@open-mercato/cli 0.8.1-develop.7297.1.67605e74f9 → 0.8.1-develop.7441.1.b42958b98c

package/dist/agentic/guides/modules/wms/contribution-resolutions.md

@@ -12,6 +12,9 @@
 | search:wms:product_inventory_profile | module:wms:product_inventory_profile @wms | capability-only | — | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
 | search:wms:warehouse_location | module:wms:warehouse_location @wms | capability-only | — | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
 | search:wms:warehouse | module:wms:warehouse @wms | capability-only | — | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
+| wms:invalidate-availability-cache-policy | wildcard:availability.policy.* | wildcard | — | [subscribers/invalidate-availability-cache-policy.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-policy.ts) |
+| wms:invalidate-availability-cache-profile | wildcard:wms.inventory_profile.* | wildcard | — | [subscribers/invalidate-availability-cache-profile.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-profile.ts) |
+| wms:invalidate-availability-cache | wildcard:wms.inventory_balance.* | wildcard | — | [subscribers/invalidate-availability-cache.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache.ts) |
 | wms:invalidate-enricher-cache-balance | wildcard:wms.inventory_balance.* | wildcard | — | [subscribers/invalidate-enricher-cache-balance.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-balance.ts) |
 | wms:invalidate-enricher-cache-inventory | wildcard:wms.inventory.* | wildcard | — | [subscribers/invalidate-enricher-cache-inventory.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-inventory.ts) |
 | wms:invalidate-enricher-cache-movement | wildcard:wms.inventory_movement.* | wildcard | — | [subscribers/invalidate-enricher-cache-movement.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-movement.ts) |

package/dist/agentic/guides/modules/wms/di-registrations-rich.md

@@ -6,13 +6,13 @@
 
 | Token | Kind | Lifetime | Injection | Provider | Source |
 |---|---|---|---|---|---|
-| InventoryBalance | value | — | — | — | [di.ts:21](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L21) |
-| InventoryLot | value | — | — | — | [di.ts:20](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L20) |
-| InventoryMovement | value | — | — | — | [di.ts:23](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L23) |
-| InventoryReservation | value | — | — | — | [di.ts:22](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L22) |
-| ProductInventoryProfile | value | — | — | — | [di.ts:19](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L19) |
-| Warehouse | value | — | — | — | [di.ts:16](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L16) |
-| WarehouseLocation | value | — | — | — | [di.ts:18](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L18) |
-| WarehouseZone | value | — | — | — | [di.ts:17](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L17) |
+| InventoryBalance | value | — | — | — | [di.ts:23](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L23) |
+| InventoryLot | value | — | — | — | [di.ts:22](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L22) |
+| InventoryMovement | value | — | — | — | [di.ts:25](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L25) |
+| InventoryReservation | value | — | — | — | [di.ts:24](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L24) |
+| ProductInventoryProfile | value | — | — | — | [di.ts:21](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L21) |
+| Warehouse | value | — | — | — | [di.ts:18](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L18) |
+| WarehouseLocation | value | — | — | — | [di.ts:20](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L20) |
+| WarehouseZone | value | — | — | — | [di.ts:19](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L19) |
 
 <!-- end module facts section: wms/di-registrations-rich -->

package/dist/agentic/guides/modules/wms/exact-override-targets.md

@@ -17,17 +17,20 @@
 | acl | `overrides.acl.features["wms.receive_inventory"]` | disable-replace | aclFeatures:wms.receive_inventory | [acl.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/acl.ts) |
 | acl | `overrides.acl.features["wms.view"]` | disable-replace | aclFeatures:wms.view | [acl.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/acl.ts) |
 | cli | `overrides.cli["verify-balances"]` | disable-replace | cliCommands:verify-balances | [cli.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/cli.ts) |
-| di | `overrides.di["InventoryBalance"]` | disable-replace | ownedContracts.di-registration:InventoryBalance | [di.ts:21](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L21) |
-| di | `overrides.di["InventoryLot"]` | disable-replace | ownedContracts.di-registration:InventoryLot | [di.ts:20](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L20) |
-| di | `overrides.di["InventoryMovement"]` | disable-replace | ownedContracts.di-registration:InventoryMovement | [di.ts:23](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L23) |
-| di | `overrides.di["InventoryReservation"]` | disable-replace | ownedContracts.di-registration:InventoryReservation | [di.ts:22](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L22) |
-| di | `overrides.di["ProductInventoryProfile"]` | disable-replace | ownedContracts.di-registration:ProductInventoryProfile | [di.ts:19](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L19) |
-| di | `overrides.di["Warehouse"]` | disable-replace | ownedContracts.di-registration:Warehouse | [di.ts:16](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L16) |
-| di | `overrides.di["WarehouseLocation"]` | disable-replace | ownedContracts.di-registration:WarehouseLocation | [di.ts:18](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L18) |
-| di | `overrides.di["WarehouseZone"]` | disable-replace | ownedContracts.di-registration:WarehouseZone | [di.ts:17](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L17) |
+| di | `overrides.di["InventoryBalance"]` | disable-replace | ownedContracts.di-registration:InventoryBalance | [di.ts:23](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L23) |
+| di | `overrides.di["InventoryLot"]` | disable-replace | ownedContracts.di-registration:InventoryLot | [di.ts:22](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L22) |
+| di | `overrides.di["InventoryMovement"]` | disable-replace | ownedContracts.di-registration:InventoryMovement | [di.ts:25](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L25) |
+| di | `overrides.di["InventoryReservation"]` | disable-replace | ownedContracts.di-registration:InventoryReservation | [di.ts:24](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L24) |
+| di | `overrides.di["ProductInventoryProfile"]` | disable-replace | ownedContracts.di-registration:ProductInventoryProfile | [di.ts:21](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L21) |
+| di | `overrides.di["Warehouse"]` | disable-replace | ownedContracts.di-registration:Warehouse | [di.ts:18](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L18) |
+| di | `overrides.di["WarehouseLocation"]` | disable-replace | ownedContracts.di-registration:WarehouseLocation | [di.ts:20](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L20) |
+| di | `overrides.di["WarehouseZone"]` | disable-replace | ownedContracts.di-registration:WarehouseZone | [di.ts:19](../../../../node_modules/@open-mercato/core/src/modules/wms/di.ts#L19) |
 | enrichers | `overrides.enrichers["wms.catalog-product-inventory"]` | disable-replace | extensionSurfaces.contributions:wms.catalog-product-inventory | [data/enrichers.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/data/enrichers.ts) |
 | enrichers | `overrides.enrichers["wms.catalog-variant-inventory"]` | disable-replace | extensionSurfaces.contributions:wms.catalog-variant-inventory | [data/enrichers.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/data/enrichers.ts) |
 | enrichers | `overrides.enrichers["wms.sales-order-inventory"]` | disable-replace | extensionSurfaces.contributions:wms.sales-order-inventory | [data/enrichers.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/data/enrichers.ts) |
+| events | `overrides.events.subscribers["wms:invalidate-availability-cache"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-availability-cache | [subscribers/invalidate-availability-cache.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache.ts) |
+| events | `overrides.events.subscribers["wms:invalidate-availability-cache-policy"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-availability-cache-policy | [subscribers/invalidate-availability-cache-policy.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-policy.ts) |
+| events | `overrides.events.subscribers["wms:invalidate-availability-cache-profile"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-availability-cache-profile | [subscribers/invalidate-availability-cache-profile.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-profile.ts) |
 | events | `overrides.events.subscribers["wms:invalidate-enricher-cache-balance"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-enricher-cache-balance | [subscribers/invalidate-enricher-cache-balance.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-balance.ts) |
 | events | `overrides.events.subscribers["wms:invalidate-enricher-cache-inventory"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-enricher-cache-inventory | [subscribers/invalidate-enricher-cache-inventory.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-inventory.ts) |
 | events | `overrides.events.subscribers["wms:invalidate-enricher-cache-movement"]` | disable-replace | extensionSurfaces.contributions:wms:invalidate-enricher-cache-movement | [subscribers/invalidate-enricher-cache-movement.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-movement.ts) |

package/dist/agentic/guides/modules/wms/index.md

@@ -1,5 +1,5 @@
 # wms — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.8.1-develop.7297.1.67605e74f9; core 0.8.1-develop.7297.1.67605e74f9 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.8.1-develop.7441.1.b42958b98c; core 0.8.1-develop.7441.1.b42958b98c — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/wms
 
 ## Sections
@@ -11,13 +11,13 @@ Source root: node_modules/@open-mercato/core/src/modules/wms
 - [Search entities](search-entities.md) — ~1 KB — Generated search entities facts for wms.
 - [Host extension points](host-extension-points.md) — ~1 KB — Generated host extension points facts for wms.
 - [UMES hosts](umes-hosts.md) — ~32 KB — Generated umes hosts facts for wms.
-- [UMES contributions](umes-contributions.md) — ~10 KB — Generated umes contributions facts for wms.
+- [UMES contributions](umes-contributions.md) — ~11 KB — Generated umes contributions facts for wms.
 - [Active extension bindings](active-extension-bindings.md) — ~1 KB — Generated active extension bindings facts for wms.
 - [Contribution resolutions](contribution-resolutions.md) — ~8 KB — Generated contribution resolutions facts for wms.
 - [UMES diagnostics](umes-diagnostics.md) — ~1 KB — Generated umes diagnostics facts for wms.
 - [Notifications](notifications.md) — ~1 KB — Generated notifications facts for wms.
 - [CLI commands](cli-commands.md) — ~1 KB — Generated cli commands facts for wms.
-- [Exact override targets](exact-override-targets.md) — ~15 KB — Generated exact override targets facts for wms.
+- [Exact override targets](exact-override-targets.md) — ~16 KB — Generated exact override targets facts for wms.
 - [Owned contract — module metadata](owned-contract-module-metadata.md) — ~1 KB — Generated owned contract — module metadata facts for wms.
 - [Domain commands](domain-commands.md) — ~4 KB — Generated domain commands facts for wms.
 - [Setup](setup.md) — ~1 KB — Generated setup facts for wms.

package/dist/agentic/guides/modules/wms/umes-contributions.md

@@ -20,6 +20,9 @@
 | search:wms:product_inventory_profile | specialized-registry | wms:product_inventory_profile | — | registry=search; registryId=wms:product_inventory_profile; specialistRoute=search | fact-ref | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
 | search:wms:warehouse | specialized-registry | wms:warehouse | — | registry=search; registryId=wms:warehouse; specialistRoute=search | fact-ref | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
 | search:wms:warehouse_location | specialized-registry | wms:warehouse_location | — | registry=search; registryId=wms:warehouse_location; specialistRoute=search | fact-ref | [search.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/search.ts) |
+| wms:invalidate-availability-cache | subscriber | wms.inventory_balance.* | before-or-after | event=wms.inventory_balance.*; persistent=false; subscriberId=wms:invalidate-availability-cache; sync=true | pattern | [subscribers/invalidate-availability-cache.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache.ts) |
+| wms:invalidate-availability-cache-policy | subscriber | availability.policy.* | before-or-after | event=availability.policy.*; persistent=false; subscriberId=wms:invalidate-availability-cache-policy; sync=true | pattern | [subscribers/invalidate-availability-cache-policy.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-policy.ts) |
+| wms:invalidate-availability-cache-profile | subscriber | wms.inventory_profile.* | before-or-after | event=wms.inventory_profile.*; persistent=false; subscriberId=wms:invalidate-availability-cache-profile; sync=true | pattern | [subscribers/invalidate-availability-cache-profile.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-availability-cache-profile.ts) |
 | wms:invalidate-enricher-cache-balance | subscriber | wms.inventory_balance.* | before-or-after | event=wms.inventory_balance.*; persistent=false; subscriberId=wms:invalidate-enricher-cache-balance; sync=true | pattern | [subscribers/invalidate-enricher-cache-balance.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-balance.ts) |
 | wms:invalidate-enricher-cache-inventory | subscriber | wms.inventory.* | before-or-after | event=wms.inventory.*; persistent=false; subscriberId=wms:invalidate-enricher-cache-inventory; sync=true | pattern | [subscribers/invalidate-enricher-cache-inventory.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-inventory.ts) |
 | wms:invalidate-enricher-cache-movement | subscriber | wms.inventory_movement.* | before-or-after | event=wms.inventory_movement.*; persistent=false; subscriberId=wms:invalidate-enricher-cache-movement; sync=true | pattern | [subscribers/invalidate-enricher-cache-movement.ts](../../../../node_modules/@open-mercato/core/src/modules/wms/subscribers/invalidate-enricher-cache-movement.ts) |

package/dist/agentic/guides/modules/workflows/active-extension-bindings.md

@@ -6,9 +6,9 @@
 
 | Activation | Kind | Host | Contribution kinds | Phases | Bridge | Source |
 |---|---|---|---|---|---|---|
-| entity:workflows.definition_draft:mutation-guard | mutation-guard | entity:workflows.definition_draft @workflows | mutation-guard | — | — | [api/definitions/[id]/draft/route.ts:224](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/definitions/[id]/draft/route.ts#L224) |
-| entity:workflows.definition:mutation-guard | mutation-guard | entity:workflows.definition @workflows | mutation-guard | — | — | [api/definitions/[id]/customize/route.ts:65](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/definitions/[id]/customize/route.ts#L65) |
-| entity:workflows.instance:mutation-guard | mutation-guard | entity:workflows.instance @workflows | mutation-guard | — | — | [api/instances/[id]/context/route.ts:104](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/instances/[id]/context/route.ts#L104) |
+| entity:workflows.definition_draft:mutation-guard | mutation-guard | entity:workflows.definition_draft @workflows | mutation-guard | — | — | [api/definitions/[id]/draft/route.ts:227](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/definitions/[id]/draft/route.ts#L227) |
+| entity:workflows.definition:mutation-guard | mutation-guard | entity:workflows.definition @workflows | mutation-guard | — | — | [api/definitions/[id]/customize/route.ts:67](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/definitions/[id]/customize/route.ts#L67) |
+| entity:workflows.instance:mutation-guard | mutation-guard | entity:workflows.instance @workflows | mutation-guard | — | — | [api/instances/[id]/context/route.ts:105](../../../../node_modules/@open-mercato/core/src/modules/workflows/api/instances/[id]/context/route.ts#L105) |
 | widget-spot:data-table:workflows.tasks.list:row-actions:widget-injection-consumer | widget-injection-consumer | widget-spot:data-table:workflows.tasks.list:row-actions @workflows | widget, data-table, crud-form | — | hosts:tasksTable.rowActions | [extension-points.ts](../../../../node_modules/@open-mercato/core/src/modules/workflows/extension-points.ts) |
 
 <!-- end module facts section: workflows/active-extension-bindings -->

package/dist/agentic/guides/modules/workflows/index.md

@@ -1,5 +1,5 @@
 # workflows — module facts (generated, do not edit)
-<!-- generated from @open-mercato/core 0.8.1-develop.7297.1.67605e74f9; core 0.8.1-develop.7297.1.67605e74f9 — R1 staleness stamp -->
+<!-- generated from @open-mercato/core 0.8.1-develop.7441.1.b42958b98c; core 0.8.1-develop.7441.1.b42958b98c — R1 staleness stamp -->
 Source root: node_modules/@open-mercato/core/src/modules/workflows
 
 ## Sections

package/dist/agentic/guides/reference-module-facts.json

@@ -1185,7 +1185,7 @@
     "facts": {
       "title": "Example Module",
       "description": "Demonstrates pages, APIs, entities and DI.",
-      "coreVersion": "0.8.1-develop.7297.1.67605e74f9",
+      "coreVersion": "0.8.1-develop.7441.1.b42958b98c",
       "sourcePackage": null,
       "sourceVersion": null,
       "sourceRoot": "src/modules/example",

package/dist/agentic/guides/upstream/BACKWARD_COMPATIBILITY.md

@@ -102,7 +102,7 @@ These exported types are consumed by module developers. Required fields MUST NOT
 - `WorkerMeta`: `queue` — MUST NOT remove
 - `TelemetryProvider` (`@open-mercato/telemetry`): `name`, `supports`, `start`, `shutdown`, `runInSpan`, `activeSpan`, `activeTraceContext`, `inject`, `runInRemoteSpan`, `emitLog`, `recordMetric` — MUST NOT remove. `reportError?()` was added 2026-09-08 as an additive OPTIONAL method (see [spec](.ai/specs/2026-09-08-error-reporting-policy.md)); it **MUST stay optional** — third parties implement this interface and a required method would break every existing provider. The facade calls it as `provider.reportError?.(…)` *in addition to* the span/log/metric path, so a provider that omits it loses nothing.
 - `ReportErrorContext` (`@open-mercato/telemetry`) and the `reportError` context of `TelemetryRuntime` (`@open-mercato/shared/lib/telemetry/runtime`): `module?` and `attributes?` — MUST NOT remove. `code?: string` was added 2026-09-08 as an additive optional field carrying the enumerated `module.reason` fingerprint the backend groups on; it MUST stay optional so existing callers (the API dispatcher, the CRUD factory) keep compiling and keep emitting exactly what they emit today. `om.errors` gains an `error.code` label only when a caller supplies one — the same attribute name the span and the log record use, so one query works against all three.
-- `RefreshCredentialsInput` (communication_channels hub): `channelId`, `credentials`, `scope` — MUST NOT remove. `oauthClient?` was added 2026-05-27 as an additive optional field (see [Spec A](.ai/specs/implemented/2026-05-27-email-integration-inbound-reliability-and-threading.md)). The legacy `credentials._client` read path in the Gmail adapter is **deprecated and slated for removal in the next minor release** — pass OAuth client config via `RefreshCredentialsInput.oauthClient` instead.
+- `RefreshCredentialsInput` (communication_channels hub): `channelId`, `credentials`, `scope` — MUST NOT remove. `oauthClient?` was added 2026-05-27 as an additive optional field (see [Spec A](.ai/specs/implemented/2026-05-27-email-integration-inbound-reliability-and-threading.md)). The legacy `credentials._client` read path in the Gmail adapter was **removed** (see #3828 / UPGRADE_NOTES) — OAuth client config MUST be passed via `RefreshCredentialsInput.oauthClient`.
 - `OAuthClientConfig` (communication_channels hub): added 2026-05-27 with `clientId` required; optional `clientSecret`, `tenantId`, `scopes`. New optional fields may be added; required `clientId` MUST NOT be removed.
 - `BackendChromePayload`: `groups`, `settingsSections`, `settingsPathPrefixes`, `profileSections`, `profilePathPrefixes`, `grantedFeatures`, `roles` — MUST NOT remove. `currentOrganization?` (`BackendChromeCurrentOrganization | null`) was added 2026-07-30 as an additive optional field (see [spec](.ai/specs/2026-07-30-backend-chrome-current-organization.md)); it is `null` under an all-organizations selection, when no organization is in scope, and when the lookup fails, so consumers MUST treat `null` as "unknown" rather than "no organization". `brand?` is **unchanged** and remains the branding channel — it populates only when the organization has a `logoUrl`, and `currentOrganization` does not supersede it.
 
@@ -360,6 +360,29 @@ Files in `apps/mercato/.mercato/generated/` are produced by the CLI generators.
 
 ---
 
+## Canonical API Interceptor Route Identity (2026-10-04)
+
+API dispatch and API-interceptor selection now share the same matched-route identity.
+This closes a policy bypass where a mixed-case or percent-encoded spelling dispatched
+to a handler but did not select its exact `before` interceptor.
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| Function signature (`findApiRouteManifestMatch`) | New optional fourth parameter `request?: Request`; existing three-argument callers keep the same return value and matching behavior | ✓ ADDITIVE (optional parameter appended) |
+| API route URLs and handler context | No route is added, removed, or renamed; handler `params` and request query semantics are unchanged | ✓ No contract change |
+| Interceptor selection | Static segments use the matched manifest spelling, while matched dynamic/catch-all values stay concrete. Alternate spellings that already reached a route now run the same exact/prefix interceptors as its normal spelling; malformed percent encoding reaches no handler | ⚠️ Intentional security narrowing only (previous policy-bypass requests are denied or intercepted) |
+| Request cloning/reconstruction | Dispatcher identity survives `Request.clone()` and `new Request(request.url, request)`. Unknown, forged, or evicted internal continuity metadata fails closed; unbound direct handlers retain legacy URL-derived matching | ✓ Behavior-preserving for valid dispatches; intentional security narrowing for forged metadata |
+| Handler ordering | Authorization and interceptor `before`/`after` positions are unchanged | ✓ Behavior-preserving for normally spelled requests |
+
+**Migration path for existing modules**: none. Keep authored `targetRoute` values.
+Callers that dispatch through the framework catch-all receive canonical binding
+automatically; direct three-argument matcher consumers continue to work unchanged.
+Synthetic dispatchers should pass the exact request they invoke as argument four.
+Request wrappers should retain headers when reconstructing the request, or pass an
+authored route constant directly to the interceptor runner.
+
+---
+
 ## CRUD Foreign-Key Violations Answer 409 (2026-09-07)
 
 Deleting a user who had customised their sidebar failed on the `user_sidebar_preferences` / `sidebar_variants` foreign keys and surfaced as a generic `500`. The fix clears those rows in `auth.users.delete`, gives both FKs `ON DELETE CASCADE`, and teaches `makeCrudRoute` to recognise a Postgres foreign-key violation (SQLSTATE 23503). **All changes are additive** and pass the contract-surface checks above:
@@ -472,6 +495,24 @@ Spec: [`.ai/specs/2026-09-08-error-reporting-policy.md`](.ai/specs/2026-09-08-er
 
 **Volume note for operators.** Reported error *volume* rises where errors were previously only recorded: an integration that writes 115 error rows now also reports 115 errors, grouped by `error.code` at the backend. This is deliberate — see the spec's §S3 — and the controls are the collector's filtering/sampling and the backend's own quotas, not a framework switch.
 
+## Data Sync Retry, Resume and Run Again (2026-09-16)
+
+[`.ai/specs/2026-09-16-data-sync-retry-resume-actions.md`](.ai/specs/2026-09-16-data-sync-retry-resume-actions.md) splits the Data Sync dashboard's single overloaded "Retry" button into three named operator actions — **Retry** (labelled **Resume** on a cancelled run), **Retry from the beginning**, and **Run again** — and states, on the run detail page, where a retry would resume. **All changes are additive** and pass the contract-surface checks above:
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| Type definitions (§2) | New exported types `ResumePoint` (a discriminated union of `none` / `noCommittedBatch` / `resumes`) and `ResumePointRun` | ✓ ADDITIVE (new types, nothing renamed — same shape as the `StartControlMap` addition before it) |
+| Import paths (§4) | New module `data_sync/lib/resume-point.ts` exporting `resolveResumePoint`, `isRetryableRunStatus`, `ResumePoint`, `ResumePointRun` | ✓ ADDITIVE (new path; nothing moved or re-exported) |
+| API route URLs (§7) | **No change.** `POST /api/data_sync/runs/[id]/retry` and `POST /api/data_sync/run` are untouched — no new request field, no new response field, no new status code and no new error code. The UI starts sending the already-accepted `fromBeginning: true` for the first time, and reads `cursor` / `initialCursor` / `batchesCompleted`, all of which `GET /api/data_sync/runs` and `GET /api/data_sync/runs/[id]` have returned since 2026-08-12 | ✓ n/a |
+| Database schema (§8) | No change. No entity, column, migration or `.snapshot-open-mercato.json` update; no new run status — the vestigial `paused` status is left exactly as it was | ✓ n/a |
+| Auto-discovery, function signatures, event IDs, widget spot IDs, DI names, ACL features, notification IDs, CLI commands, generated files | No change | ✓ n/a |
+
+**Contract commitments**: the retry endpoint deliberately does **not** enforce `supportsStartControl('fullSync', entityType)` before honouring `fromBeginning: true`. [§ Data Sync Start Control Applicability (2026-09-02)](#data-sync-start-control-applicability-2026-09-02) already commits that the declaration "governs what the dashboard **offers**, never what the run API **accepts**", and `fromBeginning: true` on `retry` requests the identical thing as `fullSync: true` on `run` — a `null` start cursor — so the two siblings MUST answer identically. An adapter-declared restriction hides the from-the-beginning action in the UI and nothing more; a scripted or API client keeps the documented escape hatch. Making either endpoint strict is a breaking change under §7 and needs the deprecation protocol, not a UI spec.
+
+`ResumePoint` also has **no `fromBeginning` variant, by design**. `api/runs/[id]/retry.ts` resolves a resumable retry as `previous.cursor ?? resolveStartCursor(...)`, and `resolveStartCursor` reads the shared `sync_cursors` row — state the run row does not carry — so a run that committed no batch of its own may still resume at a cursor an earlier run wrote. `noCommittedBatch` therefore means only "this run committed nothing" and MUST NOT be widened by a caller into a positional claim about where a retry starts. A future additive `retryStartCursor` response field is the only way to close that gap; it is out of scope here.
+
+**Migration path for existing adapters and clients**: none. The module is new, every endpoint is unchanged, and an adapter or API client that ignores all of this behaves exactly as before.
+
 ## Customers Quick-Create Injection Spot Bridge (2026-09-16)
 
 [`.ai/specs/2026-09-16-customers-quick-create-injection-spot-bridge.md`](.ai/specs/2026-09-16-customers-quick-create-injection-spot-bridge.md) binds the sales document form's Person/Company quick-create dialogs to the customers module's declared `crud-form:customers.person` / `…company` hosts. The dialogs previously had no `injectionSpotId`, so `CrudForm` auto-derived `crud-form:customers.customer_entity` (§6, FROZEN) there instead.
@@ -484,3 +525,34 @@ Spec: [`.ai/specs/2026-09-08-error-reporting-policy.md`](.ai/specs/2026-09-08-er
 | Type definitions (§2) | New optional `CrudForm` prop `legacyInjectionSpotId?: string` | ✓ ADDITIVE |
 
 **Deprecation window.** `legacyInjectionSpotId` is scoped to these two call sites and intended for removal after at least one minor version (Deprecation Protocol step 1), tracked in the spec's Changelog and in `UPGRADE_NOTES.md`. No maintainer waiver was needed — nothing is removed by this change.
+
+## Atomic Auth Command Replay (2026-10-04)
+
+[`.ai/specs/2026-07-28-protected-roles-and-audit-seam.md`](.ai/specs/2026-07-28-protected-roles-and-audit-seam.md) closes the auth undo/redo transaction, authorization, and membership-phantom gaps without changing existing command handlers by default.
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| Type definitions (`CommandHandler`, `CommandRuntimeContext`, `CommandExecuteResult`) | New optional `atomicReplay?: boolean` and `stabilizeReplay(...)` handler capabilities, optional `replayTransactionGuard` request guard, optional caller-owned `transactionLifetime`, and optional `replaySourceFinalized?: boolean` result signal. `TransactionLifetime` plus its observation/completion-registration helpers are new exports; lifetime creation/completion remains owned by `withAtomicFlush` | ✓ ADDITIVE (optional fields and exports; omitted handlers and contexts keep the prior flow) |
+| `ActionLogService` method signatures | `log`, `claimForUndo`, `releaseUndoClaim`, and `markUndone` accept an optional trailing transactional `EntityManager`; new `claimForRedo` method | ✓ ADDITIVE (optional parameters appended and a new method; existing calls retain behavior) |
+| `RbacService` | New `loadAclWithEntityManager`, `userHasAllFeaturesWithEntityManager`, and `getGrantedFeaturesWithEntityManager` methods bypass caches and bind every query to the supplied transaction | ✓ ADDITIVE (new methods; existing cache-backed methods are unchanged) |
+| Auth command replay behavior | Auth user/role handlers opt in so source-log state, domain changes, undo trace or new redo log, and redo source finalization commit or roll back together. Before the request guard or feature interceptors run, `stabilizeReplay` discovers and seals one actor/target/destination footprint and locks API keys, users, roles, tenant/organization hierarchy, and authorization children in a total order using the same transaction | ⚠️ Intentional security hardening. A race that previously could deadlock or replay with stale authority is rejected with the existing domain `409`; successful, authorized replay keeps the same response shape |
+| Action-log actor persistence and self replay | `actor_user_id` remains a UUID; new entries also store the canonical user or `api_key:<uuid>` subject in `context.actorSubject`. API-key list ownership, undo/redo ownership, exact-EM RBAC, locks, and latest replay queries use the canonical subject. Canonical history is selected before the legacy bare-UUID fallback, which additionally requires a coherent live `isApiKey`/`keyId`/`sub` tuple | ✓ Database-compatible additive context metadata; same-UUID user, malformed, or ambiguous ownership cannot shadow canonical key history and fails closed |
+| Auth authorization-state writers | First-party `UserRole`, `UserAcl`, and `RoleAcl` writers in commands, setup, CLI, execution principals, SSO, and agent orchestration now share the canonical parent-lock protocol; SSO membership and grant rows commit together | ⚠️ Intentional concurrency hardening; no request, response, schema, import-path, event, feature, or CLI contract changes |
+| Non-auth command replay | Handlers that omit `atomicReplay` retain the existing undo claim/release compensation and route-level redo finalization | ✓ Behavior-preserving |
+| API routes, response schemas, database schema, event IDs, ACL feature IDs, DI names, CLI commands, generated files | No shape or identifier change | ✓ n/a |
+
+**Migration path for existing modules**: none. Third-party commands remain on the established replay lifecycle unless they explicitly set `atomicReplay: true`. An opting-in handler must perform all replay database work through `ctx.transactionalEm`; when authorization depends on mutable domain rows it may add `stabilizeReplay` to acquire its complete footprint before guards and interceptors. The command bus supplies and owns the transaction by default. A caller deliberately composing replay inside an already-active `ctx.transactionalEm` must open that outer transaction with `withAtomicFlush(..., { transaction: true })`, obtain its exact `TransactionLifetime` inside the phase, and pass it as `ctx.transactionLifetime`; otherwise replay fails before mutation. Commit-only hooks and redo-finalization reporting follow the true outer completion. The capability does not claim that legacy non-opted-in action-log and domain writes are transactionally atomic.
+
+---
+
+## Organization Update Preserves Omitted Hierarchy Fields (2026-10-01)
+
+`directory.organizations.update` treated an omitted `parentId` as `null` and an omitted `childIds` as `[]`, so a partial update — notably `PUT /api/directory/organization-branding`, which sends only logo fields — detached the organization from its parent and orphaned its children. Omitted hierarchy fields are now preserved:
+
+| Surface | Change | Classification |
+|---------|--------|----------------|
+| Command behaviour (`directory.organizations.update`) | `parentId` is written and validated only when present in the input; children are reconciled only when `childIds` is present. Explicit `parentId: null` and `childIds: []` still clear. With `childIds` present and `parentId` omitted, listing the current parent answers `400 Child cannot equal parent` (it answered `400 Cannot assign ancestor as child`) | ⚠️ Behaviour change on a previously-corrupting path. A caller that omitted the fields to clear the hierarchy must send the explicit values. Regression-tested in `updateOrganization.partial-hierarchy.test.ts` and `TC-DIR-018` |
+| API routes (`PUT /api/directory/organizations`, `PUT /api/directory/organization-branding`) | Same URLs, request schema (`organizationUpdateSchema` already declares both fields optional) and response shapes | ✓ No shape change |
+| Database schema, event IDs, ACL features, DI names, CLI commands | No change | ✓ n/a |
+
+**Migration path for existing modules**: send `parentId: null` / `childIds: []` where clearing is intended. Trees flattened before the upgrade are not repaired (see UPGRADE_NOTES.md).

package/dist/agentic/guides/upstream/manifest.json

@@ -1,8 +1,8 @@
 {
   "version": 1,
-  "generator": "@open-mercato/cli@0.8.1-develop.7297.1.67605e74f9",
+  "generator": "@open-mercato/cli@0.8.1-develop.7441.1.b42958b98c",
   "files": {
     "AGENTS.md": "9fdaca247f55c64f5966cc103265cfb03233e0532f58f14aff538ae18aa3555d",
-    "BACKWARD_COMPATIBILITY.md": "7f7d93266be9dbf1a1e154df6d40efd6de4ffeea3a2d7b2822f3081d6395c272"
+    "BACKWARD_COMPATIBILITY.md": "853f6b5a0b88f8439d7644d463d5b27c2e917366472a1e1fc3ac4586ef47c859"
   }
 }

package/dist/agentic/shared/ai/skills/om-data-model-design/references/sensitive-data.md

@@ -6,5 +6,5 @@ Load this reference when records contain PII, credentials, addresses, contact in
 2. In module `encryption.ts`, import `ModuleEncryptionMap` from `@open-mercato/shared/modules/encryption`, declare `defaultEncryptionMaps: ModuleEncryptionMap[] = [{ entityId: '<module>:<entity>', fields: [{ field: '<database_field>' }] }]`, then `export default defaultEncryptionMaps` for generated registry compatibility. The entries are field-rule objects, not string names. Use a sibling `hashField` only for deterministic equality lookup. Let `TenantDataEncryptionService` populate it during encrypted writes, and query it with `lookupHashCandidates(value)` from `@open-mercato/shared/lib/encryption/aes`; use `hashForLookup(value)` from the same import only when the installed write contract explicitly requires a single keyed value. Never use raw SHA-256 for low-entropy PII such as email or phone values.
 3. Import `findWithDecryption`, `findOneWithDecryption`, or `findAndCountWithDecryption` from `@open-mercato/shared/lib/encryption/find` and make a concrete call in every implemented direct sensitive-record read path; an unused import or encryption map alone is not a decrypted read. For `makeCrudRoute`, its `entityId` + `fields` factory QueryEngine owns list decryption and `list` has no `findAndCount` override key—do not insert a decryption helper as an unsupported option. Put trusted tenant/organization constraints in each direct helper query `where` **and** pass `{ tenantId, organizationId }` as the fifth-argument decryption scope. The scope selects keys; it does not authorize or scope the ORM query. Use a null/global scope only when the installed contract explicitly permits it. Audit detail/export/search/worker/CLI and other direct ORM paths.
 4. Keep secrets out of responses, logs, errors, events, snapshots, cache keys, search documents, vector sources, and test artifacts. Exclude encrypted source values from `search.ts` field policies and indexes; index only an explicitly approved hash-only sibling for exact equality. Never sort or fuzzy-filter ciphertext.
-5. Seed/update encryption configuration through the supported command; never hand-roll KMS/AES. For every new or changed map, use an isolated initialized test tenant to reconcile the map, read back its registration, insert a fixture through the real write path, and assert the sensitive database columns are ciphertext before claiming runtime coverage.
+5. Seed/update encryption configuration through the supported command; never hand-roll KMS/AES. For every new or changed map, use an isolated initialized test tenant to reconcile the map, read back its registration, insert a fixture through the real write path, and assert the sensitive database columns are ciphertext before claiming runtime coverage. A fresh test tenant does not prove existing tenants are covered: maps are seeded only when a tenant is created, and nothing re-seeds tenants that already exist. When you add a map, or a field to an existing map, in a module that may already be deployed, ship a backfill migration in the same module: `this.addSql(buildEncryptionMapBackfillSql({ entityId, fields }))` from `@open-mercato/shared/lib/encryption/migration-backfill`. It inserts the map for every existing (tenant, organization) scope that already has active maps (`NOT EXISTS` guard) and appends missing fields to existing maps. Write the entity id and fields literally in the migration and leave `down()` empty. `yarn db:generate` warns when the local database shows an unbackfilled field. Plaintext rows written before the backfill are encrypted by `yarn mercato entities rotate-encryption-key --tenant <id>` without `--old-key`.
 6. Test authorized decryption, cross-scope denial, redaction, missing keys, export/search behavior, and cleanup/retention.

package/dist/bin.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { isTelemetryBackendEnabled } from "@open-mercato/shared/lib/telemetry/runtime";
 import { resolveCliBootstrapMode } from "./lib/cli-bootstrap-mode.js";
-import { flushTelemetry } from "./lib/flush-telemetry.js";
+import { flushBeforeExit } from "./lib/flush-before-exit.js";
 function assertNode24Runtime() {
   const detectedNodeVersion = process.versions.node;
   const majorVersion = Number.parseInt(detectedNodeVersion.split(".")[0] ?? "0", 10);
@@ -72,7 +72,7 @@ async function main() {
   }
   const { run } = await import("./mercato.js");
   const code = await run(process.argv);
-  await flushTelemetry();
+  await flushBeforeExit();
   process.exit(code ?? 0);
 }
 main().catch((error) => {

package/dist/bin.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../src/bin.ts"],
-  "sourcesContent": ["/**\n * CLI binary entry point for @open-mercato/cli package.\n *\n * Called from within a Next.js app directory as: yarn mercato <command>\n * Uses dynamic app resolution to find generated files at .mercato/generated/\n */\nimport { isTelemetryBackendEnabled } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { resolveCliBootstrapMode, type CliBootstrapMode } from './lib/cli-bootstrap-mode.js'\nimport { flushTelemetry } from './lib/flush-telemetry.js'\n// `run` is imported dynamically inside `main()` so telemetry can initialize\n// before the mercato entry (and its Postgres driver) loads \u2014 see main().\n\nfunction assertNode24Runtime(): void {\n  const detectedNodeVersion = process.versions.node\n  const majorVersion = Number.parseInt(detectedNodeVersion.split('.')[0] ?? '0', 10)\n  if (majorVersion >= 24) {\n    return\n  }\n  throw new Error(\n    [\n      'Unsupported Node.js runtime.',\n      `Cause: Detected Node ${detectedNodeVersion}, but Open Mercato requires Node 24.x.`,\n      'What to do: switch your shell to Node 24 (for example `nvm use 24`), run `yarn install`, then retry.',\n    ].join(' '),\n  )\n}\n\nasync function tryBootstrap(mode: Exclude<CliBootstrapMode, 'none'>): Promise<boolean> {\n  try {\n    // Use the CLI resolver to find the app directory (handles monorepo detection)\n    const { createResolver } = await import('./lib/resolver.js')\n    const resolver = createResolver()\n    const appDir = resolver.getAppDir()\n\n    if (mode === 'dev-supervisor') {\n      const {\n        canUseLightweightDevSupervisor,\n        loadDevSupervisorManifest,\n        registerDevSupervisorManifest,\n      } = await import(\n        './lib/dev-supervisor-manifest.js'\n      )\n      const manifest = loadDevSupervisorManifest(appDir)\n      if (canUseLightweightDevSupervisor(manifest)) {\n        registerDevSupervisorManifest(manifest)\n        return true\n      }\n    }\n\n    const { bootstrapFromAppRoot } = await import('@open-mercato/shared/lib/bootstrap/dynamicLoader')\n    const { registerCliModules } = await import('./mercato.js')\n    const data = await bootstrapFromAppRoot(appDir)\n    // Register CLI modules directly to avoid module resolution issues\n    registerCliModules(data.modules)\n    return true\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    // Check if the error is about missing generated files\n    if (\n      message.includes('dev-supervisor.generated.json') ||\n      (\n        message.includes('Cannot find module') &&\n        (message.includes('/generated/') || message.includes('.generated') || message.includes('.mercato'))\n      )\n    ) {\n      return false\n    }\n    // Re-throw other errors\n    throw err\n  }\n}\n\nasync function main(): Promise<void> {\n  assertNode24Runtime()\n  const bootstrapMode = resolveCliBootstrapMode(process.argv)\n\n  if (bootstrapMode !== 'none') {\n    // Load the app's `.env` BEFORE initTelemetry(): `run()` only dotenv-loads it\n    // later (ensureEnvLoaded), which is too late \u2014 TELEMETRY_BACKEND set only in\n    // `.env` would silently resolve to `noop` for worker/scheduler processes.\n    // The loader touches only the resolver + dotenv (no `pg`), preserving the\n    // instrumentation load-order guarantee below.\n    const { loadAppEnv } = await import('./lib/load-env.js')\n    await loadAppEnv()\n\n    // Initialize telemetry BEFORE bootstrapping the app graph. Bootstrap and the\n    // per-command handlers load MikroORM's Postgres driver \u2192 `pg`, and the\n    // OpenTelemetry pg/undici auto-instrumentation only records spans for a\n    // driver required AFTER the SDK has started. Registering here \u2014 ahead of any\n    // app module \u2014 is what lets long-running worker/scheduler processes emit DB\n    // spans (not just the bullmq-otel add/process envelope). The package itself\n    // is not imported unless an explicit supported backend is selected.\n    if (isTelemetryBackendEnabled()) {\n      const { initTelemetry } = await import('@open-mercato/telemetry')\n      await initTelemetry()\n    }\n\n    const bootstrapSucceeded = await tryBootstrap(bootstrapMode)\n    if (!bootstrapSucceeded) {\n      console.error('\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557')\n      console.error('\u2551  Generated files not found!                                       \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u2551  The CLI requires generated files to discover modules.           \u2551')\n      console.error('\u2551  Please run the following command first:                         \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u2551    yarn mercato generate                                         \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D')\n      process.exit(1)\n    }\n  }\n\n  // Dynamic import (not a top-level static import) so the mercato entry \u2014 and the\n  // Postgres driver it pulls in \u2014 loads only after initTelemetry() above.\n  const { run } = await import('./mercato.js')\n  const code = await run(process.argv)\n  // Flush spans/logs for commands that return (workers block forever and flush via\n  // their own shutdown handler instead).\n  await flushTelemetry()\n  process.exit(code ?? 0)\n}\n\nmain().catch((error: unknown) => {\n  if (error instanceof Error) {\n    console.error(error.message)\n  } else {\n    console.error(error)\n  }\n  process.exit(1)\n})\n"],
-  "mappings": "AAMA,SAAS,iCAAiC;AAC1C,SAAS,+BAAsD;AAC/D,SAAS,sBAAsB;AAI/B,SAAS,sBAA4B;AACnC,QAAM,sBAAsB,QAAQ,SAAS;AAC7C,QAAM,eAAe,OAAO,SAAS,oBAAoB,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AACjF,MAAI,gBAAgB,IAAI;AACtB;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR;AAAA,MACE;AAAA,MACA,wBAAwB,mBAAmB;AAAA,MAC3C;AAAA,IACF,EAAE,KAAK,GAAG;AAAA,EACZ;AACF;AAEA,eAAe,aAAa,MAA2D;AACrF,MAAI;AAEF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAC3D,UAAM,WAAW,eAAe;AAChC,UAAM,SAAS,SAAS,UAAU;AAElC,QAAI,SAAS,kBAAkB;AAC7B,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF,IAAI,MAAM,OACR,kCACF;AACA,YAAM,WAAW,0BAA0B,MAAM;AACjD,UAAI,+BAA+B,QAAQ,GAAG;AAC5C,sCAA8B,QAAQ;AACtC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kDAAkD;AAChG,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,cAAc;AAC1D,UAAM,OAAO,MAAM,qBAAqB,MAAM;AAE9C,uBAAmB,KAAK,OAAO;AAC/B,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE/D,QACE,QAAQ,SAAS,+BAA+B,KAE9C,QAAQ,SAAS,oBAAoB,MACpC,QAAQ,SAAS,aAAa,KAAK,QAAQ,SAAS,YAAY,KAAK,QAAQ,SAAS,UAAU,IAEnG;AACA,aAAO;AAAA,IACT;AAEA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,OAAsB;AACnC,sBAAoB;AACpB,QAAM,gBAAgB,wBAAwB,QAAQ,IAAI;AAE1D,MAAI,kBAAkB,QAAQ;AAM5B,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,mBAAmB;AACvD,UAAM,WAAW;AASjB,QAAI,0BAA0B,GAAG;AAC/B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,yBAAyB;AAChE,YAAM,cAAc;AAAA,IACtB;AAEA,UAAM,qBAAqB,MAAM,aAAa,aAAa;AAC3D,QAAI,CAAC,oBAAoB;AACvB,cAAQ,MAAM,gaAAuE;AACrF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gaAAuE;AACrF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAIA,QAAM,EAAE,IAAI,IAAI,MAAM,OAAO,cAAc;AAC3C,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI;AAGnC,QAAM,eAAe;AACrB,UAAQ,KAAK,QAAQ,CAAC;AACxB;AAEA,KAAK,EAAE,MAAM,CAAC,UAAmB;AAC/B,MAAI,iBAAiB,OAAO;AAC1B,YAAQ,MAAM,MAAM,OAAO;AAAA,EAC7B,OAAO;AACL,YAAQ,MAAM,KAAK;AAAA,EACrB;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;",
+  "sourcesContent": ["/**\n * CLI binary entry point for @open-mercato/cli package.\n *\n * Called from within a Next.js app directory as: yarn mercato <command>\n * Uses dynamic app resolution to find generated files at .mercato/generated/\n */\nimport { isTelemetryBackendEnabled } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { resolveCliBootstrapMode, type CliBootstrapMode } from './lib/cli-bootstrap-mode.js'\nimport { flushBeforeExit } from './lib/flush-before-exit.js'\n// `run` is imported dynamically inside `main()` so telemetry can initialize\n// before the mercato entry (and its Postgres driver) loads \u2014 see main().\n\nfunction assertNode24Runtime(): void {\n  const detectedNodeVersion = process.versions.node\n  const majorVersion = Number.parseInt(detectedNodeVersion.split('.')[0] ?? '0', 10)\n  if (majorVersion >= 24) {\n    return\n  }\n  throw new Error(\n    [\n      'Unsupported Node.js runtime.',\n      `Cause: Detected Node ${detectedNodeVersion}, but Open Mercato requires Node 24.x.`,\n      'What to do: switch your shell to Node 24 (for example `nvm use 24`), run `yarn install`, then retry.',\n    ].join(' '),\n  )\n}\n\nasync function tryBootstrap(mode: Exclude<CliBootstrapMode, 'none'>): Promise<boolean> {\n  try {\n    // Use the CLI resolver to find the app directory (handles monorepo detection)\n    const { createResolver } = await import('./lib/resolver.js')\n    const resolver = createResolver()\n    const appDir = resolver.getAppDir()\n\n    if (mode === 'dev-supervisor') {\n      const {\n        canUseLightweightDevSupervisor,\n        loadDevSupervisorManifest,\n        registerDevSupervisorManifest,\n      } = await import(\n        './lib/dev-supervisor-manifest.js'\n      )\n      const manifest = loadDevSupervisorManifest(appDir)\n      if (canUseLightweightDevSupervisor(manifest)) {\n        registerDevSupervisorManifest(manifest)\n        return true\n      }\n    }\n\n    const { bootstrapFromAppRoot } = await import('@open-mercato/shared/lib/bootstrap/dynamicLoader')\n    const { registerCliModules } = await import('./mercato.js')\n    const data = await bootstrapFromAppRoot(appDir)\n    // Register CLI modules directly to avoid module resolution issues\n    registerCliModules(data.modules)\n    return true\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    // Check if the error is about missing generated files\n    if (\n      message.includes('dev-supervisor.generated.json') ||\n      (\n        message.includes('Cannot find module') &&\n        (message.includes('/generated/') || message.includes('.generated') || message.includes('.mercato'))\n      )\n    ) {\n      return false\n    }\n    // Re-throw other errors\n    throw err\n  }\n}\n\nasync function main(): Promise<void> {\n  assertNode24Runtime()\n  const bootstrapMode = resolveCliBootstrapMode(process.argv)\n\n  if (bootstrapMode !== 'none') {\n    // Load the app's `.env` BEFORE initTelemetry(): `run()` only dotenv-loads it\n    // later (ensureEnvLoaded), which is too late \u2014 TELEMETRY_BACKEND set only in\n    // `.env` would silently resolve to `noop` for worker/scheduler processes.\n    // The loader touches only the resolver + dotenv (no `pg`), preserving the\n    // instrumentation load-order guarantee below.\n    const { loadAppEnv } = await import('./lib/load-env.js')\n    await loadAppEnv()\n\n    // Initialize telemetry BEFORE bootstrapping the app graph. Bootstrap and the\n    // per-command handlers load MikroORM's Postgres driver \u2192 `pg`, and the\n    // OpenTelemetry pg/undici auto-instrumentation only records spans for a\n    // driver required AFTER the SDK has started. Registering here \u2014 ahead of any\n    // app module \u2014 is what lets long-running worker/scheduler processes emit DB\n    // spans (not just the bullmq-otel add/process envelope). The package itself\n    // is not imported unless an explicit supported backend is selected.\n    if (isTelemetryBackendEnabled()) {\n      const { initTelemetry } = await import('@open-mercato/telemetry')\n      await initTelemetry()\n    }\n\n    const bootstrapSucceeded = await tryBootstrap(bootstrapMode)\n    if (!bootstrapSucceeded) {\n      console.error('\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2557')\n      console.error('\u2551  Generated files not found!                                       \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u2551  The CLI requires generated files to discover modules.           \u2551')\n      console.error('\u2551  Please run the following command first:                         \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u2551    yarn mercato generate                                         \u2551')\n      console.error('\u2551                                                                   \u2551')\n      console.error('\u255A\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u255D')\n      process.exit(1)\n    }\n  }\n\n  // Dynamic import (not a top-level static import) so the mercato entry \u2014 and the\n  // Postgres driver it pulls in \u2014 loads only after initTelemetry() above.\n  const { run } = await import('./mercato.js')\n  const code = await run(process.argv)\n  // Flush the coalesced browser broadcasts, then spans/logs, for commands that\n  // return (workers block forever and flush via their own shutdown handler instead).\n  await flushBeforeExit()\n  process.exit(code ?? 0)\n}\n\nmain().catch((error: unknown) => {\n  if (error instanceof Error) {\n    console.error(error.message)\n  } else {\n    console.error(error)\n  }\n  process.exit(1)\n})\n"],
+  "mappings": "AAMA,SAAS,iCAAiC;AAC1C,SAAS,+BAAsD;AAC/D,SAAS,uBAAuB;AAIhC,SAAS,sBAA4B;AACnC,QAAM,sBAAsB,QAAQ,SAAS;AAC7C,QAAM,eAAe,OAAO,SAAS,oBAAoB,MAAM,GAAG,EAAE,CAAC,KAAK,KAAK,EAAE;AACjF,MAAI,gBAAgB,IAAI;AACtB;AAAA,EACF;AACA,QAAM,IAAI;AAAA,IACR;AAAA,MACE;AAAA,MACA,wBAAwB,mBAAmB;AAAA,MAC3C;AAAA,IACF,EAAE,KAAK,GAAG;AAAA,EACZ;AACF;AAEA,eAAe,aAAa,MAA2D;AACrF,MAAI;AAEF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,mBAAmB;AAC3D,UAAM,WAAW,eAAe;AAChC,UAAM,SAAS,SAAS,UAAU;AAElC,QAAI,SAAS,kBAAkB;AAC7B,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF,IAAI,MAAM,OACR,kCACF;AACA,YAAM,WAAW,0BAA0B,MAAM;AACjD,UAAI,+BAA+B,QAAQ,GAAG;AAC5C,sCAA8B,QAAQ;AACtC,eAAO;AAAA,MACT;AAAA,IACF;AAEA,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,kDAAkD;AAChG,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,cAAc;AAC1D,UAAM,OAAO,MAAM,qBAAqB,MAAM;AAE9C,uBAAmB,KAAK,OAAO;AAC/B,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAE/D,QACE,QAAQ,SAAS,+BAA+B,KAE9C,QAAQ,SAAS,oBAAoB,MACpC,QAAQ,SAAS,aAAa,KAAK,QAAQ,SAAS,YAAY,KAAK,QAAQ,SAAS,UAAU,IAEnG;AACA,aAAO;AAAA,IACT;AAEA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,OAAsB;AACnC,sBAAoB;AACpB,QAAM,gBAAgB,wBAAwB,QAAQ,IAAI;AAE1D,MAAI,kBAAkB,QAAQ;AAM5B,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,mBAAmB;AACvD,UAAM,WAAW;AASjB,QAAI,0BAA0B,GAAG;AAC/B,YAAM,EAAE,cAAc,IAAI,MAAM,OAAO,yBAAyB;AAChE,YAAM,cAAc;AAAA,IACtB;AAEA,UAAM,qBAAqB,MAAM,aAAa,aAAa;AAC3D,QAAI,CAAC,oBAAoB;AACvB,cAAQ,MAAM,gaAAuE;AACrF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gFAAsE;AACpF,cAAQ,MAAM,iFAAuE;AACrF,cAAQ,MAAM,gaAAuE;AACrF,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AAIA,QAAM,EAAE,IAAI,IAAI,MAAM,OAAO,cAAc;AAC3C,QAAM,OAAO,MAAM,IAAI,QAAQ,IAAI;AAGnC,QAAM,gBAAgB;AACtB,UAAQ,KAAK,QAAQ,CAAC;AACxB;AAEA,KAAK,EAAE,MAAM,CAAC,UAAmB;AAC/B,MAAI,iBAAiB,OAAO;AAC1B,YAAQ,MAAM,MAAM,OAAO;AAAA,EAC7B,OAAO;AACL,YAAQ,MAAM,KAAK;AAAA,EACrB;AACA,UAAQ,KAAK,CAAC;AAChB,CAAC;",
   "names": []
 }

package/dist/lib/db/commands.js

@@ -7,6 +7,11 @@ import { ReflectMetadataProvider } from "@mikro-orm/decorators/legacy";
 import { PostgreSqlDriver } from "@mikro-orm/postgresql";
 import { getSslConfig } from "@open-mercato/shared/lib/db/ssl";
 import { quotePostgresIdentifier } from "./identifiers.js";
+import {
+  checkEncryptionMapBackfills,
+  isEncryptionBackfillCheckEnabled,
+  readDeclaredEncryptionMaps
+} from "./encryption-backfill-check.js";
 import {
   collectQueryIndexReindexEntityTypes,
   isMigrationReindexEnabled,
@@ -50,11 +55,19 @@ function getClientUrl() {
 function sortModules(mods) {
   return mods.slice().sort((a, b) => a.id.localeCompare(b.id));
 }
-async function dynamicImportProvider(id) {
-  if (process.platform === "win32" && /^[a-zA-Z]:[\\/]/.test(id)) {
-    id = pathToFileURL(id).href;
+function toImportableModuleSpecifier(id) {
+  if (id.startsWith("file:") || id.startsWith("data:") || id.startsWith("node:") || id.startsWith("http:") || id.startsWith("https:")) {
+    return id;
   }
-  return import(id);
+  const isWindowsAbsolute = /^[a-zA-Z]:[\\/]/.test(id);
+  const isFilesystemRelative = id.startsWith("./") || id.startsWith("../") || id.startsWith(".\\") || id.startsWith("..\\") || /(^|[\\/])node_modules([\\/]|$)/.test(id);
+  if (path.isAbsolute(id) || isWindowsAbsolute || isFilesystemRelative) {
+    return pathToFileURL(path.resolve(id)).href;
+  }
+  return id;
+}
+async function dynamicImportProvider(id) {
+  return import(toImportableModuleSpecifier(id));
 }
 function sanitizeModuleId(modId) {
   return modId.replace(/[^a-z0-9_]/gi, "_");
@@ -168,6 +181,69 @@ function getMigrationsPath(entry, resolver) {
   }
   return path.join(roots.pkgBase, "migrations").replace(/\\/g, "/");
 }
+async function loadModuleEncryptionMaps(entry, resolver) {
+  const roots = resolver.getModulePaths(entry);
+  const appFile = path.join(roots.appBase, "encryption.ts");
+  const pkgFile = path.join(roots.pkgBase, "encryption.ts");
+  try {
+    if (fs.existsSync(appFile)) return readDeclaredEncryptionMaps(entry.id, await importWithTypeScriptFile(appFile));
+    if (entry.from === "@app" || resolver.isMonorepo()) {
+      return fs.existsSync(pkgFile) ? readDeclaredEncryptionMaps(entry.id, await importWithTypeScriptFile(pkgFile)) : [];
+    }
+    return readDeclaredEncryptionMaps(entry.id, await import(`${resolver.getModuleImportBase(entry).pkgBase}/encryption`));
+  } catch {
+    return [];
+  }
+}
+function readModuleMigrationSources(modules, resolver) {
+  const sources = [];
+  for (const entry of modules) {
+    const migrationsPath = getMigrationsPath(entry, resolver);
+    if (!fs.existsSync(migrationsPath)) continue;
+    for (const file of fs.readdirSync(migrationsPath)) {
+      if (!/^Migration.*\.(ts|js)$/.test(file) || file.endsWith(".d.ts")) continue;
+      sources.push(fs.readFileSync(path.join(migrationsPath, file), "utf8"));
+    }
+  }
+  return sources;
+}
+async function queryEncryptionMapRows() {
+  const { Client } = await import("pg");
+  const client = new Client({ connectionString: getClientUrl(), ssl: getSslConfig(), connectionTimeoutMillis: 5e3 });
+  await client.connect();
+  try {
+    const table = await client.query(`select to_regclass('encryption_maps') is not null as "exists"`);
+    if (!table.rows[0]?.exists) return null;
+    const result = await client.query(
+      `select "tenant_id", "organization_id", "entity_id", "fields_json", "is_active" from "encryption_maps" where "deleted_at" is null`
+    );
+    return result.rows.map((row) => ({
+      tenantId: row.tenant_id ?? null,
+      organizationId: row.organization_id ?? null,
+      entityId: String(row.entity_id),
+      fieldsJson: row.fields_json,
+      isActive: row.is_active === true
+    }));
+  } finally {
+    try {
+      await client.end();
+    } catch {
+    }
+  }
+}
+async function warnAboutMissingEncryptionMapBackfills(modules, resolver) {
+  if (!isEncryptionBackfillCheckEnabled()) return;
+  await checkEncryptionMapBackfills({
+    loadDeclaredMaps: async () => {
+      const declared = [];
+      for (const entry of modules) declared.push(...await loadModuleEncryptionMaps(entry, resolver));
+      return declared;
+    },
+    loadMigrationSources: () => readModuleMigrationSources(modules, resolver),
+    queryEncryptionMaps: queryEncryptionMapRows,
+    warn: (message) => console.warn(message)
+  });
+}
 async function dbGenerate(resolver, options = {}) {
   const modules = resolver.loadEnabledModules();
   const ordered = sortModules(modules);
@@ -256,6 +332,7 @@ async function dbGenerate(resolver, options = {}) {
     }
   }
   console.log(results.join("\n"));
+  await warnAboutMissingEncryptionMapBackfills(ordered, resolver);
 }
 async function dbMigrate(resolver, options = {}) {
   const modules = resolver.loadEnabledModules();
@@ -490,6 +567,8 @@ export {
   resolveGeneratedMigrationPath,
   sanitizeModuleId,
   shouldCreateInitialModuleMigration,
-  validateTableName
+  toImportableModuleSpecifier,
+  validateTableName,
+  warnAboutMissingEncryptionMapBackfills
 };
 //# sourceMappingURL=commands.js.map