@open-mercato/core 0.4.2-canary-07dbc98202 → 0.4.2-canary-11e19dfb84

package/src/modules/auth/api/sidebar/preferences/route.ts

@@ -64,16 +64,12 @@ export async function GET(req: Request) {
     { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
   ) ?? false
 
-  // For API key auth, use userId (the actual user) if available
-  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub
-  const settings = effectiveUserId
-    ? await loadSidebarPreference(em, {
-        userId: effectiveUserId,
-        tenantId: auth.tenantId ?? null,
-        organizationId: auth.orgId ?? null,
-        locale,
-      })
-    : null
+  const settings = await loadSidebarPreference(em, {
+    userId: auth.sub,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    locale,
+  })
 
   let rolesPayload: Array<{ id: string; name: string; hasPreference: boolean }> = []
   if (canApplyToRoles) {
@@ -96,11 +92,11 @@ export async function GET(req: Request) {
   return NextResponse.json({
     locale,
     settings: {
-      version: settings?.version ?? SIDEBAR_PREFERENCES_VERSION,
-      groupOrder: settings?.groupOrder ?? [],
-      groupLabels: settings?.groupLabels ?? {},
-      itemLabels: settings?.itemLabels ?? {},
-      hiddenItems: settings?.hiddenItems ?? [],
+      version: settings.version ?? SIDEBAR_PREFERENCES_VERSION,
+      groupOrder: settings.groupOrder ?? [],
+      groupLabels: settings.groupLabels ?? {},
+      itemLabels: settings.itemLabels ?? {},
+      hiddenItems: settings.hiddenItems ?? [],
     },
     canApplyToRoles,
     roles: rolesPayload,
@@ -110,11 +106,6 @@ export async function GET(req: Request) {
 export async function PUT(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  // For API key auth, use userId (the actual user) if available
-  const effectiveUserId = auth.isApiKey ? auth.userId : auth.sub
-  if (!effectiveUserId) {
-    return NextResponse.json({ error: 'Cannot save preferences: no user associated with this API key' }, { status: 403 })
-  }
 
   let parsedBody: unknown
   try {
@@ -191,7 +182,7 @@ export async function PUT(req: Request) {
   }
 
   const settings = await saveSidebarPreference(em, {
-    userId: effectiveUserId,
+    userId: auth.sub,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
     locale,

package/src/modules/auth/commands/users.ts

@@ -27,9 +27,6 @@ import {
 import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { buildNotificationFromType } from '@open-mercato/core/modules/notifications/lib/notificationBuilder'
-import { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'
-import notificationTypes from '@open-mercato/core/modules/auth/notifications'
 
 type SerializedUser = {
   email: string
@@ -108,46 +105,6 @@ export const userCrudIndexer: CrudIndexerConfig = {
   }),
 }
 
-async function notifyRoleChanges(
-  ctx: CommandRuntimeContext,
-  user: User,
-  assignedRoles: string[],
-  revokedRoles: string[],
-): Promise<void> {
-  const tenantId = user.tenantId ? String(user.tenantId) : null
-  if (!tenantId) return
-  const organizationId = user.organizationId ? String(user.organizationId) : null
-
-  try {
-    const notificationService = resolveNotificationService(ctx.container)
-    if (assignedRoles.length) {
-      const assignedType = notificationTypes.find((type) => type.type === 'auth.role.assigned')
-      if (assignedType) {
-        const notificationInput = buildNotificationFromType(assignedType, {
-          recipientUserId: String(user.id),
-          sourceEntityType: 'auth:user',
-          sourceEntityId: String(user.id),
-        })
-        await notificationService.create(notificationInput, { tenantId, organizationId })
-      }
-    }
-
-    if (revokedRoles.length) {
-      const revokedType = notificationTypes.find((type) => type.type === 'auth.role.revoked')
-      if (revokedType) {
-        const notificationInput = buildNotificationFromType(revokedType, {
-          recipientUserId: String(user.id),
-          sourceEntityType: 'auth:user',
-          sourceEntityId: String(user.id),
-        })
-        await notificationService.create(notificationInput, { tenantId, organizationId })
-      }
-    }
-  } catch (err) {
-    console.error('[auth.users.roles] Failed to create notification:', err)
-  }
-}
-
 const createUserCommand: CommandHandler<Record<string, unknown>, User> = {
   id: 'auth.users.create',
   async execute(rawInput, ctx) {
@@ -190,10 +147,8 @@ const createUserCommand: CommandHandler<Record<string, unknown>, User> = {
       throw error
     }
 
-    let assignedRoles: string[] = []
     if (Array.isArray(parsed.roles) && parsed.roles.length) {
       await syncUserRoles(em, user, parsed.roles, tenantId)
-      assignedRoles = await loadUserRoleNames(em, String(user.id))
     }
 
     await setCustomFieldsIfAny({
@@ -218,10 +173,6 @@ const createUserCommand: CommandHandler<Record<string, unknown>, User> = {
       indexer: userCrudIndexer,
     })
 
-    if (assignedRoles.length) {
-      await notifyRoleChanges(ctx, user, assignedRoles, [])
-    }
-
     return user
   },
   captureAfter: async (_input, result, ctx) => {
@@ -337,9 +288,6 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const rolesBefore = Array.isArray(parsed.roles)
-      ? await loadUserRoleNames(em, parsed.id)
-      : null
 
     if (parsed.email !== undefined) {
       const emailHash = computeEmailHash(parsed.email)
@@ -429,14 +377,6 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       indexer: userCrudIndexer,
     })
 
-    if (Array.isArray(parsed.roles) && rolesBefore) {
-      const rolesAfter = await loadUserRoleNames(em, String(user.id))
-      const { assigned, revoked } = diffRoleChanges(rolesBefore, rolesAfter)
-      if (assigned.length || revoked.length) {
-        await notifyRoleChanges(ctx, user, assigned, revoked)
-      }
-    }
-
     await invalidateUserCache(ctx, parsed.id)
 
     return user
@@ -832,14 +772,6 @@ async function invalidateUserCache(ctx: CommandRuntimeContext, userId: string) {
   }
 }
 
-function diffRoleChanges(before: string[], after: string[]) {
-  const beforeSet = new Set(before)
-  const afterSet = new Set(after)
-  const assigned = after.filter((role) => !beforeSet.has(role))
-  const revoked = before.filter((role) => !afterSet.has(role))
-  return { assigned, revoked }
-}
-
 function arrayEquals(left: string[] | undefined, right: string[]): boolean {
   if (!left) return false
   if (left.length !== right.length) return false

package/src/modules/auth/i18n/de.json

@@ -80,19 +80,6 @@
   "auth.users.form.errors.load": "Benutzerdaten konnten nicht geladen werden",
   "auth.users.form.errors.aclUpdate": "Aktualisierung der Benutzerberechtigungen fehlgeschlagen",
   "auth.users.form.errors.delete": "Benutzer konnte nicht gelöscht werden",
-  "auth.profile.title": "Profil",
-  "auth.profile.form.email": "E-Mail",
-  "auth.profile.form.password": "Neues Passwort",
-  "auth.profile.form.confirmPassword": "Neues Passwort bestätigen",
-  "auth.profile.form.save": "Änderungen speichern",
-  "auth.profile.form.loading": "Profil wird geladen...",
-  "auth.profile.form.errors.load": "Profil konnte nicht geladen werden.",
-  "auth.profile.form.errors.save": "Profil konnte nicht aktualisiert werden.",
-  "auth.profile.form.errors.invalid": "Ungültige Profilaktualisierung.",
-  "auth.profile.form.errors.passwordMismatch": "Die Passwörter stimmen nicht überein.",
-  "auth.profile.form.errors.noChanges": "Keine Änderungen zu speichern.",
-  "auth.profile.form.errors.emailRequired": "E-Mail ist erforderlich.",
-  "auth.profile.form.success": "Profil aktualisiert.",
   "auth.users.list.error.load": "Benutzer konnten nicht geladen werden",
   "auth.users.list.error.delete": "Benutzer konnte nicht gelöscht werden",
   "auth.users.flash.created": "Benutzer erstellt",
@@ -108,20 +95,5 @@
   "auth.email.resetPassword.title": "Passwort zurücksetzen",
   "auth.email.resetPassword.body": "Klicken Sie auf den Link unten, um ein neues Passwort festzulegen. Dieser Link läuft in 60 Minuten ab.",
   "auth.email.resetPassword.cta": "Neues Passwort festlegen",
-  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren.",
-  "auth.notifications.passwordReset.requested.title": "Passwort-Zurücksetzung angefordert",
-  "auth.notifications.passwordReset.requested.body": "Ein Link zum Zurücksetzen des Passworts wurde an Ihre E-Mail gesendet",
-  "auth.notifications.passwordReset.completed.title": "Passwort erfolgreich geändert",
-  "auth.notifications.passwordReset.completed.body": "Ihr Passwort wurde erfolgreich aktualisiert",
-  "auth.notifications.account.locked.title": "Konto gesperrt",
-  "auth.notifications.account.locked.body": "Ihr Konto wurde aus Sicherheitsgründen gesperrt. Bitte wenden Sie sich an den Support.",
-  "auth.notifications.login.newDevice.title": "Neues Gerät erkannt",
-  "auth.notifications.login.newDevice.body": "Es wurde eine Anmeldung von einem unbekannten Gerät für Ihr Konto erkannt",
-  "auth.notifications.role.assigned.title": "Neue Rolle zugewiesen",
-  "auth.notifications.role.assigned.body": "Ihnen wurde eine neue Rolle mit zusätzlichen Berechtigungen zugewiesen",
-  "auth.notifications.role.revoked.title": "Rolle entfernt",
-  "auth.notifications.role.revoked.body": "Eine Rolle wurde von Ihrem Konto entfernt",
-  "auth.actions.contactSupport": "Support kontaktieren",
-  "auth.actions.viewSessions": "Sitzungen anzeigen",
-  "auth.actions.viewPermissions": "Berechtigungen anzeigen"
+  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren."
 }

package/src/modules/auth/i18n/en.json

@@ -80,19 +80,6 @@
   "auth.users.form.errors.load": "Failed to load user data",
   "auth.users.form.errors.aclUpdate": "Failed to update user access control",
   "auth.users.form.errors.delete": "Failed to delete user",
-  "auth.profile.title": "Profile",
-  "auth.profile.form.email": "Email",
-  "auth.profile.form.password": "New password",
-  "auth.profile.form.confirmPassword": "Confirm new password",
-  "auth.profile.form.save": "Save changes",
-  "auth.profile.form.loading": "Loading profile...",
-  "auth.profile.form.errors.load": "Failed to load profile.",
-  "auth.profile.form.errors.save": "Failed to update profile.",
-  "auth.profile.form.errors.invalid": "Invalid profile update.",
-  "auth.profile.form.errors.passwordMismatch": "Passwords do not match.",
-  "auth.profile.form.errors.noChanges": "No changes to save.",
-  "auth.profile.form.errors.emailRequired": "Email is required.",
-  "auth.profile.form.success": "Profile updated.",
   "auth.users.list.error.load": "Failed to load users",
   "auth.users.list.error.delete": "Failed to delete user",
   "auth.users.flash.created": "User created",
@@ -108,20 +95,5 @@
   "auth.email.resetPassword.title": "Reset your password",
   "auth.email.resetPassword.body": "Click the link below to set a new password. This link will expire in 60 minutes.",
   "auth.email.resetPassword.cta": "Set a new password",
-  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email.",
-  "auth.notifications.passwordReset.requested.title": "Password reset requested",
-  "auth.notifications.passwordReset.requested.body": "A password reset link has been sent to your email",
-  "auth.notifications.passwordReset.completed.title": "Password successfully changed",
-  "auth.notifications.passwordReset.completed.body": "Your password has been updated successfully",
-  "auth.notifications.account.locked.title": "Account locked",
-  "auth.notifications.account.locked.body": "Your account has been locked due to security reasons. Please contact support.",
-  "auth.notifications.login.newDevice.title": "New device login detected",
-  "auth.notifications.login.newDevice.body": "A new login from an unrecognized device was detected on your account",
-  "auth.notifications.role.assigned.title": "New role assigned",
-  "auth.notifications.role.assigned.body": "You have been assigned a new role with additional permissions",
-  "auth.notifications.role.revoked.title": "Role removed",
-  "auth.notifications.role.revoked.body": "A role has been removed from your account",
-  "auth.actions.contactSupport": "Contact Support",
-  "auth.actions.viewSessions": "View Sessions",
-  "auth.actions.viewPermissions": "View Permissions"
+  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email."
 }

package/src/modules/auth/i18n/es.json

@@ -80,19 +80,6 @@
   "auth.users.form.errors.load": "No se pudieron cargar los datos del usuario",
   "auth.users.form.errors.aclUpdate": "No se pudo actualizar el control de acceso del usuario",
   "auth.users.form.errors.delete": "No se pudo eliminar el usuario",
-  "auth.profile.title": "Perfil",
-  "auth.profile.form.email": "Correo electrónico",
-  "auth.profile.form.password": "Nueva contraseña",
-  "auth.profile.form.confirmPassword": "Confirmar nueva contraseña",
-  "auth.profile.form.save": "Guardar cambios",
-  "auth.profile.form.loading": "Cargando perfil...",
-  "auth.profile.form.errors.load": "No se pudo cargar el perfil.",
-  "auth.profile.form.errors.save": "No se pudo actualizar el perfil.",
-  "auth.profile.form.errors.invalid": "Actualización de perfil inválida.",
-  "auth.profile.form.errors.passwordMismatch": "Las contraseñas no coinciden.",
-  "auth.profile.form.errors.noChanges": "No hay cambios para guardar.",
-  "auth.profile.form.errors.emailRequired": "El correo electrónico es obligatorio.",
-  "auth.profile.form.success": "Perfil actualizado.",
   "auth.users.list.error.load": "No se pudieron cargar los usuarios",
   "auth.users.list.error.delete": "No se pudo eliminar el usuario",
   "auth.users.flash.created": "Usuario creado",
@@ -108,20 +95,5 @@
   "auth.email.resetPassword.title": "Restablecer tu contraseña",
   "auth.email.resetPassword.body": "Haz clic en el siguiente enlace para establecer una nueva contraseña. Este enlace caducará en 60 minutos.",
   "auth.email.resetPassword.cta": "Establecer nueva contraseña",
-  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura.",
-  "auth.notifications.passwordReset.requested.title": "Solicitud de restablecimiento de contraseña",
-  "auth.notifications.passwordReset.requested.body": "Se ha enviado un enlace de restablecimiento de contraseña a tu correo electrónico",
-  "auth.notifications.passwordReset.completed.title": "Contraseña cambiada correctamente",
-  "auth.notifications.passwordReset.completed.body": "Tu contraseña se actualizó correctamente",
-  "auth.notifications.account.locked.title": "Cuenta bloqueada",
-  "auth.notifications.account.locked.body": "Tu cuenta ha sido bloqueada por razones de seguridad. Ponte en contacto con soporte.",
-  "auth.notifications.login.newDevice.title": "Nuevo inicio de sesión detectado",
-  "auth.notifications.login.newDevice.body": "Se detectó un inicio de sesión desde un dispositivo no reconocido en tu cuenta",
-  "auth.notifications.role.assigned.title": "Nuevo rol asignado",
-  "auth.notifications.role.assigned.body": "Se te ha asignado un nuevo rol con permisos adicionales",
-  "auth.notifications.role.revoked.title": "Rol eliminado",
-  "auth.notifications.role.revoked.body": "Se ha eliminado un rol de tu cuenta",
-  "auth.actions.contactSupport": "Contactar soporte",
-  "auth.actions.viewSessions": "Ver sesiones",
-  "auth.actions.viewPermissions": "Ver permisos"
+  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura."
 }

package/src/modules/auth/i18n/pl.json

@@ -80,19 +80,6 @@
   "auth.users.form.errors.load": "Nie udało się wczytać danych użytkownika",
   "auth.users.form.errors.aclUpdate": "Nie udało się zaktualizować uprawnień użytkownika",
   "auth.users.form.errors.delete": "Nie udało się usunąć użytkownika",
-  "auth.profile.title": "Profil",
-  "auth.profile.form.email": "Email",
-  "auth.profile.form.password": "Nowe hasło",
-  "auth.profile.form.confirmPassword": "Potwierdź nowe hasło",
-  "auth.profile.form.save": "Zapisz zmiany",
-  "auth.profile.form.loading": "Ładowanie profilu...",
-  "auth.profile.form.errors.load": "Nie udało się wczytać profilu.",
-  "auth.profile.form.errors.save": "Nie udało się zaktualizować profilu.",
-  "auth.profile.form.errors.invalid": "Nieprawidłowa aktualizacja profilu.",
-  "auth.profile.form.errors.passwordMismatch": "Hasła nie są zgodne.",
-  "auth.profile.form.errors.noChanges": "Brak zmian do zapisania.",
-  "auth.profile.form.errors.emailRequired": "Email jest wymagany.",
-  "auth.profile.form.success": "Profil zaktualizowany.",
   "auth.users.list.error.load": "Nie udało się wczytać użytkowników",
   "auth.users.list.error.delete": "Nie udało się usunąć użytkownika",
   "auth.users.flash.created": "Użytkownik utworzony",
@@ -108,20 +95,5 @@
   "auth.email.resetPassword.title": "Zresetuj swoje hasło",
   "auth.email.resetPassword.body": "Kliknij poniższy link, aby ustawić nowe hasło. Link wygaśnie za 60 minut.",
   "auth.email.resetPassword.cta": "Ustaw nowe hasło",
-  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować.",
-  "auth.notifications.passwordReset.requested.title": "Żądanie resetu hasła",
-  "auth.notifications.passwordReset.requested.body": "Link do resetu hasła został wysłany na Twój adres e-mail",
-  "auth.notifications.passwordReset.completed.title": "Hasło zmienione pomyślnie",
-  "auth.notifications.passwordReset.completed.body": "Twoje hasło zostało pomyślnie zaktualizowane",
-  "auth.notifications.account.locked.title": "Konto zablokowane",
-  "auth.notifications.account.locked.body": "Twoje konto zostało zablokowane z powodów bezpieczeństwa. Skontaktuj się z pomocą techniczną.",
-  "auth.notifications.login.newDevice.title": "Wykryto logowanie z nowego urządzenia",
-  "auth.notifications.login.newDevice.body": "Wykryto logowanie z nieznanego urządzenia na Twoim koncie",
-  "auth.notifications.role.assigned.title": "Przypisano nową rolę",
-  "auth.notifications.role.assigned.body": "Przypisano Ci nową rolę z dodatkowymi uprawnieniami",
-  "auth.notifications.role.revoked.title": "Rola usunięta",
-  "auth.notifications.role.revoked.body": "Z Twojego konta usunięto rolę",
-  "auth.actions.contactSupport": "Skontaktuj się z pomocą",
-  "auth.actions.viewSessions": "Zobacz sesje",
-  "auth.actions.viewPermissions": "Zobacz uprawnienia"
+  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować."
 }

package/src/modules/auth/lib/setup-app.ts

@@ -395,7 +395,6 @@ async function ensureDefaultRoleAcls(
       'dashboards.*',
       'dashboards.admin.assign-widgets',
       'api_keys.*',
-      'notifications.manage',
       'perspectives.use',
       'perspectives.role_defaults',
       'business_rules.*',

package/src/modules/auth/services/authService.ts

@@ -75,15 +75,15 @@ export class AuthService {
     return { user, token }
   }
 
-  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
+  async confirmPasswordReset(token: string, newPassword: string) {
     const now = new Date()
     const row = await this.em.findOne(PasswordReset, { token })
-    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
+    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return false
     const user = await this.em.findOne(User, { id: row.user.id })
-    if (!user) return null
+    if (!user) return false
     user.passwordHash = await hash(newPassword, 10)
     row.usedAt = new Date()
     await this.em.flush()
-    return user
+    return true
   }
 }

package/src/modules/business_rules/i18n/en.json

@@ -367,7 +367,5 @@
   "business_rules.components.conditionRow.field.comparisonPlaceholder": "e.g., user.role",
   "business_rules.components.conditionRow.value.help": "Use JSON for arrays: [\"a\",\"b\"]",
   "business_rules.components.conditionRow.field.comparisonHelp": "Field path to compare with",
-  "business_rules.components.conditionRow.deleteCondition": "Delete condition",
-  "businessRules.notifications.rule.executionFailed.title": "Business Rule Failed",
-  "businessRules.notifications.rule.executionFailed.body": "Rule \"{ruleName}\" failed to execute{entityType, select, other { on {entityType}}}: {errorMessage}"
+  "business_rules.components.conditionRow.deleteCondition": "Delete condition"
 }

package/src/modules/catalog/i18n/en.json

@@ -681,7 +681,5 @@
         "deleteError": "Failed to delete variant."
       }
     }
-  },
-  "catalog.notifications.product.lowStock.title": "Low Stock Alert",
-  "catalog.notifications.product.lowStock.body": "{productName}{sku, select, other { ({sku})}} is running low on stock ({currentStock} remaining, threshold: {threshold})"
+  }
 }

package/src/modules/configs/cli.ts

@@ -2,7 +2,6 @@ import type { ModuleCli } from '@open-mercato/shared/modules/registry'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ModuleConfigService } from './lib/module-config-service'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
-import { DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from '../notifications/lib/deliveryConfig'
 
 function envDisablesAutoIndexing(): boolean {
   const raw = process.env.DISABLE_VECTOR_SEARCH_AUTOINDEXING
@@ -32,11 +31,6 @@ const restoreDefaults: ModuleCli = {
             name: 'auto_index_enabled',
             value: defaultEnabled,
           },
-          {
-            moduleId: 'notifications',
-            name: NOTIFICATIONS_DELIVERY_CONFIG_KEY,
-            value: DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
-          },
         ],
         { force: true },
       )

package/src/modules/customers/commands/deals.ts

@@ -35,9 +35,6 @@ import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { resolveNotificationService } from '../../notifications/lib/notificationService'
-import { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
-import { notificationTypes } from '../notifications'
 
 const DEAL_ENTITY_ID = 'customers:customer_deal'
 const dealCrudIndexer: CrudIndexerConfig<CustomerDeal> = {
@@ -284,8 +281,6 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
 
-    const previousStatus = record.status
-
     if (parsed.title !== undefined) record.title = parsed.title
     if (parsed.description !== undefined) record.description = parsed.description ?? null
     if (parsed.status !== undefined) record.status = parsed.status ?? record.status
@@ -324,40 +319,6 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
       indexer: dealCrudIndexer,
     })
 
-    // Send notifications for deal won/lost status changes
-    const newStatus = record.status
-    const normalizedStatus = newStatus === 'win' ? 'won' : newStatus === 'loose' ? 'lost' : newStatus
-    if (previousStatus !== newStatus && (normalizedStatus === 'won' || normalizedStatus === 'lost') && record.ownerUserId) {
-      try {
-        const notificationService = resolveNotificationService(ctx.container)
-        const notificationType = normalizedStatus === 'won' ? 'customers.deal.won' : 'customers.deal.lost'
-        const typeDef = notificationTypes.find((type) => type.type === notificationType)
-        if (typeDef) {
-          const valueDisplay = record.valueAmount && record.valueCurrency
-            ? `${record.valueCurrency} ${record.valueAmount}`
-            : ''
-
-          const notificationInput = buildNotificationFromType(typeDef, {
-            recipientUserId: record.ownerUserId,
-            bodyVariables: {
-              dealTitle: record.title,
-              dealValue: valueDisplay,
-            },
-            sourceEntityType: 'customers:customer_deal',
-            sourceEntityId: record.id,
-            linkHref: `/backend/customers/deals/${record.id}`,
-          })
-
-          await notificationService.create(notificationInput, {
-            tenantId: record.tenantId,
-            organizationId: record.organizationId,
-          })
-        }
-      } catch {
-        // Notification creation is non-critical, don't fail the command
-      }
-    }
-
     return { dealId: record.id }
   },
   buildLog: async ({ snapshots, ctx }) => {

package/src/modules/customers/i18n/en.json

@@ -943,9 +943,5 @@
   "customers.workPlan.customerTodos.table.state.empty": "No customer tasks yet.",
   "customers.workPlan.customerTodos.table.error.load": "Failed to load customer tasks.",
   "customers.workPlan.customerTodos.table.export.view": "Exports the current list with filters and visible columns.",
-  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes.",
-  "customers.notifications.deal.won.title": "Deal Won",
-  "customers.notifications.deal.won.body": "{dealTitle} has been marked as won{dealValue, select, other { ({dealValue})}}",
-  "customers.notifications.deal.lost.title": "Deal Lost",
-  "customers.notifications.deal.lost.body": "{dealTitle} has been marked as lost"
+  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes."
 }

package/src/modules/sales/commands/documents.ts

@@ -11,8 +11,6 @@ import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { deriveResourceFromCommandId, invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
-import { resolveNotificationService } from '../../notifications/lib/notificationService'
-import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
 import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/helpers'
 import { loadCustomFieldValues } from '@open-mercato/shared/lib/crud/custom-fields'
 import { normalizeCustomFieldValues } from '@open-mercato/shared/lib/custom-fields/normalize'
@@ -90,7 +88,6 @@ import { resolveDictionaryEntryValue } from '../lib/dictionaries'
 import { resolveStatusEntryIdByValue } from '../lib/statusHelpers'
 import { SalesDocumentNumberGenerator } from '../services/salesDocumentNumberGenerator'
 import { loadSalesSettings } from './settings'
-import { notificationTypes } from '../notifications'
 
 type DocumentAddressSnapshot = {
   id: string
@@ -3114,37 +3111,6 @@ const createQuoteCommand: CommandHandler<QuoteCreateInput, { quoteId: string }>
     })
     await em.flush()
 
-    // Create notification for users with sales.quotes.manage feature
-    try {
-      const notificationService = resolveNotificationService(ctx.container)
-      const typeDef = notificationTypes.find((type) => type.type === 'sales.quote.created')
-      if (typeDef) {
-        const totalAmount = quote.grandTotalGrossAmount && quote.currencyCode
-          ? `${quote.grandTotalGrossAmount} ${quote.currencyCode}`
-          : ''
-        const totalDisplay = totalAmount ? ` (${totalAmount})` : ''
-        const notificationInput = buildFeatureNotificationFromType(typeDef, {
-          requiredFeature: 'sales.quotes.manage',
-          bodyVariables: {
-            quoteNumber: quote.quoteNumber,
-            total: totalDisplay,
-            totalAmount,
-          },
-          sourceEntityType: 'sales:quote',
-          sourceEntityId: quote.id,
-          linkHref: `/backend/sales/quotes/${quote.id}`,
-        })
-
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: quote.tenantId,
-          organizationId: quote.organizationId ?? null,
-        })
-      }
-    } catch (err) {
-      // Notification creation is non-critical, don't fail the command
-      console.error('[sales.quotes.create] Failed to create notification:', err)
-    }
-
     return { quoteId: quote.id }
   },
   captureAfter: async (_input, result, ctx) => {
@@ -3816,37 +3782,6 @@ const createOrderCommand: CommandHandler<OrderCreateInput, { orderId: string }>
     })
     await em.flush()
 
-    // Create notification for users with sales.orders.manage feature
-    try {
-      const notificationService = resolveNotificationService(ctx.container)
-      const typeDef = notificationTypes.find((type) => type.type === 'sales.order.created')
-      if (typeDef) {
-        const totalAmount = order.grandTotalGrossAmount && order.currencyCode
-          ? `${order.grandTotalGrossAmount} ${order.currencyCode}`
-          : ''
-        const totalDisplay = totalAmount ? ` (${totalAmount})` : ''
-        const notificationInput = buildFeatureNotificationFromType(typeDef, {
-          requiredFeature: 'sales.orders.manage',
-          bodyVariables: {
-            orderNumber: order.orderNumber,
-            total: totalDisplay,
-            totalAmount,
-          },
-          sourceEntityType: 'sales:order',
-          sourceEntityId: order.id,
-          linkHref: `/backend/sales/orders/${order.id}`,
-        })
-
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: order.tenantId,
-          organizationId: order.organizationId ?? null,
-        })
-      }
-    } catch (err) {
-      // Notification creation is non-critical, don't fail the command
-      console.error('[sales.orders.create] Failed to create notification:', err)
-    }
-
     return { orderId: order.id }
   },
   captureAfter: async (_input, result, ctx) => {

package/src/modules/sales/commands/payments.ts

@@ -35,9 +35,6 @@ import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { resolveNotificationService } from '../../notifications/lib/notificationService'
-import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
-import { notificationTypes } from '../notifications'
 
 export type PaymentAllocationSnapshot = {
   id: string
@@ -425,36 +422,6 @@ const createPaymentCommand: CommandHandler<
     const totals = await recomputeOrderPaymentTotals(em, order)
     await em.flush()
     await invalidateOrderCache(ctx.container, order, ctx.auth?.tenantId ?? null)
-
-    // Create notification for payment received
-    try {
-      const notificationService = resolveNotificationService(ctx.container)
-      const typeDef = notificationTypes.find((type) => type.type === 'sales.payment.received')
-      if (typeDef) {
-        const amountDisplay = payment.amount && payment.currencyCode
-          ? `${payment.currencyCode} ${payment.amount}`
-          : ''
-        const notificationInput = buildFeatureNotificationFromType(typeDef, {
-          requiredFeature: 'sales.orders.manage',
-          bodyVariables: {
-            orderNumber: order.orderNumber ?? '',
-            amount: amountDisplay,
-          },
-          sourceEntityType: 'sales:order',
-          sourceEntityId: order.id,
-          linkHref: `/backend/sales/orders/${order.id}`,
-        })
-
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: payment.tenantId,
-          organizationId: payment.organizationId ?? null,
-        })
-      }
-    } catch (err) {
-      // Notification creation is non-critical, don't fail the command
-      console.error('[sales.payments.create] Failed to create notification:', err)
-    }
-
     return { paymentId: payment.id, orderTotals: totals }
   },
   captureAfter: async (_input, result, ctx) => {