@open-mercato/core 0.4.2-canary-ed15f2e753 → 0.4.2-canary-e2aeb1a7bf

package/dist/modules/auth/frontend/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/frontend/login.tsx"],
-  "sourcesContent": ["\"use client\"\nimport { useState } from 'react'\nimport Image from 'next/image'\nimport Link from 'next/link'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\nimport { clearAllOperations } from '@open-mercato/ui/backend/operations/store'\n\nfunction extractErrorMessage(payload: unknown): string | null {\n  if (!payload) return null\n  if (typeof payload === 'string') return payload\n  if (Array.isArray(payload)) {\n    for (const entry of payload) {\n      const resolved = extractErrorMessage(entry)\n      if (resolved) return resolved\n    }\n    return null\n  }\n  if (typeof payload === 'object') {\n    const record = payload as Record<string, unknown>\n    const candidates: unknown[] = [\n      record.error,\n      record.message,\n      record.detail,\n      record.details,\n      record.description,\n    ]\n    for (const candidate of candidates) {\n      const resolved = extractErrorMessage(candidate)\n      if (resolved) return resolved\n    }\n  }\n  return null\n}\n\nfunction looksLikeJsonString(value: string): boolean {\n  const trimmed = value.trim()\n  return trimmed.startsWith('{') || trimmed.startsWith('[')\n}\n\nexport default function LoginPage() {\n  const t = useT()\n  const translate = (key: string, fallback: string, params?: Record<string, string | number>) =>\n    translateWithFallback(t, key, fallback, params)\n  const router = useRouter()\n  const searchParams = useSearchParams()\n  const requireRole = (searchParams.get('requireRole') || searchParams.get('role') || '').trim()\n  const requireFeature = (searchParams.get('requireFeature') || '').trim()\n  const requiredRoles = requireRole ? requireRole.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const requiredFeatures = requireFeature ? requireFeature.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const translatedRoles = requiredRoles.map((role) => translate(`auth.roles.${role}`, role))\n  const translatedFeatures = requiredFeatures.map((feature) => translate(`features.${feature}`, feature))\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      if (requiredRoles.length) form.set('requireRole', requiredRoles.join(','))\n      const res = await fetch('/api/auth/login', { method: 'POST', body: form })\n      if (res.redirected) {\n        clearAllOperations()\n        // NextResponse.redirect from API\n        router.replace(res.url)\n        return\n      }\n      if (!res.ok) {\n        const fallback = (() => {\n          if (res.status === 403) {\n            return translate(\n              'auth.login.errors.permissionDenied',\n              'You do not have permission to access this area. Please contact your administrator.',\n            )\n          }\n          if (res.status === 401 || res.status === 400) {\n            return translate('auth.login.errors.invalidCredentials', 'Invalid email or password')\n          }\n          return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n        })()\n        const cloned = res.clone()\n        let errorMessage = ''\n        const contentType = res.headers.get('content-type') || ''\n        if (contentType.includes('application/json')) {\n          try {\n            const data = await res.json()\n            errorMessage = extractErrorMessage(data) || ''\n          } catch {\n            try {\n              const text = await cloned.text()\n              const trimmed = text.trim()\n              if (trimmed && !looksLikeJsonString(trimmed)) {\n                errorMessage = trimmed\n              }\n            } catch {\n              errorMessage = ''\n            }\n          }\n        } else {\n          try {\n            const text = await res.text()\n            const trimmed = text.trim()\n            if (trimmed && !looksLikeJsonString(trimmed)) {\n              errorMessage = trimmed\n            }\n          } catch {\n            errorMessage = ''\n          }\n        }\n        setError(errorMessage || fallback)\n        return\n      }\n      // In case API returns 200 with JSON\n      const data = await res.json().catch(() => null)\n      clearAllOperations()\n      if (data && data.redirect) {\n        router.replace(data.redirect)\n      }\n    } catch (err: unknown) {\n      // Handle any errors thrown (e.g., network errors or thrown exceptions)\n      const message = err instanceof Error ? err.message : ''\n      setError(message || translate('auth.login.errors.generic', 'An error occurred. Please try again.'))\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader className=\"flex flex-col items-center gap-4 text-center p-10\">\n          <Image alt={translate('auth.login.logoAlt', 'Open Mercato logo')} src=\"/open-mercato.svg\" width={150} height={150} priority />\n          <h1 className=\"text-2xl font-semibold\">{translate('auth.login.brandName', 'Open Mercato')}</h1>\n          <CardDescription>{translate('auth.login.subtitle', 'Access your workspace')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} noValidate>\n            {!!translatedRoles.length && (\n              <div className=\"rounded-md border border-blue-200 bg-blue-50 px-3 py-2 text-center text-xs text-blue-900\">\n                {translate(\n                  translatedRoles.length > 1 ? 'auth.login.requireRolesMessage' : 'auth.login.requireRoleMessage',\n                  translatedRoles.length > 1\n                    ? 'Access requires one of the following roles: {roles}'\n                    : 'Access requires role: {roles}',\n                  { roles: translatedRoles.join(', ') },\n                )}\n              </div>\n            )}\n            {!!translatedFeatures.length && (\n              <div className=\"rounded-md border border-blue-200 bg-blue-50 px-3 py-2 text-center text-xs text-blue-900\">\n                {translate('auth.login.featureDenied', \"You don't have access to this feature ({feature}). Please contact your administrator.\", {\n                  feature: translatedFeatures.join(', '),\n                })}\n              </div>\n            )}\n            {error && (\n              <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-sm text-red-700\" role=\"alert\" aria-live=\"polite\">\n                {error}\n              </div>\n            )}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"email\">{t('auth.email')}</Label>\n              <Input id=\"email\" name=\"email\" type=\"email\" required aria-invalid={!!error} />\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.password')}</Label>\n              <Input id=\"password\" name=\"password\" type=\"password\" required aria-invalid={!!error} />\n            </div>\n            <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n              <input type=\"checkbox\" name=\"remember\" className=\"accent-foreground\" />\n              <span>{translate('auth.login.rememberMe', 'Remember me')}</span>\n            </label>\n            <button disabled={submitting} className=\"h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60\">\n              {submitting ? translate('auth.login.loading', 'Loading...') : translate('auth.signIn', 'Sign in')}\n            </button>\n            <div className=\"text-xs text-muted-foreground mt-2\">\n              <Link className=\"underline\" href=\"/reset\">\n                {translate('auth.login.forgotPassword', 'Forgot password?')}\n              </Link>\n            </div>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
-  "mappings": ";AAwIQ,SACE,KADF;AAvIR,SAAS,gBAAgB;AACzB,OAAO,WAAW;AAClB,OAAO,UAAU;AACjB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,MAAM,aAAa,YAAuB,uBAAuB;AAC1E,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,0BAA0B;AAEnC,SAAS,oBAAoB,SAAiC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,oBAAoB,KAAK;AAC1C,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,WAAW,oBAAoB,SAAS;AAC9C,UAAI,SAAU,QAAO;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG;AAC1D;AAEe,SAAR,YAA6B;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,YAAY,CAAC,KAAa,UAAkB,WAChD,sBAAsB,GAAG,KAAK,UAAU,MAAM;AAChD,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,aAAa,IAAI,aAAa,KAAK,aAAa,IAAI,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,kBAAkB,aAAa,IAAI,gBAAgB,KAAK,IAAI,KAAK;AACvE,QAAM,gBAAgB,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AAC3G,QAAM,mBAAmB,iBAAiB,eAAe,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AACpH,QAAM,kBAAkB,cAAc,IAAI,CAAC,SAAS,UAAU,cAAc,IAAI,IAAI,IAAI,CAAC;AACzF,QAAM,qBAAqB,iBAAiB,IAAI,CAAC,YAAY,UAAU,YAAY,OAAO,IAAI,OAAO,CAAC;AACtG,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAElD,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAI,cAAc,OAAQ,MAAK,IAAI,eAAe,cAAc,KAAK,GAAG,CAAC;AACzE,YAAM,MAAM,MAAM,MAAM,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACzE,UAAI,IAAI,YAAY;AAClB,2BAAmB;AAEnB,eAAO,QAAQ,IAAI,GAAG;AACtB;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,YAAY,MAAM;AACtB,cAAI,IAAI,WAAW,KAAK;AACtB,mBAAO;AAAA,cACL;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,mBAAO,UAAU,wCAAwC,2BAA2B;AAAA,UACtF;AACA,iBAAO,UAAU,6BAA6B,sCAAsC;AAAA,QACtF,GAAG;AACH,cAAM,SAAS,IAAI,MAAM;AACzB,YAAI,eAAe;AACnB,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,YAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,cAAI;AACF,kBAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,2BAAe,oBAAoBA,KAAI,KAAK;AAAA,UAC9C,QAAQ;AACN,gBAAI;AACF,oBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,oBAAM,UAAU,KAAK,KAAK;AAC1B,kBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,+BAAe;AAAA,cACjB;AAAA,YACF,QAAQ;AACN,6BAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,OAAO;AACL,cAAI;AACF,kBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,kBAAM,UAAU,KAAK,KAAK;AAC1B,gBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,6BAAe;AAAA,YACjB;AAAA,UACF,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,iBAAS,gBAAgB,QAAQ;AACjC;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,yBAAmB;AACnB,UAAI,QAAQ,KAAK,UAAU;AACzB,eAAO,QAAQ,KAAK,QAAQ;AAAA,MAC9B;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS,WAAW,UAAU,6BAA6B,sCAAsC,CAAC;AAAA,IACpG,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cAAW,WAAU,qDACpB;AAAA,0BAAC,SAAM,KAAK,UAAU,sBAAsB,mBAAmB,GAAG,KAAI,qBAAoB,OAAO,KAAK,QAAQ,KAAK,UAAQ,MAAC;AAAA,MAC5H,oBAAC,QAAG,WAAU,0BAA0B,oBAAU,wBAAwB,cAAc,GAAE;AAAA,MAC1F,oBAAC,mBAAiB,oBAAU,uBAAuB,uBAAuB,GAAE;AAAA,OAC9E;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,YAAU,MACxD;AAAA,OAAC,CAAC,gBAAgB,UACjB,oBAAC,SAAI,WAAU,4FACZ;AAAA,QACC,gBAAgB,SAAS,IAAI,mCAAmC;AAAA,QAChE,gBAAgB,SAAS,IACrB,wDACA;AAAA,QACJ,EAAE,OAAO,gBAAgB,KAAK,IAAI,EAAE;AAAA,MACtC,GACF;AAAA,MAED,CAAC,CAAC,mBAAmB,UACpB,oBAAC,SAAI,WAAU,4FACZ,oBAAU,4BAA4B,yFAAyF;AAAA,QAC9H,SAAS,mBAAmB,KAAK,IAAI;AAAA,MACvC,CAAC,GACH;AAAA,MAED,SACC,oBAAC,SAAI,WAAU,yFAAwF,MAAK,SAAQ,aAAU,UAC3H,iBACH;AAAA,MAEF,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,SAAS,YAAE,YAAY,GAAE;AAAA,QACxC,oBAAC,SAAM,IAAG,SAAQ,MAAK,SAAQ,MAAK,SAAQ,UAAQ,MAAC,gBAAc,CAAC,CAAC,OAAO;AAAA,SAC9E;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,eAAe,GAAE;AAAA,QAC9C,oBAAC,SAAM,IAAG,YAAW,MAAK,YAAW,MAAK,YAAW,UAAQ,MAAC,gBAAc,CAAC,CAAC,OAAO;AAAA,SACvF;AAAA,MACA,qBAAC,WAAM,WAAU,yDACf;AAAA,4BAAC,WAAM,MAAK,YAAW,MAAK,YAAW,WAAU,qBAAoB;AAAA,QACrE,oBAAC,UAAM,oBAAU,yBAAyB,aAAa,GAAE;AAAA,SAC3D;AAAA,MACA,oBAAC,YAAO,UAAU,YAAY,WAAU,sGACrC,uBAAa,UAAU,sBAAsB,YAAY,IAAI,UAAU,eAAe,SAAS,GAClG;AAAA,MACA,oBAAC,SAAI,WAAU,sCACb,8BAAC,QAAK,WAAU,aAAY,MAAK,UAC9B,oBAAU,6BAA6B,kBAAkB,GAC5D,GACF;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport { useCallback, useEffect, useState } from 'react'\nimport Image from 'next/image'\nimport Link from 'next/link'\nimport { useRouter, useSearchParams } from 'next/navigation'\nimport { Card, CardContent, CardHeader, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\nimport { clearAllOperations } from '@open-mercato/ui/backend/operations/store'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { X } from 'lucide-react'\n\nconst loginTenantKey = 'om_login_tenant'\nconst loginTenantCookieMaxAge = 60 * 60 * 24 * 14\n\nfunction readTenantCookie() {\n  if (typeof document === 'undefined') return null\n  const entries = document.cookie.split(';')\n  for (const entry of entries) {\n    const [name, ...rest] = entry.trim().split('=')\n    if (name === loginTenantKey) return decodeURIComponent(rest.join('='))\n  }\n  return null\n}\n\nfunction setTenantCookie(value: string) {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=${encodeURIComponent(value)}; path=/; max-age=${loginTenantCookieMaxAge}; samesite=lax`\n}\n\nfunction clearTenantCookie() {\n  if (typeof document === 'undefined') return\n  document.cookie = `${loginTenantKey}=; path=/; max-age=0; samesite=lax`\n}\n\nfunction extractErrorMessage(payload: unknown): string | null {\n  if (!payload) return null\n  if (typeof payload === 'string') return payload\n  if (Array.isArray(payload)) {\n    for (const entry of payload) {\n      const resolved = extractErrorMessage(entry)\n      if (resolved) return resolved\n    }\n    return null\n  }\n  if (typeof payload === 'object') {\n    const record = payload as Record<string, unknown>\n    const candidates: unknown[] = [\n      record.error,\n      record.message,\n      record.detail,\n      record.details,\n      record.description,\n    ]\n    for (const candidate of candidates) {\n      const resolved = extractErrorMessage(candidate)\n      if (resolved) return resolved\n    }\n  }\n  return null\n}\n\nfunction looksLikeJsonString(value: string): boolean {\n  const trimmed = value.trim()\n  return trimmed.startsWith('{') || trimmed.startsWith('[')\n}\n\nexport default function LoginPage() {\n  const t = useT()\n  const translate = useCallback(\n    (key: string, fallback: string, params?: Record<string, string | number>) =>\n      translateWithFallback(t, key, fallback, params),\n    [t],\n  )\n  const router = useRouter()\n  const searchParams = useSearchParams()\n  const requireRole = (searchParams.get('requireRole') || searchParams.get('role') || '').trim()\n  const requireFeature = (searchParams.get('requireFeature') || '').trim()\n  const requiredRoles = requireRole ? requireRole.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const requiredFeatures = requireFeature ? requireFeature.split(',').map((value) => value.trim()).filter(Boolean) : []\n  const translatedRoles = requiredRoles.map((role) => translate(`auth.roles.${role}`, role))\n  const translatedFeatures = requiredFeatures.map((feature) => translate(`features.${feature}`, feature))\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const [tenantId, setTenantId] = useState<string | null>(null)\n  const [tenantName, setTenantName] = useState<string | null>(null)\n  const [tenantLoading, setTenantLoading] = useState(false)\n  const [tenantInvalid, setTenantInvalid] = useState<string | null>(null)\n  const showTenantInvalid = tenantId != null && tenantInvalid === tenantId\n\n  useEffect(() => {\n    const tenantParam = (searchParams.get('tenant') || '').trim()\n    if (tenantParam) {\n      setTenantId(tenantParam)\n      window.localStorage.setItem(loginTenantKey, tenantParam)\n      setTenantCookie(tenantParam)\n      return\n    }\n    const storedTenant = window.localStorage.getItem(loginTenantKey) || readTenantCookie()\n    if (storedTenant) {\n      setTenantId(storedTenant)\n    }\n  }, [searchParams])\n\n  useEffect(() => {\n    if (!tenantId) {\n      setTenantName(null)\n      setTenantInvalid(null)\n      return\n    }\n    if (tenantInvalid === tenantId) {\n      setTenantName(null)\n      setTenantLoading(false)\n      return\n    }\n    let active = true\n    setTenantLoading(true)\n    setTenantInvalid(null)\n    apiCall<{ ok: boolean; tenant?: { id: string; name: string }; error?: string }>(\n      `/api/directory/tenants/lookup?tenantId=${encodeURIComponent(tenantId)}`,\n    )\n      .then(({ result }) => {\n        if (!active) return\n        if (result?.ok && result.tenant) {\n          setTenantName(result.tenant.name)\n          return\n        }\n        const message = translate('auth.login.errors.tenantInvalid', 'Tenant not found. Clear the tenant selection and try again.')\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .catch(() => {\n        if (!active) return\n        setTenantName(null)\n        setTenantInvalid(tenantId)\n        setError(null)\n      })\n      .finally(() => {\n        if (active) setTenantLoading(false)\n      })\n    return () => {\n      active = false\n    }\n  }, [tenantId, translate])\n\n  function handleClearTenant() {\n    window.localStorage.removeItem(loginTenantKey)\n    clearTenantCookie()\n    setTenantId(null)\n    setTenantName(null)\n    setTenantInvalid(null)\n    const params = new URLSearchParams(searchParams)\n    params.delete('tenant')\n    setError(null)\n    const query = params.toString()\n    router.replace(query ? `/login?${query}` : '/login')\n  }\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      if (requiredRoles.length) form.set('requireRole', requiredRoles.join(','))\n      const res = await fetch('/api/auth/login', { method: 'POST', body: form })\n      if (res.redirected) {\n        clearAllOperations()\n        // NextResponse.redirect from API\n        router.replace(res.url)\n        return\n      }\n      if (!res.ok) {\n        const fallback = (() => {\n          if (res.status === 403) {\n            return translate(\n              'auth.login.errors.permissionDenied',\n              'You do not have permission to access this area. Please contact your administrator.',\n            )\n          }\n          if (res.status === 401 || res.status === 400) {\n            return translate('auth.login.errors.invalidCredentials', 'Invalid email or password')\n          }\n          return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n        })()\n        const cloned = res.clone()\n        let errorMessage = ''\n        const contentType = res.headers.get('content-type') || ''\n        if (contentType.includes('application/json')) {\n          try {\n            const data = await res.json()\n            errorMessage = extractErrorMessage(data) || ''\n          } catch {\n            try {\n              const text = await cloned.text()\n              const trimmed = text.trim()\n              if (trimmed && !looksLikeJsonString(trimmed)) {\n                errorMessage = trimmed\n              }\n            } catch {\n              errorMessage = ''\n            }\n          }\n        } else {\n          try {\n            const text = await res.text()\n            const trimmed = text.trim()\n            if (trimmed && !looksLikeJsonString(trimmed)) {\n              errorMessage = trimmed\n            }\n          } catch {\n            errorMessage = ''\n          }\n        }\n        setError(errorMessage || fallback)\n        return\n      }\n      // In case API returns 200 with JSON\n      const data = await res.json().catch(() => null)\n      clearAllOperations()\n      if (data && data.redirect) {\n        router.replace(data.redirect)\n      }\n    } catch (err: unknown) {\n      // Handle any errors thrown (e.g., network errors or thrown exceptions)\n      const message = err instanceof Error ? err.message : ''\n      setError(message || translate('auth.login.errors.generic', 'An error occurred. Please try again.'))\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader className=\"flex flex-col items-center gap-4 text-center p-10\">\n          <Image alt={translate('auth.login.logoAlt', 'Open Mercato logo')} src=\"/open-mercato.svg\" width={150} height={150} priority />\n          <h1 className=\"text-2xl font-semibold\">{translate('auth.login.brandName', 'Open Mercato')}</h1>\n          <CardDescription>{translate('auth.login.subtitle', 'Access your workspace')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit} noValidate>\n            {tenantId ? (\n              <input type=\"hidden\" name=\"tenantId\" value={tenantId} />\n            ) : null}\n            {!!translatedRoles.length && (\n              <div className=\"rounded-md border border-blue-200 bg-blue-50 px-3 py-2 text-center text-xs text-blue-900\">\n                {translate(\n                  translatedRoles.length > 1 ? 'auth.login.requireRolesMessage' : 'auth.login.requireRoleMessage',\n                  translatedRoles.length > 1\n                    ? 'Access requires one of the following roles: {roles}'\n                    : 'Access requires role: {roles}',\n                  { roles: translatedRoles.join(', ') },\n                )}\n              </div>\n            )}\n            {!!translatedFeatures.length && (\n              <div className=\"rounded-md border border-blue-200 bg-blue-50 px-3 py-2 text-center text-xs text-blue-900\">\n                {translate('auth.login.featureDenied', \"You don't have access to this feature ({feature}). Please contact your administrator.\", {\n                  feature: translatedFeatures.join(', '),\n                })}\n              </div>\n            )}\n            {showTenantInvalid ? (\n              <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-xs text-red-700\">\n                <div className=\"font-medium\">{translate('auth.login.errors.tenantInvalid', 'Tenant not found. Clear the tenant selection and try again.')}</div>\n                <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-red-300 text-red-700\" onClick={handleClearTenant}>\n                  <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                  {translate('auth.login.tenantClear', 'Clear')}\n                </Button>\n              </div>\n            ) : tenantId ? (\n              <div className=\"rounded-md border border-emerald-200 bg-emerald-50 px-3 py-2 text-center text-xs text-emerald-900\">\n                <div className=\"font-medium\">\n                  {tenantLoading\n                    ? translate('auth.login.tenantLoading', 'Loading tenant details...')\n                    : translate('auth.login.tenantBanner', \"You're logging in to {tenant} tenant.\", {\n                        tenant: tenantName || tenantId,\n                      })}\n                </div>\n                <Button type=\"button\" variant=\"outline\" size=\"sm\" className=\"mt-2 border-emerald-300 text-emerald-900\" onClick={handleClearTenant}>\n                  <X className=\"mr-2 size-4\" aria-hidden=\"true\" />\n                  {translate('auth.login.tenantClear', 'Clear')}\n                </Button>\n              </div>\n            ) : null}\n            {error && !showTenantInvalid && (\n              <div className=\"rounded-md border border-red-200 bg-red-50 px-3 py-2 text-center text-sm text-red-700\" role=\"alert\" aria-live=\"polite\">\n                {error}\n              </div>\n            )}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"email\">{t('auth.email')}</Label>\n              <Input id=\"email\" name=\"email\" type=\"email\" required aria-invalid={!!error} />\n            </div>\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.password')}</Label>\n              <Input id=\"password\" name=\"password\" type=\"password\" required aria-invalid={!!error} />\n            </div>\n            <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n              <input type=\"checkbox\" name=\"remember\" className=\"accent-foreground\" />\n              <span>{translate('auth.login.rememberMe', 'Remember me')}</span>\n            </label>\n            <button disabled={submitting} className=\"h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60\">\n              {submitting ? translate('auth.login.loading', 'Loading...') : translate('auth.signIn', 'Sign in')}\n            </button>\n            <div className=\"text-xs text-muted-foreground mt-2\">\n              <Link className=\"underline\" href=\"/reset\">\n                {translate('auth.login.forgotPassword', 'Forgot password?')}\n              </Link>\n            </div>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
+  "mappings": ";AA+OQ,SACE,KADF;AA9OR,SAAS,aAAa,WAAW,gBAAgB;AACjD,OAAO,WAAW;AAClB,OAAO,UAAU;AACjB,SAAS,WAAW,uBAAuB;AAC3C,SAAS,MAAM,aAAa,YAAY,uBAAuB;AAC/D,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,cAAc;AACvB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,SAAS;AAElB,MAAM,iBAAiB;AACvB,MAAM,0BAA0B,KAAK,KAAK,KAAK;AAE/C,SAAS,mBAAmB;AAC1B,MAAI,OAAO,aAAa,YAAa,QAAO;AAC5C,QAAM,UAAU,SAAS,OAAO,MAAM,GAAG;AACzC,aAAW,SAAS,SAAS;AAC3B,UAAM,CAAC,MAAM,GAAG,IAAI,IAAI,MAAM,KAAK,EAAE,MAAM,GAAG;AAC9C,QAAI,SAAS,eAAgB,QAAO,mBAAmB,KAAK,KAAK,GAAG,CAAC;AAAA,EACvE;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAAe;AACtC,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc,IAAI,mBAAmB,KAAK,CAAC,qBAAqB,uBAAuB;AAC9G;AAEA,SAAS,oBAAoB;AAC3B,MAAI,OAAO,aAAa,YAAa;AACrC,WAAS,SAAS,GAAG,cAAc;AACrC;AAEA,SAAS,oBAAoB,SAAiC;AAC5D,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,MAAI,MAAM,QAAQ,OAAO,GAAG;AAC1B,eAAW,SAAS,SAAS;AAC3B,YAAM,WAAW,oBAAoB,KAAK;AAC1C,UAAI,SAAU,QAAO;AAAA,IACvB;AACA,WAAO;AAAA,EACT;AACA,MAAI,OAAO,YAAY,UAAU;AAC/B,UAAM,SAAS;AACf,UAAM,aAAwB;AAAA,MAC5B,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,MACP,OAAO;AAAA,IACT;AACA,eAAW,aAAa,YAAY;AAClC,YAAM,WAAW,oBAAoB,SAAS;AAC9C,UAAI,SAAU,QAAO;AAAA,IACvB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,oBAAoB,OAAwB;AACnD,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,GAAG;AAC1D;AAEe,SAAR,YAA6B;AAClC,QAAM,IAAI,KAAK;AACf,QAAM,YAAY;AAAA,IAChB,CAAC,KAAa,UAAkB,WAC9B,sBAAsB,GAAG,KAAK,UAAU,MAAM;AAAA,IAChD,CAAC,CAAC;AAAA,EACJ;AACA,QAAM,SAAS,UAAU;AACzB,QAAM,eAAe,gBAAgB;AACrC,QAAM,eAAe,aAAa,IAAI,aAAa,KAAK,aAAa,IAAI,MAAM,KAAK,IAAI,KAAK;AAC7F,QAAM,kBAAkB,aAAa,IAAI,gBAAgB,KAAK,IAAI,KAAK;AACvE,QAAM,gBAAgB,cAAc,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AAC3G,QAAM,mBAAmB,iBAAiB,eAAe,MAAM,GAAG,EAAE,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI,CAAC;AACpH,QAAM,kBAAkB,cAAc,IAAI,CAAC,SAAS,UAAU,cAAc,IAAI,IAAI,IAAI,CAAC;AACzF,QAAM,qBAAqB,iBAAiB,IAAI,CAAC,YAAY,UAAU,YAAY,OAAO,IAAI,OAAO,CAAC;AACtG,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,SAAwB,IAAI;AAChE,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAS,KAAK;AACxD,QAAM,CAAC,eAAe,gBAAgB,IAAI,SAAwB,IAAI;AACtE,QAAM,oBAAoB,YAAY,QAAQ,kBAAkB;AAEhE,YAAU,MAAM;AACd,UAAM,eAAe,aAAa,IAAI,QAAQ,KAAK,IAAI,KAAK;AAC5D,QAAI,aAAa;AACf,kBAAY,WAAW;AACvB,aAAO,aAAa,QAAQ,gBAAgB,WAAW;AACvD,sBAAgB,WAAW;AAC3B;AAAA,IACF;AACA,UAAM,eAAe,OAAO,aAAa,QAAQ,cAAc,KAAK,iBAAiB;AACrF,QAAI,cAAc;AAChB,kBAAY,YAAY;AAAA,IAC1B;AAAA,EACF,GAAG,CAAC,YAAY,CAAC;AAEjB,YAAU,MAAM;AACd,QAAI,CAAC,UAAU;AACb,oBAAc,IAAI;AAClB,uBAAiB,IAAI;AACrB;AAAA,IACF;AACA,QAAI,kBAAkB,UAAU;AAC9B,oBAAc,IAAI;AAClB,uBAAiB,KAAK;AACtB;AAAA,IACF;AACA,QAAI,SAAS;AACb,qBAAiB,IAAI;AACrB,qBAAiB,IAAI;AACrB;AAAA,MACE,0CAA0C,mBAAmB,QAAQ,CAAC;AAAA,IACxE,EACG,KAAK,CAAC,EAAE,OAAO,MAAM;AACpB,UAAI,CAAC,OAAQ;AACb,UAAI,QAAQ,MAAM,OAAO,QAAQ;AAC/B,sBAAc,OAAO,OAAO,IAAI;AAChC;AAAA,MACF;AACA,YAAM,UAAU,UAAU,mCAAmC,6DAA6D;AAC1H,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,MAAM,MAAM;AACX,UAAI,CAAC,OAAQ;AACb,oBAAc,IAAI;AAClB,uBAAiB,QAAQ;AACzB,eAAS,IAAI;AAAA,IACf,CAAC,EACA,QAAQ,MAAM;AACb,UAAI,OAAQ,kBAAiB,KAAK;AAAA,IACpC,CAAC;AACH,WAAO,MAAM;AACX,eAAS;AAAA,IACX;AAAA,EACF,GAAG,CAAC,UAAU,SAAS,CAAC;AAExB,WAAS,oBAAoB;AAC3B,WAAO,aAAa,WAAW,cAAc;AAC7C,sBAAkB;AAClB,gBAAY,IAAI;AAChB,kBAAc,IAAI;AAClB,qBAAiB,IAAI;AACrB,UAAM,SAAS,IAAI,gBAAgB,YAAY;AAC/C,WAAO,OAAO,QAAQ;AACtB,aAAS,IAAI;AACb,UAAM,QAAQ,OAAO,SAAS;AAC9B,WAAO,QAAQ,QAAQ,UAAU,KAAK,KAAK,QAAQ;AAAA,EACrD;AAEA,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,UAAI,cAAc,OAAQ,MAAK,IAAI,eAAe,cAAc,KAAK,GAAG,CAAC;AACzE,YAAM,MAAM,MAAM,MAAM,mBAAmB,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACzE,UAAI,IAAI,YAAY;AAClB,2BAAmB;AAEnB,eAAO,QAAQ,IAAI,GAAG;AACtB;AAAA,MACF;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,YAAY,MAAM;AACtB,cAAI,IAAI,WAAW,KAAK;AACtB,mBAAO;AAAA,cACL;AAAA,cACA;AAAA,YACF;AAAA,UACF;AACA,cAAI,IAAI,WAAW,OAAO,IAAI,WAAW,KAAK;AAC5C,mBAAO,UAAU,wCAAwC,2BAA2B;AAAA,UACtF;AACA,iBAAO,UAAU,6BAA6B,sCAAsC;AAAA,QACtF,GAAG;AACH,cAAM,SAAS,IAAI,MAAM;AACzB,YAAI,eAAe;AACnB,cAAM,cAAc,IAAI,QAAQ,IAAI,cAAc,KAAK;AACvD,YAAI,YAAY,SAAS,kBAAkB,GAAG;AAC5C,cAAI;AACF,kBAAMA,QAAO,MAAM,IAAI,KAAK;AAC5B,2BAAe,oBAAoBA,KAAI,KAAK;AAAA,UAC9C,QAAQ;AACN,gBAAI;AACF,oBAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,oBAAM,UAAU,KAAK,KAAK;AAC1B,kBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,+BAAe;AAAA,cACjB;AAAA,YACF,QAAQ;AACN,6BAAe;AAAA,YACjB;AAAA,UACF;AAAA,QACF,OAAO;AACL,cAAI;AACF,kBAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,kBAAM,UAAU,KAAK,KAAK;AAC1B,gBAAI,WAAW,CAAC,oBAAoB,OAAO,GAAG;AAC5C,6BAAe;AAAA,YACjB;AAAA,UACF,QAAQ;AACN,2BAAe;AAAA,UACjB;AAAA,QACF;AACA,iBAAS,gBAAgB,QAAQ;AACjC;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,yBAAmB;AACnB,UAAI,QAAQ,KAAK,UAAU;AACzB,eAAO,QAAQ,KAAK,QAAQ;AAAA,MAC9B;AAAA,IACF,SAAS,KAAc;AAErB,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU;AACrD,eAAS,WAAW,UAAU,6BAA6B,sCAAsC,CAAC;AAAA,IACpG,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cAAW,WAAU,qDACpB;AAAA,0BAAC,SAAM,KAAK,UAAU,sBAAsB,mBAAmB,GAAG,KAAI,qBAAoB,OAAO,KAAK,QAAQ,KAAK,UAAQ,MAAC;AAAA,MAC5H,oBAAC,QAAG,WAAU,0BAA0B,oBAAU,wBAAwB,cAAc,GAAE;AAAA,MAC1F,oBAAC,mBAAiB,oBAAU,uBAAuB,uBAAuB,GAAE;AAAA,OAC9E;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAAoB,YAAU,MACxD;AAAA,iBACC,oBAAC,WAAM,MAAK,UAAS,MAAK,YAAW,OAAO,UAAU,IACpD;AAAA,MACH,CAAC,CAAC,gBAAgB,UACjB,oBAAC,SAAI,WAAU,4FACZ;AAAA,QACC,gBAAgB,SAAS,IAAI,mCAAmC;AAAA,QAChE,gBAAgB,SAAS,IACrB,wDACA;AAAA,QACJ,EAAE,OAAO,gBAAgB,KAAK,IAAI,EAAE;AAAA,MACtC,GACF;AAAA,MAED,CAAC,CAAC,mBAAmB,UACpB,oBAAC,SAAI,WAAU,4FACZ,oBAAU,4BAA4B,yFAAyF;AAAA,QAC9H,SAAS,mBAAmB,KAAK,IAAI;AAAA,MACvC,CAAC,GACH;AAAA,MAED,oBACC,qBAAC,SAAI,WAAU,yFACb;AAAA,4BAAC,SAAI,WAAU,eAAe,oBAAU,mCAAmC,6DAA6D,GAAE;AAAA,QAC1I,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,oCAAmC,SAAS,mBACtG;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE,WACF,qBAAC,SAAI,WAAU,qGACb;AAAA,4BAAC,SAAI,WAAU,eACZ,0BACG,UAAU,4BAA4B,2BAA2B,IACjE,UAAU,2BAA2B,yCAAyC;AAAA,UAC5E,QAAQ,cAAc;AAAA,QACxB,CAAC,GACP;AAAA,QACA,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,WAAU,4CAA2C,SAAS,mBAC9G;AAAA,8BAAC,KAAE,WAAU,eAAc,eAAY,QAAO;AAAA,UAC7C,UAAU,0BAA0B,OAAO;AAAA,WAC9C;AAAA,SACF,IACE;AAAA,MACH,SAAS,CAAC,qBACT,oBAAC,SAAI,WAAU,yFAAwF,MAAK,SAAQ,aAAU,UAC3H,iBACH;AAAA,MAEF,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,SAAS,YAAE,YAAY,GAAE;AAAA,QACxC,oBAAC,SAAM,IAAG,SAAQ,MAAK,SAAQ,MAAK,SAAQ,UAAQ,MAAC,gBAAc,CAAC,CAAC,OAAO;AAAA,SAC9E;AAAA,MACA,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,eAAe,GAAE;AAAA,QAC9C,oBAAC,SAAM,IAAG,YAAW,MAAK,YAAW,MAAK,YAAW,UAAQ,MAAC,gBAAc,CAAC,CAAC,OAAO;AAAA,SACvF;AAAA,MACA,qBAAC,WAAM,WAAU,yDACf;AAAA,4BAAC,WAAM,MAAK,YAAW,MAAK,YAAW,WAAU,qBAAoB;AAAA,QACrE,oBAAC,UAAM,oBAAU,yBAAyB,aAAa,GAAE;AAAA,SAC3D;AAAA,MACA,oBAAC,YAAO,UAAU,YAAY,WAAU,sGACrC,uBAAa,UAAU,sBAAsB,YAAY,IAAI,UAAU,eAAe,SAAS,GAClG;AAAA,MACA,oBAAC,SAAI,WAAU,sCACb,8BAAC,QAAK,WAAU,aAAY,MAAK,UAC9B,oBAAU,6BAA6B,kBAAkB,GAC5D,GACF;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": ["data"]
 }

package/dist/modules/auth/frontend/reset/[token]/page.js

@@ -5,10 +5,17 @@ import { Input } from "@open-mercato/ui/primitives/input";
 import { Label } from "@open-mercato/ui/primitives/label";
 import { useState } from "react";
 import { useRouter } from "next/navigation";
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { formatPasswordRequirements, getPasswordPolicy } from "@open-mercato/shared/lib/auth/passwordPolicy";
 function ResetWithTokenPage({ params }) {
   const router = useRouter();
+  const t = useT();
   const [error, setError] = useState(null);
   const [submitting, setSubmitting] = useState(false);
+  const passwordPolicy = getPasswordPolicy();
+  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t);
+  const passwordDescription = passwordRequirements ? t("auth.password.requirements.help", "Password requirements: {requirements}", { requirements: passwordRequirements }) : "";
   async function onSubmit(e) {
     e.preventDefault();
     setError(null);
@@ -16,29 +23,32 @@ function ResetWithTokenPage({ params }) {
     try {
       const form = new FormData(e.currentTarget);
       form.set("token", params.token);
-      const res = await fetch("/api/auth/reset/confirm", { method: "POST", body: form });
-      const data = await res.json().catch(() => null);
-      if (!res.ok) {
-        setError(data?.error || "Unable to reset password");
+      const { ok, result } = await apiCall(
+        "/api/auth/reset/confirm",
+        { method: "POST", body: form }
+      );
+      if (!ok || result?.ok === false) {
+        setError(result?.error || t("auth.reset.errors.failed", "Unable to reset password"));
         return;
       }
-      router.replace(data?.redirect || "/login");
+      router.replace(result?.redirect || "/login");
     } finally {
       setSubmitting(false);
     }
   }
   return /* @__PURE__ */ jsx("div", { className: "min-h-svh flex items-center justify-center p-4", children: /* @__PURE__ */ jsxs(Card, { className: "w-full max-w-sm", children: [
     /* @__PURE__ */ jsxs(CardHeader, { children: [
-      /* @__PURE__ */ jsx(CardTitle, { children: "Set a new password" }),
-      /* @__PURE__ */ jsx(CardDescription, { children: "Choose a strong password for your account." })
+      /* @__PURE__ */ jsx(CardTitle, { children: t("auth.reset.title", "Set a new password") }),
+      /* @__PURE__ */ jsx(CardDescription, { children: t("auth.reset.subtitle", "Choose a strong password for your account.") })
     ] }),
     /* @__PURE__ */ jsx(CardContent, { children: /* @__PURE__ */ jsxs("form", { className: "grid gap-3", onSubmit, children: [
       error && /* @__PURE__ */ jsx("div", { className: "text-sm text-red-600", children: error }),
       /* @__PURE__ */ jsxs("div", { className: "grid gap-1", children: [
-        /* @__PURE__ */ jsx(Label, { htmlFor: "password", children: "New password" }),
-        /* @__PURE__ */ jsx(Input, { id: "password", name: "password", type: "password", required: true, minLength: 6 })
+        /* @__PURE__ */ jsx(Label, { htmlFor: "password", children: t("auth.reset.form.password", "New password") }),
+        /* @__PURE__ */ jsx(Input, { id: "password", name: "password", type: "password", required: true, minLength: passwordPolicy.minLength }),
+        passwordDescription ? /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: passwordDescription }) : null
       ] }),
-      /* @__PURE__ */ jsx("button", { disabled: submitting, className: "h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60", children: submitting ? "..." : "Update password" })
+      /* @__PURE__ */ jsx("button", { disabled: submitting, className: "h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60", children: submitting ? t("auth.reset.form.loading", "...") : t("auth.reset.form.submit", "Update password") })
     ] }) })
   ] }) });
 }

package/dist/modules/auth/frontend/reset/[token]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/frontend/reset/%5Btoken%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useState } from 'react'\nimport { useRouter } from 'next/navigation'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      form.set('token', params.token)\n      const res = await fetch('/api/auth/reset/confirm', { method: 'POST', body: form })\n      const data = await res.json().catch(() => null)\n      if (!res.ok) {\n        setError(data?.error || 'Unable to reset password')\n        return\n      }\n      router.replace(data?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>Set a new password</CardTitle>\n          <CardDescription>Choose a strong password for your account.</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit}>\n            {error && <div className=\"text-sm text-red-600\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">New password</Label>\n              <Input id=\"password\" name=\"password\" type=\"password\" required minLength={6} />\n            </div>\n            <button disabled={submitting} className=\"h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60\">\n              {submitting ? '...' : 'Update password'}\n            </button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n\n"],
-  "mappings": ";AAkCQ,SACE,KADF;AAjCR,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAEX,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAElD,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,MAAM,MAAM,MAAM,2BAA2B,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AACjF,YAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC9C,UAAI,CAAC,IAAI,IAAI;AACX,iBAAS,MAAM,SAAS,0BAA0B;AAClD;AAAA,MACF;AACA,aAAO,QAAQ,MAAM,YAAY,QAAQ;AAAA,IAC3C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAU,gCAAkB;AAAA,MAC7B,oBAAC,mBAAgB,wDAA0C;AAAA,OAC7D;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAC1B;AAAA,eAAS,oBAAC,SAAI,WAAU,wBAAwB,iBAAM;AAAA,MACvD,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAW,0BAAY;AAAA,QACtC,oBAAC,SAAM,IAAG,YAAW,MAAK,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,GAAG;AAAA,SAC9E;AAAA,MACA,oBAAC,YAAO,UAAU,YAAY,WAAU,sGACrC,uBAAa,QAAQ,mBACxB;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\nimport { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { Label } from '@open-mercato/ui/primitives/label'\nimport { useState } from 'react'\nimport { useRouter } from 'next/navigation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'\n\nexport default function ResetWithTokenPage({ params }: { params: { token: string } }) {\n  const router = useRouter()\n  const t = useT()\n  const [error, setError] = useState<string | null>(null)\n  const [submitting, setSubmitting] = useState(false)\n  const passwordPolicy = getPasswordPolicy()\n  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)\n  const passwordDescription = passwordRequirements\n    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })\n    : ''\n\n  async function onSubmit(e: React.FormEvent<HTMLFormElement>) {\n    e.preventDefault()\n    setError(null)\n    setSubmitting(true)\n    try {\n      const form = new FormData(e.currentTarget)\n      form.set('token', params.token)\n      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(\n        '/api/auth/reset/confirm',\n        { method: 'POST', body: form },\n      )\n      if (!ok || result?.ok === false) {\n        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))\n        return\n      }\n      router.replace(result?.redirect || '/login')\n    } finally {\n      setSubmitting(false)\n    }\n  }\n\n  return (\n    <div className=\"min-h-svh flex items-center justify-center p-4\">\n      <Card className=\"w-full max-w-sm\">\n        <CardHeader>\n          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>\n          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>\n        </CardHeader>\n        <CardContent>\n          <form className=\"grid gap-3\" onSubmit={onSubmit}>\n            {error && <div className=\"text-sm text-red-600\">{error}</div>}\n            <div className=\"grid gap-1\">\n              <Label htmlFor=\"password\">{t('auth.reset.form.password', 'New password')}</Label>\n              <Input id=\"password\" name=\"password\" type=\"password\" required minLength={passwordPolicy.minLength} />\n              {passwordDescription ? (\n                <p className=\"text-xs text-muted-foreground\">{passwordDescription}</p>\n              ) : null}\n            </div>\n            <button disabled={submitting} className=\"h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60\">\n              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}\n            </button>\n          </form>\n        </CardContent>\n      </Card>\n    </div>\n  )\n}\n"],
+  "mappings": ";AA6CQ,SACE,KADF;AA5CR,SAAS,MAAM,aAAa,YAAY,WAAW,uBAAuB;AAC1E,SAAS,aAAa;AACtB,SAAS,aAAa;AACtB,SAAS,gBAAgB;AACzB,SAAS,iBAAiB;AAC1B,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,4BAA4B,yBAAyB;AAE/C,SAAR,mBAAoC,EAAE,OAAO,GAAkC;AACpF,QAAM,SAAS,UAAU;AACzB,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,SAAwB,IAAI;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,SAAS,KAAK;AAClD,QAAM,iBAAiB,kBAAkB;AACzC,QAAM,uBAAuB,2BAA2B,gBAAgB,CAAC;AACzE,QAAM,sBAAsB,uBACxB,EAAE,mCAAmC,yCAAyC,EAAE,cAAc,qBAAqB,CAAC,IACpH;AAEJ,iBAAe,SAAS,GAAqC;AAC3D,MAAE,eAAe;AACjB,aAAS,IAAI;AACb,kBAAc,IAAI;AAClB,QAAI;AACF,YAAM,OAAO,IAAI,SAAS,EAAE,aAAa;AACzC,WAAK,IAAI,SAAS,OAAO,KAAK;AAC9B,YAAM,EAAE,IAAI,OAAO,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA,EAAE,QAAQ,QAAQ,MAAM,KAAK;AAAA,MAC/B;AACA,UAAI,CAAC,MAAM,QAAQ,OAAO,OAAO;AAC/B,iBAAS,QAAQ,SAAS,EAAE,4BAA4B,0BAA0B,CAAC;AACnF;AAAA,MACF;AACA,aAAO,QAAQ,QAAQ,YAAY,QAAQ;AAAA,IAC7C,UAAE;AACA,oBAAc,KAAK;AAAA,IACrB;AAAA,EACF;AAEA,SACE,oBAAC,SAAI,WAAU,kDACb,+BAAC,QAAK,WAAU,mBACd;AAAA,yBAAC,cACC;AAAA,0BAAC,aAAW,YAAE,oBAAoB,oBAAoB,GAAE;AAAA,MACxD,oBAAC,mBAAiB,YAAE,uBAAuB,4CAA4C,GAAE;AAAA,OAC3F;AAAA,IACA,oBAAC,eACC,+BAAC,UAAK,WAAU,cAAa,UAC1B;AAAA,eAAS,oBAAC,SAAI,WAAU,wBAAwB,iBAAM;AAAA,MACvD,qBAAC,SAAI,WAAU,cACb;AAAA,4BAAC,SAAM,SAAQ,YAAY,YAAE,4BAA4B,cAAc,GAAE;AAAA,QACzE,oBAAC,SAAM,IAAG,YAAW,MAAK,YAAW,MAAK,YAAW,UAAQ,MAAC,WAAW,eAAe,WAAW;AAAA,QAClG,sBACC,oBAAC,OAAE,WAAU,iCAAiC,+BAAoB,IAChE;AAAA,SACN;AAAA,MACA,oBAAC,YAAO,UAAU,YAAY,WAAU,sGACrC,uBAAa,EAAE,2BAA2B,KAAK,IAAI,EAAE,0BAA0B,iBAAiB,GACnG;AAAA,OACF,GACF;AAAA,KACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/auth/lib/setup-app.js

@@ -3,11 +3,6 @@ import { Role, RoleAcl, User, UserRole } from "@open-mercato/core/modules/auth/d
 import { Tenant, Organization } from "@open-mercato/core/modules/directory/data/entities";
 import { rebuildHierarchyForTenant } from "@open-mercato/core/modules/directory/lib/hierarchy";
 import { normalizeTenantId } from "./tenantAccess.js";
-import { SalesSettings, SalesDocumentSequence } from "@open-mercato/core/modules/sales/data/entities";
-import {
-  DEFAULT_ORDER_NUMBER_FORMAT,
-  DEFAULT_QUOTE_NUMBER_FORMAT
-} from "@open-mercato/core/modules/sales/lib/documentNumberTokens";
 import { computeEmailHash } from "@open-mercato/core/modules/auth/lib/emailHash";
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from "@open-mercato/shared/lib/encryption/toggles";
 import { EncryptionMap } from "@open-mercato/core/modules/entities/data/entities";
@@ -15,6 +10,7 @@ import { DEFAULT_ENCRYPTION_MAPS } from "@open-mercato/core/modules/entities/lib
 import { createKmsService } from "@open-mercato/shared/lib/encryption/kms";
 import { TenantDataEncryptionService } from "@open-mercato/shared/lib/encryption/tenantDataEncryptionService";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
 const DEFAULT_ROLE_NAMES = ["employee", "admin", "superadmin"];
 const DEMO_SUPERADMIN_EMAIL = "superadmin@acme.com";
 async function ensureRolesInContext(em, roleNames, tenantId) {
@@ -53,6 +49,10 @@ async function findRoleByNameOrFail(em, name, tenantId) {
   if (!role) throw new Error(`ROLE_NOT_FOUND:${name}`);
   return role;
 }
+const DERIVED_EMAIL_ENV = {
+  admin: "OM_INIT_ADMIN_EMAIL",
+  employee: "OM_INIT_EMPLOYEE_EMAIL"
+};
 async function setupInitialTenant(em, options) {
   const {
     primaryUser,
@@ -110,12 +110,17 @@ async function setupInitialTenant(em, options) {
       { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) }
     ];
     if (includeDerivedUsers) {
-      const [local, domain] = String(primaryUser.email).split("@");
-      const isSuperadminLocal = (local || "").toLowerCase() === "superadmin" && !!domain;
-      if (isSuperadminLocal) {
-        baseUsers.push({ email: `admin@${domain}`, roles: ["admin"] });
-        baseUsers.push({ email: `employee@${domain}`, roles: ["employee"] });
-      }
+      const [, domain] = String(primaryUser.email).split("@");
+      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin);
+      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee);
+      const adminEmail = adminOverride ?? (domain ? `admin@${domain}` : "");
+      const employeeEmail = employeeOverride ?? (domain ? `employee@${domain}` : "");
+      const adminPassword = readEnvValue("OM_INIT_ADMIN_PASSWORD") || "secret";
+      const employeePassword = readEnvValue("OM_INIT_EMPLOYEE_PASSWORD") || "secret";
+      const adminPasswordHash = adminPassword ? await resolvePasswordHash({ email: adminEmail, password: adminPassword }) : null;
+      const employeePasswordHash = employeePassword ? await resolvePasswordHash({ email: employeeEmail, password: employeePassword }) : null;
+      addUniqueBaseUser(baseUsers, { email: adminEmail, roles: ["admin"], passwordHash: adminPasswordHash });
+      addUniqueBaseUser(baseUsers, { email: employeeEmail, roles: ["employee"], passwordHash: employeePasswordHash });
     }
     const passwordHash = await resolvePasswordHash(primaryUser);
     await em.transactional(async (tem) => {
@@ -197,11 +202,12 @@ async function setupInitialTenant(em, options) {
         await encryptionService.invalidateMap("auth:user", String(tenantId), null);
       }
       for (const base of baseUsers) {
+        const resolvedPasswordHash = base.passwordHash ?? passwordHash;
         let user = await tem.findOne(User, { email: base.email });
         const confirm = primaryUser.confirm ?? true;
         const encryptedPayload = encryptionService ? await encryptionService.encryptEntityPayload("auth:user", { email: base.email }, tenantId, organizationId) : { email: base.email, emailHash: computeEmailHash(base.email) };
         if (user) {
-          user.passwordHash = passwordHash;
+          user.passwordHash = resolvedPasswordHash;
           user.organizationId = organizationId;
           user.tenantId = tenantId;
           if (isTenantDataEncryptionEnabled()) {
@@ -216,7 +222,7 @@ async function setupInitialTenant(em, options) {
           user = tem.create(User, {
             email: encryptedPayload.email ?? base.email,
             emailHash: isTenantDataEncryptionEnabled() ? encryptedPayload.emailHash ?? computeEmailHash(base.email) : void 0,
-            passwordHash,
+            passwordHash: resolvedPasswordHash,
             organizationId,
             tenantId,
             name: base.name ?? void 0,
@@ -242,9 +248,14 @@ async function setupInitialTenant(em, options) {
   if (!reusedExistingUser) {
     await rebuildHierarchyForTenant(em, tenantId);
   }
-  await ensureDefaultRoleAcls(em, tenantId, { includeSuperadminRole });
+  const resolvedModules = options.modules ?? tryGetModules();
+  await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole });
   await deactivateDemoSuperAdminIfSelfOnboardingEnabled(em);
-  await ensureSalesNumberingDefaults(em, { tenantId, organizationId });
+  for (const mod of resolvedModules) {
+    if (mod.setup?.onTenantCreated) {
+      await mod.setup.onTenantCreated({ em, tenantId, organizationId });
+    }
+  }
   return {
     tenantId,
     organizationId,
@@ -258,95 +269,56 @@ function resolvePrimaryName(input) {
   if (parts.length) return parts.join(" ");
   return null;
 }
+function readEnvValue(key) {
+  const value = process.env[key];
+  if (typeof value !== "string") return void 0;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : void 0;
+}
+function addUniqueBaseUser(baseUsers, entry) {
+  if (!entry.email) return;
+  const normalized = entry.email.toLowerCase();
+  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return;
+  baseUsers.push(entry);
+}
+function isDemoModeEnabled() {
+  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? "");
+  return parsed === false ? false : true;
+}
+function shouldKeepDemoSuperadminDuringInit() {
+  if (process.env.OM_INIT_FLOW !== "true") return false;
+  if (!readEnvValue("OM_INIT_SUPERADMIN_EMAIL")) return false;
+  return isDemoModeEnabled();
+}
 async function resolvePasswordHash(input) {
   if (typeof input.hashedPassword === "string") return input.hashedPassword;
   if (input.password) return hash(input.password, 10);
   return null;
 }
-async function ensureDefaultRoleAcls(em, tenantId, options = {}) {
+async function ensureDefaultRoleAcls(em, tenantId, modules, options = {}) {
   const includeSuperadminRole = options.includeSuperadminRole ?? true;
   const roleTenantId = normalizeTenantId(tenantId) ?? null;
   const superadminRole = includeSuperadminRole ? await findRoleByName(em, "superadmin", roleTenantId) : null;
   const adminRole = await findRoleByName(em, "admin", roleTenantId);
   const employeeRole = await findRoleByName(em, "employee", roleTenantId);
+  const superadminFeatures = [];
+  const adminFeatures = [];
+  const employeeFeatures = [];
+  for (const mod of modules) {
+    const roleFeatures = mod.setup?.defaultRoleFeatures;
+    if (!roleFeatures) continue;
+    if (roleFeatures.superadmin) superadminFeatures.push(...roleFeatures.superadmin);
+    if (roleFeatures.admin) adminFeatures.push(...roleFeatures.admin);
+    if (roleFeatures.employee) employeeFeatures.push(...roleFeatures.employee);
+  }
   if (includeSuperadminRole && superadminRole) {
-    await ensureRoleAclFor(em, superadminRole, tenantId, ["directory.tenants.*"], { isSuperAdmin: true });
+    await ensureRoleAclFor(em, superadminRole, tenantId, superadminFeatures, { isSuperAdmin: true });
   }
   if (adminRole) {
-    const adminFeatures = [
-      "auth.*",
-      "entities.*",
-      "attachments.*",
-      "attachments.view",
-      "attachments.manage",
-      "query_index.*",
-      "search.*",
-      "vector.*",
-      "feature_toggles.*",
-      "configs.system_status.view",
-      "configs.cache.view",
-      "configs.cache.manage",
-      "configs.manage",
-      "catalog.*",
-      "catalog.variants.manage",
-      "catalog.pricing.manage",
-      "sales.*",
-      "audit_logs.*",
-      "directory.organizations.view",
-      "directory.organizations.manage",
-      "customers.*",
-      "customers.people.view",
-      "customers.people.manage",
-      "customers.companies.view",
-      "customers.companies.manage",
-      "customers.deals.view",
-      "customers.deals.manage",
-      "dictionaries.view",
-      "dictionaries.manage",
-      "example.*",
-      "dashboards.*",
-      "dashboards.admin.assign-widgets",
-      "analytics.view",
-      "api_keys.*",
-      "perspectives.use",
-      "perspectives.role_defaults",
-      "business_rules.*",
-      "workflows.*",
-      "currencies.*",
-      "staff.*",
-      "staff.leave_requests.manage",
-      "resources.*",
-      "planner.*"
-    ];
-    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures, { remove: ["directory.organizations.*", "directory.tenants.*"] });
+    await ensureRoleAclFor(em, adminRole, tenantId, adminFeatures);
   }
   if (employeeRole) {
-    await ensureRoleAclFor(em, employeeRole, tenantId, [
-      "customers.*",
-      "customers.people.view",
-      "customers.people.manage",
-      "customers.companies.view",
-      "customers.companies.manage",
-      "vector.*",
-      "catalog.*",
-      "catalog.variants.manage",
-      "catalog.pricing.manage",
-      "sales.*",
-      "dictionaries.view",
-      "example.*",
-      "example.widgets.*",
-      "dashboards.view",
-      "dashboards.configure",
-      "analytics.view",
-      "audit_logs.undo_self",
-      "perspectives.use",
-      "staff.leave_requests.send",
-      "staff.my_availability.view",
-      "staff.my_availability.manage",
-      "staff.my_leave_requests.view",
-      "staff.my_leave_requests.send",
-      "planner.view"
-    ]);
+    await ensureRoleAclFor(em, employeeRole, tenantId, employeeFeatures);
   }
 }
 async function ensureRoleAclFor(em, role, tenantId, features, options = {}) {
@@ -364,19 +336,8 @@ async function ensureRoleAclFor(em, role, tenantId, features, options = {}) {
   }
   const currentFeatures = Array.isArray(existing.featuresJson) ? existing.featuresJson : [];
   const merged = Array.from(/* @__PURE__ */ new Set([...currentFeatures, ...features]));
-  const removeSet = new Set(options.remove ?? []);
-  const sanitized = removeSet.size ? merged.filter((value) => {
-    if (removeSet.has(value)) return false;
-    for (const entry of removeSet) {
-      if (entry.endsWith(".*")) {
-        const prefix = entry.slice(0, -1);
-        if (value === entry || value.startsWith(prefix)) return false;
-      }
-    }
-    return true;
-  }) : merged;
-  const changed = sanitized.length !== currentFeatures.length || sanitized.some((value, index) => value !== currentFeatures[index]);
-  if (changed) existing.featuresJson = sanitized;
+  const changed = merged.length !== currentFeatures.length || merged.some((value, index) => value !== currentFeatures[index]);
+  if (changed) existing.featuresJson = merged;
   if (options.isSuperAdmin && !existing.isSuperAdmin) {
     existing.isSuperAdmin = true;
   }
@@ -386,6 +347,7 @@ async function ensureRoleAclFor(em, role, tenantId, features, options = {}) {
 }
 async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em) {
   if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== "true") return;
+  if (shouldKeepDemoSuperadminDuringInit()) return;
   try {
     const user = await em.findOne(User, { email: DEMO_SUPERADMIN_EMAIL });
     if (!user) return;
@@ -405,71 +367,12 @@ async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em) {
     console.error("[auth.setup] failed to deactivate demo superadmin user", error);
   }
 }
-async function ensureSalesNumberingDefaults(em, scope) {
-  const repo = em.getRepository?.(SalesSettings);
-  const findSettings = async () => repo?.findOne({
-    tenantId: scope.tenantId,
-    organizationId: scope.organizationId
-  }) ?? em.findOne?.(SalesSettings, {
-    tenantId: scope.tenantId,
-    organizationId: scope.organizationId
-  });
-  const exists = await findSettings();
-  if (!exists) {
-    const settings = repo?.create?.({
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      orderNumberFormat: DEFAULT_ORDER_NUMBER_FORMAT,
-      quoteNumberFormat: DEFAULT_QUOTE_NUMBER_FORMAT,
-      createdAt: /* @__PURE__ */ new Date(),
-      updatedAt: /* @__PURE__ */ new Date()
-    }) ?? em.create?.(SalesSettings, {
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      orderNumberFormat: DEFAULT_ORDER_NUMBER_FORMAT,
-      quoteNumberFormat: DEFAULT_QUOTE_NUMBER_FORMAT,
-      createdAt: /* @__PURE__ */ new Date(),
-      updatedAt: /* @__PURE__ */ new Date()
-    });
-    if (settings && em.persist) {
-      em.persist(settings);
-    }
-  }
-  const sequenceRepo = em.getRepository?.(SalesDocumentSequence);
-  const kinds = ["order", "quote"];
-  for (const kind of kinds) {
-    const seq = sequenceRepo?.findOne({
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      documentKind: kind
-    }) ?? em.findOne?.(SalesDocumentSequence, {
-      tenantId: scope.tenantId,
-      organizationId: scope.organizationId,
-      documentKind: kind
-    });
-    if (!seq) {
-      const entry = sequenceRepo?.create?.({
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        documentKind: kind,
-        currentValue: 0,
-        createdAt: /* @__PURE__ */ new Date(),
-        updatedAt: /* @__PURE__ */ new Date()
-      }) ?? em.create?.(SalesDocumentSequence, {
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        documentKind: kind,
-        currentValue: 0,
-        createdAt: /* @__PURE__ */ new Date(),
-        updatedAt: /* @__PURE__ */ new Date()
-      });
-      if (entry && em.persist) {
-        em.persist(entry);
-      }
-    }
-  }
-  if (em.flush) {
-    await em.flush();
+function tryGetModules() {
+  try {
+    const { getModules } = require("@open-mercato/shared/lib/modules/registry");
+    return getModules();
+  } catch {
+    return [];
   }
 }
 export {