@open-mercato/core 0.10.1-develop.7833.1.d6cbf0e3ab → 0.10.1-develop.7841.1.af87ac614d

package/src/modules/customers/lib/dictionaryDefaults.ts

@@ -0,0 +1,137 @@
+type DictionaryDefault = {
+  value: string
+  label: string
+  color?: string
+  icon?: string
+}
+
+export const DEAL_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'open', label: 'Open', color: '#2563eb', icon: 'lucide:circle' },
+  { value: 'closed', label: 'Closed', color: '#6b7280', icon: 'lucide:check-circle' },
+  { value: 'win', label: 'Win', color: '#22c55e', icon: 'lucide:trophy' },
+  { value: 'lost', label: 'Lost', color: '#ef4444', icon: 'lucide:flag' },
+  { value: 'in_progress', label: 'In progress', color: '#f59e0b', icon: 'lucide:activity' },
+]
+
+export const PIPELINE_STAGE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'opportunity', label: 'Opportunity', color: '#38bdf8', icon: 'lucide:target' },
+  { value: 'marketing_qualified_lead', label: 'Marketing Qualified Lead', color: '#a855f7', icon: 'lucide:sparkles' },
+  { value: 'sales_qualified_lead', label: 'Sales Qualified Lead', color: '#f97316', icon: 'lucide:users' },
+  { value: 'offering', label: 'Offering', color: '#22c55e', icon: 'lucide:package' },
+  { value: 'negotiations', label: 'Negotiations', color: '#facc15', icon: 'lucide:handshake' },
+  { value: 'win', label: 'Win', color: '#16a34a', icon: 'lucide:award' },
+  { value: 'lost', label: 'Lost', color: '#ef4444', icon: 'lucide:flag' },
+  { value: 'stalled', label: 'Stalled', color: '#6b7280', icon: 'lucide:alert-circle' },
+]
+
+export const ENTITY_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'active', label: 'Active', color: '#22c55e', icon: 'lucide:user-check' },
+  { value: 'inactive', label: 'Inactive', color: '#94a3b8', icon: 'lucide:pause-circle' },
+  { value: 'pending', label: 'Pending', color: '#f59e0b', icon: 'lucide:clock' },
+  { value: 'archived', label: 'Archived', color: '#64748b', icon: 'lucide:archive' },
+]
+
+export const ENTITY_LIFECYCLE_STAGE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'lead', label: 'Lead', color: '#3b82f6', icon: 'lucide:sparkles' },
+  { value: 'prospect', label: 'Prospect', color: '#8b5cf6', icon: 'lucide:eye' },
+  { value: 'customer', label: 'Customer', color: '#22c55e', icon: 'lucide:handshake' },
+  { value: 'subscriber', label: 'Subscriber', color: '#10b981', icon: 'lucide:bell' },
+  { value: 'churned', label: 'Churned', color: '#ef4444', icon: 'lucide:user-x' },
+  { value: 'other', label: 'Other', color: '#94a3b8', icon: 'lucide:circle' },
+]
+
+export const ENTITY_SOURCE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'linkedin', label: 'LinkedIn', color: '#0a66c2', icon: 'lucide:linkedin' },
+  { value: 'email', label: 'Email', color: '#3b82f6', icon: 'lucide:mail' },
+  { value: 'web_form', label: 'Web form', color: '#22c55e', icon: 'lucide:globe' },
+  { value: 'referral', label: 'Referral', color: '#8b5cf6', icon: 'lucide:users' },
+  { value: 'customer_referral', label: 'Customer referral', color: '#22c55e', icon: 'lucide:thumbs-up' },
+  { value: 'partner_referral', label: 'Partner referral', color: '#3b82f6', icon: 'lucide:handshake' },
+  { value: 'event', label: 'Conference / Event', color: '#f59e0b', icon: 'lucide:calendar' },
+  { value: 'cold_outreach', label: 'Cold outreach', color: '#94a3b8', icon: 'lucide:phone' },
+  { value: 'facebook', label: 'Facebook', color: '#1877f2', icon: 'lucide:facebook' },
+  { value: 'typeform', label: 'Typeform', color: '#262627', icon: 'lucide:file-text' },
+  { value: 'other', label: 'Other', color: '#64748b', icon: 'lucide:circle' },
+]
+
+export const ADDRESS_TYPE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'office', label: 'Office', color: '#3b82f6', icon: 'lucide:building' },
+  { value: 'work', label: 'Work', color: '#6366f1', icon: 'lucide:briefcase' },
+  { value: 'billing', label: 'Billing', color: '#f97316', icon: 'lucide:wallet' },
+  { value: 'shipping', label: 'Shipping', color: '#22c55e', icon: 'lucide:truck' },
+  { value: 'home', label: 'Home', color: '#10b981', icon: 'lucide:map-pin' },
+]
+
+export const ACTIVITY_TYPE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'call', label: 'Call', color: '#2563eb', icon: 'lucide:phone-call' },
+  { value: 'email', label: 'Email', color: '#16a34a', icon: 'lucide:mail' },
+  { value: 'event', label: 'Event', color: '#6366f1', icon: 'lucide:calendar' },
+  { value: 'meeting', label: 'Meeting', color: '#f59e0b', icon: 'lucide:users' },
+  { value: 'note', label: 'Note', color: '#a855f7', icon: 'lucide:notebook' },
+  { value: 'task', label: 'Task', color: '#ef4444', icon: 'lucide:check-square' },
+]
+
+export const INTERACTION_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'planned', label: 'Planned', color: '#2563eb', icon: 'lucide:circle' },
+  { value: 'in_progress', label: 'In progress', color: '#f59e0b', icon: 'lucide:activity' },
+  { value: 'waiting', label: 'Waiting / blocked', color: '#a855f7', icon: 'lucide:pause-circle' },
+  { value: 'done', label: 'Done', color: '#22c55e', icon: 'lucide:check-circle' },
+  { value: 'canceled', label: 'Canceled', color: '#6b7280', icon: 'lucide:x-circle' },
+]
+
+export const JOB_TITLE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'Director of Operations', label: 'Director of Operations', color: '#f97316', icon: 'lucide:settings' },
+  { value: 'VP of Partnerships', label: 'VP of Partnerships', color: '#6366f1', icon: 'lucide:users' },
+  { value: 'Founder & Principal', label: 'Founder & Principal', color: '#ec4899', icon: 'lucide:star' },
+  { value: 'Senior Project Manager', label: 'Senior Project Manager', color: '#0ea5e9', icon: 'lucide:clipboard-list' },
+  { value: 'Chief Revenue Officer', label: 'Chief Revenue Officer', color: '#8b5cf6', icon: 'lucide:bar-chart-3' },
+  { value: 'Director of Retail Partnerships', label: 'Director of Retail Partnerships', color: '#f59e0b', icon: 'lucide:shopping-bag' },
+]
+
+export const INDUSTRY_DEFAULTS: DictionaryDefault[] = [
+  { value: 'Renewable Energy', label: 'Renewable Energy' },
+  { value: 'Software', label: 'Software' },
+  { value: 'Interior Design', label: 'Interior Design' },
+  { value: 'SaaS', label: 'SaaS' },
+  { value: 'E-commerce', label: 'E-commerce' },
+  { value: 'Healthcare', label: 'Healthcare' },
+  { value: 'Manufacturing', label: 'Manufacturing' },
+  { value: 'Logistics', label: 'Logistics' },
+  { value: 'Financial Services', label: 'Financial Services' },
+  { value: 'Retail', label: 'Retail' },
+  { value: 'Hospitality', label: 'Hospitality' },
+  { value: 'Energy', label: 'Energy' },
+  { value: 'Media', label: 'Media' },
+]
+
+export const TEMPERATURE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'hot', label: 'Hot', color: '#ef4444', icon: 'lucide:flame' },
+  { value: 'high', label: 'High', color: '#f59e0b', icon: 'lucide:trending-up' },
+  { value: 'medium', label: 'Medium', color: '#8b5cf6', icon: 'lucide:sparkles' },
+  { value: 'low', label: 'Low', color: '#64748b', icon: 'lucide:clock' },
+  { value: 'cold', label: 'Cold', color: '#94a3b8', icon: 'lucide:snowflake' },
+]
+
+export const PERSON_COMPANY_ROLE_DEFAULTS = [
+  { value: 'decision_maker', label: 'Decision maker', color: '#f59e0b', icon: 'lucide:crown' },
+  { value: 'influencer', label: 'Influencer', color: '#8b5cf6', icon: 'lucide:sparkles' },
+  { value: 'budget_holder', label: 'Budget holder', color: '#3b82f6', icon: 'lucide:wallet' },
+  { value: 'technical_evaluator', label: 'Technical evaluator', color: '#22c55e', icon: 'lucide:wrench' },
+  { value: 'primary_contact', label: 'Primary contact', color: '#0ea5e9', icon: 'lucide:star' },
+  { value: 'end_user', label: 'End user', color: '#64748b', icon: 'lucide:user' },
+]
+
+export const CUSTOMER_DICTIONARY_DEFAULTS: Record<string, readonly DictionaryDefault[]> = {
+  status: ENTITY_STATUS_DEFAULTS,
+  source: ENTITY_SOURCE_DEFAULTS,
+  lifecycle_stage: ENTITY_LIFECYCLE_STAGE_DEFAULTS,
+  address_type: ADDRESS_TYPE_DEFAULTS,
+  activity_type: ACTIVITY_TYPE_DEFAULTS,
+  interaction_status: INTERACTION_STATUS_DEFAULTS,
+  job_title: JOB_TITLE_DEFAULTS,
+  deal_status: DEAL_STATUS_DEFAULTS,
+  pipeline_stage: PIPELINE_STAGE_DEFAULTS,
+  industry: INDUSTRY_DEFAULTS,
+  temperature: TEMPERATURE_DEFAULTS,
+  person_company_role: PERSON_COMPANY_ROLE_DEFAULTS,
+}

package/src/modules/customers/lib/dictionaryLabels.ts

@@ -0,0 +1,73 @@
+import type { AwilixContainer } from 'awilix'
+import type { Locale } from '@open-mercato/shared/lib/i18n/config'
+import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
+import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { getTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { CUSTOMER_DICTIONARY_DEFAULTS } from './dictionaryDefaults'
+
+const logger = createLogger('customers').child({ component: 'dictionary-labels' })
+
+type DictionaryLabelEntry = {
+  id: string
+  value: string
+  label: string
+  organizationId: string
+}
+
+export function customerDictionaryLabelKey(kind: string, value: string): string {
+  const token = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_|_$/g, '')
+  return `customers.dictionaries.defaults.${kind}.${token}`
+}
+
+export async function localizeCustomerDictionaryEntries<T extends DictionaryLabelEntry>(
+  entries: T[],
+  options: { kind: string; locale: string; tenantId: string; container: AwilixContainer },
+): Promise<T[]> {
+  if (!entries.length) return []
+  const dictionaryLocale = options.locale.toLowerCase().split('-')[0] as Locale
+  const translate = createFallbackTranslator(await loadDictionary(dictionaryLocale))
+  const defaults = Object.prototype.hasOwnProperty.call(CUSTOMER_DICTIONARY_DEFAULTS, options.kind)
+    ? CUSTOMER_DICTIONARY_DEFAULTS[options.kind]
+    : []
+  const localized = entries.map((entry) => {
+    const seeded = defaults.find((candidate) => candidate.value === entry.value && candidate.label === entry.label)
+    const renewalQuarter = options.kind === 'renewal_quarter' ? /^(\d{4})_q([1-4])$/.exec(entry.value) : null
+    const label = renewalQuarter && entry.label === `Q${renewalQuarter[2]} ${renewalQuarter[1]}`
+      ? translate('customers.dictionaries.defaults.renewal_quarter.label', entry.label, {
+          year: renewalQuarter[1], quarter: renewalQuarter[2],
+        })
+      : seeded ? translate(customerDictionaryLabelKey(options.kind, seeded.value), entry.label) : entry.label
+    return {
+      ...entry,
+      label,
+    }
+  })
+  const { overlay } = getTranslationOverlayPlugin()
+  if (!overlay) return localized
+
+  const organizationIds = new Set(localized.map((entry) => entry.organizationId))
+  const labelsById = new Map<string, string>()
+  for (const organizationId of organizationIds) {
+    const items = localized.filter((entry) => entry.organizationId === organizationId)
+    try {
+      const translated = await overlay(items.map(({ id, label }) => ({ id, label })), {
+        entityType: 'customers:customer_dictionary_entry',
+        locale: options.locale,
+        tenantId: options.tenantId,
+        organizationId,
+        container: options.container,
+      })
+      for (const item of translated) {
+        if (typeof item.id === 'string' && typeof item.label === 'string' && item.label.trim()) {
+          labelsById.set(item.id, item.label)
+        }
+      }
+    } catch (error) {
+      getTelemetryRuntime()?.reportError(error, { module: 'customers', code: 'customers.dictionary_translation_failed' })
+      logger.warn('Translation overlay failed', { error })
+    }
+  }
+  return localized.map((entry) => ({ ...entry, label: labelsById.get(entry.id) ?? entry.label }))
+}

package/src/modules/customers/lib/interactionCompatibility.ts

@@ -63,6 +63,7 @@ export function mapInteractionRecordToTodoSummary(interaction: InteractionRecord
     todoId: interaction.id,
     todoSource: CUSTOMER_INTERACTION_TASK_SOURCE,
     createdAt: interaction.createdAt,
+    updatedAt: interaction.updatedAt,
     title: interaction.title ?? null,
     isDone: interaction.status === 'done',
     status: interaction.status,

package/src/modules/customers/translations.ts

@@ -0,0 +1,5 @@
+export const translatableFields: Record<string, string[]> = {
+  'customers:customer_dictionary_entry': ['label'],
+}
+
+export default translatableFields

package/src/modules/eudr/index.ts

@@ -7,6 +7,19 @@ export const metadata: ModuleInfo = {
   description: 'EU Deforestation Regulation compliance: product commodity mappings, supplier origin evidence, due diligence statements.',
   author: 'Open Mercato Team',
   license: 'MIT',
+  /**
+   * `catalog` is a HARD dependency, and saying so is the fix.
+   *
+   * `data/enrichers.ts` reads `E.catalog.catalog_product` at module scope, so with `catalog` disabled
+   * `E.catalog` is undefined and the read throws while the enricher registry is being imported — which takes
+   * `/api/auth/login` with it. An installation shaped as a CRM rather than a shop could not reach its own login
+   * screen, and the error named a property rather than a module.
+   *
+   * Declared rather than defended with optional chaining. This module exists to map PRODUCTS to deforestation
+   * compliance evidence, so without a catalogue it has nothing to work on at all — the honest answer is that it
+   * cannot be enabled, which the generator now says before anybody starts the app rather than after.
+   */
+  requires: ['catalog'],
   ejectable: true,
 }
 

package/src/modules/sales/commands/documents.ts

@@ -646,8 +646,9 @@ const documentUpdateFieldsSchema = z
     currencyCode: currencyCodeSchema.optional(),
     // Order-only columns — SalesQuote declares none of them. Declared here
     // because the create schema declares them and a caller reusing its create
-    // payload on an update otherwise lost them silently; `applyDocumentUpdate`
-    // rejects each with a 400 on a quote rather than dropping it.
+    // payload on an update otherwise lost them silently. `applyDocumentUpdate`
+    // rejects them on a quote, except `totalsMode`, which is ignored to preserve
+    // quote-create compatibility without enabling external quote amounts.
     exchangeRate: z.union([z.null(), exchangeRateSchema]).optional(),
     paymentStatusEntryId: z.string().uuid().nullable().optional(),
     fulfillmentStatusEntryId: z.string().uuid().nullable().optional(),
@@ -5894,7 +5895,6 @@ const updateQuoteCommand: CommandHandler<
   },
   async execute(rawInput, ctx) {
     const parsed = documentUpdateSchema.parse(rawInput ?? {});
-    await assertAmountsModeUnsupportedOnQuote([parsed]);
     documentEditSchema.parse(rawInput ?? {});
     const em = (ctx.container.resolve("em") as EntityManager).fork();
     let quote!: SalesQuote;

package/src/modules/sales/components/documents/ItemsSection.tsx

@@ -7,7 +7,8 @@ import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimi
 import { deleteCrud } from "@open-mercato/ui/backend/utils/crud";
 import { normalizeCrudServerError } from "@open-mercato/ui/backend/utils/serverErrors";
 import { ErrorMessage, LoadingMessage, TabEmptyState } from "@open-mercato/ui/backend/detail";
-import { Button } from "@open-mercato/ui/primitives/button";
+import { IconButton } from "@open-mercato/ui/primitives/icon-button";
+import { SimpleTooltip } from "@open-mercato/ui/primitives/tooltip";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { Pencil, Trash2 } from "lucide-react";
 import {
@@ -41,6 +42,53 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('sales')
 
+function DisabledActionHint({
+  label,
+  reason,
+  children,
+}: {
+  label: string
+  reason?: string
+  children: React.ReactNode
+}) {
+  const [open, setOpen] = React.useState(false)
+  const touchOpenRef = React.useRef(false)
+  if (!reason) return <>{children}</>
+  return (
+    <SimpleTooltip
+      content={reason}
+      open={open}
+      onOpenChange={(nextOpen) => {
+        if (nextOpen || !touchOpenRef.current) setOpen(nextOpen)
+      }}
+    >
+      <span
+        className="inline-flex rounded-md focus-visible:outline-none focus-visible:shadow-focus"
+        tabIndex={0}
+        aria-label={`${label}: ${reason}`}
+        onClick={(event) => event.stopPropagation()}
+        onPointerDown={(event) => {
+          if (event.pointerType !== 'touch') return
+          touchOpenRef.current = true
+          setOpen(true)
+          event.currentTarget.focus()
+        }}
+        onBlur={() => {
+          touchOpenRef.current = false
+          setOpen(false)
+        }}
+        onKeyDown={(event) => {
+          if (event.key !== 'Escape') return
+          touchOpenRef.current = false
+          setOpen(false)
+        }}
+      >
+        {children}
+      </span>
+    </SimpleTooltip>
+  )
+}
+
 type ResolvedUnitPriceReference = {
   grossPerReference: number;
   referenceUnitCode: string;
@@ -932,11 +980,13 @@ export function SalesDocumentItemsSection({
                             {discount.amount !== null ? (
                               <span className="font-mono text-sm">
                                 {t(
-                                  "sales.documents.items.table.discountAmount",
-                                  "−{{value}}",
+                                  discount.amount < 0
+                                    ? "sales.documents.items.table.markupAmount"
+                                    : "sales.documents.items.table.discountAmount",
+                                  discount.amount < 0 ? "+{{value}}" : "−{{value}}",
                                   {
                                     value: formatMoney(
-                                      discount.amount,
+                                      Math.abs(discount.amount),
                                       item.currencyCode ??
                                         currencyCode ??
                                         undefined,
@@ -1005,30 +1055,39 @@ export function SalesDocumentItemsSection({
                     })}
                     <td className="px-3 py-3">
                       <div className="flex items-center gap-2 justify-end">
-                        <Button
-                          size="icon"
-                          variant="ghost"
-                          className="h-8 w-8"
-                          aria-label={t('ui.actions.edit', 'Edit')}
-                          disabled={amountsReadOnly}
-                          onClick={(event) => {
-                            event.stopPropagation();
-                            handleEdit(item);
-                          }}
+                        <DisabledActionHint
+                          label={t('ui.actions.edit', 'Edit')}
+                          reason={amountsReadOnly
+                            ? t('sales.documents.amountsExternalHint', 'Totals on this document come from an external system and are stored as supplied.')
+                            : undefined}
                         >
-                          <Pencil className="h-4 w-4" />
-                        </Button>
-                        <span
-                          title={amountsReadOnly
+                          <IconButton
+                            type="button"
+                            size="default"
+                            variant="ghost"
+                            aria-label={t('ui.actions.edit', 'Edit')}
+                            disabled={amountsReadOnly}
+                            onClick={(event) => {
+                              event.stopPropagation();
+                              handleEdit(item);
+                            }}
+                          >
+                            <Pencil className="h-4 w-4" />
+                          </IconButton>
+                        </DisabledActionHint>
+                        <DisabledActionHint
+                          label={t('ui.actions.delete', 'Delete')}
+                          reason={amountsReadOnly
                             ? t('sales.documents.amountsExternalHint', 'Totals on this document come from an external system and are stored as supplied.')
                             : kind === 'order' && items.length === 1
                               ? t('sales.documents.items.errorDeleteLast', 'An order must contain at least one line item.')
                               : undefined}
                         >
-                          <Button
-                            size="icon"
+                          <IconButton
+                            type="button"
+                            size="default"
                             variant="ghost"
-                            className="h-8 w-8 text-destructive"
+                            className="text-destructive"
                             aria-label={t('ui.actions.delete', 'Delete')}
                             disabled={amountsReadOnly || (kind === 'order' && items.length === 1)}
                             onClick={(event) => {
@@ -1037,8 +1096,8 @@ export function SalesDocumentItemsSection({
                             }}
                           >
                             <Trash2 className="h-4 w-4" />
-                          </Button>
-                        </span>
+                          </IconButton>
+                        </DisabledActionHint>
                       </div>
                     </td>
                   </tr>

package/src/modules/sales/components/documents/lineItemUtils.ts

@@ -73,10 +73,10 @@ export function resolveLineDiscountDisplay(
 ): LineDiscountDisplay | null {
   const amount = normalizeNumber(line.discountAmount, 0)
   const percent = normalizeNumber(line.discountPercent, 0)
-  if (amount > 0) {
+  if (amount !== 0) {
     return {
       amount,
-      percent: percentAccountsForAmount(line, percent, amount) ? percent : null,
+      percent: amount > 0 && percentAccountsForAmount(line, percent, amount) ? percent : null,
     }
   }
   if (percent > 0) return { amount: null, percent }

package/src/modules/sales/i18n/de.json

@@ -1091,6 +1091,7 @@
   "sales.documents.items.table.discountAmount": "−{{value}}",
   "sales.documents.items.table.discountPercent": "{{value}} %",
   "sales.documents.items.table.gross": "brutto",
+  "sales.documents.items.table.markupAmount": "+{{value}}",
   "sales.documents.items.table.net": "netto",
   "sales.documents.items.table.product": "Produkt",
   "sales.documents.items.table.quantity": "Menge",

package/src/modules/sales/i18n/en.json

@@ -1091,6 +1091,7 @@
   "sales.documents.items.table.discountAmount": "−{{value}}",
   "sales.documents.items.table.discountPercent": "{{value}}%",
   "sales.documents.items.table.gross": "gross",
+  "sales.documents.items.table.markupAmount": "+{{value}}",
   "sales.documents.items.table.net": "net",
   "sales.documents.items.table.product": "Product",
   "sales.documents.items.table.quantity": "Qty",

package/src/modules/sales/i18n/es.json

@@ -1091,6 +1091,7 @@
   "sales.documents.items.table.discountAmount": "−{{value}}",
   "sales.documents.items.table.discountPercent": "{{value}} %",
   "sales.documents.items.table.gross": "bruto",
+  "sales.documents.items.table.markupAmount": "+{{value}}",
   "sales.documents.items.table.net": "neto",
   "sales.documents.items.table.product": "Producto",
   "sales.documents.items.table.quantity": "Cant.",

package/src/modules/sales/i18n/ko.json

@@ -1091,6 +1091,7 @@
   "sales.documents.items.table.discountAmount": "−{{value}}",
   "sales.documents.items.table.discountPercent": "{{value}}%",
   "sales.documents.items.table.gross": "세금 포함",
+  "sales.documents.items.table.markupAmount": "+{{value}}",
   "sales.documents.items.table.net": "세금 제외",
   "sales.documents.items.table.product": "상품",
   "sales.documents.items.table.quantity": "수량",

package/src/modules/sales/i18n/pl.json

@@ -1091,6 +1091,7 @@
   "sales.documents.items.table.discountAmount": "−{{value}}",
   "sales.documents.items.table.discountPercent": "{{value}}%",
   "sales.documents.items.table.gross": "brutto",
+  "sales.documents.items.table.markupAmount": "+{{value}}",
   "sales.documents.items.table.net": "netto",
   "sales.documents.items.table.product": "Produkt",
   "sales.documents.items.table.quantity": "Ilość",

package/src/modules/staff/api/timesheets/access-requests/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -74,7 +75,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   if (!requesterUserId) {
     throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
   }
-  if (!auth.orgId) {
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  if (!scope.tenantId || !scope.selectedId || scope.selectionRejected === true) {
     throw new CrudHttpError(400, {
       error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),
     })
@@ -82,8 +84,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   return {
     container,
     em: (container.resolve('em') as EntityManager).fork(),
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
     requesterUserId,
     requesterEmail: typeof auth.email === 'string' && auth.email.trim().length > 0 ? auth.email : null,
     translate,
@@ -155,17 +157,14 @@ async function resolveRequesterName(context: AccessRequestContext): Promise<stri
 async function POST(req: Request) {
   try {
     const context = await resolveAccessRequestContext(req)
-    // The grant list the interceptors and the mutation-guard registry gate on
-    // comes from the module's single RBAC authority, so it is always an array:
-    // the nullable read it replaces could not say whether an empty answer meant
-    // "no grants" or "could not ask". Authorization itself stays with the
-    // declarative `requireFeatures` guard in `metadata`.
-    const grantedFeatures = (
-      await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
-        tenantId: context.tenantId,
-        organizationId: context.organizationId,
-      })
-    ).grantedFeatures
+    const featureAccess = await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+    })
+    if (!featureAccess.allowed) {
+      throw new CrudHttpError(403, { error: context.translate('staff.errors.forbidden', 'Forbidden') })
+    }
+    const grantedFeatures = featureAccess.grantedFeatures
 
     const interceptors = await runTimesheetInterceptors({
       request: req,

package/src/modules/staff/api/timesheets/time-projects/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { staffTimeProjectCrudEvents } from '../../../lib/crud'
+import { PROJECT_SCOPE_TENANT_HEADER, PROJECT_SCOPE_ORGANIZATION_HEADER, type ResolvedProjectAccessScope } from '../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -500,24 +501,28 @@ async function buildAccessDenialResponse(): Promise<Response> {
  * `reason` discriminator carries only "you are not a member of this project",
  * never the project or customer it is refusing to describe.
  */
-async function resolveProjectAccessDenial(req: Request): Promise<Response | null> {
+async function resolveProjectAccessDenial(req: Request): Promise<{ denial: Response | null; scope: ResolvedProjectAccessScope | null }> {
+  const unresolved = { denial: null, scope: null }
   const url = new URL(req.url)
   const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')
-  if (!isIdsParamProvided(rawIds)) return null
+  if (!isIdsParamProvided(rawIds)) return unresolved
   const requestedIds = parseIdsParam(rawIds)
   // Malformed ids match nothing on their own; the factory answers an empty list.
-  if (requestedIds.length === 0) return null
+  if (requestedIds.length === 0) return unresolved
 
   try {
     const container = await createRequestContainer()
     const auth = await getAuthFromRequest(req)
     // Unauthenticated and unscoped requests are the factory's to reject.
-    if (!auth) return null
+    if (!auth) return unresolved
     const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
     const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null
     const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth) ?? null
-    if (!tenantId || !organizationId) return null
+    if (!tenantId || !organizationId) return unresolved
 
+    const scope = orgScope?.tenantId && orgScope.selectedId && orgScope.selectionRejected !== true
+      ? { tenantId: orgScope.tenantId, organizationId: orgScope.selectedId }
+      : null
     const access = await resolveRequestProjectAccess(req, () =>
       loadProjectAccess(
         container,
@@ -526,20 +531,24 @@ async function resolveProjectAccessDenial(req: Request): Promise<Response | null
         organizationId,
       ),
     )
-    if (access.canManageAll) return null
-    if (requestedIds.some((id) => access.projectIds.includes(id))) return null
-    return await buildAccessDenialResponse()
+    if (access.canManageAll) return { denial: null, scope }
+    if (requestedIds.some((id) => access.projectIds.includes(id))) return { denial: null, scope }
+    return { denial: await buildAccessDenialResponse(), scope }
   } catch (err) {
     // Fail closed: an access decision that could not be made is a denial.
     logger.error('staff.timesheets.time-projects denial probe failed', { err })
-    return await buildAccessDenialResponse()
+    return { denial: await buildAccessDenialResponse(), scope: null }
   }
 }
 
 export async function GET(req: Request): Promise<Response> {
-  const denial = await resolveProjectAccessDenial(req)
-  if (denial) return denial
-  return crud.GET(req)
+  const { denial, scope } = await resolveProjectAccessDenial(req)
+  const response = denial ?? await crud.GET(req)
+  if (scope) {
+    response.headers.set(PROJECT_SCOPE_TENANT_HEADER, scope.tenantId)
+    response.headers.set(PROJECT_SCOPE_ORGANIZATION_HEADER, scope.organizationId)
+  }
+  return response
 }
 
 export const POST = crud.POST
@@ -611,7 +620,7 @@ export const openApi = {
       ? {
           GET: {
             ...baseOpenApi.methods.GET,
-            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
+            description: `${baseOpenApi.methods.GET.description ?? ''} Project-specific reads include optional x-om-project-scope-tenant-id and x-om-project-scope-organization-id response headers when the server resolves a scope. These identify the request scope for client hydration; a missing header provides no scope identity. Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
             responses: [
               ...(baseOpenApi.methods.GET.responses ?? []),
               {