@open-mercato/core 0.10.1-develop.7836.1.0ef0f453c6 → 0.10.1-develop.7841.1.af87ac614d

package/dist/modules/staff/lib/time-tracking-ui/NoProjectAccess.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/NoProjectAccess.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { ArrowLeft, FolderOpen, MessageSquare, ShieldAlert } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { EmptyState } from '@open-mercato/ui/primitives/empty-state'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\nexport const MY_WORK_HREF = '/backend/staff/time-tracking'\nexport const ACCESS_REQUEST_ENDPOINT = '/api/staff/timesheets/access-requests'\nconst ACCESS_REQUEST_CONTEXT_ID = 'staff.time_tracking.access_request'\n\nexport type AccessRequestButtonProps = {\n  /**\n   * Sent with the request so a Team Leader lands on the right project team\n   * drawer. It is never rendered \u2014 screen 17 note 1 forbids confirming that the\n   * project exists to a user who has no right to it.\n   */\n  timeProjectId?: string | null\n  label: string\n  sentLabel: string\n  variant?: 'default' | 'outline'\n}\n\nexport function AccessRequestButton({\n  timeProjectId,\n  label,\n  sentLabel,\n  variant = 'outline',\n}: AccessRequestButtonProps) {\n  const t = useT()\n  const [submitting, setSubmitting] = React.useState(false)\n  const [sent, setSent] = React.useState(false)\n  const { runMutation, retryLastMutation } = useGuardedMutation<Record<string, unknown>>({\n    contextId: ACCESS_REQUEST_CONTEXT_ID,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const requestAccess = React.useCallback(async () => {\n    const payload = timeProjectId ? { timeProjectId } : {}\n    setSubmitting(true)\n    try {\n      await runMutation({\n        operation: () =>\n          apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify(payload),\n          }),\n        context: {\n          formId: ACCESS_REQUEST_CONTEXT_ID,\n          resourceKind: 'staff.timesheets.access_request',\n          retryLastMutation,\n        },\n        mutationPayload: payload,\n      })\n      setSent(true)\n      flash(\n        t(\n          'staff.time_tracking.access.request.success',\n          'Your request has been sent to the Team Leaders.',\n        ),\n        'success',\n      )\n    } catch {\n      flash(\n        t('staff.time_tracking.access.request.error', 'Could not send the access request.'),\n        'error',\n      )\n    } finally {\n      setSubmitting(false)\n    }\n  }, [retryLastMutation, runMutation, t, timeProjectId])\n\n  return (\n    <Button type=\"button\" variant={variant} onClick={requestAccess} disabled={submitting || sent}>\n      <MessageSquare className=\"size-4\" aria-hidden=\"true\" />\n      {sent ? sentLabel : label}\n    </Button>\n  )\n}\n\nexport type NoProjectAccessProps = {\n  timeProjectId?: string | null\n  /** Where the \"Back to My work\" action returns to. */\n  myWorkHref?: string\n}\n\n/**\n * Screen 17 \u2014 a project-scoped route the caller may not open. The copy names\n * neither the customer nor the project (note 1) and covers both \"never had\n * access\" and \"access was revoked\" (note 2); navigation stays untouched because\n * the caller still has other projects (note 3).\n */\nexport function NoProjectAccess({ timeProjectId, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {\n  const t = useT()\n  return (\n    <Page>\n      <PageBody>\n        <EmptyState\n          variant=\"subtle\"\n          size=\"lg\"\n          icon={<ShieldAlert className=\"size-6\" aria-hidden=\"true\" />}\n          title={t('staff.time_tracking.access.denied.title', 'You do not have access to this project')}\n          description={t(\n            'staff.time_tracking.access.denied.description',\n            'Project access is granted one project at a time by a Team Leader. If you had access before, it may have been revoked \u2014 your earlier time entries stay saved.',\n          )}\n          actions={\n            <div className=\"flex flex-wrap items-center justify-center gap-2\">\n              <Button type=\"button\" variant=\"default\" asChild>\n                <a href={myWorkHref}>\n                  <ArrowLeft className=\"size-4\" aria-hidden=\"true\" />\n                  {t('staff.time_tracking.access.denied.back', 'Back to My work')}\n                </a>\n              </Button>\n              <AccessRequestButton\n                timeProjectId={timeProjectId}\n                label={t('staff.time_tracking.access.denied.request', 'Request access')}\n                sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n              />\n            </div>\n          }\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\n/**\n * Screen 2 \u2014 the caller has no project assignments at all. Rendered inside the\n * host page (which keeps its own header), so it stays a bare empty state.\n */\nexport function NoTimeProjectAssignments() {\n  const t = useT()\n  return (\n    <EmptyState\n      variant=\"subtle\"\n      size=\"lg\"\n      icon={<FolderOpen className=\"size-6\" aria-hidden=\"true\" />}\n      title={t('staff.time_tracking.access.empty.title', 'You have no projects assigned yet')}\n      description={t(\n        'staff.time_tracking.access.empty.description',\n        'A Team Leader grants project access. Once you are added to a project it shows up here right away \u2014 no need to log in again.',\n      )}\n      actions={\n        <AccessRequestButton\n          variant=\"default\"\n          label={t('staff.time_tracking.access.empty.request', 'Ask a Team Leader for access')}\n          sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n        />\n      }\n    />\n  )\n}\n\nexport default NoProjectAccess\n"],
-  "mappings": ";AAgFI,SACE,KADF;AA9EJ,YAAY,WAAW;AAEvB,SAAS,WAAW,YAAY,eAAe,mBAAmB;AAClE,SAAS,MAAM,gBAAgB;AAC/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AACnC,SAAS,YAAY;AAEd,MAAM,eAAe;AACrB,MAAM,0BAA0B;AACvC,MAAM,4BAA4B;AAc3B,SAAS,oBAAoB;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AACZ,GAA6B;AAC3B,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAA4C;AAAA,IACrF,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM,UAAU,gBAAgB,EAAE,cAAc,IAAI,CAAC;AACrD,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MACT,eAAe,yBAAyB;AAAA,UACtC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,QAC9B,CAAC;AAAA,QACH,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB;AAAA,MACnB,CAAC;AACD,cAAQ,IAAI;AACZ;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN;AAAA,QACE,EAAE,4CAA4C,oCAAoC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF,GAAG,CAAC,mBAAmB,aAAa,GAAG,aAAa,CAAC;AAErD,SACE,qBAAC,UAAO,MAAK,UAAS,SAAkB,SAAS,eAAe,UAAU,cAAc,MACtF;AAAA,wBAAC,iBAAc,WAAU,UAAS,eAAY,QAAO;AAAA,IACpD,OAAO,YAAY;AAAA,KACtB;AAEJ;AAcO,SAAS,gBAAgB,EAAE,eAAe,aAAa,aAAa,GAAyB;AAClG,QAAM,IAAI,KAAK;AACf,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,eAAY,WAAU,UAAS,eAAY,QAAO;AAAA,MACzD,OAAO,EAAE,2CAA2C,wCAAwC;AAAA,MAC5F,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE,qBAAC,SAAI,WAAU,oDACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAO,MAC7C,+BAAC,OAAE,MAAM,YACP;AAAA,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA,UAChD,EAAE,0CAA0C,iBAAiB;AAAA,WAChE,GACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA,OAAO,EAAE,6CAA6C,gBAAgB;AAAA,YACtE,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,QACxE;AAAA,SACF;AAAA;AAAA,EAEJ,GACF,GACF;AAEJ;AAMO,SAAS,2BAA2B;AACzC,QAAM,IAAI,KAAK;AACf,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,cAAW,WAAU,UAAS,eAAY,QAAO;AAAA,MACxD,OAAO,EAAE,0CAA0C,mCAAmC;AAAA,MACtF,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,OAAO,EAAE,4CAA4C,8BAA8B;AAAA,UACnF,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,MACxE;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,0BAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { ArrowLeft, FolderOpen, MessageSquare, ShieldAlert } from 'lucide-react'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { EmptyState } from '@open-mercato/ui/primitives/empty-state'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCallOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useProjectAccessScope } from './projectAccessScope'\nimport type { ResolvedProjectAccessScope } from './projectAccessScopeHeaders'\n\nexport const MY_WORK_HREF = '/backend/staff/time-tracking'\nexport const ACCESS_REQUEST_ENDPOINT = '/api/staff/timesheets/access-requests'\nconst ACCESS_REQUEST_CONTEXT_ID = 'staff.time_tracking.access_request'\n\nexport type AccessRequestButtonProps = {\n  /**\n   * Sent with the request so a Team Leader lands on the right project team\n   * drawer. It is never rendered \u2014 screen 17 note 1 forbids confirming that the\n   * project exists to a user who has no right to it.\n   */\n  timeProjectId?: string | null\n  resolvedScope?: ResolvedProjectAccessScope | null\n  label: string\n  sentLabel: string\n  variant?: 'default' | 'outline'\n}\n\nexport function AccessRequestButton(props: AccessRequestButtonProps) {\n  const { scopeKey, isCurrentScope } = useProjectAccessScope(props.timeProjectId, props.resolvedScope)\n  return <ScopedAccessRequestButton key={scopeKey} {...props} isCurrentScope={isCurrentScope} />\n}\n\nfunction ScopedAccessRequestButton({\n  timeProjectId,\n  label,\n  sentLabel,\n  variant = 'outline',\n  isCurrentScope,\n}: AccessRequestButtonProps & { isCurrentScope: () => boolean }) {\n  const t = useT()\n  const [submitting, setSubmitting] = React.useState(false)\n  const [sent, setSent] = React.useState(false)\n  const mounted = React.useRef(true)\n  React.useEffect(() => {\n    mounted.current = true\n    return () => { mounted.current = false }\n  }, [])\n  const { runMutation, retryLastMutation } = useGuardedMutation<Record<string, unknown>>({\n    contextId: ACCESS_REQUEST_CONTEXT_ID,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const requestAccess = React.useCallback(async () => {\n    const isCurrent = () => mounted.current && isCurrentScope()\n    if (!isCurrent()) return\n    const payload = timeProjectId ? { timeProjectId } : {}\n    setSubmitting(true)\n    try {\n      await runMutation({\n        operation: () => {\n          if (!isCurrent()) throw new Error('[internal] Access request scope changed')\n          return apiCallOrThrow(ACCESS_REQUEST_ENDPOINT, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify(payload),\n          })\n        },\n        context: {\n          formId: ACCESS_REQUEST_CONTEXT_ID,\n          resourceKind: 'staff.timesheets.access_request',\n          retryLastMutation,\n        },\n        mutationPayload: payload,\n      })\n      if (!isCurrent()) return\n      setSent(true)\n      flash(\n        t(\n          'staff.time_tracking.access.request.success',\n          'Your request has been sent to the Team Leaders.',\n        ),\n        'success',\n      )\n    } catch {\n      if (!isCurrent()) return\n      flash(\n        t('staff.time_tracking.access.request.error', 'Could not send the access request.'),\n        'error',\n      )\n    } finally {\n      if (isCurrent()) setSubmitting(false)\n    }\n  }, [isCurrentScope, retryLastMutation, runMutation, t, timeProjectId])\n\n  return (\n    <Button type=\"button\" variant={variant} onClick={requestAccess} disabled={submitting || sent}>\n      <MessageSquare className=\"size-4\" aria-hidden=\"true\" />\n      {sent ? sentLabel : label}\n    </Button>\n  )\n}\n\nexport type NoProjectAccessProps = {\n  timeProjectId?: string | null\n  resolvedScope?: ResolvedProjectAccessScope | null\n  /** Where the \"Back to My work\" action returns to. */\n  myWorkHref?: string\n}\n\n/**\n * Screen 17 \u2014 a project-scoped route the caller may not open. The copy names\n * neither the customer nor the project (note 1) and covers both \"never had\n * access\" and \"access was revoked\" (note 2); navigation stays untouched because\n * the caller still has other projects (note 3).\n */\nexport function NoProjectAccess({ timeProjectId, resolvedScope, myWorkHref = MY_WORK_HREF }: NoProjectAccessProps) {\n  const t = useT()\n  return (\n    <Page>\n      <PageBody>\n        <EmptyState\n          variant=\"subtle\"\n          size=\"lg\"\n          icon={<ShieldAlert className=\"size-6\" aria-hidden=\"true\" />}\n          title={t('staff.time_tracking.access.denied.title', 'You do not have access to this project')}\n          description={t(\n            'staff.time_tracking.access.denied.description',\n            'Project access is granted one project at a time by a Team Leader. If you had access before, it may have been revoked \u2014 your earlier time entries stay saved.',\n          )}\n          actions={\n            <div className=\"flex flex-wrap items-center justify-center gap-2\">\n              <Button type=\"button\" variant=\"default\" asChild>\n                <a href={myWorkHref}>\n                  <ArrowLeft className=\"size-4\" aria-hidden=\"true\" />\n                  {t('staff.time_tracking.access.denied.back', 'Back to My work')}\n                </a>\n              </Button>\n              <AccessRequestButton\n                timeProjectId={timeProjectId}\n                resolvedScope={resolvedScope}\n                label={t('staff.time_tracking.access.denied.request', 'Request access')}\n                sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n              />\n            </div>\n          }\n        />\n      </PageBody>\n    </Page>\n  )\n}\n\n/**\n * Screen 2 \u2014 the caller has no project assignments at all. Rendered inside the\n * host page (which keeps its own header), so it stays a bare empty state.\n */\nexport function NoTimeProjectAssignments() {\n  const t = useT()\n  return (\n    <EmptyState\n      variant=\"subtle\"\n      size=\"lg\"\n      icon={<FolderOpen className=\"size-6\" aria-hidden=\"true\" />}\n      title={t('staff.time_tracking.access.empty.title', 'You have no projects assigned yet')}\n      description={t(\n        'staff.time_tracking.access.empty.description',\n        'A Team Leader grants project access. Once you are added to a project it shows up here right away \u2014 no need to log in again.',\n      )}\n      actions={\n        <AccessRequestButton\n          variant=\"default\"\n          label={t('staff.time_tracking.access.empty.request', 'Ask a Team Leader for access')}\n          sentLabel={t('staff.time_tracking.access.request.sent', 'Request sent')}\n        />\n      }\n    />\n  )\n}\n\nexport default NoProjectAccess\n"],
+  "mappings": ";AAkCS,cAkEL,YAlEK;AAhCT,YAAY,WAAW;AAEvB,SAAS,WAAW,YAAY,eAAe,mBAAmB;AAClE,SAAS,MAAM,gBAAgB;AAC/B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,aAAa;AACtB,SAAS,sBAAsB;AAC/B,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AAG/B,MAAM,eAAe;AACrB,MAAM,0BAA0B;AACvC,MAAM,4BAA4B;AAe3B,SAAS,oBAAoB,OAAiC;AACnE,QAAM,EAAE,UAAU,eAAe,IAAI,sBAAsB,MAAM,eAAe,MAAM,aAAa;AACnG,SAAO,oBAAC,6BAA0C,GAAG,OAAO,kBAArB,QAAqD;AAC9F;AAEA,SAAS,0BAA0B;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,UAAU;AAAA,EACV;AACF,GAAiE;AAC/D,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AACxD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,KAAK;AAC5C,QAAM,UAAU,MAAM,OAAO,IAAI;AACjC,QAAM,UAAU,MAAM;AACpB,YAAQ,UAAU;AAClB,WAAO,MAAM;AAAE,cAAQ,UAAU;AAAA,IAAM;AAAA,EACzC,GAAG,CAAC,CAAC;AACL,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAA4C;AAAA,IACrF,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,gBAAgB,MAAM,YAAY,YAAY;AAClD,UAAM,YAAY,MAAM,QAAQ,WAAW,eAAe;AAC1D,QAAI,CAAC,UAAU,EAAG;AAClB,UAAM,UAAU,gBAAgB,EAAE,cAAc,IAAI,CAAC;AACrD,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MAAM;AACf,cAAI,CAAC,UAAU,EAAG,OAAM,IAAI,MAAM,yCAAyC;AAC3E,iBAAO,eAAe,yBAAyB;AAAA,YAC7C,QAAQ;AAAA,YACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,YAC9C,MAAM,KAAK,UAAU,OAAO;AAAA,UAC9B,CAAC;AAAA,QACH;AAAA,QACA,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB;AAAA,MACnB,CAAC;AACD,UAAI,CAAC,UAAU,EAAG;AAClB,cAAQ,IAAI;AACZ;AAAA,QACE;AAAA,UACE;AAAA,UACA;AAAA,QACF;AAAA,QACA;AAAA,MACF;AAAA,IACF,QAAQ;AACN,UAAI,CAAC,UAAU,EAAG;AAClB;AAAA,QACE,EAAE,4CAA4C,oCAAoC;AAAA,QAClF;AAAA,MACF;AAAA,IACF,UAAE;AACA,UAAI,UAAU,EAAG,eAAc,KAAK;AAAA,IACtC;AAAA,EACF,GAAG,CAAC,gBAAgB,mBAAmB,aAAa,GAAG,aAAa,CAAC;AAErE,SACE,qBAAC,UAAO,MAAK,UAAS,SAAkB,SAAS,eAAe,UAAU,cAAc,MACtF;AAAA,wBAAC,iBAAc,WAAU,UAAS,eAAY,QAAO;AAAA,IACpD,OAAO,YAAY;AAAA,KACtB;AAEJ;AAeO,SAAS,gBAAgB,EAAE,eAAe,eAAe,aAAa,aAAa,GAAyB;AACjH,QAAM,IAAI,KAAK;AACf,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,eAAY,WAAU,UAAS,eAAY,QAAO;AAAA,MACzD,OAAO,EAAE,2CAA2C,wCAAwC;AAAA,MAC5F,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE,qBAAC,SAAI,WAAU,oDACb;AAAA,4BAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,SAAO,MAC7C,+BAAC,OAAE,MAAM,YACP;AAAA,8BAAC,aAAU,WAAU,UAAS,eAAY,QAAO;AAAA,UAChD,EAAE,0CAA0C,iBAAiB;AAAA,WAChE,GACF;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC;AAAA,YACA;AAAA,YACA,OAAO,EAAE,6CAA6C,gBAAgB;AAAA,YACtE,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,QACxE;AAAA,SACF;AAAA;AAAA,EAEJ,GACF,GACF;AAEJ;AAMO,SAAS,2BAA2B;AACzC,QAAM,IAAI,KAAK;AACf,SACE;AAAA,IAAC;AAAA;AAAA,MACC,SAAQ;AAAA,MACR,MAAK;AAAA,MACL,MAAM,oBAAC,cAAW,WAAU,UAAS,eAAY,QAAO;AAAA,MACxD,OAAO,EAAE,0CAA0C,mCAAmC;AAAA,MACtF,aAAa;AAAA,QACX;AAAA,QACA;AAAA,MACF;AAAA,MACA,SACE;AAAA,QAAC;AAAA;AAAA,UACC,SAAQ;AAAA,UACR,OAAO,EAAE,4CAA4C,8BAA8B;AAAA,UACnF,WAAW,EAAE,2CAA2C,cAAc;AAAA;AAAA,MACxE;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,0BAAQ;",
   "names": []
 }

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScope.js

@@ -0,0 +1,64 @@
+"use client";
+import * as React from "react";
+import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
+import {
+  parseSelectedOrganizationCookie,
+  parseSelectedTenantCookie
+} from "@open-mercato/core/modules/directory/utils/scopeCookies";
+function readProjectAccessScope(timeProjectId) {
+  const cookieHeader = typeof document === "undefined" ? null : document.cookie;
+  return {
+    projectId: timeProjectId ?? null,
+    tenantId: parseSelectedTenantCookie(cookieHeader),
+    organizationId: parseSelectedOrganizationCookie(cookieHeader)
+  };
+}
+function bindProjectAccessScope(bound, current, resolvedScope) {
+  const continues = (boundValue, currentValue, resolvedValue) => boundValue === currentValue || boundValue === null && currentValue === resolvedValue;
+  if (bound.projectId !== current.projectId) return null;
+  if (!continues(bound.tenantId, current.tenantId, resolvedScope?.tenantId)) return null;
+  if (!continues(bound.organizationId, current.organizationId, resolvedScope?.organizationId)) return null;
+  return current;
+}
+function isSameProjectAccessScope(left, right) {
+  return left.projectId === right.projectId && left.tenantId === right.tenantId && left.organizationId === right.organizationId;
+}
+function rebindProjectAccessScope(binding, current) {
+  const continued = bindProjectAccessScope(binding.scope, current, binding.resolvedScope);
+  if (!continued) return { scope: current, generation: binding.generation + 1, resolvedScope: null };
+  if (isSameProjectAccessScope(continued, binding.scope)) return binding;
+  return { ...binding, scope: continued };
+}
+function useProjectAccessScope(timeProjectId, initialResolvedScope) {
+  useOrganizationScopeVersion();
+  const current = readProjectAccessScope(timeProjectId);
+  const [binding, setBinding] = React.useState(() => ({
+    scope: current,
+    generation: 0,
+    resolvedScope: initialResolvedScope ?? null
+  }));
+  const nextBinding = rebindProjectAccessScope(binding, current);
+  if (nextBinding !== binding) setBinding(nextBinding);
+  const boundScope = React.useRef(nextBinding);
+  boundScope.current = nextBinding;
+  const generation = nextBinding.generation;
+  const isCurrentScope = React.useCallback(() => {
+    const active = boundScope.current;
+    return active.generation === generation && bindProjectAccessScope(active.scope, readProjectAccessScope(timeProjectId), active.resolvedScope) !== null;
+  }, [generation, timeProjectId]);
+  const resolveScope = React.useCallback((resolvedScope) => {
+    setBinding((previous) => {
+      if (previous.generation !== generation) return previous;
+      if (!bindProjectAccessScope(previous.scope, readProjectAccessScope(timeProjectId), resolvedScope)) return previous;
+      const changed = previous.resolvedScope !== null && resolvedScope !== null && (previous.resolvedScope.tenantId !== resolvedScope.tenantId || previous.resolvedScope.organizationId !== resolvedScope.organizationId);
+      return { ...previous, resolvedScope, generation: previous.generation + (changed ? 1 : 0) };
+    });
+  }, [generation, timeProjectId]);
+  return { scopeKey: String(generation), isCurrentScope, resolvedScope: nextBinding.resolvedScope, resolveScope };
+}
+export {
+  bindProjectAccessScope,
+  readProjectAccessScope,
+  useProjectAccessScope
+};
+//# sourceMappingURL=projectAccessScope.js.map

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/projectAccessScope.ts"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'\nimport {\n  parseSelectedOrganizationCookie,\n  parseSelectedTenantCookie,\n} from '@open-mercato/core/modules/directory/utils/scopeCookies'\nimport type { ResolvedProjectAccessScope } from './projectAccessScopeHeaders'\n\nexport type ProjectAccessScope = {\n  projectId: string | null\n  tenantId: string | null\n  organizationId: string | null\n}\n\nexport type ProjectAccessScopeState = {\n  /** Stable while the scope stays the same; changes when the project, tenant or organization changes. */\n  scopeKey: string\n  /** Reads the scope cookies again, so it also catches a change that has not been rendered yet. */\n  isCurrentScope: () => boolean\n  resolvedScope: ResolvedProjectAccessScope | null\n  resolveScope: (scope: ResolvedProjectAccessScope | null) => void\n}\n\ntype ProjectAccessScopeBinding = {\n  scope: ProjectAccessScope\n  generation: number\n  resolvedScope: ResolvedProjectAccessScope | null\n}\n\nexport function readProjectAccessScope(timeProjectId?: string | null): ProjectAccessScope {\n  const cookieHeader = typeof document === 'undefined' ? null : document.cookie\n  return {\n    projectId: timeProjectId ?? null,\n    tenantId: parseSelectedTenantCookie(cookieHeader),\n    organizationId: parseSelectedOrganizationCookie(cookieHeader),\n  }\n}\n\nexport function bindProjectAccessScope(\n  bound: ProjectAccessScope,\n  current: ProjectAccessScope,\n  resolvedScope?: ResolvedProjectAccessScope | null,\n): ProjectAccessScope | null {\n  const continues = (boundValue: string | null, currentValue: string | null, resolvedValue?: string) =>\n    boundValue === currentValue || (boundValue === null && currentValue === resolvedValue)\n  if (bound.projectId !== current.projectId) return null\n  if (!continues(bound.tenantId, current.tenantId, resolvedScope?.tenantId)) return null\n  if (!continues(bound.organizationId, current.organizationId, resolvedScope?.organizationId)) return null\n  return current\n}\n\nfunction isSameProjectAccessScope(left: ProjectAccessScope, right: ProjectAccessScope): boolean {\n  return left.projectId === right.projectId\n    && left.tenantId === right.tenantId\n    && left.organizationId === right.organizationId\n}\n\nfunction rebindProjectAccessScope(\n  binding: ProjectAccessScopeBinding,\n  current: ProjectAccessScope,\n): ProjectAccessScopeBinding {\n  const continued = bindProjectAccessScope(binding.scope, current, binding.resolvedScope)\n  if (!continued) return { scope: current, generation: binding.generation + 1, resolvedScope: null }\n  if (isSameProjectAccessScope(continued, binding.scope)) return binding\n  return { ...binding, scope: continued }\n}\n\nexport function useProjectAccessScope(\n  timeProjectId?: string | null,\n  initialResolvedScope?: ResolvedProjectAccessScope | null,\n): ProjectAccessScopeState {\n  useOrganizationScopeVersion()\n  const current = readProjectAccessScope(timeProjectId)\n  const [binding, setBinding] = React.useState<ProjectAccessScopeBinding>(() => ({\n    scope: current,\n    generation: 0,\n    resolvedScope: initialResolvedScope ?? null,\n  }))\n  const nextBinding = rebindProjectAccessScope(binding, current)\n  if (nextBinding !== binding) setBinding(nextBinding)\n  const boundScope = React.useRef(nextBinding)\n  boundScope.current = nextBinding\n  const generation = nextBinding.generation\n  const isCurrentScope = React.useCallback(() => {\n    const active = boundScope.current\n    return active.generation === generation\n      && bindProjectAccessScope(active.scope, readProjectAccessScope(timeProjectId), active.resolvedScope) !== null\n  }, [generation, timeProjectId])\n  const resolveScope = React.useCallback((resolvedScope: ResolvedProjectAccessScope | null) => {\n    setBinding((previous) => {\n      if (previous.generation !== generation) return previous\n      if (!bindProjectAccessScope(previous.scope, readProjectAccessScope(timeProjectId), resolvedScope)) return previous\n      const changed = previous.resolvedScope !== null && resolvedScope !== null\n        && (previous.resolvedScope.tenantId !== resolvedScope.tenantId\n          || previous.resolvedScope.organizationId !== resolvedScope.organizationId)\n      return { ...previous, resolvedScope, generation: previous.generation + (changed ? 1 : 0) }\n    })\n  }, [generation, timeProjectId])\n  return { scopeKey: String(generation), isCurrentScope, resolvedScope: nextBinding.resolvedScope, resolveScope }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAwBA,SAAS,uBAAuB,eAAmD;AACxF,QAAM,eAAe,OAAO,aAAa,cAAc,OAAO,SAAS;AACvE,SAAO;AAAA,IACL,WAAW,iBAAiB;AAAA,IAC5B,UAAU,0BAA0B,YAAY;AAAA,IAChD,gBAAgB,gCAAgC,YAAY;AAAA,EAC9D;AACF;AAEO,SAAS,uBACd,OACA,SACA,eAC2B;AAC3B,QAAM,YAAY,CAAC,YAA2B,cAA6B,kBACzE,eAAe,gBAAiB,eAAe,QAAQ,iBAAiB;AAC1E,MAAI,MAAM,cAAc,QAAQ,UAAW,QAAO;AAClD,MAAI,CAAC,UAAU,MAAM,UAAU,QAAQ,UAAU,eAAe,QAAQ,EAAG,QAAO;AAClF,MAAI,CAAC,UAAU,MAAM,gBAAgB,QAAQ,gBAAgB,eAAe,cAAc,EAAG,QAAO;AACpG,SAAO;AACT;AAEA,SAAS,yBAAyB,MAA0B,OAAoC;AAC9F,SAAO,KAAK,cAAc,MAAM,aAC3B,KAAK,aAAa,MAAM,YACxB,KAAK,mBAAmB,MAAM;AACrC;AAEA,SAAS,yBACP,SACA,SAC2B;AAC3B,QAAM,YAAY,uBAAuB,QAAQ,OAAO,SAAS,QAAQ,aAAa;AACtF,MAAI,CAAC,UAAW,QAAO,EAAE,OAAO,SAAS,YAAY,QAAQ,aAAa,GAAG,eAAe,KAAK;AACjG,MAAI,yBAAyB,WAAW,QAAQ,KAAK,EAAG,QAAO;AAC/D,SAAO,EAAE,GAAG,SAAS,OAAO,UAAU;AACxC;AAEO,SAAS,sBACd,eACA,sBACyB;AACzB,8BAA4B;AAC5B,QAAM,UAAU,uBAAuB,aAAa;AACpD,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAoC,OAAO;AAAA,IAC7E,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,eAAe,wBAAwB;AAAA,EACzC,EAAE;AACF,QAAM,cAAc,yBAAyB,SAAS,OAAO;AAC7D,MAAI,gBAAgB,QAAS,YAAW,WAAW;AACnD,QAAM,aAAa,MAAM,OAAO,WAAW;AAC3C,aAAW,UAAU;AACrB,QAAM,aAAa,YAAY;AAC/B,QAAM,iBAAiB,MAAM,YAAY,MAAM;AAC7C,UAAM,SAAS,WAAW;AAC1B,WAAO,OAAO,eAAe,cACxB,uBAAuB,OAAO,OAAO,uBAAuB,aAAa,GAAG,OAAO,aAAa,MAAM;AAAA,EAC7G,GAAG,CAAC,YAAY,aAAa,CAAC;AAC9B,QAAM,eAAe,MAAM,YAAY,CAAC,kBAAqD;AAC3F,eAAW,CAAC,aAAa;AACvB,UAAI,SAAS,eAAe,WAAY,QAAO;AAC/C,UAAI,CAAC,uBAAuB,SAAS,OAAO,uBAAuB,aAAa,GAAG,aAAa,EAAG,QAAO;AAC1G,YAAM,UAAU,SAAS,kBAAkB,QAAQ,kBAAkB,SAC/D,SAAS,cAAc,aAAa,cAAc,YACjD,SAAS,cAAc,mBAAmB,cAAc;AAC/D,aAAO,EAAE,GAAG,UAAU,eAAe,YAAY,SAAS,cAAc,UAAU,IAAI,GAAG;AAAA,IAC3F,CAAC;AAAA,EACH,GAAG,CAAC,YAAY,aAAa,CAAC;AAC9B,SAAO,EAAE,UAAU,OAAO,UAAU,GAAG,gBAAgB,eAAe,YAAY,eAAe,aAAa;AAChH;",
+  "names": []
+}

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.js

@@ -0,0 +1,13 @@
+const PROJECT_SCOPE_TENANT_HEADER = "x-om-project-scope-tenant-id";
+const PROJECT_SCOPE_ORGANIZATION_HEADER = "x-om-project-scope-organization-id";
+function readResolvedProjectAccessScope(response) {
+  const tenantId = response.headers?.get(PROJECT_SCOPE_TENANT_HEADER);
+  const organizationId = response.headers?.get(PROJECT_SCOPE_ORGANIZATION_HEADER);
+  return tenantId && organizationId ? { tenantId, organizationId } : null;
+}
+export {
+  PROJECT_SCOPE_ORGANIZATION_HEADER,
+  PROJECT_SCOPE_TENANT_HEADER,
+  readResolvedProjectAccessScope
+};
+//# sourceMappingURL=projectAccessScopeHeaders.js.map

package/dist/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/staff/lib/time-tracking-ui/projectAccessScopeHeaders.ts"],
+  "sourcesContent": ["export const PROJECT_SCOPE_TENANT_HEADER = 'x-om-project-scope-tenant-id'\nexport const PROJECT_SCOPE_ORGANIZATION_HEADER = 'x-om-project-scope-organization-id'\n\nexport type ResolvedProjectAccessScope = {\n  tenantId: string\n  organizationId: string\n}\n\nexport function readResolvedProjectAccessScope(\n  response: { headers?: Pick<Headers, 'get'> },\n): ResolvedProjectAccessScope | null {\n  const tenantId = response.headers?.get(PROJECT_SCOPE_TENANT_HEADER)\n  const organizationId = response.headers?.get(PROJECT_SCOPE_ORGANIZATION_HEADER)\n  return tenantId && organizationId ? { tenantId, organizationId } : null\n}\n"],
+  "mappings": "AAAO,MAAM,8BAA8B;AACpC,MAAM,oCAAoC;AAO1C,SAAS,+BACd,UACmC;AACnC,QAAM,WAAW,SAAS,SAAS,IAAI,2BAA2B;AAClE,QAAM,iBAAiB,SAAS,SAAS,IAAI,iCAAiC;AAC9E,SAAO,YAAY,iBAAiB,EAAE,UAAU,eAAe,IAAI;AACrE;",
+  "names": []
+}

package/dist/modules/sync_excel/index.js

@@ -1,7 +1,17 @@
 const metadata = {
   id: "sync_excel",
   title: "Excel / CSV Import",
-  description: "File-upload-based CSV import foundation built on top of the data sync hub."
+  description: "File-upload-based CSV import foundation built on top of the data sync hub.",
+  /**
+   * `customers` is a HARD dependency: `lib/adapters/customers.ts` reads `E.customers.*` at module scope.
+   *
+   * `E` only carries a key for an ENABLED module, so with `customers` switched off that read is
+   * `undefined.customer_entity` and it throws while the adapter is being imported — not inside a request, where
+   * it could be traced. Declaring it has the generator refuse the combination before anybody starts the app.
+   *
+   * `data_sync` is the hub this is built on, named in the description and now in the manifest too.
+   */
+  requires: ["customers", "data_sync"]
 };
 var sync_excel_default = metadata;
 export {

package/dist/modules/sync_excel/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/sync_excel/index.ts"],
-  "sourcesContent": ["export const metadata = {\n  id: 'sync_excel',\n  title: 'Excel / CSV Import',\n  description: 'File-upload-based CSV import foundation built on top of the data sync hub.',\n}\n\nexport default metadata\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,aAAa;AACf;AAEA,IAAO,qBAAQ;",
+  "sourcesContent": ["export const metadata = {\n  id: 'sync_excel',\n  title: 'Excel / CSV Import',\n  description: 'File-upload-based CSV import foundation built on top of the data sync hub.',\n  /**\n   * `customers` is a HARD dependency: `lib/adapters/customers.ts` reads `E.customers.*` at module scope.\n   *\n   * `E` only carries a key for an ENABLED module, so with `customers` switched off that read is\n   * `undefined.customer_entity` and it throws while the adapter is being imported \u2014 not inside a request, where\n   * it could be traced. Declaring it has the generator refuse the combination before anybody starts the app.\n   *\n   * `data_sync` is the hub this is built on, named in the description and now in the manifest too.\n   */\n  requires: ['customers', 'data_sync'],\n}\n\nexport default metadata\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUb,UAAU,CAAC,aAAa,WAAW;AACrC;AAEA,IAAO,qBAAQ;",
   "names": []
 }

package/dist/modules/translations/di.js

@@ -2,6 +2,7 @@ import { registerTranslatableFields } from "@open-mercato/shared/lib/localizatio
 import { registerTranslationOverlayPlugin } from "@open-mercato/shared/lib/localization/overlay-plugin";
 import { registerSupportedLocalesResolver } from "@open-mercato/shared/lib/i18n/locale-registry";
 import { translatableFields as catalogFields } from "../catalog/translations.js";
+import { translatableFields as customerFields } from "../customers/translations.js";
 import { translatableFields as dictionaryFields } from "../dictionaries/translations.js";
 import { translatableFields as entitiesFields } from "../entities/translations.js";
 import { translatableFields as resourcesFields } from "../resources/translations.js";
@@ -11,6 +12,7 @@ import { resolveTenantSupportedLocales } from "./lib/supported-locales.js";
 registerSupportedLocalesResolver(resolveTenantSupportedLocales);
 function register() {
   registerTranslatableFields(catalogFields);
+  registerTranslatableFields(customerFields);
   registerTranslatableFields(dictionaryFields);
   registerTranslatableFields(entitiesFields);
   registerTranslatableFields(resourcesFields);

package/dist/modules/translations/di.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/translations/di.ts"],
-  "sourcesContent": ["import { registerTranslatableFields } from '@open-mercato/shared/lib/localization/translatable-fields'\nimport { registerTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'\nimport { registerSupportedLocalesResolver } from '@open-mercato/shared/lib/i18n/locale-registry'\nimport { translatableFields as catalogFields } from '../catalog/translations'\nimport { translatableFields as dictionaryFields } from '../dictionaries/translations'\nimport { translatableFields as entitiesFields } from '../entities/translations'\nimport { translatableFields as resourcesFields } from '../resources/translations'\nimport { applyTranslationOverlays } from './lib/apply'\nimport { resolveLocaleFromRequest } from './lib/locale'\nimport { resolveTenantSupportedLocales } from './lib/supported-locales'\n\n// Registered at module scope, not inside `register()`: module DI registrars only\n// run when the first request container is built, and the root layout resolves the\n// served locale set without ever building one. Inside `register()` the very first\n// render of a fresh process would find an empty resolver slot and serve the\n// un-narrowed set. `di.generated.ts` imports this module statically from the app\n// bootstrap, so the slot is filled at import time instead.\nregisterSupportedLocalesResolver(resolveTenantSupportedLocales)\n\nexport function register() {\n  registerTranslatableFields(catalogFields)\n  registerTranslatableFields(dictionaryFields)\n  registerTranslatableFields(entitiesFields)\n  registerTranslatableFields(resourcesFields)\n  registerTranslationOverlayPlugin(applyTranslationOverlays, resolveLocaleFromRequest)\n}\n"],
-  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,wCAAwC;AACjD,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,qBAAqB;AACpD,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,uBAAuB;AACtD,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AACzC,SAAS,qCAAqC;AAQ9C,iCAAiC,6BAA6B;AAEvD,SAAS,WAAW;AACzB,6BAA2B,aAAa;AACxC,6BAA2B,gBAAgB;AAC3C,6BAA2B,cAAc;AACzC,6BAA2B,eAAe;AAC1C,mCAAiC,0BAA0B,wBAAwB;AACrF;",
+  "sourcesContent": ["import { registerTranslatableFields } from '@open-mercato/shared/lib/localization/translatable-fields'\nimport { registerTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'\nimport { registerSupportedLocalesResolver } from '@open-mercato/shared/lib/i18n/locale-registry'\nimport { translatableFields as catalogFields } from '../catalog/translations'\nimport { translatableFields as customerFields } from '../customers/translations'\nimport { translatableFields as dictionaryFields } from '../dictionaries/translations'\nimport { translatableFields as entitiesFields } from '../entities/translations'\nimport { translatableFields as resourcesFields } from '../resources/translations'\nimport { applyTranslationOverlays } from './lib/apply'\nimport { resolveLocaleFromRequest } from './lib/locale'\nimport { resolveTenantSupportedLocales } from './lib/supported-locales'\n\n// Registered at module scope, not inside `register()`: module DI registrars only\n// run when the first request container is built, and the root layout resolves the\n// served locale set without ever building one. Inside `register()` the very first\n// render of a fresh process would find an empty resolver slot and serve the\n// un-narrowed set. `di.generated.ts` imports this module statically from the app\n// bootstrap, so the slot is filled at import time instead.\nregisterSupportedLocalesResolver(resolveTenantSupportedLocales)\n\nexport function register() {\n  registerTranslatableFields(catalogFields)\n  registerTranslatableFields(customerFields)\n  registerTranslatableFields(dictionaryFields)\n  registerTranslatableFields(entitiesFields)\n  registerTranslatableFields(resourcesFields)\n  registerTranslationOverlayPlugin(applyTranslationOverlays, resolveLocaleFromRequest)\n}\n"],
+  "mappings": "AAAA,SAAS,kCAAkC;AAC3C,SAAS,wCAAwC;AACjD,SAAS,wCAAwC;AACjD,SAAS,sBAAsB,qBAAqB;AACpD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,wBAAwB;AACvD,SAAS,sBAAsB,sBAAsB;AACrD,SAAS,sBAAsB,uBAAuB;AACtD,SAAS,gCAAgC;AACzC,SAAS,gCAAgC;AACzC,SAAS,qCAAqC;AAQ9C,iCAAiC,6BAA6B;AAEvD,SAAS,WAAW;AACzB,6BAA2B,aAAa;AACxC,6BAA2B,cAAc;AACzC,6BAA2B,gBAAgB;AAC3C,6BAA2B,cAAc;AACzC,6BAA2B,eAAe;AAC1C,mCAAiC,0BAA0B,wBAAwB;AACrF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7836.1.0ef0f453c6",
+  "version": "0.10.1-develop.7841.1.af87ac614d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.6.6"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/shared": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/ui": "0.10.1-develop.7836.1.0ef0f453c6",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/shared": "0.10.1-develop.7836.1.0ef0f453c6",
-    "@open-mercato/ui": "0.10.1-develop.7836.1.0ef0f453c6",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/shared": "0.10.1-develop.7841.1.af87ac614d",
+    "@open-mercato/ui": "0.10.1-develop.7841.1.af87ac614d",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/customer_accounts/api/admin/roles.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
@@ -8,6 +9,7 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { createRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
+import { resolveAdminTargetOrganization } from '@open-mercato/core/modules/customer_accounts/lib/adminOrganizationScope'
 
 export const metadata = {}
 
@@ -25,6 +27,21 @@ export async function GET(req: Request) {
   }
 
   const url = new URL(req.url)
+  const requestedOrganizationId = url.searchParams.get('organizationId')
+  let organizationId = auth.orgId
+  if (requestedOrganizationId) {
+    const target = await resolveAdminTargetOrganization({ container, auth, request: req, requestedOrganizationId })
+    if (!target.ok) return target.response
+    organizationId = target.organizationId
+    if (organizationId !== auth.orgId) {
+      const hasTargetAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId })
+      if (!hasTargetAccess) {
+        const { translate } = await resolveTranslations()
+        return NextResponse.json({ ok: false, error: translate('customer_accounts.admin.errors.insufficientPermissions', 'Insufficient permissions') }, { status: 403 })
+      }
+    }
+  }
+
   const page = Math.max(1, parseInt(url.searchParams.get('page') || '1', 10) || 1)
   const pageSize = Math.min(100, Math.max(1, parseInt(url.searchParams.get('pageSize') || '50', 10) || 50))
   const search = (url.searchParams.get('search') || '').trim()
@@ -33,7 +50,7 @@ export async function GET(req: Request) {
 
   const where: Record<string, unknown> = {
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     deletedAt: null,
   }
 
@@ -179,14 +196,21 @@ const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
 
 const getMethodDoc: OpenApiMethodDoc = {
   summary: 'List customer roles (admin)',
-  description: 'Returns all customer roles for the tenant.',
+  description: 'Returns customer roles for the caller\'s active organization, or for the organization passed as organizationId when it is within the caller\'s organization scope.',
   tags: ['Customer Accounts Admin'],
+  query: z.object({
+    page: z.number().int().positive().optional(),
+    pageSize: z.number().int().positive().max(100).optional(),
+    search: z.string().optional(),
+    organizationId: z.string().uuid().optional(),
+  }),
   responses: [{
     status: 200,
     description: 'Role list',
     schema: z.object({ ok: z.literal(true), items: z.array(roleSchema), total: z.number(), totalPages: z.number(), page: z.number() }),
   }],
   errors: [
+    { status: 400, description: 'Organization not found or outside the caller scope', schema: errorSchema },
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
   ],

package/src/modules/customer_accounts/api/admin/users.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
@@ -13,6 +14,7 @@ import { adminCreateUserSchema } from '@open-mercato/core/modules/customer_accou
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { findAndCountWithDecryption, findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOwnedCompanyEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
+import { resolveAdminTargetOrganization } from '@open-mercato/core/modules/customer_accounts/lib/adminOrganizationScope'
 import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { E } from '#generated/entities.ids.generated'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
@@ -259,6 +261,23 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })
   }
 
+  const target = await resolveAdminTargetOrganization({
+    container,
+    auth,
+    request: req,
+    requestedOrganizationId: parsed.data.organizationId,
+  })
+  if (!target.ok) return target.response
+  const organizationId = target.organizationId
+
+  if (organizationId !== auth.orgId) {
+    const hasTargetAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.manage'], { tenantId: auth.tenantId, organizationId })
+    if (!hasTargetAccess) {
+      const { translate } = await resolveTranslations()
+      return NextResponse.json({ ok: false, error: translate('customer_accounts.admin.errors.insufficientPermissions', 'Insufficient permissions') }, { status: 403 })
+    }
+  }
+
   const em = container.resolve('em') as EntityManager
   const customerUserService = container.resolve('customerUserService') as CustomerUserService
 
@@ -281,11 +300,11 @@ export async function POST(req: Request) {
       {
         id: { $in: requestedRoleIds } as any,
         tenantId: auth.tenantId,
-        organizationId: auth.orgId,
+        organizationId,
         deletedAt: null,
       } as any,
       undefined,
-      { tenantId: auth.tenantId, organizationId: auth.orgId },
+      { tenantId: auth.tenantId, organizationId },
     )
     if (validRoles.length !== requestedRoleIds.length) {
       const foundIds = new Set(validRoles.map((role) => role.id))
@@ -301,7 +320,7 @@ export async function POST(req: Request) {
   if (parsed.data.customerEntityId) {
     const owned = await isOwnedCompanyEntity(em, parsed.data.customerEntityId, {
       tenantId: auth.tenantId,
-      organizationId: auth.orgId,
+      organizationId,
     })
     if (!owned) {
       return NextResponse.json({ ok: false, error: 'Company not found' }, { status: 400 })
@@ -312,7 +331,7 @@ export async function POST(req: Request) {
     parsed.data.email,
     parsed.data.password,
     parsed.data.displayName,
-    { tenantId: auth.tenantId!, organizationId: auth.orgId! },
+    { tenantId: auth.tenantId!, organizationId },
   )
   user.emailVerifiedAt = new Date()
 
@@ -341,7 +360,7 @@ export async function POST(req: Request) {
     id: user.id,
     email: user.email,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    organizationId,
     createdBy: auth.sub,
   }).catch(() => undefined)
 
@@ -434,12 +453,12 @@ const getMethodDoc: OpenApiMethodDoc = {
 
 const postMethodDoc: OpenApiMethodDoc = {
   summary: 'Create customer user (admin)',
-  description: 'Creates a new customer user directly. Staff-initiated, bypasses signup flow.',
+  description: 'Creates a new customer user directly. Staff-initiated, bypasses signup flow. Pass organizationId to create the user in a specific organization within the caller\'s organization scope; it defaults to the caller\'s active organization. Roles and the company link are validated against the target organization.',
   tags: ['Customer Accounts Admin'],
   requestBody: { schema: adminCreateUserSchema },
   responses: [{ status: 201, description: 'User created', schema: successSchema }],
   errors: [
-    { status: 400, description: 'Validation failed', schema: errorSchema },
+    { status: 400, description: 'Validation failed, organization not found or outside the caller scope, or no organization could be resolved', schema: errorSchema },
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
     { status: 409, description: 'Email already exists', schema: errorSchema },