@open-mercato/core 0.4.2-canary-ed15f2e753 → 0.4.2-canary-e2aeb1a7bf

package/dist/modules/workflows/notifications.js

@@ -0,0 +1,28 @@
+const notificationTypes = [
+  {
+    type: "workflows.task.assigned",
+    module: "workflows",
+    titleKey: "workflows.notifications.task.assigned.title",
+    bodyKey: "workflows.notifications.task.assigned.body",
+    icon: "clipboard-list",
+    severity: "info",
+    actions: [
+      {
+        id: "view",
+        labelKey: "common.view",
+        variant: "outline",
+        href: "/backend/workflows/tasks/{sourceEntityId}",
+        icon: "external-link"
+      }
+    ],
+    linkHref: "/backend/workflows/tasks/{sourceEntityId}",
+    expiresAfterHours: 168
+    // 7 days
+  }
+];
+var notifications_default = notificationTypes;
+export {
+  notifications_default as default,
+  notificationTypes
+};
+//# sourceMappingURL=notifications.js.map

package/dist/modules/workflows/notifications.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/workflows/notifications.ts"],
+  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'workflows.task.assigned',\n    module: 'workflows',\n    titleKey: 'workflows.notifications.task.assigned.title',\n    bodyKey: 'workflows.notifications.task.assigned.body',\n    icon: 'clipboard-list',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/workflows/tasks/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/workflows/tasks/{sourceEntityId}',\n    expiresAfterHours: 168, // 7 days\n  },\n]\n\nexport default notificationTypes\n"],
+  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
+  "names": []
+}

package/dist/modules/workflows/setup.js

@@ -0,0 +1,16 @@
+import { seedExampleWorkflows } from "./lib/seeds.js";
+const setup = {
+  seedDefaults: async (ctx) => {
+    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId };
+    await seedExampleWorkflows(ctx.em, scope);
+  },
+  defaultRoleFeatures: {
+    admin: ["workflows.*"]
+  }
+};
+var setup_default = setup;
+export {
+  setup_default as default,
+  setup
+};
+//# sourceMappingURL=setup.js.map

package/dist/modules/workflows/setup.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/workflows/setup.ts"],
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { seedExampleWorkflows } from './lib/seeds'\n\nexport const setup: ModuleSetupConfig = {\n  seedDefaults: async (ctx) => {\n    const scope = { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n    await seedExampleWorkflows(ctx.em, scope)\n  },\n\n  defaultRoleFeatures: {\n    admin: ['workflows.*'],\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AACA,SAAS,4BAA4B;AAE9B,MAAM,QAA2B;AAAA,EACtC,cAAc,OAAO,QAAQ;AAC3B,UAAM,QAAQ,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAC3E,UAAM,qBAAqB,IAAI,IAAI,KAAK;AAAA,EAC1C;AAAA,EAEA,qBAAqB;AAAA,IACnB,OAAO,CAAC,aAAa;AAAA,EACvB;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/workflows/subscribers/task-assigned-notification.js

@@ -0,0 +1,38 @@
+import { resolveNotificationService } from "../../notifications/lib/notificationService.js";
+import { buildNotificationFromType } from "../../notifications/lib/notificationBuilder.js";
+import { notificationTypes } from "../notifications.js";
+const metadata = {
+  event: "workflows.task.assigned",
+  persistent: true,
+  id: "workflows:task-assigned-notification"
+};
+async function handle(payload, ctx) {
+  if (!payload.assignedUserId) return;
+  try {
+    const notificationService = resolveNotificationService(ctx);
+    const typeDef = notificationTypes.find((type) => type.type === "workflows.task.assigned");
+    if (!typeDef) return;
+    const notificationInput = buildNotificationFromType(typeDef, {
+      recipientUserId: payload.assignedUserId,
+      bodyVariables: {
+        taskName: payload.taskName,
+        workflowName: payload.workflowName,
+        dueDate: payload.dueDate ?? ""
+      },
+      sourceEntityType: "workflows:user_task",
+      sourceEntityId: payload.taskId,
+      linkHref: `/backend/workflows/tasks/${payload.taskId}`
+    });
+    await notificationService.create(notificationInput, {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null
+    });
+  } catch (err) {
+    console.error("[workflows:task-assigned-notification] Failed to create notification:", err);
+  }
+}
+export {
+  handle as default,
+  metadata
+};
+//# sourceMappingURL=task-assigned-notification.js.map

package/dist/modules/workflows/subscribers/task-assigned-notification.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/subscribers/task-assigned-notification.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveNotificationService } from '../../notifications/lib/notificationService'\nimport { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'\nimport { notificationTypes } from '../notifications'\n\nexport const metadata = {\n  event: 'workflows.task.assigned',\n  persistent: true,\n  id: 'workflows:task-assigned-notification',\n}\n\ntype TaskAssignedPayload = {\n  taskId: string\n  taskName: string\n  workflowName: string\n  assignedUserId: string\n  dueDate?: string | null\n  tenantId: string\n  organizationId?: string | null\n}\n\ntype ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport default async function handle(payload: TaskAssignedPayload, ctx: ResolverContext) {\n  if (!payload.assignedUserId) return\n\n  try {\n    const notificationService = resolveNotificationService(ctx)\n    const typeDef = notificationTypes.find((type) => type.type === 'workflows.task.assigned')\n    if (!typeDef) return\n\n    const notificationInput = buildNotificationFromType(typeDef, {\n      recipientUserId: payload.assignedUserId,\n      bodyVariables: {\n        taskName: payload.taskName,\n        workflowName: payload.workflowName,\n        dueDate: payload.dueDate ?? '',\n      },\n      sourceEntityType: 'workflows:user_task',\n      sourceEntityId: payload.taskId,\n      linkHref: `/backend/workflows/tasks/${payload.taskId}`,\n    })\n\n    await notificationService.create(notificationInput, {\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    })\n  } catch (err) {\n    console.error('[workflows:task-assigned-notification] Failed to create notification:', err)\n  }\n}\n"],
+  "mappings": "AACA,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAC1C,SAAS,yBAAyB;AAE3B,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAgBA,eAAO,OAA8B,SAA8B,KAAsB;AACvF,MAAI,CAAC,QAAQ,eAAgB;AAE7B,MAAI;AACF,UAAM,sBAAsB,2BAA2B,GAAG;AAC1D,UAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,yBAAyB;AACxF,QAAI,CAAC,QAAS;AAEd,UAAM,oBAAoB,0BAA0B,SAAS;AAAA,MAC3D,iBAAiB,QAAQ;AAAA,MACzB,eAAe;AAAA,QACb,UAAU,QAAQ;AAAA,QAClB,cAAc,QAAQ;AAAA,QACtB,SAAS,QAAQ,WAAW;AAAA,MAC9B;AAAA,MACA,kBAAkB;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,UAAU,4BAA4B,QAAQ,MAAM;AAAA,IACtD,CAAC;AAED,UAAM,oBAAoB,OAAO,mBAAmB;AAAA,MAClD,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,YAAQ,MAAM,yEAAyE,GAAG;AAAA,EAC5F;AACF;",
+  "names": []
+}

package/generated/entities/notification/index.ts

@@ -0,0 +1,27 @@
+export const id = 'id'
+export const recipient_user_id = 'recipient_user_id'
+export const type = 'type'
+export const title_key = 'title_key'
+export const body_key = 'body_key'
+export const title_variables = 'title_variables'
+export const body_variables = 'body_variables'
+export const title = 'title'
+export const body = 'body'
+export const icon = 'icon'
+export const severity = 'severity'
+export const status = 'status'
+export const action_data = 'action_data'
+export const action_result = 'action_result'
+export const action_taken = 'action_taken'
+export const source_module = 'source_module'
+export const source_entity_type = 'source_entity_type'
+export const source_entity_id = 'source_entity_id'
+export const link_href = 'link_href'
+export const group_key = 'group_key'
+export const created_at = 'created_at'
+export const read_at = 'read_at'
+export const actioned_at = 'actioned_at'
+export const dismissed_at = 'dismissed_at'
+export const expires_at = 'expires_at'
+export const tenant_id = 'tenant_id'
+export const organization_id = 'organization_id'

package/generated/entities.ids.generated.ts

@@ -21,7 +21,8 @@ export const M = {
   "currencies": "currencies",
   "planner": "planner",
   "resources": "resources",
-  "staff": "staff"
+  "staff": "staff",
+  "notifications": "notifications"
 } as const
 export const E = {
   "dashboards": {
@@ -154,7 +155,6 @@ export const E = {
     "user_task": "workflows:user_task",
     "workflow_definition": "workflows:workflow_definition",
     "workflow_event": "workflows:workflow_event",
-    "workflow_event_trigger": "workflows:workflow_event_trigger",
     "workflow_instance": "workflows:workflow_instance"
   },
   "currencies": {
@@ -183,6 +183,9 @@ export const E = {
     "staff_team_member_comment": "staff:staff_team_member_comment",
     "staff_team_member_job_history": "staff:staff_team_member_job_history",
     "staff_team_role": "staff:staff_team_role"
+  },
+  "notifications": {
+    "notification": "notifications:notification"
   }
 } as const
 export type KnownModuleId = keyof typeof M

package/generated/entity-fields-registry.ts

@@ -53,6 +53,7 @@ import * as feature_toggle_override from './entities/feature_toggle_override/ind
 import * as indexer_error_log from './entities/indexer_error_log/index'
 import * as indexer_status_log from './entities/indexer_status_log/index'
 import * as module_config from './entities/module_config/index'
+import * as notification from './entities/notification/index'
 import * as organization from './entities/organization/index'
 import * as password_reset from './entities/password_reset/index'
 import * as perspective from './entities/perspective/index'
@@ -116,7 +117,6 @@ import * as user_sidebar_preference from './entities/user_sidebar_preference/ind
 import * as user_task from './entities/user_task/index'
 import * as workflow_definition from './entities/workflow_definition/index'
 import * as workflow_event from './entities/workflow_event/index'
-import * as workflow_event_trigger from './entities/workflow_event_trigger/index'
 import * as workflow_instance from './entities/workflow_instance/index'
 
 export const entityFieldsRegistry: Record<string, Record<string, string>> = {
@@ -173,6 +173,7 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
   indexer_error_log,
   indexer_status_log,
   module_config,
+  notification,
   organization,
   password_reset,
   perspective,
@@ -236,7 +237,6 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
   user_task,
   workflow_definition,
   workflow_event,
-  workflow_event_trigger,
   workflow_instance
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.4.2-canary-ed15f2e753",
+  "version": "0.4.2-canary-e2aeb1a7bf",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -207,7 +207,7 @@
     }
   },
   "dependencies": {
-    "@open-mercato/shared": "0.4.2-canary-ed15f2e753",
+    "@open-mercato/shared": "0.4.2-canary-e2aeb1a7bf",
     "@xyflow/react": "^12.6.0",
     "date-fns": "^4.1.0",
     "date-fns-tz": "^3.2.0"

package/src/__tests__/module-decoupling.test.ts

@@ -0,0 +1,356 @@
+/**
+ * Module Decoupling Tests
+ *
+ * Verifies that the application remains functional when optional modules
+ * (catalog, sales, api_keys) are disabled — removed from the generated
+ * module registry and entity IDs.
+ */
+
+// Build a reduced entity IDs registry excluding catalog, sales, api_keys
+const reducedE = {
+  dashboards: {
+    dashboard_layout: 'dashboards:dashboard_layout',
+    dashboard_role_widgets: 'dashboards:dashboard_role_widgets',
+    dashboard_user_widgets: 'dashboards:dashboard_user_widgets',
+  },
+  auth: {
+    password_reset: 'auth:password_reset',
+    role: 'auth:role',
+    role_acl: 'auth:role_acl',
+    role_sidebar_preference: 'auth:role_sidebar_preference',
+    session: 'auth:session',
+    user: 'auth:user',
+    user_acl: 'auth:user_acl',
+    user_role: 'auth:user_role',
+    user_sidebar_preference: 'auth:user_sidebar_preference',
+  },
+  directory: {
+    organization: 'directory:organization',
+    tenant: 'directory:tenant',
+  },
+  customers: {
+    customer_activity: 'customers:customer_activity',
+    customer_address: 'customers:customer_address',
+    customer_comment: 'customers:customer_comment',
+    customer_company_profile: 'customers:customer_company_profile',
+    customer_deal: 'customers:customer_deal',
+    customer_deal_company_link: 'customers:customer_deal_company_link',
+    customer_deal_person_link: 'customers:customer_deal_person_link',
+    customer_dictionary_entry: 'customers:customer_dictionary_entry',
+    customer_entity: 'customers:customer_entity',
+    customer_person_profile: 'customers:customer_person_profile',
+    customer_settings: 'customers:customer_settings',
+    customer_tag: 'customers:customer_tag',
+    customer_tag_assignment: 'customers:customer_tag_assignment',
+    customer_todo_link: 'customers:customer_todo_link',
+  },
+  entities: {
+    custom_entity: 'entities:custom_entity',
+    custom_entity_storage: 'entities:custom_entity_storage',
+    custom_field_def: 'entities:custom_field_def',
+    custom_field_entity_config: 'entities:custom_field_entity_config',
+    custom_field_value: 'entities:custom_field_value',
+    encryption_map: 'entities:encryption_map',
+  },
+  attachments: {
+    attachment: 'attachments:attachment',
+    attachment_partition: 'attachments:attachment_partition',
+  },
+} as const
+
+const reducedM = {
+  dashboards: 'dashboards',
+  auth: 'auth',
+  directory: 'directory',
+  customers: 'customers',
+  entities: 'entities',
+  attachments: 'attachments',
+} as const
+
+// Mock generated entity IDs to exclude catalog, sales, api_keys
+jest.mock('#generated/entities.ids.generated', () => ({
+  E: reducedE,
+  M: reducedM,
+}))
+
+// Mock cache dependency used by upgrade-actions
+jest.mock('@open-mercato/cache', () => ({
+  runWithCacheTenant: jest.fn((_: unknown, fn: () => unknown) => fn()),
+}))
+jest.mock('@open-mercato/shared/lib/crud/cache-stats', () => ({
+  collectCrudCacheStats: jest.fn().mockResolvedValue({ segments: [] }),
+  purgeCrudCacheSegment: jest.fn(),
+}))
+jest.mock('@open-mercato/shared/lib/crud/cache', () => ({
+  isCrudCacheEnabled: jest.fn().mockReturnValue(false),
+  resolveCrudCache: jest.fn(),
+}))
+
+import { registerEntityIds, getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { registerModules } from '@open-mercato/shared/lib/modules/registry'
+import type { Module } from '@open-mercato/shared/modules/registry'
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+
+// Build module list that mirrors enabled modules without catalog/sales/api_keys
+function buildReducedModules(): Module[] {
+  const moduleSetups: Record<string, ModuleSetupConfig> = {
+    dashboards: {
+      defaultRoleFeatures: {
+        admin: ['dashboards.*', 'dashboards.admin.assign-widgets'],
+        employee: ['dashboards.view', 'dashboards.configure'],
+      },
+    },
+    auth: {
+      defaultRoleFeatures: { admin: ['auth.*'] },
+    },
+    directory: {
+      defaultRoleFeatures: {
+        superadmin: ['directory.tenants.*'],
+        admin: ['directory.organizations.view', 'directory.organizations.manage'],
+      },
+    },
+    customers: {
+      defaultRoleFeatures: {
+        admin: [
+          'customers.*',
+          'customers.people.view',
+          'customers.people.manage',
+          'customers.companies.view',
+          'customers.companies.manage',
+          'customers.deals.view',
+          'customers.deals.manage',
+        ],
+        employee: [
+          'customers.*',
+          'customers.people.view',
+          'customers.people.manage',
+          'customers.companies.view',
+          'customers.companies.manage',
+        ],
+      },
+    },
+    entities: {
+      defaultRoleFeatures: { admin: ['entities.*'] },
+    },
+    attachments: {
+      defaultRoleFeatures: { admin: ['attachments.*', 'attachments.view', 'attachments.manage'] },
+    },
+    audit_logs: {
+      defaultRoleFeatures: { admin: ['audit_logs.*'], employee: ['audit_logs.undo_self'] },
+    },
+    dictionaries: {
+      defaultRoleFeatures: { admin: ['dictionaries.view', 'dictionaries.manage'], employee: ['dictionaries.view'] },
+    },
+    perspectives: {
+      defaultRoleFeatures: { admin: ['perspectives.use', 'perspectives.role_defaults'], employee: ['perspectives.use'] },
+    },
+    configs: {
+      defaultRoleFeatures: { admin: ['configs.system_status.view', 'configs.cache.view', 'configs.cache.manage', 'configs.manage'] },
+    },
+    query_index: {
+      defaultRoleFeatures: { admin: ['query_index.*'] },
+    },
+    feature_toggles: {
+      defaultRoleFeatures: { admin: ['feature_toggles.*'] },
+    },
+    business_rules: {
+      defaultRoleFeatures: { admin: ['business_rules.*'] },
+    },
+    workflows: {
+      defaultRoleFeatures: { admin: ['workflows.*'] },
+    },
+    currencies: {
+      defaultRoleFeatures: { admin: ['currencies.*'] },
+    },
+    staff: {
+      defaultRoleFeatures: {
+        admin: ['staff.*', 'staff.leave_requests.manage'],
+        employee: [
+          'staff.leave_requests.send',
+          'staff.my_availability.view',
+          'staff.my_availability.manage',
+          'staff.my_leave_requests.view',
+          'staff.my_leave_requests.send',
+        ],
+      },
+    },
+    resources: {
+      defaultRoleFeatures: { admin: ['resources.*'] },
+    },
+    planner: {
+      defaultRoleFeatures: { admin: ['planner.*'], employee: ['planner.view'] },
+    },
+    search: {
+      defaultRoleFeatures: { admin: ['search.*', 'vector.*'], employee: ['vector.*'] },
+    },
+  }
+
+  return Object.entries(moduleSetups).map(([id, setup]) => ({
+    id,
+    setup,
+  }))
+}
+
+const reducedModules = buildReducedModules()
+
+beforeAll(() => {
+  registerEntityIds(reducedE as any)
+  registerModules(reducedModules)
+})
+
+describe('Module Decoupling', () => {
+  describe('1. Entity IDs registry excludes disabled modules', () => {
+    it('getEntityIds() has no catalog, sales, or api_keys keys', () => {
+      const entityIds = getEntityIds()
+      expect(entityIds).not.toHaveProperty('catalog')
+      expect(entityIds).not.toHaveProperty('sales')
+      expect(entityIds).not.toHaveProperty('api_keys')
+    })
+
+    it('still contains core modules', () => {
+      const entityIds = getEntityIds()
+      expect(entityIds).toHaveProperty('auth')
+      expect(entityIds).toHaveProperty('attachments')
+      expect(entityIds).toHaveProperty('customers')
+      expect(entityIds).toHaveProperty('dashboards')
+      expect(entityIds).toHaveProperty('directory')
+      expect(entityIds).toHaveProperty('entities')
+    })
+  })
+
+  describe('2. attachments/partitions.ts — resolveDefaultPartitionCode', () => {
+    it('returns privateAttachments for null, undefined, arbitrary strings, and catalog entity IDs', async () => {
+      const { resolveDefaultPartitionCode } = await import(
+        '@open-mercato/core/modules/attachments/lib/partitions'
+      )
+
+      expect(resolveDefaultPartitionCode(null)).toBe('privateAttachments')
+      expect(resolveDefaultPartitionCode(undefined)).toBe('privateAttachments')
+      expect(resolveDefaultPartitionCode('some-entity')).toBe('privateAttachments')
+      // When catalog is disabled, the literal string also falls through
+      expect(resolveDefaultPartitionCode('catalog:catalog_product')).toBe('privateAttachments')
+    })
+  })
+
+  describe('3. attachments/assignmentDetails.ts — resolveAssignmentEnrichments', () => {
+    it('does not crash with empty assignments and null queryEngine', async () => {
+      const { resolveAssignmentEnrichments } = await import(
+        '@open-mercato/core/modules/attachments/lib/assignmentDetails'
+      )
+
+      const result = await resolveAssignmentEnrichments([], {
+        queryEngine: null,
+        tenantId: 'tenant-1',
+        organizationId: 'org-1',
+      })
+      expect(result).toBeInstanceOf(Map)
+      expect(result.size).toBe(0)
+    })
+
+    it('does not crash with assignments referencing catalog entity IDs', async () => {
+      const { resolveAssignmentEnrichments } = await import(
+        '@open-mercato/core/modules/attachments/lib/assignmentDetails'
+      )
+
+      const result = await resolveAssignmentEnrichments(
+        [{ type: 'catalog:catalog_product', id: 'some-uuid' }],
+        {
+          queryEngine: null,
+          tenantId: 'tenant-1',
+          organizationId: 'org-1',
+        },
+      )
+      expect(result).toBeInstanceOf(Map)
+      expect(result.size).toBe(0)
+    })
+  })
+
+  describe('4. Role feature merging', () => {
+    it('admin features contain enabled module features', () => {
+      const adminFeatures: string[] = []
+      for (const mod of reducedModules) {
+        const roleFeatures = mod.setup?.defaultRoleFeatures
+        if (roleFeatures?.admin) adminFeatures.push(...roleFeatures.admin)
+      }
+
+      expect(adminFeatures).toContain('auth.*')
+      expect(adminFeatures).toContain('attachments.*')
+      expect(adminFeatures).toContain('dashboards.*')
+      expect(adminFeatures).toContain('customers.*')
+      expect(adminFeatures).toContain('entities.*')
+      expect(adminFeatures).toContain('query_index.*')
+      expect(adminFeatures).toContain('configs.manage')
+      expect(adminFeatures).toContain('directory.organizations.manage')
+    })
+
+    it('admin features do NOT contain disabled module features', () => {
+      const adminFeatures: string[] = []
+      for (const mod of reducedModules) {
+        const roleFeatures = mod.setup?.defaultRoleFeatures
+        if (roleFeatures?.admin) adminFeatures.push(...roleFeatures.admin)
+      }
+
+      expect(adminFeatures).not.toContain('catalog.*')
+      expect(adminFeatures).not.toContain('sales.*')
+      expect(adminFeatures).not.toContain('api_keys.*')
+    })
+
+    it('employee features similarly exclude disabled module features', () => {
+      const employeeFeatures: string[] = []
+      for (const mod of reducedModules) {
+        const roleFeatures = mod.setup?.defaultRoleFeatures
+        if (roleFeatures?.employee) employeeFeatures.push(...roleFeatures.employee)
+      }
+
+      expect(employeeFeatures).not.toContain('catalog.*')
+      expect(employeeFeatures).not.toContain('sales.*')
+      expect(employeeFeatures).not.toContain('api_keys.*')
+
+      // Enabled modules' employee features are present
+      expect(employeeFeatures).toContain('customers.*')
+      expect(employeeFeatures).toContain('dashboards.view')
+      expect(employeeFeatures).toContain('audit_logs.undo_self')
+      expect(employeeFeatures).toContain('vector.*')
+    })
+
+    it('superadmin features come from enabled modules only', () => {
+      const superadminFeatures: string[] = []
+      for (const mod of reducedModules) {
+        const roleFeatures = mod.setup?.defaultRoleFeatures
+        if (roleFeatures?.superadmin) superadminFeatures.push(...roleFeatures.superadmin)
+      }
+
+      expect(superadminFeatures).toContain('directory.tenants.*')
+      expect(superadminFeatures).not.toContain('catalog.*')
+      expect(superadminFeatures).not.toContain('sales.*')
+    })
+  })
+
+  describe('5. configs/upgrade-actions.ts loads without crashing', () => {
+    it('imports and exposes upgradeActions array and compareVersions function', async () => {
+      const mod = await import(
+        '@open-mercato/core/modules/configs/lib/upgrade-actions'
+      )
+
+      expect(Array.isArray(mod.upgradeActions)).toBe(true)
+      expect(typeof mod.compareVersions).toBe('function')
+    })
+
+    it('upgradeActions array is defined and non-empty', async () => {
+      const mod = await import(
+        '@open-mercato/core/modules/configs/lib/upgrade-actions'
+      )
+
+      expect(mod.upgradeActions.length).toBeGreaterThan(0)
+    })
+
+    it('actionsUpToVersion returns actions without crashing', async () => {
+      const mod = await import(
+        '@open-mercato/core/modules/configs/lib/upgrade-actions'
+      )
+
+      const actions = mod.actionsUpToVersion('99.99.99')
+      expect(Array.isArray(actions)).toBe(true)
+    })
+  })
+})

package/src/modules/api_docs/frontend/docs/api/page.tsx

@@ -2,6 +2,7 @@ import ApiDocsExplorer from './Explorer'
 import { getModules } from '@open-mercato/shared/lib/i18n/server'
 import { buildOpenApiDocument } from '@open-mercato/shared/lib/openapi'
 import { resolveApiDocsBaseUrl } from '@open-mercato/core/modules/api_docs/lib/resources'
+import { APP_VERSION } from '@open-mercato/shared/lib/version'
 
 type ExplorerOperation = {
   id: string
@@ -54,7 +55,7 @@ export default async function ApiDocsViewerPage() {
   const modules = getModules()
   const doc = buildOpenApiDocument(modules, {
     title: 'Open Mercato API',
-    version: '1.0.0',
+    version: APP_VERSION,
     description: 'Auto-generated OpenAPI definition for all enabled modules.',
     servers: [{ url: baseUrl, description: 'Default environment' }],
     baseUrlForExamples: baseUrl,
@@ -67,7 +68,7 @@ export default async function ApiDocsViewerPage() {
   return (
     <ApiDocsExplorer
       title={doc.info?.title ?? 'Open Mercato API'}
-      version={doc.info?.version ?? '1.0.0'}
+      version={doc.info?.version ?? APP_VERSION}
       description={doc.info?.description}
       operations={operations}
       tagOrder={tagOrder}

package/src/modules/api_keys/backend/api-keys/page.tsx

@@ -175,7 +175,7 @@ export default function ApiKeysListPage() {
           perspective={{ tableId: 'api_keys.list' }}
           rowActions={(row) => (
             <RowActions items={[
-              { label: t('common.delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
+              { id: 'delete', label: t('common.delete'), destructive: true, onSelect: () => { void handleDelete(row) } },
             ]} />
           )}
           pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}

package/src/modules/api_keys/setup.ts

@@ -0,0 +1,9 @@
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+
+export const setup: ModuleSetupConfig = {
+  defaultRoleFeatures: {
+    admin: ['api_keys.*'],
+  },
+}
+
+export default setup

package/src/modules/attachments/components/AttachmentLibrary.tsx

@@ -893,8 +893,8 @@ export function AttachmentLibrary() {
               {assignments.map((assignment) => {
                 const label = assignment.label?.trim() || assignment.id
                 const hideType =
-                  assignment.type === E.catalog.catalog_product ||
-                  assignment.type === E.catalog.catalog_product_variant
+                  assignment.type === (E as any).catalog?.catalog_product ||
+                  assignment.type === (E as any).catalog?.catalog_product_variant
                 const content = hideType ? label : `${assignment.type}: ${label}`
                 return assignment.href ? (
                   <a
@@ -1056,6 +1056,7 @@ export function AttachmentLibrary() {
           <RowActions
             items={[
               {
+                id: 'open',
                 label: t('attachments.library.actions.open', 'Open'),
                 onSelect: () => {
                   if (!row.url) return
@@ -1063,10 +1064,12 @@ export function AttachmentLibrary() {
                 },
               },
               {
+                id: 'edit',
                 label: t('attachments.library.actions.edit', 'Edit metadata'),
                 onSelect: () => openMetadataDialog(row),
               },
               {
+                id: 'copy-url',
                 label: t('attachments.library.actions.copyUrl', 'Copy URL'),
                 onSelect: () => {
                   if (!row.url) {
@@ -1091,6 +1094,7 @@ export function AttachmentLibrary() {
                 },
               },
               {
+                id: 'delete',
                 label: t('attachments.library.actions.delete', 'Delete'),
                 destructive: true,
                 onSelect: () => openDeleteDialog(row),