QAAQ,CAAC;AAC7D,YAAM,iBAAiB,SAAS,SAC5B,CAAC,aAAa,MAAM,IACpB,CAAC,GAAG,IAAI,SAAS,MAAM;AAC3B,iBAAW,aAAa,gBAAgB;AACtC,cAAM,WAAW,gBAAgB,KAAK,SAAS;AAC/C,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,YAAI,OAAQ,SAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,EAAE;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wCAAwC,SAG7C;AACT,QAAM,UAAoB,CAAC;AAC3B,QAAM,gBAAgB,WAAW,QAAQ,aAAa,KAAK,QAAQ,QAAQ,WAAW,GAAG,SAAS;AAClG,UAAQ,KAAK,iBAAiB,WAAW,QAAQ,WAAW,EAAE;AAE9D,aAAW,SAAS,QAAQ,aAAa;AACvC,yBAAqB,SAAS,KAAK;AACnC,sBAAkB,SAAS,KAAK;AAAA,EAClC;AAEA,SAAO,SAAS,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AACvE;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport fs from 'node:fs'\nimport path from 'node:path'\nimport {\n  MODULE_CODE_EXTENSIONS,\n  SCAN_CONFIGS,\n  scanModuleDir,\n  stripModuleCodeExtension,\n  type ModuleRoots,\n} from './generators/scanner'\n\nconst STRUCTURAL_CONVENTION_FILES = [\n  'index.ts',\n  'cli.ts',\n  'di.ts',\n  'acl.ts',\n  'setup.ts',\n  'runtime.ts',\n  'encryption.ts',\n  'ce.ts',\n  'search.ts',\n  'events.ts',\n  'notifications.ts',\n  'notifications.client.ts',\n  'notifications.handlers.ts',\n  'translations.ts',\n  'generators.ts',\n  'ai-tools.ts',\n  'ai-agents.ts',\n  'analytics.ts',\n  'workflows.ts',\n  'inbox-actions.ts',\n  'message-types.ts',\n  'message-objects.ts',\n  'integration.ts',\n  'security.mfa-providers.ts',\n  'security.sudo.ts',\n  'data/entities.ts',\n  'data/extensions.ts',\n  'data/fields.ts',\n  'data/enrichers.ts',\n  'data/guards.ts',\n  'api/interceptors.ts',\n  'commands/interceptors.ts',\n  'widgets/components.ts',\n  'widgets/injection-table.ts',\n  'frontend/middleware.ts',\n  'backend/middleware.ts',\n] as const\n\nconst CONTENT_SENSITIVE_SCAN_CONFIGS = [\n  SCAN_CONFIGS.apiRoutes,\n  SCAN_CONFIGS.apiPlainFiles,\n  SCAN_CONFIGS.subscribers,\n  SCAN_CONFIGS.workers,\n  SCAN_CONFIGS.dashboardWidgets,\n  SCAN_CONFIGS.injectionWidgets,\n] as const\n\nconst ROUTE_SHAPE_SCAN_CONFIGS = [\n  SCAN_CONFIGS.frontendPages,\n  SCAN_CONFIGS.backendPages,\n] as const\n\nfunction checksum(value: string): string {\n  return crypto.createHash('md5').update(value).digest('hex')\n}\n\nfunction fileRecord(filePath: string, base: string, mode: 'content' | 'shape'): string | null {\n  if (!fs.existsSync(filePath)) return null\n  let stat: fs.Stats\n  try {\n    stat = fs.statSync(filePath)\n  } catch {\n    return null\n  }\n  if (!stat.isFile()) return null\n  const rel = path.relative(base, filePath).replace(/\\\\/g, '/')\n  if (mode === 'shape') {\n    return `file:${rel}`\n  }\n  try {\n    return `file:${rel}:${stat.size}:${checksum(fs.readFileSync(filePath, 'utf8'))}`\n  } catch {\n    return `file:${rel}:unreadable`\n  }\n}\n\nfunction resolveCodeFile(base: string, relativePath: string): string | null {\n  const stripped = stripModuleCodeExtension(relativePath)\n  const candidates = MODULE_CODE_EXTENSIONS.map((extension) => `${stripped}${extension}`)\n  for (const candidate of candidates) {\n    const filePath = path.join(base, ...candidate.split('/'))\n    if (fs.existsSync(filePath)) return filePath\n  }\n  return null\n}\n\nfunction hasInlinePageMetadata(filePath: string): boolean {\n  try {\n    const source = fs.readFileSync(filePath, 'utf8')\n    return /\\bexport\\s+(?:const|let|var|function|class)\\s+metadata\\b/.test(source)\n      || /\\bexport\\s+\\{[^}]*\\bmetadata\\b[^}]*\\}/.test(source)\n  } catch {\n    return false\n  }\n}\n\nfunction addConventionRecords(records: string[], roots: ModuleRoots): void {\n  for (const base of [roots.pkgBase, roots.appBase]) {\n    records.push(`module-root:${base}:${fs.existsSync(base) ? 'present' : 'missing'}`)\n    for (const relativePath of STRUCTURAL_CONVENTION_FILES) {\n      const filePath = resolveCodeFile(base, relativePath)\n      if (!filePath) {\n        records.push(`missing:${base}:${relativePath}`)\n        continue\n      }\n      const record = fileRecord(filePath, base, 'content')\n      if (record) records.push(record)\n    }\n  }\n}\n\nfunction addScannedRecords(records: string[], roots: ModuleRoots): void {\n  for (const config of CONTENT_SENSITIVE_SCAN_CONFIGS) {\n    for (const scanned of scanModuleDir(roots, config)) {\n      const base = scanned.fromApp ? roots.appBase : roots.pkgBase\n      const filePath = path.join(base, ...config.folder.split('/'), ...scanned.relPath.split('/'))\n      const record = fileRecord(filePath, base, 'content')\n      if (record) records.push(`${config.folder}:${record}`)\n    }\n  }\n\n  for (const config of ROUTE_SHAPE_SCAN_CONFIGS) {\n    for (const scanned of scanModuleDir(roots, config)) {\n      const base = scanned.fromApp ? roots.appBase : roots.pkgBase\n      const folderPath = path.join(base, ...config.folder.split('/'))\n      const filePath = path.join(folderPath, ...scanned.relPath.split('/'))\n      const pageRecord = fileRecord(filePath, base, hasInlinePageMetadata(filePath) ? 'content' : 'shape')\n      if (pageRecord) records.push(`${config.folder}:${pageRecord}`)\n\n      const dir = path.dirname(filePath)\n      const stem = stripModuleCodeExtension(path.basename(filePath))\n      const metaCandidates = stem === 'page'\n        ? ['page.meta', 'meta']\n        : [`${stem}.meta`, 'meta']\n      for (const candidate of metaCandidates) {\n        const metaPath = resolveCodeFile(dir, candidate)\n        if (!metaPath) continue\n        const record = fileRecord(metaPath, base, 'content')\n        if (record) records.push(`${config.folder}:meta:${record}`)\n      }\n    }\n  }\n}\n\nexport function calculateGenerateWatchStructureChecksum(options: {\n  modulesFile: string\n  moduleRoots: ModuleRoots[]\n}): string {\n  const records: string[] = []\n  const modulesRecord = fileRecord(options.modulesFile, path.dirname(options.modulesFile), 'content')\n  records.push(modulesRecord ?? `missing:${options.modulesFile}`)\n\n  for (const roots of options.moduleRoots) {\n    addConventionRecords(records, roots)\n    addScannedRecords(records, roots)\n  }\n\n  return checksum(records.sort((a, b) => a.localeCompare(b)).join('\\n'))\n}\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAEP,MAAM,8BAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,iCAAiC;AAAA,EACrC,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AACf;AAEA,MAAM,2BAA2B;AAAA,EAC/B,aAAa;AAAA,EACb,aAAa;AACf;AAEA,SAAS,SAAS,OAAuB;AACvC,SAAO,OAAO,WAAW,KAAK,EAAE,OAAO,KAAK,EAAE,OAAO,KAAK;AAC5D;AAEA,SAAS,WAAW,UAAkB,MAAc,MAA0C;AAC5F,MAAI,CAAC,GAAG,WAAW,QAAQ,EAAG,QAAO;AACrC,MAAI;AACJ,MAAI;AACF,WAAO,GAAG,SAAS,QAAQ;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAK,OAAO,EAAG,QAAO;AAC3B,QAAM,MAAM,KAAK,SAAS,MAAM,QAAQ,EAAE,QAAQ,OAAO,GAAG;AAC5D,MAAI,SAAS,SAAS;AACpB,WAAO,QAAQ,GAAG;AAAA,EACpB;AACA,MAAI;AACF,WAAO,QAAQ,GAAG,IAAI,KAAK,IAAI,IAAI,SAAS,GAAG,aAAa,UAAU,MAAM,CAAC,CAAC;AAAA,EAChF,QAAQ;AACN,WAAO,QAAQ,GAAG;AAAA,EACpB;AACF;AAEA,SAAS,gBAAgB,MAAc,cAAqC;AAC1E,QAAM,WAAW,yBAAyB,YAAY;AACtD,QAAM,aAAa,uBAAuB,IAAI,CAAC,cAAc,GAAG,QAAQ,GAAG,SAAS,EAAE;AACtF,aAAW,aAAa,YAAY;AAClC,UAAM,WAAW,KAAK,KAAK,MAAM,GAAG,UAAU,MAAM,GAAG,CAAC;AACxD,QAAI,GAAG,WAAW,QAAQ,EAAG,QAAO;AAAA,EACtC;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,UAA2B;AACxD,MAAI;AACF,UAAM,SAAS,GAAG,aAAa,UAAU,MAAM;AAC/C,WAAO,2DAA2D,KAAK,MAAM,KACxE,wCAAwC,KAAK,MAAM;AAAA,EAC1D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,qBAAqB,SAAmB,OAA0B;AACzE,aAAW,QAAQ,CAAC,MAAM,SAAS,MAAM,OAAO,GAAG;AACjD,YAAQ,KAAK,eAAe,IAAI,IAAI,GAAG,WAAW,IAAI,IAAI,YAAY,SAAS,EAAE;AACjF,eAAW,gBAAgB,6BAA6B;AACtD,YAAM,WAAW,gBAAgB,MAAM,YAAY;AACnD,UAAI,CAAC,UAAU;AACb,gBAAQ,KAAK,WAAW,IAAI,IAAI,YAAY,EAAE;AAC9C;AAAA,MACF;AACA,YAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,UAAI,OAAQ,SAAQ,KAAK,MAAM;AAAA,IACjC;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,SAAmB,OAA0B;AACtE,aAAW,UAAU,gCAAgC;AACnD,eAAW,WAAW,cAAc,OAAO,MAAM,GAAG;AAClD,YAAM,OAAO,QAAQ,UAAU,MAAM,UAAU,MAAM;AACrD,YAAM,WAAW,KAAK,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM,GAAG,GAAG,GAAG,QAAQ,QAAQ,MAAM,GAAG,CAAC;AAC3F,YAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,UAAI,OAAQ,SAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,MAAM,EAAE;AAAA,IACvD;AAAA,EACF;AAEA,aAAW,UAAU,0BAA0B;AAC7C,eAAW,WAAW,cAAc,OAAO,MAAM,GAAG;AAClD,YAAM,OAAO,QAAQ,UAAU,MAAM,UAAU,MAAM;AACrD,YAAM,aAAa,KAAK,KAAK,MAAM,GAAG,OAAO,OAAO,MAAM,GAAG,CAAC;AAC9D,YAAM,WAAW,KAAK,KAAK,YAAY,GAAG,QAAQ,QAAQ,MAAM,GAAG,CAAC;AACpE,YAAM,aAAa,WAAW,UAAU,MAAM,sBAAsB,QAAQ,IAAI,YAAY,OAAO;AACnG,UAAI,WAAY,SAAQ,KAAK,GAAG,OAAO,MAAM,IAAI,UAAU,EAAE;AAE7D,YAAM,MAAM,KAAK,QAAQ,QAAQ;AACjC,YAAM,OAAO,yBAAyB,KAAK,SAAS,QAAQ,CAAC;AAC7D,YAAM,iBAAiB,SAAS,SAC5B,CAAC,aAAa,MAAM,IACpB,CAAC,GAAG,IAAI,SAAS,MAAM;AAC3B,iBAAW,aAAa,gBAAgB;AACtC,cAAM,WAAW,gBAAgB,KAAK,SAAS;AAC/C,YAAI,CAAC,SAAU;AACf,cAAM,SAAS,WAAW,UAAU,MAAM,SAAS;AACnD,YAAI,OAAQ,SAAQ,KAAK,GAAG,OAAO,MAAM,SAAS,MAAM,EAAE;AAAA,MAC5D;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,wCAAwC,SAG7C;AACT,QAAM,UAAoB,CAAC;AAC3B,QAAM,gBAAgB,WAAW,QAAQ,aAAa,KAAK,QAAQ,QAAQ,WAAW,GAAG,SAAS;AAClG,UAAQ,KAAK,iBAAiB,WAAW,QAAQ,WAAW,EAAE;AAE9D,aAAW,SAAS,QAAQ,aAAa;AACvC,yBAAqB,SAAS,KAAK;AACnC,sBAAkB,SAAS,KAAK;AAAA,EAClC;AAEA,SAAO,SAAS,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AACvE;",
   "names": []
 }

package/dist/lib/generators/module-registry.js

@@ -1999,6 +1999,12 @@ function buildLegacyModuleSetupValue(importName) {
     identifier("undefined")
   ]);
 }
+function buildLegacyModuleRuntimeValue(importName) {
+  return logicalOr([
+    legacyNamespaceMemberFallback(importName, ["default", "runtime"]),
+    identifier("undefined")
+  ]);
+}
 function buildLegacyIntegrationListValue(importName, pluralMember, singularMember, castType) {
   const singular = propertyAccess(identifier(importName), singularMember);
   return asExpression(
@@ -2761,6 +2767,7 @@ async function generateModuleRegistryFromDiscovery(options) {
     let customFieldSetsExpr = "[]";
     const dashboardWidgets = [];
     let setupImportName = null;
+    let moduleRuntimeImportName = null;
     let encryptionImportName = null;
     let integrationImportName = null;
     const indexResolved = discovered.resolve("index.ts");
@@ -2874,6 +2881,10 @@ async function generateModuleRegistryFromDiscovery(options) {
         integrationImportName = importName;
       }
     }
+    {
+      const moduleRuntime = resolveConventionFile(discovered.resolve("runtime.ts"), "RUNTIME", modId, importIdRef, imports, runtimeImports);
+      if (moduleRuntime) moduleRuntimeImportName = moduleRuntime.importName;
+    }
     {
       const fields = resolveConventionFile(discovered.resolve("data/fields.ts"), "F", modId, importIdRef, imports, runtimeImports);
       if (fields) fieldsImportName = fields.importName;
@@ -3010,6 +3021,9 @@ async function generateModuleRegistryFromDiscovery(options) {
     if (setupImportName) {
       setupAndBeyondEntries.push({ name: "setup", value: buildLegacyModuleSetupValue(setupImportName) });
     }
+    if (moduleRuntimeImportName) {
+      setupAndBeyondEntries.push({ name: "runtime", value: buildLegacyModuleRuntimeValue(moduleRuntimeImportName) });
+    }
     if (encryptionImportName) {
       setupAndBeyondEntries.push({
         name: "defaultEncryptionMaps",
@@ -3378,6 +3392,7 @@ async function generateModuleRegistryAppFromDiscovery(options) {
     let customEntitiesImportName = null;
     let dashboardWidgetsValue = emptyArray();
     let setupImportName = null;
+    let moduleRuntimeImportName = null;
     let encryptionImportName = null;
     let integrationImportName = null;
     const indexResolved = discovered.resolve("index.ts");
@@ -3398,6 +3413,11 @@ async function generateModuleRegistryAppFromDiscovery(options) {
       if (setup) bootstrapImports.push(buildImportStatement(`* as ${setup.importName}`, setup.importPath));
       if (setup) setupImportName = setup.importName;
     }
+    {
+      const moduleRuntime = resolveConventionFile(discovered.resolve("runtime.ts"), "RUNTIME", modId, importIdRef, imports);
+      if (moduleRuntime) bootstrapImports.push(buildImportStatement(`* as ${moduleRuntime.importName}`, moduleRuntime.importPath));
+      if (moduleRuntime) moduleRuntimeImportName = moduleRuntime.importName;
+    }
     {
       const encryption = resolveConventionFile(discovered.resolve("encryption.ts"), "ENCRYPTION", modId, importIdRef, imports);
       if (encryption) bootstrapImports.push(buildImportStatement(`* as ${encryption.importName}`, encryption.importPath));
@@ -3576,6 +3596,16 @@ async function generateModuleRegistryAppFromDiscovery(options) {
         })
       });
     }
+    if (moduleRuntimeImportName) {
+      moduleEntries.push({
+        name: "runtime",
+        value: namespaceFallback({
+          importName: moduleRuntimeImportName,
+          members: ["default", "runtime"],
+          fallback: identifier("undefined")
+        })
+      });
+    }
     if (encryptionImportName) {
       moduleEntries.push({
         name: "defaultEncryptionMaps",
@@ -3752,6 +3782,7 @@ async function generateModuleRegistryCliFromDiscovery(options) {
     let vectorImportName = null;
     let dashboardWidgetsValue = emptyArray();
     let setupImportName = null;
+    let moduleRuntimeImportName = null;
     let encryptionImportName = null;
     let integrationImportName = null;
     const indexResolved = discovered.resolve("index.ts");
@@ -3770,6 +3801,10 @@ async function generateModuleRegistryCliFromDiscovery(options) {
       const setup = resolveConventionFile(discovered.resolve("setup.ts"), "SETUP", modId, importIdRef, imports);
       if (setup) setupImportName = setup.importName;
     }
+    {
+      const moduleRuntime = resolveConventionFile(discovered.resolve("runtime.ts"), "RUNTIME", modId, importIdRef, imports);
+      if (moduleRuntime) moduleRuntimeImportName = moduleRuntime.importName;
+    }
     {
       const encryption = resolveConventionFile(discovered.resolve("encryption.ts"), "ENCRYPTION", modId, importIdRef, imports);
       if (encryption) encryptionImportName = encryption.importName;
@@ -3914,6 +3949,16 @@ async function generateModuleRegistryCliFromDiscovery(options) {
         })
       });
     }
+    if (moduleRuntimeImportName) {
+      moduleEntries.push({
+        name: "runtime",
+        value: namespaceFallback({
+          importName: moduleRuntimeImportName,
+          members: ["default", "runtime"],
+          fallback: identifier("undefined")
+        })
+      });
+    }
     if (encryptionImportName) {
       moduleEntries.push({
         name: "defaultEncryptionMaps",