@open-mercato/core 0.10.1-develop.7954.1.48da4a7d13 → 0.10.1-develop.7972.1.03f813eaaf

package/dist/modules/warranty_claims/setup.js

@@ -42,6 +42,36 @@ function stableScheduleUuid(stableKey) {
 function stableSlaSweepScheduleId(organizationId) {
   return stableScheduleUuid(`warranty_claims:sla-sweep:${organizationId}`);
 }
+async function ensureSlaSweepSchedule(ctx) {
+  const cradle = ctx.container;
+  if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) return;
+  const schedulerService = ctx.container.resolve("schedulerService");
+  try {
+    await schedulerService.register({
+      id: stableSlaSweepScheduleId(ctx.organizationId),
+      name: "Warranty claims SLA sweep",
+      description: "Enqueues tenant-scoped warranty claim SLA escalation sweeps every 900 seconds.",
+      scopeType: "organization",
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: "interval",
+      scheduleValue: "900s",
+      timezone: "UTC",
+      targetType: "queue",
+      targetQueue: "warranty_claims.sla_sweep",
+      targetPayload: {
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+      },
+      sourceType: "module",
+      sourceModule: "warranty_claims",
+      isEnabled: true
+    });
+  } catch (error) {
+    logger.warn("[warranty_claims] Failed to register SLA sweep schedule", {
+      error: error instanceof Error ? error.message : error
+    });
+  }
+}
 const setup = {
   defaultRoleFeatures: {
     admin: adminFeatures,
@@ -81,36 +111,10 @@ const setup = {
   },
   async seedDefaults({ em, tenantId, organizationId, container }) {
     await seedWarrantyClaimDictionaries(em, { tenantId, organizationId });
-    const cradle = container;
-    if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) {
-      return;
-    }
-    const schedulerService = container.resolve("schedulerService");
-    try {
-      await schedulerService.register({
-        id: stableSlaSweepScheduleId(organizationId),
-        name: "Warranty claims SLA sweep",
-        description: "Enqueues tenant-scoped warranty claim SLA escalation sweeps every 900 seconds.",
-        scopeType: "organization",
-        organizationId,
-        tenantId,
-        scheduleType: "interval",
-        scheduleValue: "900s",
-        timezone: "UTC",
-        targetType: "queue",
-        targetQueue: "warranty_claims.sla_sweep",
-        targetPayload: {
-          scope: { tenantId, organizationId }
-        },
-        sourceType: "module",
-        sourceModule: "warranty_claims",
-        isEnabled: true
-      });
-    } catch (error) {
-      logger.warn("[warranty_claims] Failed to register SLA sweep schedule", {
-        error: error instanceof Error ? error.message : error
-      });
-    }
+    await ensureSlaSweepSchedule({ container, tenantId, organizationId });
+  },
+  async onOrganizationCreated({ container, tenantId, organizationId }) {
+    await ensureSlaSweepSchedule({ container, tenantId, organizationId });
   }
 };
 var setup_default = setup;

package/dist/modules/warranty_claims/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/warranty_claims/setup.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CLAIM_TYPES } from './data/validators'\nimport { WarrantyClaimSequence } from './data/entities'\nimport { seedWarrantyClaimDictionaries } from './lib/dictionaries'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\n// Cross-module READ grants the desk genuinely needs: the intake order picker and\n// the product picker call the sales and catalog list APIs directly. Assignee names\n// are resolved through this module's own `warranty_claims.claim.view`-gated\n// `/api/warranty_claims/assignees` endpoint, so no `auth.*` grant is required here \u2014\n// granting one would hand every role that can see a claim the tenant's full user\n// directory, including emails and role assignments.\nconst connectedIntakeFeatures = ['sales.orders.view', 'catalog.products.view']\n\nconst adminFeatures = [\n  'warranty_claims.*',\n  'warranty_claims.claim.view',\n  'warranty_claims.claim.create',\n  'warranty_claims.claim.manage',\n  'warranty_claims.claim.delete',\n  'warranty_claims.settings.manage',\n  'warranty_claims.external.submit',\n  'warranty_claims.external.view',\n  'warranty_claims.registration.view',\n  'warranty_claims.registration.manage',\n  'warranty_claims.vendor_policy.manage',\n  'warranty_claims.troubleshooting.manage',\n  'warranty_claims.receiving.manage',\n  ...connectedIntakeFeatures,\n]\n\nconst ownerFeatures = [\n  'warranty_claims.*',\n  'warranty_claims.claim.view',\n  'warranty_claims.claim.create',\n  'warranty_claims.claim.manage',\n  'warranty_claims.claim.delete',\n  'warranty_claims.settings.manage',\n  'warranty_claims.registration.view',\n  'warranty_claims.registration.manage',\n  'warranty_claims.vendor_policy.manage',\n  'warranty_claims.troubleshooting.manage',\n  'warranty_claims.receiving.manage',\n  ...connectedIntakeFeatures,\n]\n\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stableSlaSweepScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`warranty_claims:sla-sweep:${organizationId}`)\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    admin: adminFeatures,\n    owner: ownerFeatures,\n    employee: [\n      'warranty_claims.claim.view',\n      'warranty_claims.claim.create',\n      'warranty_claims.claim.manage',\n      'warranty_claims.registration.view',\n      'warranty_claims.registration.manage',\n      'warranty_claims.receiving.manage',\n      ...connectedIntakeFeatures,\n    ],\n  },\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    const now = new Date()\n    for (const claimType of CLAIM_TYPES) {\n      const sequence = await em.findOne(WarrantyClaimSequence, {\n        tenantId,\n        organizationId,\n        claimType,\n      })\n      if (!sequence) {\n        em.persist(\n          em.create(WarrantyClaimSequence, {\n            tenantId,\n            organizationId,\n            claimType,\n            nextNumber: 1,\n            createdAt: now,\n            updatedAt: now,\n          })\n        )\n      }\n    }\n    await em.flush()\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedWarrantyClaimDictionaries(em, { tenantId, organizationId })\n    const cradle = container as { hasRegistration?: (name: string) => boolean }\n    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n      return\n    }\n\n    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n    try {\n      await schedulerService.register({\n        id: stableSlaSweepScheduleId(organizationId),\n        name: 'Warranty claims SLA sweep',\n        description: 'Enqueues tenant-scoped warranty claim SLA escalation sweeps every 900 seconds.',\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'interval',\n        scheduleValue: '900s',\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: 'warranty_claims.sla_sweep',\n        targetPayload: {\n          scope: { tenantId, organizationId },\n        },\n        sourceType: 'module',\n        sourceModule: 'warranty_claims',\n        isEnabled: true,\n      })\n    } catch (error) {\n      logger.warn('[warranty_claims] Failed to register SLA sweep schedule', {\n        error: error instanceof Error ? error.message : error,\n      })\n    }\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,mBAAmB;AAC5B,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AA4B7C,MAAM,0BAA0B,CAAC,qBAAqB,uBAAuB;AAE7E,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,6BAA6B,cAAc,EAAE;AACzE;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IACL;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,MAAM,oBAAI,KAAK;AACrB,eAAW,aAAa,aAAa;AACnC,YAAM,WAAW,MAAM,GAAG,QAAQ,uBAAuB;AAAA,QACvD;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,CAAC,UAAU;AACb,WAAG;AAAA,UACD,GAAG,OAAO,uBAAuB;AAAA,YAC/B;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,YACZ,WAAW;AAAA,YACX,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,8BAA8B,IAAI,EAAE,UAAU,eAAe,CAAC;AACpE,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F;AAAA,IACF;AAEA,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAC7D,QAAI;AACF,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,yBAAyB,cAAc;AAAA,QAC3C,MAAM;AAAA,QACN,aAAa;AAAA,QACb,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe;AAAA,QACf,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,eAAe;AAAA,UACb,OAAO,EAAE,UAAU,eAAe;AAAA,QACpC;AAAA,QACA,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK,2DAA2D;AAAA,QACrE,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAClD,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CLAIM_TYPES } from './data/validators'\nimport { WarrantyClaimSequence } from './data/entities'\nimport { seedWarrantyClaimDictionaries } from './lib/dictionaries'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\n// Cross-module READ grants the desk genuinely needs: the intake order picker and\n// the product picker call the sales and catalog list APIs directly. Assignee names\n// are resolved through this module's own `warranty_claims.claim.view`-gated\n// `/api/warranty_claims/assignees` endpoint, so no `auth.*` grant is required here \u2014\n// granting one would hand every role that can see a claim the tenant's full user\n// directory, including emails and role assignments.\nconst connectedIntakeFeatures = ['sales.orders.view', 'catalog.products.view']\n\nconst adminFeatures = [\n  'warranty_claims.*',\n  'warranty_claims.claim.view',\n  'warranty_claims.claim.create',\n  'warranty_claims.claim.manage',\n  'warranty_claims.claim.delete',\n  'warranty_claims.settings.manage',\n  'warranty_claims.external.submit',\n  'warranty_claims.external.view',\n  'warranty_claims.registration.view',\n  'warranty_claims.registration.manage',\n  'warranty_claims.vendor_policy.manage',\n  'warranty_claims.troubleshooting.manage',\n  'warranty_claims.receiving.manage',\n  ...connectedIntakeFeatures,\n]\n\nconst ownerFeatures = [\n  'warranty_claims.*',\n  'warranty_claims.claim.view',\n  'warranty_claims.claim.create',\n  'warranty_claims.claim.manage',\n  'warranty_claims.claim.delete',\n  'warranty_claims.settings.manage',\n  'warranty_claims.registration.view',\n  'warranty_claims.registration.manage',\n  'warranty_claims.vendor_policy.manage',\n  'warranty_claims.troubleshooting.manage',\n  'warranty_claims.receiving.manage',\n  ...connectedIntakeFeatures,\n]\n\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stableSlaSweepScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`warranty_claims:sla-sweep:${organizationId}`)\n}\n\nasync function ensureSlaSweepSchedule(ctx: {\n  container: import('awilix').AwilixContainer\n  tenantId: string\n  organizationId: string\n}): Promise<void> {\n  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }\n  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return\n\n  const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike\n  try {\n    await schedulerService.register({\n      id: stableSlaSweepScheduleId(ctx.organizationId),\n      name: 'Warranty claims SLA sweep',\n      description: 'Enqueues tenant-scoped warranty claim SLA escalation sweeps every 900 seconds.',\n      scopeType: 'organization',\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      scheduleType: 'interval',\n      scheduleValue: '900s',\n      timezone: 'UTC',\n      targetType: 'queue',\n      targetQueue: 'warranty_claims.sla_sweep',\n      targetPayload: {\n        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n      },\n      sourceType: 'module',\n      sourceModule: 'warranty_claims',\n      isEnabled: true,\n    })\n  } catch (error) {\n    logger.warn('[warranty_claims] Failed to register SLA sweep schedule', {\n      error: error instanceof Error ? error.message : error,\n    })\n  }\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    admin: adminFeatures,\n    owner: ownerFeatures,\n    employee: [\n      'warranty_claims.claim.view',\n      'warranty_claims.claim.create',\n      'warranty_claims.claim.manage',\n      'warranty_claims.registration.view',\n      'warranty_claims.registration.manage',\n      'warranty_claims.receiving.manage',\n      ...connectedIntakeFeatures,\n    ],\n  },\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    const now = new Date()\n    for (const claimType of CLAIM_TYPES) {\n      const sequence = await em.findOne(WarrantyClaimSequence, {\n        tenantId,\n        organizationId,\n        claimType,\n      })\n      if (!sequence) {\n        em.persist(\n          em.create(WarrantyClaimSequence, {\n            tenantId,\n            organizationId,\n            claimType,\n            nextNumber: 1,\n            createdAt: now,\n            updatedAt: now,\n          })\n        )\n      }\n    }\n    await em.flush()\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedWarrantyClaimDictionaries(em, { tenantId, organizationId })\n    await ensureSlaSweepSchedule({ container, tenantId, organizationId })\n  },\n\n  async onOrganizationCreated({ container, tenantId, organizationId }) {\n    await ensureSlaSweepSchedule({ container, tenantId, organizationId })\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,mBAAmB;AAC5B,SAAS,6BAA6B;AACtC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AA4B7C,MAAM,0BAA0B,CAAC,qBAAqB,uBAAuB;AAE7E,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,GAAG;AACL;AAEA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,6BAA6B,cAAc,EAAE;AACzE;AAEA,eAAe,uBAAuB,KAIpB;AAChB,QAAM,SAAS,IAAI;AACnB,MAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,EAAG;AAEjG,QAAM,mBAAmB,IAAI,UAAU,QAAQ,kBAAkB;AACjE,MAAI;AACF,UAAM,iBAAiB,SAAS;AAAA,MAC9B,IAAI,yBAAyB,IAAI,cAAc;AAAA,MAC/C,MAAM;AAAA,MACN,aAAa;AAAA,MACb,WAAW;AAAA,MACX,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,eAAe;AAAA,QACb,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MACtE;AAAA,MACA,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,KAAK,2DAA2D;AAAA,MACrE,OAAO,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAClD,CAAC;AAAA,EACH;AACF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,OAAO;AAAA,IACP,OAAO;AAAA,IACP,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,GAAG;AAAA,IACL;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,MAAM,oBAAI,KAAK;AACrB,eAAW,aAAa,aAAa;AACnC,YAAM,WAAW,MAAM,GAAG,QAAQ,uBAAuB;AAAA,QACvD;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,UAAI,CAAC,UAAU;AACb,WAAG;AAAA,UACD,GAAG,OAAO,uBAAuB;AAAA,YAC/B;AAAA,YACA;AAAA,YACA;AAAA,YACA,YAAY;AAAA,YACZ,WAAW;AAAA,YACX,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,8BAA8B,IAAI,EAAE,UAAU,eAAe,CAAC;AACpE,UAAM,uBAAuB,EAAE,WAAW,UAAU,eAAe,CAAC;AAAA,EACtE;AAAA,EAEA,MAAM,sBAAsB,EAAE,WAAW,UAAU,eAAe,GAAG;AACnE,UAAM,uBAAuB,EAAE,WAAW,UAAU,eAAe,CAAC;AAAA,EACtE;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/workflows/setup.js

@@ -45,6 +45,13 @@ const setup = {
       organizationId: ctx.organizationId
     });
   },
+  onOrganizationCreated: async (ctx) => {
+    await ensureMetricRollupSchedule({
+      container: ctx.container,
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId
+    });
+  },
   /**
    * Portal grants for the §6.4 portal task surface.
    *

package/dist/modules/workflows/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/workflows/setup.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { resolveBusinessRuleDiscoveryCache } from '@open-mercato/core/modules/business_rules/lib/rule-engine'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { seedExampleWorkflows } from './lib/seeds'\nimport { WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL } from './lib/metrics/rollup-schedule'\n\nconst logger = createLogger('workflows')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType?: string\n    sourceModule?: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * `seedDefaults` instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\n/**\n * Register the per-organization KPI rollup tick (spec \u00A78.5).\n *\n * Per ORGANIZATION rather than one system-wide tick that enumerates tenants:\n * the pass would otherwise need an unscoped read to discover which\n * organizations exist, and this module's rule is that every query carries both\n * scope columns. One schedule row per organization is the price of that.\n *\n * Best-effort in both directions: `@open-mercato/scheduler` is an optional peer\n * (no registration in the container \u21D2 silent no-op), and a failure to register\n * must never abort tenant setup \u2014 the read API live-computes when no rollup row\n * exists, so a missing schedule degrades freshness, not correctness.\n */\nasync function ensureMetricRollupSchedule(ctx: {\n  container: { resolve: (name: string) => unknown; hasRegistration?: (name: string) => boolean }\n  tenantId: string\n  organizationId: string\n}): Promise<void> {\n  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }\n  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return\n  try {\n    const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike\n    await schedulerService.register({\n      id: stableScheduleUuid(`workflows:definition-metric-rollup:${ctx.organizationId}`),\n      name: 'Workflow definition metric rollup',\n      description:\n        'Recomputes per-definition run, success-rate, duration-percentile and task-SLA KPIs into workflow_definition_metric_rollups.',\n      scopeType: 'organization',\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      scheduleType: 'interval',\n      scheduleValue: WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL,\n      timezone: 'UTC',\n      targetType: 'queue',\n      targetQueue: 'workflow-definition-metric-rollup',\n      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },\n      sourceType: 'module',\n      sourceModule: 'workflows',\n      isEnabled: true,\n    })\n  } catch (error) {\n    logger.warn('[internal] workflows: failed to register the metric-rollup schedule', { err: error })\n  }\n}\n\nexport const setup: ModuleSetupConfig = {\n  seedDefaults: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    const cache = resolveBusinessRuleDiscoveryCache(ctx.container.resolve.bind(ctx.container))\n    await seedExampleWorkflows(ctx.em, scope, { cache })\n    await ensureMetricRollupSchedule({\n      container: ctx.container as never,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    })\n  },\n\n  /**\n   * Portal grants for the \u00A76.4 portal task surface.\n   *\n   * Declared HERE rather than in `customer_accounts` because a module ships its\n   * own portal features the same way it ships its own backoffice ones \u2014\n   * `syncDefaultCustomerRoleAcls` collects `defaultCustomerRoleFeatures` from\n   * every enabled module and merges them into the seeded customer roles.\n   * Workflows is the first shipped consumer of that seam.\n   *\n   * `portal_admin` is deliberately absent: it already carries `portal.*`, and a\n   * wildcard is exactly what the portal branch of the predicate refuses to treat\n   * as ownership. Granting it explicitly would suggest the wildcard means\n   * something it does not.\n   *\n   * Two rollout caveats, neither a bug:\n   * - The merge is additive into EXISTING roles and runs during tenant setup,\n   *   so an already-provisioned tenant picks these up only after\n   *   `mercato customer_accounts sync-customer-role-acls`.\n   * - `CustomerRbacService` caches ACLs for 5 minutes, so a fresh grant is not\n   *   immediately visible to a signed-in portal user.\n   */\n  defaultCustomerRoleFeatures: {\n    buyer: ['portal.tasks.view', 'portal.tasks.complete'],\n    viewer: ['portal.tasks.view'],\n  },\n\n  defaultRoleFeatures: {\n    // `workflows.*` already grants every concrete id, including the spec \u00A78.4\n    // recovery features `workflows.instances.rerun_step` and\n    // `workflows.instances.bulk_ops`, the spec \u00A78.5 ops feature\n    // `workflows.metrics.view`, and the execution-identity feature\n    // `workflows.definitions.grant_features` (safe to hold under a wildcard: a\n    // grant can never exceed the granting user's OWN current features, so an\n    // admin can only delegate powers they already have). Existing tenants pick\n    // up newly declared features only after `yarn mercato auth sync-role-acls`.\n    admin: ['workflows.*'],\n    employee: [\n      'workflows.view',\n      'workflows.view_tasks',\n      'workflows.tasks.view',\n      'workflows.tasks.claim',\n      'workflows.tasks.complete',\n      'workflows.instances.view',\n    ],\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,kDAAkD;AAE3D,MAAM,SAAS,aAAa,WAAW;AA4BvC,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAeA,eAAe,2BAA2B,KAIxB;AAChB,QAAM,SAAS,IAAI;AACnB,MAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,EAAG;AACjG,MAAI;AACF,UAAM,mBAAmB,IAAI,UAAU,QAAQ,kBAAkB;AACjE,UAAM,iBAAiB,SAAS;AAAA,MAC9B,IAAI,mBAAmB,sCAAsC,IAAI,cAAc,EAAE;AAAA,MACjF,MAAM;AAAA,MACN,aACE;AAAA,MACF,WAAW;AAAA,MACX,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,eAAe,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe,EAAE;AAAA,MACvF,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,KAAK,uEAAuE,EAAE,KAAK,MAAM,CAAC;AAAA,EACnG;AACF;AAEO,MAAM,QAA2B;AAAA,EACtC,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,QAAQ,kCAAkC,IAAI,UAAU,QAAQ,KAAK,IAAI,SAAS,CAAC;AACzF,UAAM,qBAAqB,IAAI,IAAI,OAAO,EAAE,MAAM,CAAC;AACnD,UAAM,2BAA2B;AAAA,MAC/B,WAAW,IAAI;AAAA,MACf,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,6BAA6B;AAAA,IAC3B,OAAO,CAAC,qBAAqB,uBAAuB;AAAA,IACpD,QAAQ,CAAC,mBAAmB;AAAA,EAC9B;AAAA,EAEA,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASnB,OAAO,CAAC,aAAa;AAAA,IACrB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { resolveBusinessRuleDiscoveryCache } from '@open-mercato/core/modules/business_rules/lib/rule-engine'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { seedExampleWorkflows } from './lib/seeds'\nimport { WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL } from './lib/metrics/rollup-schedule'\n\nconst logger = createLogger('workflows')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType?: string\n    sourceModule?: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * `seedDefaults` instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\n/**\n * Register the per-organization KPI rollup tick (spec \u00A78.5).\n *\n * Per ORGANIZATION rather than one system-wide tick that enumerates tenants:\n * the pass would otherwise need an unscoped read to discover which\n * organizations exist, and this module's rule is that every query carries both\n * scope columns. One schedule row per organization is the price of that.\n *\n * Best-effort in both directions: `@open-mercato/scheduler` is an optional peer\n * (no registration in the container \u21D2 silent no-op), and a failure to register\n * must never abort tenant setup \u2014 the read API live-computes when no rollup row\n * exists, so a missing schedule degrades freshness, not correctness.\n */\nasync function ensureMetricRollupSchedule(ctx: {\n  container: { resolve: (name: string) => unknown; hasRegistration?: (name: string) => boolean }\n  tenantId: string\n  organizationId: string\n}): Promise<void> {\n  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }\n  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return\n  try {\n    const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike\n    await schedulerService.register({\n      id: stableScheduleUuid(`workflows:definition-metric-rollup:${ctx.organizationId}`),\n      name: 'Workflow definition metric rollup',\n      description:\n        'Recomputes per-definition run, success-rate, duration-percentile and task-SLA KPIs into workflow_definition_metric_rollups.',\n      scopeType: 'organization',\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      scheduleType: 'interval',\n      scheduleValue: WORKFLOW_DEFINITION_METRIC_ROLLUP_INTERVAL,\n      timezone: 'UTC',\n      targetType: 'queue',\n      targetQueue: 'workflow-definition-metric-rollup',\n      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },\n      sourceType: 'module',\n      sourceModule: 'workflows',\n      isEnabled: true,\n    })\n  } catch (error) {\n    logger.warn('[internal] workflows: failed to register the metric-rollup schedule', { err: error })\n  }\n}\n\nexport const setup: ModuleSetupConfig = {\n  seedDefaults: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    const cache = resolveBusinessRuleDiscoveryCache(ctx.container.resolve.bind(ctx.container))\n    await seedExampleWorkflows(ctx.em, scope, { cache })\n    await ensureMetricRollupSchedule({\n      container: ctx.container as never,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    })\n  },\n\n  onOrganizationCreated: async (ctx) => {\n    await ensureMetricRollupSchedule({\n      container: ctx.container as never,\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n    })\n  },\n\n  /**\n   * Portal grants for the \u00A76.4 portal task surface.\n   *\n   * Declared HERE rather than in `customer_accounts` because a module ships its\n   * own portal features the same way it ships its own backoffice ones \u2014\n   * `syncDefaultCustomerRoleAcls` collects `defaultCustomerRoleFeatures` from\n   * every enabled module and merges them into the seeded customer roles.\n   * Workflows is the first shipped consumer of that seam.\n   *\n   * `portal_admin` is deliberately absent: it already carries `portal.*`, and a\n   * wildcard is exactly what the portal branch of the predicate refuses to treat\n   * as ownership. Granting it explicitly would suggest the wildcard means\n   * something it does not.\n   *\n   * Two rollout caveats, neither a bug:\n   * - The merge is additive into EXISTING roles and runs during tenant setup,\n   *   so an already-provisioned tenant picks these up only after\n   *   `mercato customer_accounts sync-customer-role-acls`.\n   * - `CustomerRbacService` caches ACLs for 5 minutes, so a fresh grant is not\n   *   immediately visible to a signed-in portal user.\n   */\n  defaultCustomerRoleFeatures: {\n    buyer: ['portal.tasks.view', 'portal.tasks.complete'],\n    viewer: ['portal.tasks.view'],\n  },\n\n  defaultRoleFeatures: {\n    // `workflows.*` already grants every concrete id, including the spec \u00A78.4\n    // recovery features `workflows.instances.rerun_step` and\n    // `workflows.instances.bulk_ops`, the spec \u00A78.5 ops feature\n    // `workflows.metrics.view`, and the execution-identity feature\n    // `workflows.definitions.grant_features` (safe to hold under a wildcard: a\n    // grant can never exceed the granting user's OWN current features, so an\n    // admin can only delegate powers they already have). Existing tenants pick\n    // up newly declared features only after `yarn mercato auth sync-role-acls`.\n    admin: ['workflows.*'],\n    employee: [\n      'workflows.view',\n      'workflows.view_tasks',\n      'workflows.tasks.view',\n      'workflows.tasks.claim',\n      'workflows.tasks.complete',\n      'workflows.instances.view',\n    ],\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAC7B,SAAS,4BAA4B;AACrC,SAAS,kDAAkD;AAE3D,MAAM,SAAS,aAAa,WAAW;AA4BvC,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAeA,eAAe,2BAA2B,KAIxB;AAChB,QAAM,SAAS,IAAI;AACnB,MAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,EAAG;AACjG,MAAI;AACF,UAAM,mBAAmB,IAAI,UAAU,QAAQ,kBAAkB;AACjE,UAAM,iBAAiB,SAAS;AAAA,MAC9B,IAAI,mBAAmB,sCAAsC,IAAI,cAAc,EAAE;AAAA,MACjF,MAAM;AAAA,MACN,aACE;AAAA,MACF,WAAW;AAAA,MACX,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,cAAc;AAAA,MACd,eAAe;AAAA,MACf,UAAU;AAAA,MACV,YAAY;AAAA,MACZ,aAAa;AAAA,MACb,eAAe,EAAE,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe,EAAE;AAAA,MACvF,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,KAAK,uEAAuE,EAAE,KAAK,MAAM,CAAC;AAAA,EACnG;AACF;AAEO,MAAM,QAA2B;AAAA,EACtC,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,QAAQ,kCAAkC,IAAI,UAAU,QAAQ,KAAK,IAAI,SAAS,CAAC;AACzF,UAAM,qBAAqB,IAAI,IAAI,OAAO,EAAE,MAAM,CAAC;AACnD,UAAM,2BAA2B;AAAA,MAC/B,WAAW,IAAI;AAAA,MACf,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA,EAEA,uBAAuB,OAAO,QAAQ;AACpC,UAAM,2BAA2B;AAAA,MAC/B,WAAW,IAAI;AAAA,MACf,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,IACtB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAuBA,6BAA6B;AAAA,IAC3B,OAAO,CAAC,qBAAqB,uBAAuB;AAAA,IACpD,QAAQ,CAAC,mBAAmB;AAAA,EAC9B;AAAA,EAEA,qBAAqB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASnB,OAAO,CAAC,aAAa;AAAA,IACrB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7954.1.48da4a7d13",
+  "version": "0.10.1-develop.7972.1.03f813eaaf",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.6.6"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7954.1.48da4a7d13",
-    "@open-mercato/shared": "0.10.1-develop.7954.1.48da4a7d13",
-    "@open-mercato/ui": "0.10.1-develop.7954.1.48da4a7d13",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7972.1.03f813eaaf",
+    "@open-mercato/shared": "0.10.1-develop.7972.1.03f813eaaf",
+    "@open-mercato/ui": "0.10.1-develop.7972.1.03f813eaaf",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7954.1.48da4a7d13",
-    "@open-mercato/shared": "0.10.1-develop.7954.1.48da4a7d13",
-    "@open-mercato/ui": "0.10.1-develop.7954.1.48da4a7d13",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7972.1.03f813eaaf",
+    "@open-mercato/shared": "0.10.1-develop.7972.1.03f813eaaf",
+    "@open-mercato/ui": "0.10.1-develop.7972.1.03f813eaaf",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/auth/api/logout.ts

@@ -55,7 +55,7 @@ function extractAuthTokenClaims(token: string | null): AuthTokenClaims {
 export async function POST(req: Request) {
   const sessToken = parseCookie(req, 'session_token')
   const authToken = parseCookie(req, 'auth_token')
-  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, '/login')
+  if (!sessToken && !authToken) return buildSafeRedirectResponse(req, '/login', 303)
   const claims = extractAuthTokenClaims(authToken)
   let sessionRevoked = false
   if (sessToken || claims.sessionId) {
@@ -83,7 +83,7 @@ export async function POST(req: Request) {
       at: new Date().toISOString(),
     }, { persistent: true }).catch(() => undefined)
   }
-  const res = buildSafeRedirectResponse(req, '/login')
+  const res = buildSafeRedirectResponse(req, '/login', 303)
   res.cookies.set('auth_token', '', { path: '/', maxAge: 0 })
   res.cookies.set('session_token', '', { path: '/', maxAge: 0 })
   res.cookies.set('om_selected_org', '', { path: '/', maxAge: 0 })
@@ -103,7 +103,7 @@ export const openApi: OpenApiRouteDoc = {
       summary: 'Invalidate session and redirect',
       description: 'Revokes the session identified by the `auth_token` sid claim and the `session_token` cookie, clears both cookies together with the organization-scope cookies (`om_selected_org`, `om_selected_tenant`), and redirects the browser to the login page. A valid access token is not required, so a logout submitted after the access token expired still revokes the remember-me refresh session. A request that carries neither session cookie is only redirected.',
       responses: [
-        { status: 307, description: 'Redirect to login after successful logout', mediaType: 'text/html' },
+        { status: 303, description: 'See Other: navigate to login with GET after logout', mediaType: 'text/html' },
       ],
     },
   },

package/src/modules/auth/commands/roles.ts

@@ -415,41 +415,52 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const redoLogEntry = (ctx as RoleReplayRuntimeContext)[ROLE_REDO_LOG]
     let role: Role | null = null
-    await withAtomicFlush(em, [async () => {
-      if (redoLogEntry) {
-        await authorizeRoleReplayAtMutation('update', {
-          operation: 'redo',
-          input: rawInput,
-          ctx,
-          logEntry: redoLogEntry,
+    try {
+      await withAtomicFlush(em, [async () => {
+        if (redoLogEntry) {
+          await authorizeRoleReplayAtMutation('update', {
+            operation: 'redo',
+            input: rawInput,
+            ctx,
+            logEntry: redoLogEntry,
+          })
+        }
+        await lockRoleWriterAuthorizationState(em, [parsed.id])
+        if (wantsTenantChange) {
+          await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
+        }
+        role = await de.updateOrmEntity({
+          entity: Role,
+          where: buildScopedRoleFilter(parsed.id, scope),
+          apply: (entity) => {
+            if (parsed.name !== undefined) entity.name = parsed.name
+            if (parsed.tenantId !== undefined && scope.isSuperAdmin) entity.tenantId = parsed.tenantId
+          },
         })
-      }
-      await lockRoleWriterAuthorizationState(em, [parsed.id])
-      if (wantsTenantChange) {
-        await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
-      }
-      role = await de.updateOrmEntity({
-        entity: Role,
-        where: buildScopedRoleFilter(parsed.id, scope),
-        apply: (entity) => {
-          if (parsed.name !== undefined) entity.name = parsed.name
-          if (parsed.tenantId !== undefined && scope.isSuperAdmin) entity.tenantId = parsed.tenantId
-        },
-      })
-      if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
+        if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
 
-      await setCustomFieldsIfAny({
-        dataEngine: de,
-        entityId: E.auth.role,
-        recordId: String(role.id),
-        organizationId: null,
-        tenantId: role.tenantId ? String(role.tenantId) : null,
-        values: custom,
+        await setCustomFieldsIfAny({
+          dataEngine: de,
+          entityId: E.auth.role,
+          recordId: String(role.id),
+          organizationId: null,
+          tenantId: role.tenantId ? String(role.tenantId) : null,
+          values: custom,
+        })
+      }], {
+        transaction: true,
+        label: redoLogEntry ? 'auth.roles.update.redo' : 'auth.roles.update',
       })
-    }], {
-      transaction: true,
-      label: redoLogEntry ? 'auth.roles.update.redo' : 'auth.roles.update',
-    })
+    } catch (error) {
+      if (!isUniqueViolation(error, 'roles_tenant_id_name_unique')) throw error
+      const { translate } = await resolveTranslations()
+      const message = translate('auth.roles.errors.nameExists', 'A role with this name already exists')
+      throw new CrudHttpError(400, {
+        error: message,
+        fieldErrors: { name: message },
+        details: [{ path: ['name'], message, code: 'duplicate', origin: 'validation' }],
+      })
+    }
     const updatedRole = role as Role | null
     if (!updatedRole) throw new CrudHttpError(404, { error: 'Role not found' })
 

package/src/modules/communication_channels/setup.ts

@@ -71,6 +71,60 @@ function stablePollTickScheduleId(organizationId: string): string {
   return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)
 }
 
+async function ensureCommunicationChannelSchedules(ctx: {
+  container: import('awilix').AwilixContainer
+  tenantId: string
+  organizationId: string
+}): Promise<void> {
+  const cradle = ctx.container as { hasRegistration?: (name: string) => boolean }
+  if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) return
+
+  const schedulerService = ctx.container.resolve('schedulerService') as SchedulerServiceLike
+  try {
+    await schedulerService.register({
+      id: stablePollTickScheduleId(ctx.organizationId),
+      name: 'Communication channels poll tick',
+      description:
+        `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,
+      scopeType: 'organization',
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: 'interval',
+      scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,
+      timezone: 'UTC',
+      targetType: 'queue',
+      targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
+      targetPayload: {
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
+      },
+      sourceType: 'module',
+      sourceModule: 'communication_channels',
+      isEnabled: true,
+    })
+
+    await schedulerService.register({
+      id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${ctx.organizationId}`),
+      name: 'Gmail watch renewal',
+      description:
+        'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',
+      scopeType: 'organization',
+      organizationId: ctx.organizationId,
+      tenantId: ctx.tenantId,
+      scheduleType: 'cron',
+      scheduleValue: '0 4 * * *',
+      timezone: 'UTC',
+      targetType: 'queue',
+      targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,
+      targetPayload: { scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId } },
+      sourceType: 'module',
+      sourceModule: 'communication_channels',
+      isEnabled: true,
+    })
+  } catch (error) {
+    logger.warn('Failed to register module schedules', { err: error })
+  }
+}
+
 export const setup: ModuleSetupConfig = {
   defaultRoleFeatures: {
     superadmin: [
@@ -195,59 +249,11 @@ export const setup: ModuleSetupConfig = {
      * scheduler module isn't enabled — keeps the hub usable in scheduler-less
      * test harnesses.
      */
-    const cradle = container as { hasRegistration?: (name: string) => boolean }
-    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {
-      return
-    }
-    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike
-    // Best-effort: a scheduler failure must not abort tenant initialization for
-    // every other module (mirrors the ai_assistant setup pattern). The schedule
-    // ids are deterministic uuids so re-runs upsert idempotently.
-    try {
-      await schedulerService.register({
-        id: stablePollTickScheduleId(organizationId),
-        name: 'Communication channels poll tick',
-        description:
-          `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,
-        scopeType: 'organization',
-        organizationId,
-        tenantId,
-        scheduleType: 'interval',
-        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,
-        timezone: 'UTC',
-        targetType: 'queue',
-        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
-        targetPayload: {
-          scope: { tenantId, organizationId },
-        },
-        sourceType: 'module',
-        sourceModule: 'communication_channels',
-        isEnabled: true,
-      })
-
-      // Spec C § Phase C4 — Gmail watch renewal cron, per-org so multi-tenant
-      // deploys schedule independently.
-      await schedulerService.register({
-        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),
-        name: 'Gmail watch renewal',
-        description:
-          'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',
-        scopeType: 'organization',
-        organizationId,
-        tenantId,
-        scheduleType: 'cron',
-        scheduleValue: '0 4 * * *',
-        timezone: 'UTC',
-        targetType: 'queue',
-        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,
-        targetPayload: { scope: { tenantId, organizationId } },
-        sourceType: 'module',
-        sourceModule: 'communication_channels',
-        isEnabled: true,
-      })
-    } catch (error) {
-      logger.warn('Failed to register module schedules', { err: error })
-    }
+    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId })
+  },
+
+  async onOrganizationCreated({ container, tenantId, organizationId }) {
+    await ensureCommunicationChannelSchedules({ container, tenantId, organizationId })
   },
 }
 

package/src/modules/customer_accounts/services/domainMappingService.ts

@@ -1,5 +1,8 @@
 import { Resolver, promises as dnsPromises } from 'node:dns'
 import { request as httpsRequest } from 'node:https'
+import type { ClientRequest } from 'node:http'
+import { resolveSafeHostAddress } from '@open-mercato/shared/lib/host-pinning'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { setTimeout as delay } from 'node:timers/promises'
 import { EntityManager } from '@mikro-orm/postgresql'
 import { runWithCacheTenant } from '@open-mercato/cache'
@@ -99,36 +102,61 @@ const defaultDnsResolver: DnsResolverContract = {
 
 const defaultHealthCheck: HealthCheckContract = (hostname, timeoutMs) =>
   new Promise((resolve) => {
-    const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()
-    const req = httpsRequest(
-      {
-        host: hostname,
-        port: 443,
-        path: '/api/customer_accounts/domain-check',
-        method: 'GET',
-        headers: { 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },
-        timeout: timeoutMs,
-      },
-      (res) => {
-        const headerValue = res.headers[headerName]
-        const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue
-        const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'
-        const status = res.statusCode ?? 0
-        res.resume() // discard body
-        resolve({
-          ok: status >= 200 && status < 400,
-          originHeaderPresent,
-          reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,
-        })
-      },
-    )
-    req.on('timeout', () => {
-      req.destroy(new Error('TLS health check timed out'))
-    })
-    req.on('error', (err) => {
-      resolve({ ok: false, originHeaderPresent: false, reason: (err as Error).message })
+    let req: ClientRequest | undefined
+    let settled = false
+    const failure = { ok: false, originHeaderPresent: false, reason: 'TLS health check failed' }
+    const finish = (result: Awaited<ReturnType<HealthCheckContract>>) => {
+      if (settled) return
+      settled = true
+      clearTimeout(deadline)
+      resolve(result)
+    }
+    const deadline = setTimeout(() => {
+      finish(failure)
+      req?.destroy()
+    }, timeoutMs)
+
+    void resolveSafeHostAddress(hostname).then(({ host }) => {
+      if (settled) return
+      const headerName = (process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin').toLowerCase()
+      req = httpsRequest(
+        {
+          host,
+          servername: hostname,
+          rejectUnauthorized: true,
+          agent: false,
+          port: 443,
+          path: '/api/customer_accounts/domain-check',
+          method: 'GET',
+          headers: { Host: hostname, 'X-Domain-Check-Secret': process.env.DOMAIN_CHECK_SECRET ?? '' },
+          timeout: timeoutMs,
+        },
+        (res) => {
+          const headerValue = res.headers[headerName]
+          const originHeader = Array.isArray(headerValue) ? headerValue[0] : headerValue
+          const originHeaderPresent = typeof originHeader === 'string' && originHeader === '1'
+          const status = res.statusCode ?? 0
+          res.resume()
+          finish({
+            ok: status >= 200 && status < 400,
+            originHeaderPresent,
+            reason: status >= 200 && status < 400 ? undefined : `HTTP ${status}`,
+          })
+        },
+      )
+      req.on('timeout', () => {
+        finish(failure)
+        req?.destroy()
+      })
+      req.on('error', () => finish(failure))
+      req.end()
+    }).catch(() => {
+      getTelemetryRuntime()?.reportError(new Error('[internal] Domain TLS health check failed'), {
+        module: 'customer_accounts',
+        code: 'customer_accounts.domain_health_check_failed',
+      })
+      finish(failure)
     })
-    req.end()
   })
 
 export class DomainMappingService {

package/src/modules/customers/components/detail/ActivitiesSection.tsx

@@ -94,8 +94,12 @@ function sortTimelineActivities(items: InteractionSummary[]): InteractionSummary
       return leftScheduled - rightScheduled
     }
 
-    const leftTime = left.occurredAt ?? left.createdAt
-    const rightTime = right.occurredAt ?? right.createdAt
+    const leftTime = left.occurredAt ?? left.scheduledAt ?? null
+    const rightTime = right.occurredAt ?? right.scheduledAt ?? null
+    if (!leftTime || !rightTime) {
+      if (leftTime !== rightTime) return leftTime ? -1 : 1
+      return right.id.localeCompare(left.id)
+    }
     const compare = rightTime.localeCompare(leftTime)
     if (compare !== 0) return compare
     return right.id.localeCompare(left.id)
@@ -242,7 +246,8 @@ export function ActivitiesSection({
       }
       const legacyFiltered = legacyItems.filter((entry) => {
         if (filterTypes.length > 0 && !filterTypes.includes(entry.interactionType)) return false
-        const dateOnly = toDateOnly(entry.occurredAt ?? entry.createdAt)
+        const dateOnly = toDateOnly(entry.occurredAt ?? entry.scheduledAt)
+        if ((filterDateFrom || filterDateTo) && !dateOnly) return false
         if (filterDateFrom && dateOnly < filterDateFrom) return false
         if (filterDateTo && dateOnly > filterDateTo) return false
         return true

package/src/modules/customers/components/detail/ActivityCard.tsx

@@ -116,7 +116,7 @@ function buildEmailCardWidgetData(activity: InteractionSummary): EmailCardWidget
 
 export function ActivityCard({ activity, onOpen, onChanged, runMutation }: ActivityCardProps) {
   const t = useT()
-  const timestamp = activity.occurredAt ?? activity.scheduledAt ?? activity.createdAt
+  const timestamp = activity.occurredAt ?? activity.scheduledAt
   const TypeIcon = TYPE_ICONS[activity.interactionType] ?? StickyNote
   const titleBase = activity.title ?? activity.body ?? activity.interactionType
   const title = activity.duration ? `${titleBase} (${activity.duration} min)` : titleBase
@@ -179,8 +179,8 @@ export function ActivityCard({ activity, onOpen, onChanged, runMutation }: Activ
       } : undefined}
     >
       <div className="pt-1 text-xs text-muted-foreground">
-        <div className="font-semibold text-foreground">{formatDayLabel(timestamp, t)}</div>
-        <div>{formatTimeLabel(timestamp)}</div>
+        <div className="font-semibold text-foreground">{timestamp ? formatDayLabel(timestamp, t) : t('customers.timeline.date.unknown', 'Unknown date')}</div>
+        <div>{timestamp ? formatTimeLabel(timestamp) : null}</div>
       </div>
 
       <div className="flex size-9 items-center justify-center rounded-lg bg-muted/80">