@open-mercato/core 0.4.2-canary-da2b080494 → 0.4.2-canary-19353c5970

package/src/modules/catalog/subscribers/low-stock-notification.ts

@@ -0,0 +1,52 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
+
+export const metadata = {
+  event: 'catalog.product.stock_low',
+  persistent: true,
+  id: 'catalog:low-stock-notification',
+}
+
+type LowStockPayload = {
+  productId: string
+  productName: string
+  sku?: string | null
+  currentStock: number
+  threshold: number
+  tenantId: string
+  organizationId?: string | null
+}
+
+type ResolverContext = {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export default async function handle(payload: LowStockPayload, ctx: ResolverContext) {
+  try {
+    const notificationService = resolveNotificationService(ctx)
+    const typeDef = notificationTypes.find((type) => type.type === 'catalog.product.low_stock')
+    if (!typeDef) return
+
+    const notificationInput = buildFeatureNotificationFromType(typeDef, {
+      requiredFeature: 'catalog.products.manage',
+      bodyVariables: {
+        productName: payload.productName,
+        sku: payload.sku ?? '',
+        currentStock: String(payload.currentStock),
+        threshold: String(payload.threshold),
+      },
+      sourceEntityType: 'catalog:product',
+      sourceEntityId: payload.productId,
+      linkHref: `/backend/catalog/products/${payload.productId}`,
+    })
+
+    await notificationService.createForFeature(notificationInput, {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+    })
+  } catch (err) {
+    console.error('[catalog:low-stock-notification] Failed to create notification:', err)
+  }
+}

package/src/modules/configs/cli.ts

@@ -2,6 +2,7 @@ import type { ModuleCli } from '@open-mercato/shared/modules/registry'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ModuleConfigService } from './lib/module-config-service'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from '../notifications/lib/deliveryConfig'
 
 function envDisablesAutoIndexing(): boolean {
   const raw = process.env.DISABLE_VECTOR_SEARCH_AUTOINDEXING
@@ -31,6 +32,11 @@ const restoreDefaults: ModuleCli = {
             name: 'auto_index_enabled',
             value: defaultEnabled,
           },
+          {
+            moduleId: 'notifications',
+            name: NOTIFICATIONS_DELIVERY_CONFIG_KEY,
+            value: DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
+          },
         ],
         { force: true },
       )

package/src/modules/configs/components/CachePanel.tsx

@@ -194,7 +194,7 @@ export function CachePanel() {
         <header className="space-y-1">
           <h2 className="text-lg font-semibold">{t('configs.cache.title', 'Cache overview')}</h2>
           <p className="text-sm text-muted-foreground">
-            {t('configs.cache.description', 'Inspect cached CRUD responses and clear segments when necessary.')}
+            {t('configs.cache.description', 'Inspect cached responses and clear segments when necessary.')}
           </p>
         </header>
         <div className="flex items-center gap-2 text-sm text-muted-foreground">
@@ -211,7 +211,7 @@ export function CachePanel() {
         <header className="space-y-1">
           <h2 className="text-lg font-semibold">{t('configs.cache.title', 'Cache overview')}</h2>
           <p className="text-sm text-muted-foreground">
-            {t('configs.cache.description', 'Inspect cached CRUD responses and clear segments when necessary.')}
+            {t('configs.cache.description', 'Inspect cached responses and clear segments when necessary.')}
           </p>
         </header>
         <div className="rounded border border-red-200 bg-red-50 p-3 text-sm text-red-700">
@@ -235,7 +235,7 @@ export function CachePanel() {
         <div className="space-y-1">
           <h2 className="text-lg font-semibold">{t('configs.cache.title', 'Cache overview')}</h2>
           <p className="text-sm text-muted-foreground">
-            {t('configs.cache.description', 'Inspect cached CRUD responses and clear segments when necessary.')}
+            {t('configs.cache.description', 'Inspect cached responses and clear segments when necessary.')}
           </p>
           {stats ? (
             <>
@@ -342,7 +342,7 @@ export function CachePanel() {
           </div>
         ) : (
           <p className="text-sm text-muted-foreground">
-            {t('configs.cache.empty', 'No cached CRUD responses for this tenant.')}
+            {t('configs.cache.empty', 'No cached responses for this tenant.')}
           </p>
         )}
       </div>

package/src/modules/configs/i18n/en.json

@@ -35,14 +35,14 @@
   "configs.systemStatus.actions.purgeCacheUnavailable": "Cache service is unavailable.",
   "configs.config.nav.cache": "Cache",
   "configs.cache.title": "Cache overview",
-  "configs.cache.description": "Inspect cached CRUD responses and clear segments when necessary.",
+  "configs.cache.description": "Inspect cached responses and clear segments when necessary.",
   "configs.cache.loading": "Loading cache statistics…",
   "configs.cache.loadError": "Failed to load cache statistics.",
   "configs.cache.retry": "Retry",
   "configs.cache.refresh": "Refresh",
   "configs.cache.generatedAt": "Stats generated {{timestamp}}",
   "configs.cache.totalEntries": "{{count}} cached entries",
-  "configs.cache.empty": "No cached CRUD responses for this tenant.",
+  "configs.cache.empty": "No cached responses for this tenant.",
   "configs.cache.purgeAll": "Purge all cache",
   "configs.cache.purgeAllLoading": "Purging…",
   "configs.cache.purgeAllConfirm": "Purge all cached entries for this tenant?",
@@ -64,6 +64,8 @@
   "configs.systemStatus.categories.profilingDescription": "Flags that control request and query profiling outputs.",
   "configs.systemStatus.categories.logging": "Logging",
   "configs.systemStatus.categories.loggingDescription": "Tune verbosity and SQL logging for diagnostics.",
+  "configs.systemStatus.categories.security": "Security",
+  "configs.systemStatus.categories.securityDescription": "Password policy requirements enforced at login and user creation.",
   "configs.systemStatus.categories.caching": "Caching",
   "configs.systemStatus.categories.cachingDescription": "Cache providers and TTL controls for backend responses.",
   "configs.systemStatus.categories.queryIndex": "Query index",
@@ -84,6 +86,14 @@
   "configs.systemStatus.variables.logVerbosity.description": "Overrides structured log verbosity such as debug or trace.",
   "configs.systemStatus.variables.logLevel.label": "Log level",
   "configs.systemStatus.variables.logLevel.description": "Fallback log level applied when verbosity is not set.",
+  "configs.systemStatus.variables.passwordMinLength.label": "Password min length",
+  "configs.systemStatus.variables.passwordMinLength.description": "Minimum number of characters required for passwords.",
+  "configs.systemStatus.variables.passwordRequireDigit.label": "Password requires digit",
+  "configs.systemStatus.variables.passwordRequireDigit.description": "Require at least one numeric character.",
+  "configs.systemStatus.variables.passwordRequireUppercase.label": "Password requires uppercase",
+  "configs.systemStatus.variables.passwordRequireUppercase.description": "Require at least one uppercase letter.",
+  "configs.systemStatus.variables.passwordRequireSpecial.label": "Password requires special",
+  "configs.systemStatus.variables.passwordRequireSpecial.description": "Require at least one special character.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "CRUD API cache",
   "configs.systemStatus.variables.enableCrudApiCache.description": "Enable the CRUD API response cache layer.",
   "configs.systemStatus.variables.cacheStrategy.label": "Cache strategy",

package/src/modules/configs/i18n/pl.json

@@ -35,14 +35,14 @@
   "configs.systemStatus.actions.purgeCacheUnavailable": "Usługa pamięci podręcznej jest niedostępna.",
   "configs.config.nav.cache": "Pamięć podręczna",
   "configs.cache.title": "Podgląd pamięci podręcznej",
-  "configs.cache.description": "Przeglądaj zapisane odpowiedzi CRUD i czyść segmenty w razie potrzeby.",
+  "configs.cache.description": "Przeglądaj zapisane odpowiedzi i czyść segmenty w razie potrzeby.",
   "configs.cache.loading": "Ładowanie statystyk pamięci podręcznej…",
   "configs.cache.loadError": "Nie udało się wczytać statystyk pamięci podręcznej.",
   "configs.cache.retry": "Spróbuj ponownie",
   "configs.cache.refresh": "Odśwież",
   "configs.cache.generatedAt": "Statystyki z {{timestamp}}",
   "configs.cache.totalEntries": "{{count}} wpisów w pamięci podręcznej",
-  "configs.cache.empty": "Brak zapisanych odpowiedzi CRUD dla tego tenanta.",
+  "configs.cache.empty": "Brak zapisanych odpowiedzi dla tego tenanta.",
   "configs.cache.purgeAll": "Wyczyść całą pamięć",
   "configs.cache.purgeAllLoading": "Czyszczenie…",
   "configs.cache.purgeAllConfirm": "Wyczyścić wszystkie wpisy pamięci podręcznej dla tego tenanta?",
@@ -64,6 +64,8 @@
   "configs.systemStatus.categories.profilingDescription": "Flagi sterujące generowaniem danych z profilowania zapytań i żądań.",
   "configs.systemStatus.categories.logging": "Logowanie",
   "configs.systemStatus.categories.loggingDescription": "Dostosuj poziom logowania i zapisywanie zapytań SQL na potrzeby diagnostyki.",
+  "configs.systemStatus.categories.security": "Bezpieczeństwo",
+  "configs.systemStatus.categories.securityDescription": "Wymagania polityki haseł stosowane przy logowaniu i tworzeniu użytkowników.",
   "configs.systemStatus.categories.caching": "Buforowanie",
   "configs.systemStatus.categories.cachingDescription": "Mechanizmy cache oraz kontrola czasu życia odpowiedzi backendu.",
   "configs.systemStatus.categories.queryIndex": "Indeks zapytań",
@@ -84,6 +86,14 @@
   "configs.systemStatus.variables.logVerbosity.description": "Nadpisuje poziom szczegółowości logów, np. debug lub trace.",
   "configs.systemStatus.variables.logLevel.label": "Poziom logowania",
   "configs.systemStatus.variables.logLevel.description": "Domyślny poziom logowania używany, gdy nie ustawiono szczegółowości.",
+  "configs.systemStatus.variables.passwordMinLength.label": "Minimalna długość hasła",
+  "configs.systemStatus.variables.passwordMinLength.description": "Minimalna liczba znaków wymagana w haśle.",
+  "configs.systemStatus.variables.passwordRequireDigit.label": "Hasło wymaga cyfry",
+  "configs.systemStatus.variables.passwordRequireDigit.description": "Wymagaj co najmniej jednej cyfry.",
+  "configs.systemStatus.variables.passwordRequireUppercase.label": "Hasło wymaga wielkiej litery",
+  "configs.systemStatus.variables.passwordRequireUppercase.description": "Wymagaj co najmniej jednej wielkiej litery.",
+  "configs.systemStatus.variables.passwordRequireSpecial.label": "Hasło wymaga znaku specjalnego",
+  "configs.systemStatus.variables.passwordRequireSpecial.description": "Wymagaj co najmniej jednego znaku specjalnego.",
   "configs.systemStatus.variables.enableCrudApiCache.label": "Cache API CRUD",
   "configs.systemStatus.variables.enableCrudApiCache.description": "Włącza warstwę buforowania odpowiedzi API CRUD.",
   "configs.systemStatus.variables.cacheStrategy.label": "Strategia cache",

package/src/modules/configs/lib/system-status.ts

@@ -19,7 +19,14 @@ type SystemStatusVariableDefinition = {
   defaultValue: string | null
 }
 
-const CATEGORY_ORDER: SystemStatusCategoryKey[] = ['profiling', 'logging', 'caching', 'query_index', 'entities']
+const CATEGORY_ORDER: SystemStatusCategoryKey[] = [
+  'profiling',
+  'logging',
+  'security',
+  'caching',
+  'query_index',
+  'entities',
+]
 
 const CATEGORY_METADATA: Record<
   SystemStatusCategoryKey,
@@ -33,6 +40,10 @@ const CATEGORY_METADATA: Record<
     labelKey: 'configs.systemStatus.categories.logging',
     descriptionKey: 'configs.systemStatus.categories.loggingDescription',
   },
+  security: {
+    labelKey: 'configs.systemStatus.categories.security',
+    descriptionKey: 'configs.systemStatus.categories.securityDescription',
+  },
   caching: {
     labelKey: 'configs.systemStatus.categories.caching',
     descriptionKey: 'configs.systemStatus.categories.cachingDescription',
@@ -113,6 +124,42 @@ export const SYSTEM_STATUS_VARIABLES: SystemStatusVariableDefinition[] = [
     docUrl: `${SYSTEM_STATUS_DOC_BASE}#log_level`,
     defaultValue: '',
   },
+  {
+    key: 'OM_PASSWORD_MIN_LENGTH',
+    category: 'security',
+    kind: 'string',
+    labelKey: 'configs.systemStatus.variables.passwordMinLength.label',
+    descriptionKey: 'configs.systemStatus.variables.passwordMinLength.description',
+    docUrl: `${SYSTEM_STATUS_DOC_BASE}#om_password_min_length`,
+    defaultValue: '6',
+  },
+  {
+    key: 'OM_PASSWORD_REQUIRE_DIGIT',
+    category: 'security',
+    kind: 'boolean',
+    labelKey: 'configs.systemStatus.variables.passwordRequireDigit.label',
+    descriptionKey: 'configs.systemStatus.variables.passwordRequireDigit.description',
+    docUrl: `${SYSTEM_STATUS_DOC_BASE}#om_password_require_digit`,
+    defaultValue: 'true',
+  },
+  {
+    key: 'OM_PASSWORD_REQUIRE_UPPERCASE',
+    category: 'security',
+    kind: 'boolean',
+    labelKey: 'configs.systemStatus.variables.passwordRequireUppercase.label',
+    descriptionKey: 'configs.systemStatus.variables.passwordRequireUppercase.description',
+    docUrl: `${SYSTEM_STATUS_DOC_BASE}#om_password_require_uppercase`,
+    defaultValue: 'true',
+  },
+  {
+    key: 'OM_PASSWORD_REQUIRE_SPECIAL',
+    category: 'security',
+    kind: 'boolean',
+    labelKey: 'configs.systemStatus.variables.passwordRequireSpecial.label',
+    descriptionKey: 'configs.systemStatus.variables.passwordRequireSpecial.description',
+    docUrl: `${SYSTEM_STATUS_DOC_BASE}#om_password_require_special`,
+    defaultValue: 'true',
+  },
   {
     key: 'ENABLE_CRUD_API_CACHE',
     category: 'caching',

package/src/modules/configs/lib/system-status.types.ts

@@ -1,6 +1,7 @@
 export type SystemStatusCategoryKey =
   | 'profiling'
   | 'logging'
+  | 'security'
   | 'caching'
   | 'query_index'
   | 'entities'

package/src/modules/configs/lib/upgrade-actions.ts

@@ -11,6 +11,7 @@ import { seedExampleWorkflows } from '@open-mercato/core/modules/workflows/lib/s
 import { seedPlannerAvailabilityRuleSetDefaults, seedPlannerUnavailabilityReasons } from '@open-mercato/core/modules/planner/lib/seeds'
 import { seedResourcesAddressTypes, seedResourcesCapacityUnits, seedResourcesResourceExamples } from '@open-mercato/core/modules/resources/lib/seeds'
 import { seedStaffTeamExamples } from '@open-mercato/core/modules/staff/lib/seeds'
+import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { collectCrudCacheStats, purgeCrudCacheSegment } from '@open-mercato/shared/lib/crud/cache-stats'
 import { isCrudCacheEnabled, resolveCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import * as semver from 'semver'
@@ -370,6 +371,23 @@ export const upgradeActions: UpgradeActionDefinition[] = [
       await reindexModules(em, ['planner', 'staff', 'resources'], { tenantId, organizationId, vectorService })
     },
   },
+  {
+    id: 'configs.upgrades.dashboards.analytics_widgets',
+    version: '0.4.2',
+    messageKey: 'upgrades.v042.message',
+    ctaKey: 'upgrades.v042.cta',
+    successKey: 'upgrades.v042.success',
+    loadingKey: 'upgrades.v042.loading',
+    async run({ em, tenantId, organizationId }) {
+      const widgetIds = await resolveAnalyticsWidgetIds()
+      await appendWidgetsToRoles(em, {
+        tenantId,
+        organizationId,
+        roleNames: ['admin', 'employee'],
+        widgetIds,
+      })
+    },
+  },
 ]
 
 export function actionsUpToVersion(version: string): UpgradeActionDefinition[] {

package/src/modules/currencies/backend/currencies/page.tsx

@@ -256,12 +256,14 @@ export default function CurrenciesPage() {
             <RowActions
               items={[
                 {
+                  id: 'edit',
                   label: t('common.edit'),
                   href: `/backend/currencies/${row.id}`,
                 },
                 ...(!row.isBase
                   ? [
                       {
+                        id: 'set-base',
                         label: t('currencies.list.actions.setBase'),
                         onSelect: () => handleSetBase(row),
                       },
@@ -270,6 +272,7 @@ export default function CurrenciesPage() {
                 ...(!row.isBase
                   ? [
                       {
+                        id: 'delete',
                         label: t('common.delete'),
                         destructive: true,
                         onSelect: () => handleDelete(row),

package/src/modules/currencies/backend/exchange-rates/page.tsx

@@ -279,10 +279,12 @@ export default function ExchangeRatesPage() {
             <RowActions
               items={[
                 {
+                  id: 'edit',
                   label: t('common.edit'),
                   href: `/backend/exchange-rates/${row.id}`,
                 },
                 {
+                  id: 'delete',
                   label: t('common.delete'),
                   destructive: true,
                   onSelect: () => handleDelete(row),

package/src/modules/customers/backend/customers/companies/page.tsx

@@ -597,14 +597,17 @@ export default function CustomersCompaniesPage() {
             <RowActions
               items={[
                 {
+                  id: 'view',
                   label: t('customers.companies.list.actions.view'),
                   onSelect: () => { router.push(`/backend/customers/companies/${row.id}`) },
                 },
                 {
+                  id: 'open-new-tab',
                   label: t('customers.companies.list.actions.openInNewTab'),
                   onSelect: () => window.open(`/backend/customers/companies/${row.id}`, '_blank', 'noopener'),
                 },
                 {
+                  id: 'delete',
                   label: t('customers.companies.list.actions.delete'),
                   destructive: true,
                   onSelect: () => handleDelete(row),

package/src/modules/customers/backend/customers/deals/page.tsx

@@ -889,10 +889,12 @@ export default function CustomersDealsPage() {
               <RowActions
                 items={[
                   {
+                    id: 'edit',
                     label: t('customers.deals.list.actions.edit', 'Edit'),
                     onSelect: () => { router.push(`/backend/customers/deals/${row.id}`) },
                   },
                   {
+                    id: 'open-new-tab',
                     label: t('customers.deals.list.actions.openInNewTab', 'Open in new tab'),
                     onSelect: () => {
                       if (typeof window !== 'undefined') {
@@ -901,6 +903,7 @@ export default function CustomersDealsPage() {
                     },
                   },
                   {
+                    id: 'delete',
                     label: isDeleting
                       ? t('customers.deals.list.actions.deleting', 'Deleting…')
                       : t('customers.deals.list.actions.delete', 'Delete'),

package/src/modules/customers/backend/customers/people/page.tsx

@@ -614,14 +614,17 @@ export default function CustomersPeoplePage() {
             <RowActions
               items={[
                 {
+                  id: 'view',
                   label: t('customers.people.list.actions.view'),
                   onSelect: () => { router.push(`/backend/customers/people/${row.id}`) },
                 },
                 {
+                  id: 'open-new-tab',
                   label: t('customers.people.list.actions.openInNewTab'),
                   onSelect: () => window.open(`/backend/customers/people/${row.id}`, '_blank', 'noopener'),
                 },
                 {
+                  id: 'delete',
                   label: t('customers.people.list.actions.delete'),
                   destructive: true,
                   onSelect: () => handleDelete(row),

package/src/modules/customers/commands/deals.ts

@@ -35,6 +35,9 @@ import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
 
 const DEAL_ENTITY_ID = 'customers:customer_deal'
 const dealCrudIndexer: CrudIndexerConfig<CustomerDeal> = {
@@ -281,6 +284,8 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
 
+    const previousStatus = record.status
+
     if (parsed.title !== undefined) record.title = parsed.title
     if (parsed.description !== undefined) record.description = parsed.description ?? null
     if (parsed.status !== undefined) record.status = parsed.status ?? record.status
@@ -319,6 +324,40 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
       indexer: dealCrudIndexer,
     })
 
+    // Send notifications for deal won/lost status changes
+    const newStatus = record.status
+    const normalizedStatus = newStatus === 'win' ? 'won' : newStatus === 'loose' ? 'lost' : newStatus
+    if (previousStatus !== newStatus && (normalizedStatus === 'won' || normalizedStatus === 'lost') && record.ownerUserId) {
+      try {
+        const notificationService = resolveNotificationService(ctx.container)
+        const notificationType = normalizedStatus === 'won' ? 'customers.deal.won' : 'customers.deal.lost'
+        const typeDef = notificationTypes.find((type) => type.type === notificationType)
+        if (typeDef) {
+          const valueDisplay = record.valueAmount && record.valueCurrency
+            ? `${record.valueCurrency} ${record.valueAmount}`
+            : ''
+
+          const notificationInput = buildNotificationFromType(typeDef, {
+            recipientUserId: record.ownerUserId,
+            bodyVariables: {
+              dealTitle: record.title,
+              dealValue: valueDisplay,
+            },
+            sourceEntityType: 'customers:customer_deal',
+            sourceEntityId: record.id,
+            linkHref: `/backend/customers/deals/${record.id}`,
+          })
+
+          await notificationService.create(notificationInput, {
+            tenantId: record.tenantId,
+            organizationId: record.organizationId,
+          })
+        }
+      } catch {
+        // Notification creation is non-critical, don't fail the command
+      }
+    }
+
     return { dealId: record.id }
   },
   buildLog: async ({ snapshots, ctx }) => {

package/src/modules/customers/components/CustomerTodosTable.tsx

@@ -253,6 +253,7 @@ export function CustomerTodosTable(): React.JSX.Element {
           <RowActions
             items={[
               {
+                id: 'open-customer',
                 label: t('customers.workPlan.customerTodos.table.actions.openCustomer'),
                 href: customerLink,
               },

package/src/modules/customers/i18n/en.json

@@ -943,5 +943,9 @@
   "customers.workPlan.customerTodos.table.state.empty": "No customer tasks yet.",
   "customers.workPlan.customerTodos.table.error.load": "Failed to load customer tasks.",
   "customers.workPlan.customerTodos.table.export.view": "Exports the current list with filters and visible columns.",
-  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes."
+  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes.",
+  "customers.notifications.deal.won.title": "Deal Won",
+  "customers.notifications.deal.won.body": "{dealTitle} has been marked as won{dealValue, select, other { ({dealValue})}}",
+  "customers.notifications.deal.lost.title": "Deal Lost",
+  "customers.notifications.deal.lost.body": "{dealTitle} has been marked as lost"
 }

package/src/modules/customers/notifications.ts

@@ -0,0 +1,44 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'customers.deal.won',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.won.title',
+    bodyKey: 'customers.notifications.deal.won.body',
+    icon: 'trophy',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'customers.deal.lost',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.lost.title',
+    bodyKey: 'customers.notifications.deal.lost.body',
+    icon: 'x-circle',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+]
+
+export default notificationTypes

package/src/modules/dashboards/cli.ts

@@ -4,6 +4,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data/entities'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
+import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { seedAnalyticsData } from './seed/analytics'
 
 type Args = Record<string, string>
@@ -41,15 +42,25 @@ export async function seedDashboardDefaultsForTenant(
   const widgetMap = new Map(widgets.map((widget) => [widget.metadata.id, widget]))
   const resolvedWidgetIds = widgetIds && widgetIds.length
     ? widgetIds.filter((id) => widgetMap.has(id))
-    : widgets.filter((widget) => widget.metadata.defaultEnabled).map((widget) => widget.metadata.id)
+    : null
+  const defaultWidgetIds = widgets
+    .filter((widget) => widget.metadata.defaultEnabled)
+    .map((widget) => widget.metadata.id)
+  const allWidgetIds = widgets.map((widget) => widget.metadata.id)
 
-  if (!resolvedWidgetIds.length) {
+  if (resolvedWidgetIds && resolvedWidgetIds.length === 0) {
     log('No widgets resolved for dashboard seeding.')
     return false
   }
 
   await em.transactional(async (tem) => {
     for (const roleName of roleNames) {
+      const isAdminRole = roleName === 'admin' || roleName === 'superadmin'
+      const roleWidgetIds = resolvedWidgetIds ?? (isAdminRole ? allWidgetIds : defaultWidgetIds)
+      if (!roleWidgetIds.length) {
+        log(`No widgets resolved for role "${roleName}".`)
+        continue
+      }
       const role = await tem.findOne(Role, { name: roleName })
       if (!role) {
         log(`Skipping role "${roleName}" (not found)`)
@@ -62,7 +73,7 @@ export async function seedDashboardDefaultsForTenant(
         deletedAt: null,
       })
       if (existing) {
-        existing.widgetIdsJson = resolvedWidgetIds
+        existing.widgetIdsJson = roleWidgetIds
         tem.persist(existing)
         log(`Updated dashboard widgets for role "${roleName}"`)
       } else {
@@ -70,7 +81,7 @@ export async function seedDashboardDefaultsForTenant(
           roleId: String(role.id),
           tenantId,
           organizationId,
-          widgetIdsJson: resolvedWidgetIds,
+          widgetIdsJson: roleWidgetIds,
           createdAt: new Date(),
           updatedAt: null,
           deletedAt: null,
@@ -120,6 +131,45 @@ const seedDefaults: ModuleCli = {
   },
 }
 
+const enableAnalyticsWidgets: ModuleCli = {
+  command: 'enable-analytics-widgets',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const tenantId = args.tenant || args.tenantId || null
+    const organizationId = args.organization || args.organizationId || args.org || null
+    const roleCsv = args.roles || 'admin,employee'
+    if (!tenantId) {
+      console.error('Usage: mercato dashboards enable-analytics-widgets --tenant <tenantId> [--org <orgId>] [--roles admin,employee]')
+      return
+    }
+
+    const roleNames = roleCsv
+      .split(',')
+      .map((name) => name.trim())
+      .filter(Boolean)
+
+    if (!roleNames.length) {
+      console.log('No roles provided, nothing to update.')
+      return
+    }
+
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as EntityManager
+    const widgetIds = await resolveAnalyticsWidgetIds()
+
+    const updated = await appendWidgetsToRoles(em, {
+      tenantId,
+      organizationId,
+      roleNames,
+      widgetIds,
+    })
+
+    if (!updated) {
+      console.log('No dashboard role widgets updated.')
+    }
+  },
+}
+
 const seedAnalytics: ModuleCli = {
   command: 'seed-analytics',
   async run(rest) {
@@ -282,4 +332,4 @@ const debugAnalytics: ModuleCli = {
   },
 }
 
-export default [seedDefaults, seedAnalytics, debugAnalytics]
+export default [seedDefaults, enableAnalyticsWidgets, seedAnalytics, debugAnalytics]