@open-mercato/core 0.4.2-canary-f075c3eb92 → 0.4.2-canary-8a04af8836

package/src/modules/customers/commands/deals.ts

@@ -35,6 +35,9 @@ import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CrudIndexerConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
 
 const DEAL_ENTITY_ID = 'customers:customer_deal'
 const dealCrudIndexer: CrudIndexerConfig<CustomerDeal> = {
@@ -281,6 +284,8 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
 
+    const previousStatus = record.status
+
     if (parsed.title !== undefined) record.title = parsed.title
     if (parsed.description !== undefined) record.description = parsed.description ?? null
     if (parsed.status !== undefined) record.status = parsed.status ?? record.status
@@ -319,6 +324,40 @@ const updateDealCommand: CommandHandler<DealUpdateInput, { dealId: string }> = {
       indexer: dealCrudIndexer,
     })
 
+    // Send notifications for deal won/lost status changes
+    const newStatus = record.status
+    const normalizedStatus = newStatus === 'win' ? 'won' : newStatus === 'loose' ? 'lost' : newStatus
+    if (previousStatus !== newStatus && (normalizedStatus === 'won' || normalizedStatus === 'lost') && record.ownerUserId) {
+      try {
+        const notificationService = resolveNotificationService(ctx.container)
+        const notificationType = normalizedStatus === 'won' ? 'customers.deal.won' : 'customers.deal.lost'
+        const typeDef = notificationTypes.find((type) => type.type === notificationType)
+        if (typeDef) {
+          const valueDisplay = record.valueAmount && record.valueCurrency
+            ? `${record.valueCurrency} ${record.valueAmount}`
+            : ''
+
+          const notificationInput = buildNotificationFromType(typeDef, {
+            recipientUserId: record.ownerUserId,
+            bodyVariables: {
+              dealTitle: record.title,
+              dealValue: valueDisplay,
+            },
+            sourceEntityType: 'customers:customer_deal',
+            sourceEntityId: record.id,
+            linkHref: `/backend/customers/deals/${record.id}`,
+          })
+
+          await notificationService.create(notificationInput, {
+            tenantId: record.tenantId,
+            organizationId: record.organizationId,
+          })
+        }
+      } catch {
+        // Notification creation is non-critical, don't fail the command
+      }
+    }
+
     return { dealId: record.id }
   },
   buildLog: async ({ snapshots, ctx }) => {

package/src/modules/customers/components/CustomerTodosTable.tsx

@@ -253,6 +253,7 @@ export function CustomerTodosTable(): React.JSX.Element {
           <RowActions
             items={[
               {
+                id: 'open-customer',
                 label: t('customers.workPlan.customerTodos.table.actions.openCustomer'),
                 href: customerLink,
               },

package/src/modules/customers/i18n/en.json

@@ -943,5 +943,9 @@
   "customers.workPlan.customerTodos.table.state.empty": "No customer tasks yet.",
   "customers.workPlan.customerTodos.table.error.load": "Failed to load customer tasks.",
   "customers.workPlan.customerTodos.table.export.view": "Exports the current list with filters and visible columns.",
-  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes."
+  "customers.workPlan.customerTodos.table.export.full": "Exports every linked task field, including hidden attributes.",
+  "customers.notifications.deal.won.title": "Deal Won",
+  "customers.notifications.deal.won.body": "{dealTitle} has been marked as won{dealValue, select, other { ({dealValue})}}",
+  "customers.notifications.deal.lost.title": "Deal Lost",
+  "customers.notifications.deal.lost.body": "{dealTitle} has been marked as lost"
 }

package/src/modules/customers/notifications.ts

@@ -0,0 +1,44 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'customers.deal.won',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.won.title',
+    bodyKey: 'customers.notifications.deal.won.body',
+    icon: 'trophy',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'customers.deal.lost',
+    module: 'customers',
+    titleKey: 'customers.notifications.deal.lost.title',
+    bodyKey: 'customers.notifications.deal.lost.body',
+    icon: 'x-circle',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customers/deals/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customers/deals/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+]
+
+export default notificationTypes

package/src/modules/customers/widgets/dashboard/customer-todos/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import CustomerTodosWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateCustomerTodoSettings, type CustomerTodoWidgetSettings } from './config'
+const CustomerTodosWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<CustomerTodoWidgetSettings> = {
   metadata: {

package/src/modules/customers/widgets/dashboard/new-customers/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import CustomerNewCustomersWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateNewCustomersSettings, type CustomerNewCustomersSettings } from './config'
+const CustomerNewCustomersWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<CustomerNewCustomersSettings> = {
   metadata: {

package/src/modules/customers/widgets/dashboard/new-deals/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import CustomerNewDealsWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateNewDealsSettings, type CustomerNewDealsSettings } from './config'
+const CustomerNewDealsWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<CustomerNewDealsSettings> = {
   metadata: {

package/src/modules/customers/widgets/dashboard/next-interactions/widget.ts

@@ -1,10 +1,10 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import CustomerNextInteractionsWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import {
   DEFAULT_SETTINGS,
   hydrateNextInteractionsSettings,
   type CustomerNextInteractionsSettings,
 } from './config'
+const CustomerNextInteractionsWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<CustomerNextInteractionsSettings> = {
   metadata: {

package/src/modules/dashboards/cli.ts

@@ -4,6 +4,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data/entities'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
+import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 import { seedAnalyticsData } from './seed/analytics'
 
 type Args = Record<string, string>
@@ -41,15 +42,25 @@ export async function seedDashboardDefaultsForTenant(
   const widgetMap = new Map(widgets.map((widget) => [widget.metadata.id, widget]))
   const resolvedWidgetIds = widgetIds && widgetIds.length
     ? widgetIds.filter((id) => widgetMap.has(id))
-    : widgets.filter((widget) => widget.metadata.defaultEnabled).map((widget) => widget.metadata.id)
+    : null
+  const defaultWidgetIds = widgets
+    .filter((widget) => widget.metadata.defaultEnabled)
+    .map((widget) => widget.metadata.id)
+  const allWidgetIds = widgets.map((widget) => widget.metadata.id)
 
-  if (!resolvedWidgetIds.length) {
+  if (resolvedWidgetIds && resolvedWidgetIds.length === 0) {
     log('No widgets resolved for dashboard seeding.')
     return false
   }
 
   await em.transactional(async (tem) => {
     for (const roleName of roleNames) {
+      const isAdminRole = roleName === 'admin' || roleName === 'superadmin'
+      const roleWidgetIds = resolvedWidgetIds ?? (isAdminRole ? allWidgetIds : defaultWidgetIds)
+      if (!roleWidgetIds.length) {
+        log(`No widgets resolved for role "${roleName}".`)
+        continue
+      }
       const role = await tem.findOne(Role, { name: roleName })
       if (!role) {
         log(`Skipping role "${roleName}" (not found)`)
@@ -62,7 +73,7 @@ export async function seedDashboardDefaultsForTenant(
         deletedAt: null,
       })
       if (existing) {
-        existing.widgetIdsJson = resolvedWidgetIds
+        existing.widgetIdsJson = roleWidgetIds
         tem.persist(existing)
         log(`Updated dashboard widgets for role "${roleName}"`)
       } else {
@@ -70,7 +81,7 @@ export async function seedDashboardDefaultsForTenant(
           roleId: String(role.id),
           tenantId,
           organizationId,
-          widgetIdsJson: resolvedWidgetIds,
+          widgetIdsJson: roleWidgetIds,
           createdAt: new Date(),
           updatedAt: null,
           deletedAt: null,
@@ -120,6 +131,45 @@ const seedDefaults: ModuleCli = {
   },
 }
 
+const enableAnalyticsWidgets: ModuleCli = {
+  command: 'enable-analytics-widgets',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const tenantId = args.tenant || args.tenantId || null
+    const organizationId = args.organization || args.organizationId || args.org || null
+    const roleCsv = args.roles || 'admin,employee'
+    if (!tenantId) {
+      console.error('Usage: mercato dashboards enable-analytics-widgets --tenant <tenantId> [--org <orgId>] [--roles admin,employee]')
+      return
+    }
+
+    const roleNames = roleCsv
+      .split(',')
+      .map((name) => name.trim())
+      .filter(Boolean)
+
+    if (!roleNames.length) {
+      console.log('No roles provided, nothing to update.')
+      return
+    }
+
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as EntityManager
+    const widgetIds = await resolveAnalyticsWidgetIds()
+
+    const updated = await appendWidgetsToRoles(em, {
+      tenantId,
+      organizationId,
+      roleNames,
+      widgetIds,
+    })
+
+    if (!updated) {
+      console.log('No dashboard role widgets updated.')
+    }
+  },
+}
+
 const seedAnalytics: ModuleCli = {
   command: 'seed-analytics',
   async run(rest) {
@@ -282,4 +332,4 @@ const debugAnalytics: ModuleCli = {
   },
 }
 
-export default [seedDefaults, seedAnalytics, debugAnalytics]
+export default [seedDefaults, enableAnalyticsWidgets, seedAnalytics, debugAnalytics]

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -44,9 +44,13 @@ type UserProps = BaseProps & {
 
 type WidgetVisibilityEditorProps = RoleProps | UserProps
 
+export type WidgetVisibilityEditorHandle = {
+  save: () => Promise<void>
+}
+
 const EMPTY: string[] = []
 
-export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
+export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHandle, WidgetVisibilityEditorProps>(function WidgetVisibilityEditor(props, ref) {
   const t = useT()
   const { kind, targetId, tenantId, organizationId } = props
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
@@ -60,6 +64,15 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   const [originalMode, setOriginalMode] = React.useState<'inherit' | 'override'>('inherit')
   const [effective, setEffective] = React.useState<string[]>(EMPTY)
 
+  const dirty = React.useMemo(() => {
+    if (kind === 'user') {
+      if (mode !== originalMode) return true
+      if (mode === 'override') return selected.join('|') !== original.join('|')
+      return false
+    }
+    return selected.join('|') !== original.join('|')
+  }, [kind, mode, original, originalMode, selected])
+
   const loadCatalog = React.useCallback(async () => {
     const data = await readApiResultOrThrow<{ items?: unknown[] }>(
       '/api/dashboards/widgets/catalog',
@@ -149,6 +162,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
   }, [original, originalMode])
 
   const save = React.useCallback(async () => {
+    if (loading) return
+    if (error && catalog.length === 0) return
+    if (!dirty) return
     setSaving(true)
     setError(null)
     try {
@@ -202,16 +218,9 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
     } finally {
       setSaving(false)
     }
-  }, [kind, mode, organizationId, selected, t, targetId, tenantId])
+  }, [catalog.length, dirty, error, kind, loading, mode, organizationId, selected, t, targetId, tenantId])
 
-  const dirty = React.useMemo(() => {
-    if (kind === 'user') {
-      if (mode !== originalMode) return true
-      if (mode === 'override') return selected.join('|') !== original.join('|')
-      return false
-    }
-    return selected.join('|') !== original.join('|')
-  }, [kind, mode, original, originalMode, selected])
+  React.useImperativeHandle(ref, () => ({ save }), [save])
 
   if (loading) {
     return (
@@ -297,4 +306,6 @@ export function WidgetVisibilityEditor(props: WidgetVisibilityEditorProps) {
       </div>
     </div>
   )
-}
+})
+
+WidgetVisibilityEditor.displayName = 'WidgetVisibilityEditor'

package/src/modules/dashboards/lib/role-widgets.ts

@@ -0,0 +1,80 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { Role } from '@open-mercato/core/modules/auth/data/entities'
+import { DashboardRoleWidgets } from '../data/entities'
+import { loadAllWidgets } from './widgets'
+
+type RoleWidgetScope = {
+  tenantId: string
+  organizationId?: string | null
+  roleNames: string[]
+  widgetIds: string[]
+}
+
+async function findRoleByName(
+  em: EntityManager,
+  roleName: string,
+  tenantId: string,
+): Promise<Role | null> {
+  const tenantRole = await em.findOne(Role, { name: roleName, tenantId })
+  if (tenantRole) return tenantRole
+  return em.findOne(Role, { name: roleName, tenantId: null })
+}
+
+export async function resolveAnalyticsWidgetIds(): Promise<string[]> {
+  const widgets = await loadAllWidgets()
+  return widgets
+    .filter((widget) => widget.metadata.category === 'analytics' || widget.metadata.id.startsWith('dashboards.analytics.'))
+    .map((widget) => widget.metadata.id)
+}
+
+export async function appendWidgetsToRoles(
+  em: EntityManager,
+  { tenantId, organizationId = null, roleNames, widgetIds }: RoleWidgetScope,
+): Promise<boolean> {
+  const trimmedTenantId = tenantId.trim()
+  const widgets = await loadAllWidgets()
+  const validWidgetIds = new Set(widgets.map((widget) => widget.metadata.id))
+  const resolvedWidgetIds = widgetIds.filter((id) => validWidgetIds.has(id))
+  if (!resolvedWidgetIds.length) return false
+
+  let updated = false
+  await em.transactional(async (tem) => {
+    for (const roleName of roleNames) {
+      const role = await findRoleByName(tem, roleName, trimmedTenantId)
+      if (!role) continue
+
+      const record = await tem.findOne(DashboardRoleWidgets, {
+        roleId: String(role.id),
+        tenantId: trimmedTenantId,
+        organizationId,
+        deletedAt: null,
+      })
+      const roleRecord = record ?? (organizationId
+        ? await tem.findOne(DashboardRoleWidgets, {
+          roleId: String(role.id),
+          tenantId: trimmedTenantId,
+          organizationId: null,
+          deletedAt: null,
+        })
+        : null)
+      if (!roleRecord) continue
+
+      const current = Array.isArray(roleRecord.widgetIdsJson) ? roleRecord.widgetIdsJson : []
+      const next = [...current]
+      const existing = new Set(current)
+      for (const widgetId of resolvedWidgetIds) {
+        if (existing.has(widgetId)) continue
+        existing.add(widgetId)
+        next.push(widgetId)
+      }
+
+      if (next.length === current.length) continue
+      roleRecord.widgetIdsJson = next
+      roleRecord.updatedAt = new Date()
+      tem.persist(roleRecord)
+      updated = true
+    }
+  })
+
+  return updated
+}

package/src/modules/dashboards/services/widgetDataService.ts

@@ -1,6 +1,10 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
 import { createHash } from 'node:crypto'
+import { decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
+import { resolveTenantEncryptionService } from '@open-mercato/shared/lib/encryption/customFieldValues'
+import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   type DateRangePreset,
   resolveDateRange,
@@ -17,6 +21,8 @@ import {
 import type { AnalyticsRegistry } from './analyticsRegistry'
 
 const WIDGET_DATA_CACHE_TTL = 120_000
+const WIDGET_DATA_SEGMENT_TTL = 86_400_000
+const WIDGET_DATA_SEGMENT_KEY = 'widget-data:__segment__'
 
 const SAFE_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*$/
 
@@ -168,6 +174,11 @@ export class WidgetDataService {
       const tags = this.getCacheTags(request.entityType)
       try {
         await this.cache.set(cacheKey, response, { ttl: WIDGET_DATA_CACHE_TTL, tags })
+        await this.cache.set(
+          WIDGET_DATA_SEGMENT_KEY,
+          { updatedAt: response.metadata.fetchedAt },
+          { ttl: WIDGET_DATA_SEGMENT_TTL, tags: ['widget-data'] },
+        )
       } catch {
       }
     }
@@ -282,6 +293,75 @@ export class WidgetDataService {
     assertSafeIdentifier(config.idColumn, 'id column')
     assertSafeIdentifier(config.labelColumn, 'label column')
 
+    const meta = this.resolveEntityMetadata(config.table)
+    const idProp = meta ? this.resolveEntityPropertyName(meta, config.idColumn) : null
+    const labelProp = meta ? this.resolveEntityPropertyName(meta, config.labelColumn) : null
+    const tenantProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'tenant_id') ?? this.resolveEntityPropertyName(meta, 'tenantId'))
+      : null
+    const organizationProp = meta
+      ? (this.resolveEntityPropertyName(meta, 'organization_id') ?? this.resolveEntityPropertyName(meta, 'organizationId'))
+      : null
+    const entityName = meta ? ((meta as any).class ?? meta.className ?? meta.name) : null
+
+    if (meta && idProp && labelProp && tenantProp && entityName) {
+      const where: Record<string, unknown> = {
+        [idProp]: { $in: uniqueIds },
+        [tenantProp]: this.scope.tenantId,
+      }
+      if (organizationProp && this.scope.organizationIds && this.scope.organizationIds.length > 0) {
+        where[organizationProp] = { $in: this.scope.organizationIds }
+      }
+
+      try {
+        const records = await findWithDecryption(
+          this.em,
+          entityName,
+          where,
+          { fields: [idProp, labelProp, tenantProp, organizationProp].filter(Boolean) },
+          { tenantId: this.scope.tenantId, organizationId: this.resolveOrganizationId() },
+        )
+
+        const encryptionService = resolveTenantEncryptionService(this.em as any)
+        const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
+        let hasEncryptedLabels = false
+        let hasDecryptedLabels = false
+
+        const labelMap = new Map<string, string>()
+        for (const record of records as Array<Record<string, unknown>>) {
+          const id = record[idProp]
+          let labelValue = record[labelProp]
+          if (typeof labelValue === 'string' && this.isEncryptedPayload(labelValue)) {
+            hasEncryptedLabels = true
+            if (dek?.key) {
+              const decrypted = this.decryptWithDek(labelValue, dek.key)
+              if (decrypted !== null) {
+                labelValue = decrypted
+                hasDecryptedLabels = true
+              }
+            }
+          } else if (labelValue != null && labelValue !== '') {
+            hasDecryptedLabels = true
+          }
+
+          if (typeof id === 'string' && labelValue != null && labelValue !== '') {
+            labelMap.set(id, String(labelValue))
+          }
+        }
+
+        if (labelMap.size > 0 && (!hasEncryptedLabels || hasDecryptedLabels)) {
+          return data.map((item) => ({
+            ...item,
+            groupLabel: typeof item.groupKey === 'string' && labelMap.has(item.groupKey)
+              ? labelMap.get(item.groupKey)!
+              : undefined,
+          }))
+        }
+      } catch {
+        // fall through to SQL resolution
+      }
+    }
+
     const clauses = [`"${config.idColumn}" = ANY(?::uuid[])`, 'tenant_id = ?']
     const params: unknown[] = [`{${uniqueIds.join(',')}}`, this.scope.tenantId]
 
@@ -290,17 +370,43 @@ export class WidgetDataService {
       params.push(`{${this.scope.organizationIds.join(',')}}`)
     }
 
-    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label FROM "${config.table}" WHERE ${clauses.join(
+    const sql = `SELECT "${config.idColumn}" as id, "${config.labelColumn}" as label, tenant_id, organization_id FROM "${config.table}" WHERE ${clauses.join(
       ' AND ',
     )}`
 
     try {
       const labelRows = await this.em.getConnection().execute(sql, params)
+      const entityId = this.resolveEntityId(meta)
+      const encryptionService = resolveTenantEncryptionService(this.em as any)
+      const organizationId = this.resolveOrganizationId()
+      const dek = encryptionService?.isEnabled() ? await encryptionService.getDek(this.scope.tenantId) : null
 
       const labelMap = new Map<string, string>()
-      for (const row of labelRows as Array<{ id: string; label: string | null }>) {
-        if (row.id && row.label != null && row.label !== '') {
-          labelMap.set(row.id, row.label)
+      for (const row of labelRows as Array<{ id: string; label: string | null; tenant_id?: string | null; organization_id?: string | null }>) {
+        let labelValue = row.label
+        if (entityId && encryptionService?.isEnabled() && labelValue != null) {
+          const rowOrgId = row.organization_id ?? organizationId ?? null
+          const decrypted = await encryptionService.decryptEntityPayload(
+            entityId,
+            { [config.labelColumn]: labelValue },
+            this.scope.tenantId,
+            rowOrgId,
+          )
+          const resolved = decrypted[config.labelColumn]
+          if (typeof resolved === 'string' || typeof resolved === 'number') {
+            labelValue = String(resolved)
+          }
+        }
+
+        if (labelValue && dek?.key && this.isEncryptedPayload(labelValue)) {
+          const decrypted = this.decryptWithDek(labelValue, dek.key)
+          if (decrypted !== null) {
+            labelValue = decrypted
+          }
+        }
+
+        if (row.id && labelValue != null && labelValue !== '') {
+          labelMap.set(row.id, labelValue)
         }
       }
 
@@ -317,6 +423,60 @@ export class WidgetDataService {
       }))
     }
   }
+
+  private resolveOrganizationId(): string | null {
+    if (!this.scope.organizationIds || this.scope.organizationIds.length !== 1) return null
+    return this.scope.organizationIds[0] ?? null
+  }
+
+  private resolveEntityMetadata(tableName: string): Record<string, any> | null {
+    const registry = (this.em as any)?.getMetadata?.()
+    if (!registry) return null
+    const entries =
+      (typeof registry.getAll === 'function' && registry.getAll()) ||
+      (Array.isArray(registry.metadata) ? registry.metadata : Object.values(registry.metadata ?? {}))
+    const metas = Array.isArray(entries) ? entries : Object.values(entries ?? {})
+    const match = metas.find((meta: any) => {
+      const table = meta?.tableName ?? meta?.collection
+      if (typeof table !== 'string') return false
+      if (table === tableName) return true
+      return table.split('.').pop() === tableName
+    })
+    return match ?? null
+  }
+
+  private resolveEntityPropertyName(meta: Record<string, any>, columnName: string): string | null {
+    const properties = meta?.properties ? Object.values(meta.properties) : []
+    for (const prop of properties as Array<Record<string, any>>) {
+      const fieldName = prop?.fieldName
+      const fieldNames = prop?.fieldNames
+      if (typeof fieldName === 'string' && fieldName === columnName) return prop?.name ?? null
+      if (Array.isArray(fieldNames) && fieldNames.includes(columnName)) return prop?.name ?? null
+      if (prop?.name === columnName) return prop?.name ?? null
+    }
+    return null
+  }
+
+  private resolveEntityId(meta: Record<string, any> | null): string | null {
+    if (!meta) return null
+    try {
+      return resolveEntityIdFromMetadata(meta as any)
+    } catch {
+      return null
+    }
+  }
+
+  private isEncryptedPayload(value: string): boolean {
+    const parts = value.split(':')
+    return parts.length === 4 && parts[3] === 'v1'
+  }
+
+  private decryptWithDek(value: string, dek: string): string | null {
+    const first = decryptWithAesGcm(value, dek)
+    if (first === null) return null
+    if (!this.isEncryptedPayload(first)) return first
+    return decryptWithAesGcm(first, dek) ?? first
+  }
 }
 
 export function createWidgetDataService(

package/src/modules/dashboards/setup.ts

@@ -1,10 +1,26 @@
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import { seedDashboardDefaultsForTenant } from '@open-mercato/core/modules/dashboards/cli'
+import { appendWidgetsToRoles, resolveAnalyticsWidgetIds } from '@open-mercato/core/modules/dashboards/lib/role-widgets'
 
 export const setup: ModuleSetupConfig = {
   defaultRoleFeatures: {
     admin: ['dashboards.*', 'dashboards.admin.assign-widgets', 'analytics.view'],
     employee: ['dashboards.view', 'dashboards.configure', 'analytics.view'],
   },
+
+  async onTenantCreated({ em, tenantId, organizationId }) {
+    await seedDashboardDefaultsForTenant(em, { tenantId, organizationId, logger: () => {} })
+  },
+
+  async seedDefaults({ em, tenantId, organizationId }) {
+    const analyticsWidgetIds = await resolveAnalyticsWidgetIds()
+    await appendWidgetsToRoles(em, {
+      tenantId,
+      organizationId,
+      roleNames: ['admin', 'employee'],
+      widgetIds: analyticsWidgetIds,
+    })
+  },
 }
 
 export default setup

package/src/modules/dashboards/widgets/dashboard/aov-kpi/widget.ts

@@ -1,6 +1,6 @@
-import type { DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
-import AovKpiWidget from './widget.client'
+import { lazyDashboardWidget, type DashboardWidgetModule } from '@open-mercato/shared/modules/dashboard/widgets'
 import { DEFAULT_SETTINGS, hydrateSettings, type AovKpiSettings } from './config'
+const AovKpiWidget = lazyDashboardWidget(() => import('./widget.client'))
 
 const widget: DashboardWidgetModule<AovKpiSettings> = {
   metadata: {