@open-mercato/core 0.4.5-develop-2e9903a57a → 0.4.5-develop-eeccf7adf4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.4.5-develop-2e9903a57a",
+  "version": "0.4.5-develop-eeccf7adf4",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -207,7 +207,7 @@
     }
   },
   "dependencies": {
-    "@open-mercato/shared": "0.4.5-develop-2e9903a57a",
+    "@open-mercato/shared": "0.4.5-develop-eeccf7adf4",
     "@types/semver": "^7.5.8",
     "@xyflow/react": "^12.6.0",
     "ai": "^6.0.0",

package/dist/modules/auth/__integration__/TC-AUTH-001.spec.js

@@ -1,9 +0,0 @@
-import { test, expect } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-test.describe("TC-AUTH-001: Successful User Login", () => {
-  test("should login with valid credentials and redirect to dashboard", async ({ page }) => {
-    await login(page, "admin");
-    await expect(page).toHaveURL(/\/backend/);
-  });
-});
-//# sourceMappingURL=TC-AUTH-001.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-001.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-001.spec.ts"],
-  "sourcesContent": ["import { test, expect } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AUTH-001: Successful User Login\n * Source: .ai/qa/scenarios/TC-AUTH-001-user-login-success.md\n */\ntest.describe('TC-AUTH-001: Successful User Login', () => {\n  test('should login with valid credentials and redirect to dashboard', async ({ page }) => {\n    await login(page, 'admin');\n    await expect(page).toHaveURL(/\\/backend/);\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,MAAM,cAAc;AAC7B,SAAS,aAAa;AAMtB,KAAK,SAAS,sCAAsC,MAAM;AACxD,OAAK,iEAAiE,OAAO,EAAE,KAAK,MAAM;AACxF,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,OAAO,IAAI,EAAE,UAAU,WAAW;AAAA,EAC1C,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-002.spec.js

@@ -1,22 +0,0 @@
-import { expect, test } from "@playwright/test";
-test.describe("TC-AUTH-002: Login Failure with Invalid Credentials", () => {
-  test("should reject invalid credentials with a generic error", async ({ page }) => {
-    const baseUrl = process.env.BASE_URL || "http://localhost:3000";
-    await page.context().addCookies([
-      { name: "om_demo_notice_ack", value: "ack", url: baseUrl, sameSite: "Lax" },
-      { name: "om_cookie_notice_ack", value: "ack", url: baseUrl, sameSite: "Lax" }
-    ]);
-    await page.goto("/login");
-    await page.getByLabel("Email").fill("admin@acme.com");
-    await page.getByLabel("Password").fill("wrong-password");
-    await page.getByLabel("Password").press("Enter");
-    await expect(page).toHaveURL(/\/login$/);
-    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();
-    await page.getByLabel("Email").fill(`not-found-${Date.now()}@acme.com`);
-    await page.getByLabel("Password").fill("wrong-password");
-    await page.getByLabel("Password").press("Enter");
-    await expect(page).toHaveURL(/\/login$/);
-    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-002.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-002.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-002.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\n\n/**\n * TC-AUTH-002: Login Failure with Invalid Credentials\n * Source: .ai/qa/scenarios/TC-AUTH-002-user-login-invalid-credentials.md\n */\ntest.describe('TC-AUTH-002: Login Failure with Invalid Credentials', () => {\n  test('should reject invalid credentials with a generic error', async ({ page }) => {\n    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n    await page.context().addCookies([\n      { name: 'om_demo_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },\n      { name: 'om_cookie_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },\n    ]);\n\n    await page.goto('/login');\n    await page.getByLabel('Email').fill('admin@acme.com');\n    await page.getByLabel('Password').fill('wrong-password');\n    await page.getByLabel('Password').press('Enter');\n\n    await expect(page).toHaveURL(/\\/login$/);\n    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();\n\n    await page.getByLabel('Email').fill(`not-found-${Date.now()}@acme.com`);\n    await page.getByLabel('Password').fill('wrong-password');\n    await page.getByLabel('Password').press('Enter');\n\n    await expect(page).toHaveURL(/\\/login$/);\n    await expect(page.getByText(/invalid email or password|invalid credentials/i).first()).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAM7B,KAAK,SAAS,uDAAuD,MAAM;AACzE,OAAK,0DAA0D,OAAO,EAAE,KAAK,MAAM;AACjF,UAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,UAAM,KAAK,QAAQ,EAAE,WAAW;AAAA,MAC9B,EAAE,MAAM,sBAAsB,OAAO,OAAO,KAAK,SAAS,UAAU,MAAM;AAAA,MAC1E,EAAE,MAAM,wBAAwB,OAAO,OAAO,KAAK,SAAS,UAAU,MAAM;AAAA,IAC9E,CAAC;AAED,UAAM,KAAK,KAAK,QAAQ;AACxB,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,gBAAgB;AACpD,UAAM,KAAK,WAAW,UAAU,EAAE,KAAK,gBAAgB;AACvD,UAAM,KAAK,WAAW,UAAU,EAAE,MAAM,OAAO;AAE/C,UAAM,OAAO,IAAI,EAAE,UAAU,UAAU;AACvC,UAAM,OAAO,KAAK,UAAU,gDAAgD,EAAE,MAAM,CAAC,EAAE,YAAY;AAEnG,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,aAAa,KAAK,IAAI,CAAC,WAAW;AACtE,UAAM,KAAK,WAAW,UAAU,EAAE,KAAK,gBAAgB;AACvD,UAAM,KAAK,WAAW,UAAU,EAAE,MAAM,OAAO;AAE/C,UAAM,OAAO,IAAI,EAAE,UAAU,UAAU;AACvC,UAAM,OAAO,KAAK,UAAU,gDAAgD,EAAE,MAAM,CAAC,EAAE,YAAY;AAAA,EACrG,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-003.spec.js

@@ -1,21 +0,0 @@
-import { expect, test } from "@playwright/test";
-test.describe("TC-AUTH-003: Login with Remember Me", () => {
-  test("should set both auth and session cookies when remember me is enabled", async ({ page }) => {
-    const baseUrl = process.env.BASE_URL || "http://localhost:3000";
-    await page.context().addCookies([
-      { name: "om_demo_notice_ack", value: "ack", url: baseUrl, sameSite: "Lax" },
-      { name: "om_cookie_notice_ack", value: "ack", url: baseUrl, sameSite: "Lax" }
-    ]);
-    await page.goto("/login");
-    await page.getByLabel("Email").fill("admin@acme.com");
-    await page.getByLabel("Password").fill("secret");
-    await page.getByRole("checkbox", { name: /remember me/i }).check();
-    await page.getByLabel("Password").press("Enter");
-    await expect(page).toHaveURL(/\/backend(?:\/.*)?$/);
-    const cookies = await page.context().cookies();
-    const names = new Set(cookies.map((cookie) => cookie.name));
-    expect(names.has("auth_token")).toBeTruthy();
-    expect(names.has("session_token")).toBeTruthy();
-  });
-});
-//# sourceMappingURL=TC-AUTH-003.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-003.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-003.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\n\n/**\n * TC-AUTH-003: Login with Remember Me\n * Source: .ai/qa/scenarios/TC-AUTH-003-user-login-remember-me.md\n */\ntest.describe('TC-AUTH-003: Login with Remember Me', () => {\n  test('should set both auth and session cookies when remember me is enabled', async ({ page }) => {\n    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';\n    await page.context().addCookies([\n      { name: 'om_demo_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },\n      { name: 'om_cookie_notice_ack', value: 'ack', url: baseUrl, sameSite: 'Lax' },\n    ]);\n\n    await page.goto('/login');\n    await page.getByLabel('Email').fill('admin@acme.com');\n    await page.getByLabel('Password').fill('secret');\n    await page.getByRole('checkbox', { name: /remember me/i }).check();\n    await page.getByLabel('Password').press('Enter');\n\n    await expect(page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n\n    const cookies = await page.context().cookies();\n    const names = new Set(cookies.map((cookie) => cookie.name));\n    expect(names.has('auth_token')).toBeTruthy();\n    expect(names.has('session_token')).toBeTruthy();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAM7B,KAAK,SAAS,uCAAuC,MAAM;AACzD,OAAK,wEAAwE,OAAO,EAAE,KAAK,MAAM;AAC/F,UAAM,UAAU,QAAQ,IAAI,YAAY;AACxC,UAAM,KAAK,QAAQ,EAAE,WAAW;AAAA,MAC9B,EAAE,MAAM,sBAAsB,OAAO,OAAO,KAAK,SAAS,UAAU,MAAM;AAAA,MAC1E,EAAE,MAAM,wBAAwB,OAAO,OAAO,KAAK,SAAS,UAAU,MAAM;AAAA,IAC9E,CAAC;AAED,UAAM,KAAK,KAAK,QAAQ;AACxB,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,gBAAgB;AACpD,UAAM,KAAK,WAAW,UAAU,EAAE,KAAK,QAAQ;AAC/C,UAAM,KAAK,UAAU,YAAY,EAAE,MAAM,eAAe,CAAC,EAAE,MAAM;AACjE,UAAM,KAAK,WAAW,UAAU,EAAE,MAAM,OAAO;AAE/C,UAAM,OAAO,IAAI,EAAE,UAAU,qBAAqB;AAElD,UAAM,UAAU,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAC7C,UAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,CAAC,WAAW,OAAO,IAAI,CAAC;AAC1D,WAAO,MAAM,IAAI,YAAY,CAAC,EAAE,WAAW;AAC3C,WAAO,MAAM,IAAI,eAAe,CAAC,EAAE,WAAW;AAAA,EAChD,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-004.spec.js

@@ -1,15 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-test.describe("TC-AUTH-004: User Logout", () => {
-  test("should clear session and redirect to login", async ({ page }) => {
-    await login(page, "admin");
-    await expect(page).toHaveURL(/\/backend(?:\/.*)?$/);
-    await page.getByRole("button", { name: /admin@acme.com/i }).click();
-    await page.getByRole("menuitem", { name: /logout/i }).click();
-    await page.waitForTimeout(500);
-    const cookies = await page.context().cookies();
-    const authCookie = cookies.find((cookie) => cookie.name === "auth_token");
-    expect(authCookie).toBeUndefined();
-  });
-});
-//# sourceMappingURL=TC-AUTH-004.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-004.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-004.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AUTH-004: User Logout\n * Source: .ai/qa/scenarios/TC-AUTH-004-user-logout.md\n */\ntest.describe('TC-AUTH-004: User Logout', () => {\n  test('should clear session and redirect to login', async ({ page }) => {\n    await login(page, 'admin');\n    await expect(page).toHaveURL(/\\/backend(?:\\/.*)?$/);\n\n    await page.getByRole('button', { name: /admin@acme.com/i }).click();\n    await page.getByRole('menuitem', { name: /logout/i }).click();\n    await page.waitForTimeout(500);\n\n    const cookies = await page.context().cookies();\n    const authCookie = cookies.find((cookie) => cookie.name === 'auth_token');\n    expect(authCookie).toBeUndefined();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AAMtB,KAAK,SAAS,4BAA4B,MAAM;AAC9C,OAAK,8CAA8C,OAAO,EAAE,KAAK,MAAM;AACrE,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,OAAO,IAAI,EAAE,UAAU,qBAAqB;AAElD,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,kBAAkB,CAAC,EAAE,MAAM;AAClE,UAAM,KAAK,UAAU,YAAY,EAAE,MAAM,UAAU,CAAC,EAAE,MAAM;AAC5D,UAAM,KAAK,eAAe,GAAG;AAE7B,UAAM,UAAU,MAAM,KAAK,QAAQ,EAAE,QAAQ;AAC7C,UAAM,aAAa,QAAQ,KAAK,CAAC,WAAW,OAAO,SAAS,YAAY;AACxE,WAAO,UAAU,EAAE,cAAc;AAAA,EACnC,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-005.spec.js

@@ -1,11 +0,0 @@
-import { expect, test } from "@playwright/test";
-test.describe("TC-AUTH-005: Password Reset Request", () => {
-  test("should accept reset request and show generic confirmation", async ({ page }) => {
-    await page.goto("/reset");
-    await expect(page.getByText(/reset password/i).first()).toBeVisible();
-    await page.getByLabel("Email").fill("admin@acme.com");
-    await page.getByRole("button", { name: /send reset link/i }).click();
-    await expect(page.getByText(/if an account with that email exists/i)).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-005.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-005.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-005.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\n\n/**\n * TC-AUTH-005: Password Reset Request\n * Source: .ai/qa/scenarios/TC-AUTH-005-password-reset-request.md\n */\ntest.describe('TC-AUTH-005: Password Reset Request', () => {\n  test('should accept reset request and show generic confirmation', async ({ page }) => {\n    await page.goto('/reset');\n    await expect(page.getByText(/reset password/i).first()).toBeVisible();\n\n    await page.getByLabel('Email').fill('admin@acme.com');\n    await page.getByRole('button', { name: /send reset link/i }).click();\n\n    await expect(page.getByText(/if an account with that email exists/i)).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAM7B,KAAK,SAAS,uCAAuC,MAAM;AACzD,OAAK,6DAA6D,OAAO,EAAE,KAAK,MAAM;AACpF,UAAM,KAAK,KAAK,QAAQ;AACxB,UAAM,OAAO,KAAK,UAAU,iBAAiB,EAAE,MAAM,CAAC,EAAE,YAAY;AAEpE,UAAM,KAAK,WAAW,OAAO,EAAE,KAAK,gBAAgB;AACpD,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,mBAAmB,CAAC,EAAE,MAAM;AAEnE,UAAM,OAAO,KAAK,UAAU,uCAAuC,CAAC,EAAE,YAAY;AAAA,EACpF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-006.spec.js

@@ -1,11 +0,0 @@
-import { expect, test } from "@playwright/test";
-test.describe("TC-AUTH-006: Complete Password Reset", () => {
-  test("should show reset form and reject completion with an invalid token", async ({ page }) => {
-    await page.goto("/reset/qa-invalid-token");
-    await expect(page.getByText(/set a new password/i)).toBeVisible();
-    await page.getByLabel(/new password/i).fill("Valid1!Pass");
-    await page.getByRole("button", { name: /update password/i }).click();
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-006.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-006.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-006.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\n\n/**\n * TC-AUTH-006: Complete Password Reset\n * Source: .ai/qa/scenarios/TC-AUTH-006-password-reset-complete.md\n */\ntest.describe('TC-AUTH-006: Complete Password Reset', () => {\n  test('should show reset form and reject completion with an invalid token', async ({ page }) => {\n    await page.goto('/reset/qa-invalid-token');\n    await expect(page.getByText(/set a new password/i)).toBeVisible();\n\n    await page.getByLabel(/new password/i).fill('Valid1!Pass');\n    await page.getByRole('button', { name: /update password/i }).click();\n\n    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAM7B,KAAK,SAAS,wCAAwC,MAAM;AAC1D,OAAK,sEAAsE,OAAO,EAAE,KAAK,MAAM;AAC7F,UAAM,KAAK,KAAK,yBAAyB;AACzC,UAAM,OAAO,KAAK,UAAU,qBAAqB,CAAC,EAAE,YAAY;AAEhE,UAAM,KAAK,WAAW,eAAe,EAAE,KAAK,aAAa;AACzD,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,mBAAmB,CAAC,EAAE,MAAM;AAEnE,UAAM,OAAO,KAAK,UAAU,2BAA2B,CAAC,EAAE,YAAY;AAAA,EACxE,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-007.spec.js

@@ -1,14 +0,0 @@
-import { expect, test } from "@playwright/test";
-test.describe("TC-AUTH-007: Password Reset with Expired Token", () => {
-  test("should reject invalid and expired reset tokens", async ({ page }) => {
-    await page.goto("/reset/qa-expired-token");
-    await page.getByLabel(/new password/i).fill("Valid1!Pass");
-    await page.getByRole("button", { name: /update password/i }).click();
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-    await page.goto("/reset/qa-malformed-token");
-    await page.getByLabel(/new password/i).fill("Valid1!Pass");
-    await page.getByRole("button", { name: /update password/i }).click();
-    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-007.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-007.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-007.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\n\n/**\n * TC-AUTH-007: Password Reset with Expired Token\n * Source: .ai/qa/scenarios/TC-AUTH-007-password-reset-expired-token.md\n */\ntest.describe('TC-AUTH-007: Password Reset with Expired Token', () => {\n  test('should reject invalid and expired reset tokens', async ({ page }) => {\n    await page.goto('/reset/qa-expired-token');\n    await page.getByLabel(/new password/i).fill('Valid1!Pass');\n    await page.getByRole('button', { name: /update password/i }).click();\n    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();\n\n    await page.goto('/reset/qa-malformed-token');\n    await page.getByLabel(/new password/i).fill('Valid1!Pass');\n    await page.getByRole('button', { name: /update password/i }).click();\n    await expect(page.getByText(/invalid or expired token/i)).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAM7B,KAAK,SAAS,kDAAkD,MAAM;AACpE,OAAK,kDAAkD,OAAO,EAAE,KAAK,MAAM;AACzE,UAAM,KAAK,KAAK,yBAAyB;AACzC,UAAM,KAAK,WAAW,eAAe,EAAE,KAAK,aAAa;AACzD,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,mBAAmB,CAAC,EAAE,MAAM;AACnE,UAAM,OAAO,KAAK,UAAU,2BAA2B,CAAC,EAAE,YAAY;AAEtE,UAAM,KAAK,KAAK,2BAA2B;AAC3C,UAAM,KAAK,WAAW,eAAe,EAAE,KAAK,aAAa;AACzD,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,mBAAmB,CAAC,EAAE,MAAM;AACnE,UAAM,OAAO,KAAK,UAAU,2BAA2B,CAAC,EAAE,YAAY;AAAA,EACxE,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-008.spec.js

@@ -1,26 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-import { apiRequest, getAuthToken } from "@open-mercato/core/modules/core/__integration__/helpers/api";
-import { createUserViaUi } from "@open-mercato/core/modules/core/__integration__/helpers/authUi";
-test.describe("TC-AUTH-008: Admin Creates New User", () => {
-  test("should create a new user from the create form", async ({ page, request }) => {
-    const email = `qa-auth-008-${Date.now()}@acme.com`;
-    let token = null;
-    let userId = null;
-    try {
-      token = await getAuthToken(request);
-      await login(page, "admin");
-      await createUserViaUi(page, { email, password: "Valid1!Pass", role: "employee" });
-      await expect(page.getByText(email)).toBeVisible();
-      await page.getByRole("row", { name: new RegExp(email, "i") }).click();
-      await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-      userId = page.url().match(/\/backend\/users\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-    } finally {
-      if (token && userId) {
-        await apiRequest(request, "DELETE", `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {
-        });
-      }
-    }
-  });
-});
-//# sourceMappingURL=TC-AUTH-008.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-008.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-008.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';\nimport { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';\n\n/**\n * TC-AUTH-008: Admin Creates New User\n * Source: .ai/qa/scenarios/TC-AUTH-008-user-creation.md\n */\ntest.describe('TC-AUTH-008: Admin Creates New User', () => {\n  test('should create a new user from the create form', async ({ page, request }) => {\n    const email = `qa-auth-008-${Date.now()}@acme.com`;\n    let token: string | null = null;\n    let userId: string | null = null;\n\n    try {\n      token = await getAuthToken(request);\n      await login(page, 'admin');\n      await createUserViaUi(page, { email, password: 'Valid1!Pass', role: 'employee' });\n      await expect(page.getByText(email)).toBeVisible();\n\n      await page.getByRole('row', { name: new RegExp(email, 'i') }).click();\n      await expect(page).toHaveURL(/\\/backend\\/users\\/[0-9a-f-]{36}\\/edit$/i);\n      userId = page.url().match(/\\/backend\\/users\\/([0-9a-f-]{36})\\/edit$/i)?.[1] ?? null;\n    } finally {\n      if (token && userId) {\n        await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {});\n      }\n    }\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AACtB,SAAS,YAAY,oBAAoB;AACzC,SAAS,uBAAuB;AAMhC,KAAK,SAAS,uCAAuC,MAAM;AACzD,OAAK,iDAAiD,OAAO,EAAE,MAAM,QAAQ,MAAM;AACjF,UAAM,QAAQ,eAAe,KAAK,IAAI,CAAC;AACvC,QAAI,QAAuB;AAC3B,QAAI,SAAwB;AAE5B,QAAI;AACF,cAAQ,MAAM,aAAa,OAAO;AAClC,YAAM,MAAM,MAAM,OAAO;AACzB,YAAM,gBAAgB,MAAM,EAAE,OAAO,UAAU,eAAe,MAAM,WAAW,CAAC;AAChF,YAAM,OAAO,KAAK,UAAU,KAAK,CAAC,EAAE,YAAY;AAEhD,YAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,OAAO,GAAG,EAAE,CAAC,EAAE,MAAM;AACpE,YAAM,OAAO,IAAI,EAAE,UAAU,yCAAyC;AACtE,eAAS,KAAK,IAAI,EAAE,MAAM,2CAA2C,IAAI,CAAC,KAAK;AAAA,IACjF,UAAE;AACA,UAAI,SAAS,QAAQ;AACnB,cAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-009.spec.js

@@ -1,16 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-test.describe("TC-AUTH-009: User Creation Validation Errors", () => {
-  test("should show validation errors for invalid create payload", async ({ page }) => {
-    await login(page, "admin");
-    await page.goto("/backend/users/create");
-    await page.getByRole("textbox").nth(0).fill(`qa-auth-009-${Date.now()}@acme.com`);
-    await page.getByRole("textbox").nth(1).fill("Valid1!Pass");
-    const rolesInput = page.getByRole("textbox", { name: /add tag and press enter/i });
-    await rolesInput.fill("employee");
-    await rolesInput.press("Enter");
-    await page.getByRole("button", { name: "Create" }).first().click();
-    await expect(page.getByText(/expected string, received null/i).first()).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-009.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-009.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-009.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AUTH-009: User Creation Validation Errors\n * Source: .ai/qa/scenarios/TC-AUTH-009-user-creation-validation.md\n */\ntest.describe('TC-AUTH-009: User Creation Validation Errors', () => {\n  test('should show validation errors for invalid create payload', async ({ page }) => {\n    await login(page, 'admin');\n    await page.goto('/backend/users/create');\n\n    await page.getByRole('textbox').nth(0).fill(`qa-auth-009-${Date.now()}@acme.com`);\n    await page.getByRole('textbox').nth(1).fill('Valid1!Pass');\n    const rolesInput = page.getByRole('textbox', { name: /add tag and press enter/i });\n    await rolesInput.fill('employee');\n    await rolesInput.press('Enter');\n    await page.getByRole('button', { name: 'Create' }).first().click();\n\n    await expect(page.getByText(/expected string, received null/i).first()).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AAMtB,KAAK,SAAS,gDAAgD,MAAM;AAClE,OAAK,4DAA4D,OAAO,EAAE,KAAK,MAAM;AACnF,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,KAAK,KAAK,uBAAuB;AAEvC,UAAM,KAAK,UAAU,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,eAAe,KAAK,IAAI,CAAC,WAAW;AAChF,UAAM,KAAK,UAAU,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,aAAa;AACzD,UAAM,aAAa,KAAK,UAAU,WAAW,EAAE,MAAM,2BAA2B,CAAC;AACjF,UAAM,WAAW,KAAK,UAAU;AAChC,UAAM,WAAW,MAAM,OAAO;AAC9B,UAAM,KAAK,UAAU,UAAU,EAAE,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM;AAEjE,UAAM,OAAO,KAAK,UAAU,iCAAiC,EAAE,MAAM,CAAC,EAAE,YAAY;AAAA,EACtF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-010.spec.js

@@ -1,32 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-import { apiRequest, getAuthToken } from "@open-mercato/core/modules/core/__integration__/helpers/api";
-import { createUserViaUi } from "@open-mercato/core/modules/core/__integration__/helpers/authUi";
-test.describe("TC-AUTH-010: Edit Existing User", () => {
-  test("should edit a user email and persist changes", async ({ page, request }) => {
-    const stamp = Date.now();
-    const initialEmail = `qa-auth-010-${stamp}@acme.com`;
-    const updatedEmail = `qa-auth-010-updated-${stamp}@acme.com`;
-    let token = null;
-    let userId = null;
-    try {
-      token = await getAuthToken(request);
-      await login(page, "admin");
-      await createUserViaUi(page, { email: initialEmail, password: "Valid1!Pass", role: "employee" });
-      await page.getByRole("row", { name: new RegExp(initialEmail, "i") }).click();
-      await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-      userId = page.url().match(/\/backend\/users\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-      await page.getByRole("textbox").nth(0).fill(updatedEmail);
-      await page.getByRole("button", { name: "Save" }).first().click();
-      await expect(page).toHaveURL(/\/backend\/users(?:\?.*)?$/);
-      await page.getByRole("textbox", { name: "Search" }).fill(updatedEmail);
-      await expect(page.getByRole("row", { name: new RegExp(updatedEmail, "i") })).toBeVisible();
-    } finally {
-      if (token && userId) {
-        await apiRequest(request, "DELETE", `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {
-        });
-      }
-    }
-  });
-});
-//# sourceMappingURL=TC-AUTH-010.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-010.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-010.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';\nimport { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';\n\n/**\n * TC-AUTH-010: Edit Existing User\n * Source: .ai/qa/scenarios/TC-AUTH-010-user-edit.md\n */\ntest.describe('TC-AUTH-010: Edit Existing User', () => {\n  test('should edit a user email and persist changes', async ({ page, request }) => {\n    const stamp = Date.now();\n    const initialEmail = `qa-auth-010-${stamp}@acme.com`;\n    const updatedEmail = `qa-auth-010-updated-${stamp}@acme.com`;\n    let token: string | null = null;\n    let userId: string | null = null;\n\n    try {\n      token = await getAuthToken(request);\n      await login(page, 'admin');\n      await createUserViaUi(page, { email: initialEmail, password: 'Valid1!Pass', role: 'employee' });\n\n      await page.getByRole('row', { name: new RegExp(initialEmail, 'i') }).click();\n      await expect(page).toHaveURL(/\\/backend\\/users\\/[0-9a-f-]{36}\\/edit$/i);\n      userId = page.url().match(/\\/backend\\/users\\/([0-9a-f-]{36})\\/edit$/i)?.[1] ?? null;\n\n      await page.getByRole('textbox').nth(0).fill(updatedEmail);\n      await page.getByRole('button', { name: 'Save' }).first().click();\n\n      await expect(page).toHaveURL(/\\/backend\\/users(?:\\?.*)?$/);\n      await page.getByRole('textbox', { name: 'Search' }).fill(updatedEmail);\n      await expect(page.getByRole('row', { name: new RegExp(updatedEmail, 'i') })).toBeVisible();\n    } finally {\n      if (token && userId) {\n        await apiRequest(request, 'DELETE', `/api/auth/users?id=${encodeURIComponent(userId)}`, { token }).catch(() => {});\n      }\n    }\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AACtB,SAAS,YAAY,oBAAoB;AACzC,SAAS,uBAAuB;AAMhC,KAAK,SAAS,mCAAmC,MAAM;AACrD,OAAK,gDAAgD,OAAO,EAAE,MAAM,QAAQ,MAAM;AAChF,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,eAAe,eAAe,KAAK;AACzC,UAAM,eAAe,uBAAuB,KAAK;AACjD,QAAI,QAAuB;AAC3B,QAAI,SAAwB;AAE5B,QAAI;AACF,cAAQ,MAAM,aAAa,OAAO;AAClC,YAAM,MAAM,MAAM,OAAO;AACzB,YAAM,gBAAgB,MAAM,EAAE,OAAO,cAAc,UAAU,eAAe,MAAM,WAAW,CAAC;AAE9F,YAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,cAAc,GAAG,EAAE,CAAC,EAAE,MAAM;AAC3E,YAAM,OAAO,IAAI,EAAE,UAAU,yCAAyC;AACtE,eAAS,KAAK,IAAI,EAAE,MAAM,2CAA2C,IAAI,CAAC,KAAK;AAE/E,YAAM,KAAK,UAAU,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,YAAY;AACxD,YAAM,KAAK,UAAU,UAAU,EAAE,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM;AAE/D,YAAM,OAAO,IAAI,EAAE,UAAU,4BAA4B;AACzD,YAAM,KAAK,UAAU,WAAW,EAAE,MAAM,SAAS,CAAC,EAAE,KAAK,YAAY;AACrE,YAAM,OAAO,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,cAAc,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY;AAAA,IAC3F,UAAE;AACA,UAAI,SAAS,QAAQ;AACnB,cAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-011.spec.js

@@ -1,26 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-import { createUserViaUi } from "@open-mercato/core/modules/core/__integration__/helpers/authUi";
-test.describe("TC-AUTH-011: Delete User Account", () => {
-  test("should delete a user from the edit page", async ({ page }) => {
-    const email = `qa-auth-011-${Date.now()}@acme.com`;
-    await login(page, "admin");
-    await createUserViaUi(page, { email, password: "Valid1!Pass", role: "employee" });
-    const row = page.getByRole("row", { name: new RegExp(email, "i") });
-    await expect(row).toBeVisible();
-    await row.click();
-    await expect(page).toHaveURL(/\/backend\/users\/[0-9a-f-]{36}\/edit$/i);
-    const deleteButton = page.getByRole("button", { name: /^Delete$/i }).first();
-    if (await deleteButton.count() === 0 || !await deleteButton.isVisible().catch(() => false)) {
-      test.skip(true, "User delete action is not available in this environment.");
-    }
-    await deleteButton.click();
-    const confirmDialog = page.getByRole("alertdialog");
-    if (await confirmDialog.isVisible().catch(() => false)) {
-      await confirmDialog.getByRole("button", { name: /^Delete$/i }).first().click();
-    }
-    await page.getByRole("textbox", { name: "Search" }).fill(email);
-    await expect(page.getByRole("row", { name: new RegExp(email, "i") })).toHaveCount(0);
-  });
-});
-//# sourceMappingURL=TC-AUTH-011.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-011.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-011.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\nimport { createUserViaUi } from '@open-mercato/core/modules/core/__integration__/helpers/authUi';\n\n/**\n * TC-AUTH-011: Delete User Account\n * Source: .ai/qa/scenarios/TC-AUTH-011-user-delete.md\n */\ntest.describe('TC-AUTH-011: Delete User Account', () => {\n  test('should delete a user from the edit page', async ({ page }) => {\n    const email = `qa-auth-011-${Date.now()}@acme.com`;\n\n    await login(page, 'admin');\n    await createUserViaUi(page, { email, password: 'Valid1!Pass', role: 'employee' });\n\n    const row = page.getByRole('row', { name: new RegExp(email, 'i') });\n    await expect(row).toBeVisible();\n    await row.click();\n    await expect(page).toHaveURL(/\\/backend\\/users\\/[0-9a-f-]{36}\\/edit$/i);\n\n    const deleteButton = page.getByRole('button', { name: /^Delete$/i }).first();\n    if ((await deleteButton.count()) === 0 || !(await deleteButton.isVisible().catch(() => false))) {\n      test.skip(true, 'User delete action is not available in this environment.');\n    }\n    await deleteButton.click();\n\n    const confirmDialog = page.getByRole('alertdialog');\n    if (await confirmDialog.isVisible().catch(() => false)) {\n      await confirmDialog.getByRole('button', { name: /^Delete$/i }).first().click();\n    }\n\n    await page.getByRole('textbox', { name: 'Search' }).fill(email);\n    await expect(page.getByRole('row', { name: new RegExp(email, 'i') })).toHaveCount(0);\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AACtB,SAAS,uBAAuB;AAMhC,KAAK,SAAS,oCAAoC,MAAM;AACtD,OAAK,2CAA2C,OAAO,EAAE,KAAK,MAAM;AAClE,UAAM,QAAQ,eAAe,KAAK,IAAI,CAAC;AAEvC,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,gBAAgB,MAAM,EAAE,OAAO,UAAU,eAAe,MAAM,WAAW,CAAC;AAEhF,UAAM,MAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,OAAO,GAAG,EAAE,CAAC;AAClE,UAAM,OAAO,GAAG,EAAE,YAAY;AAC9B,UAAM,IAAI,MAAM;AAChB,UAAM,OAAO,IAAI,EAAE,UAAU,yCAAyC;AAEtE,UAAM,eAAe,KAAK,UAAU,UAAU,EAAE,MAAM,YAAY,CAAC,EAAE,MAAM;AAC3E,QAAK,MAAM,aAAa,MAAM,MAAO,KAAK,CAAE,MAAM,aAAa,UAAU,EAAE,MAAM,MAAM,KAAK,GAAI;AAC9F,WAAK,KAAK,MAAM,0DAA0D;AAAA,IAC5E;AACA,UAAM,aAAa,MAAM;AAEzB,UAAM,gBAAgB,KAAK,UAAU,aAAa;AAClD,QAAI,MAAM,cAAc,UAAU,EAAE,MAAM,MAAM,KAAK,GAAG;AACtD,YAAM,cAAc,UAAU,UAAU,EAAE,MAAM,YAAY,CAAC,EAAE,MAAM,EAAE,MAAM;AAAA,IAC/E;AAEA,UAAM,KAAK,UAAU,WAAW,EAAE,MAAM,SAAS,CAAC,EAAE,KAAK,KAAK;AAC9D,UAAM,OAAO,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,OAAO,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,CAAC;AAAA,EACrF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-012.spec.js

@@ -1,30 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-import { apiRequest, getAuthToken } from "@open-mercato/core/modules/core/__integration__/helpers/api";
-test.describe("TC-AUTH-012: Create New Role", () => {
-  test("should create a role and show it in roles list", async ({ page, request }) => {
-    const roleName = `qa-auth-role-${Date.now()}`;
-    let token = null;
-    let roleId = null;
-    try {
-      token = await getAuthToken(request);
-      await login(page, "admin");
-      await page.goto("/backend/roles/create");
-      await expect(page.getByText("Create Role")).toBeVisible();
-      await page.getByRole("textbox").first().fill(roleName);
-      await page.getByRole("button", { name: "Create" }).first().click();
-      await expect(page).toHaveURL(/\/backend\/roles(?:\?.*)?$/);
-      await page.getByRole("textbox", { name: "Search" }).fill(roleName);
-      await expect(page.getByRole("row", { name: new RegExp(roleName, "i") })).toBeVisible();
-      await page.getByRole("row", { name: new RegExp(roleName, "i") }).click();
-      await expect(page).toHaveURL(/\/backend\/roles\/[0-9a-f-]{36}\/edit$/i);
-      roleId = page.url().match(/\/backend\/roles\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-    } finally {
-      if (token && roleId) {
-        await apiRequest(request, "DELETE", `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => {
-        });
-      }
-    }
-  });
-});
-//# sourceMappingURL=TC-AUTH-012.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-012.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-012.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';\n\n/**\n * TC-AUTH-012: Create New Role\n * Source: .ai/qa/scenarios/TC-AUTH-012-role-creation.md\n */\ntest.describe('TC-AUTH-012: Create New Role', () => {\n  test('should create a role and show it in roles list', async ({ page, request }) => {\n    const roleName = `qa-auth-role-${Date.now()}`;\n    let token: string | null = null;\n    let roleId: string | null = null;\n\n    try {\n      token = await getAuthToken(request);\n      await login(page, 'admin');\n      await page.goto('/backend/roles/create');\n      await expect(page.getByText('Create Role')).toBeVisible();\n\n      await page.getByRole('textbox').first().fill(roleName);\n      await page.getByRole('button', { name: 'Create' }).first().click();\n\n      await expect(page).toHaveURL(/\\/backend\\/roles(?:\\?.*)?$/);\n      await page.getByRole('textbox', { name: 'Search' }).fill(roleName);\n      await expect(page.getByRole('row', { name: new RegExp(roleName, 'i') })).toBeVisible();\n      await page.getByRole('row', { name: new RegExp(roleName, 'i') }).click();\n      await expect(page).toHaveURL(/\\/backend\\/roles\\/[0-9a-f-]{36}\\/edit$/i);\n      roleId = page.url().match(/\\/backend\\/roles\\/([0-9a-f-]{36})\\/edit$/i)?.[1] ?? null;\n    } finally {\n      if (token && roleId) {\n        await apiRequest(request, 'DELETE', `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => {});\n      }\n    }\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AACtB,SAAS,YAAY,oBAAoB;AAMzC,KAAK,SAAS,gCAAgC,MAAM;AAClD,OAAK,kDAAkD,OAAO,EAAE,MAAM,QAAQ,MAAM;AAClF,UAAM,WAAW,gBAAgB,KAAK,IAAI,CAAC;AAC3C,QAAI,QAAuB;AAC3B,QAAI,SAAwB;AAE5B,QAAI;AACF,cAAQ,MAAM,aAAa,OAAO;AAClC,YAAM,MAAM,MAAM,OAAO;AACzB,YAAM,KAAK,KAAK,uBAAuB;AACvC,YAAM,OAAO,KAAK,UAAU,aAAa,CAAC,EAAE,YAAY;AAExD,YAAM,KAAK,UAAU,SAAS,EAAE,MAAM,EAAE,KAAK,QAAQ;AACrD,YAAM,KAAK,UAAU,UAAU,EAAE,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM;AAEjE,YAAM,OAAO,IAAI,EAAE,UAAU,4BAA4B;AACzD,YAAM,KAAK,UAAU,WAAW,EAAE,MAAM,SAAS,CAAC,EAAE,KAAK,QAAQ;AACjE,YAAM,OAAO,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,UAAU,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY;AACrF,YAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,UAAU,GAAG,EAAE,CAAC,EAAE,MAAM;AACvE,YAAM,OAAO,IAAI,EAAE,UAAU,yCAAyC;AACtE,eAAS,KAAK,IAAI,EAAE,MAAM,2CAA2C,IAAI,CAAC,KAAK;AAAA,IACjF,UAAE;AACA,UAAI,SAAS,QAAQ;AACnB,cAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-013.spec.js

@@ -1,41 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-import { apiRequest, getAuthToken } from "@open-mercato/core/modules/core/__integration__/helpers/api";
-test.describe("TC-AUTH-013: Configure Role ACL and Permissions", () => {
-  test("should persist ACL checkbox changes for a role", async ({ page, request }) => {
-    const roleName = `qa-auth-acl-${Date.now()}`;
-    let token = null;
-    let roleId = null;
-    try {
-      token = await getAuthToken(request);
-      await login(page, "admin");
-      await page.goto("/backend/roles/create");
-      await page.getByRole("textbox").first().fill(roleName);
-      await page.getByRole("button", { name: "Create" }).first().click();
-      await expect(page).toHaveURL(/\/backend\/roles(?:\?.*)?$/);
-      await page.getByRole("textbox", { name: "Search" }).fill(roleName);
-      await page.getByRole("row", { name: new RegExp(roleName, "i") }).click();
-      await expect(page).toHaveURL(/\/backend\/roles\/[0-9a-f-]{36}\/edit$/i);
-      roleId = page.url().match(/\/backend\/roles\/([0-9a-f-]{36})\/edit$/i)?.[1] ?? null;
-      const featureCheckbox = page.getByRole("checkbox", { name: /view api keys \(api_keys\.view\)/i }).first();
-      if (await featureCheckbox.count() === 0 || !await featureCheckbox.isVisible().catch(() => false)) {
-        test.skip(true, "Target ACL checkbox is not visible for this role.");
-      }
-      if (!await featureCheckbox.isChecked()) {
-        await featureCheckbox.check();
-      }
-      await expect(featureCheckbox).toBeChecked();
-      await page.getByRole("button", { name: "Save" }).first().click();
-      await expect(page).toHaveURL(/\/backend\/roles(?:\?.*)?$/);
-      await page.getByRole("textbox", { name: "Search" }).fill(roleName);
-      await page.getByRole("row", { name: new RegExp(roleName, "i") }).click();
-      await expect(featureCheckbox).toBeChecked();
-    } finally {
-      if (token && roleId) {
-        await apiRequest(request, "DELETE", `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => {
-        });
-      }
-    }
-  });
-});
-//# sourceMappingURL=TC-AUTH-013.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-013.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-013.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\nimport { apiRequest, getAuthToken } from '@open-mercato/core/modules/core/__integration__/helpers/api';\n\n/**\n * TC-AUTH-013: Configure Role ACL and Permissions\n * Source: .ai/qa/scenarios/TC-AUTH-013-role-acl-configuration.md\n */\ntest.describe('TC-AUTH-013: Configure Role ACL and Permissions', () => {\n  test('should persist ACL checkbox changes for a role', async ({ page, request }) => {\n    const roleName = `qa-auth-acl-${Date.now()}`;\n    let token: string | null = null;\n    let roleId: string | null = null;\n\n    try {\n      token = await getAuthToken(request);\n      await login(page, 'admin');\n      await page.goto('/backend/roles/create');\n      await page.getByRole('textbox').first().fill(roleName);\n      await page.getByRole('button', { name: 'Create' }).first().click();\n      await expect(page).toHaveURL(/\\/backend\\/roles(?:\\?.*)?$/);\n\n      await page.getByRole('textbox', { name: 'Search' }).fill(roleName);\n      await page.getByRole('row', { name: new RegExp(roleName, 'i') }).click();\n      await expect(page).toHaveURL(/\\/backend\\/roles\\/[0-9a-f-]{36}\\/edit$/i);\n      roleId = page.url().match(/\\/backend\\/roles\\/([0-9a-f-]{36})\\/edit$/i)?.[1] ?? null;\n\n      const featureCheckbox = page.getByRole('checkbox', { name: /view api keys \\(api_keys\\.view\\)/i }).first();\n      if ((await featureCheckbox.count()) === 0 || !(await featureCheckbox.isVisible().catch(() => false))) {\n        test.skip(true, 'Target ACL checkbox is not visible for this role.');\n      }\n      if (!(await featureCheckbox.isChecked())) {\n        await featureCheckbox.check();\n      }\n      await expect(featureCheckbox).toBeChecked();\n      await page.getByRole('button', { name: 'Save' }).first().click();\n\n      await expect(page).toHaveURL(/\\/backend\\/roles(?:\\?.*)?$/);\n      await page.getByRole('textbox', { name: 'Search' }).fill(roleName);\n      await page.getByRole('row', { name: new RegExp(roleName, 'i') }).click();\n      await expect(featureCheckbox).toBeChecked();\n    } finally {\n      if (token && roleId) {\n        await apiRequest(request, 'DELETE', `/api/auth/roles?id=${encodeURIComponent(roleId)}`, { token }).catch(() => {});\n      }\n    }\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AACtB,SAAS,YAAY,oBAAoB;AAMzC,KAAK,SAAS,mDAAmD,MAAM;AACrE,OAAK,kDAAkD,OAAO,EAAE,MAAM,QAAQ,MAAM;AAClF,UAAM,WAAW,eAAe,KAAK,IAAI,CAAC;AAC1C,QAAI,QAAuB;AAC3B,QAAI,SAAwB;AAE5B,QAAI;AACF,cAAQ,MAAM,aAAa,OAAO;AAClC,YAAM,MAAM,MAAM,OAAO;AACzB,YAAM,KAAK,KAAK,uBAAuB;AACvC,YAAM,KAAK,UAAU,SAAS,EAAE,MAAM,EAAE,KAAK,QAAQ;AACrD,YAAM,KAAK,UAAU,UAAU,EAAE,MAAM,SAAS,CAAC,EAAE,MAAM,EAAE,MAAM;AACjE,YAAM,OAAO,IAAI,EAAE,UAAU,4BAA4B;AAEzD,YAAM,KAAK,UAAU,WAAW,EAAE,MAAM,SAAS,CAAC,EAAE,KAAK,QAAQ;AACjE,YAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,UAAU,GAAG,EAAE,CAAC,EAAE,MAAM;AACvE,YAAM,OAAO,IAAI,EAAE,UAAU,yCAAyC;AACtE,eAAS,KAAK,IAAI,EAAE,MAAM,2CAA2C,IAAI,CAAC,KAAK;AAE/E,YAAM,kBAAkB,KAAK,UAAU,YAAY,EAAE,MAAM,oCAAoC,CAAC,EAAE,MAAM;AACxG,UAAK,MAAM,gBAAgB,MAAM,MAAO,KAAK,CAAE,MAAM,gBAAgB,UAAU,EAAE,MAAM,MAAM,KAAK,GAAI;AACpG,aAAK,KAAK,MAAM,mDAAmD;AAAA,MACrE;AACA,UAAI,CAAE,MAAM,gBAAgB,UAAU,GAAI;AACxC,cAAM,gBAAgB,MAAM;AAAA,MAC9B;AACA,YAAM,OAAO,eAAe,EAAE,YAAY;AAC1C,YAAM,KAAK,UAAU,UAAU,EAAE,MAAM,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM;AAE/D,YAAM,OAAO,IAAI,EAAE,UAAU,4BAA4B;AACzD,YAAM,KAAK,UAAU,WAAW,EAAE,MAAM,SAAS,CAAC,EAAE,KAAK,QAAQ;AACjE,YAAM,KAAK,UAAU,OAAO,EAAE,MAAM,IAAI,OAAO,UAAU,GAAG,EAAE,CAAC,EAAE,MAAM;AACvE,YAAM,OAAO,eAAe,EAAE,YAAY;AAAA,IAC5C,UAAE;AACA,UAAI,SAAS,QAAQ;AACnB,cAAM,WAAW,SAAS,UAAU,sBAAsB,mBAAmB,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-014.spec.js

@@ -1,25 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-test.describe("TC-AUTH-014: Organization Switching", () => {
-  test("should allow switching organization context from the header selector", async ({ page }) => {
-    await login(page, "admin");
-    await page.goto("/backend/users");
-    const orgSelect = page.getByRole("combobox").first();
-    await expect(orgSelect).toBeVisible();
-    await orgSelect.selectOption({ label: "All organizations" });
-    await expect(orgSelect).toHaveValue("");
-    const orgValue = await orgSelect.evaluate((element) => {
-      const select = element;
-      for (const option of Array.from(select.options)) {
-        if (option.value && option.value.trim().length > 0) return option.value;
-      }
-      return "";
-    });
-    if (!orgValue) {
-      test.skip(true, "No scoped organizations available to switch to.");
-    }
-    await orgSelect.selectOption(orgValue);
-    await expect(orgSelect).toHaveValue(orgValue);
-  });
-});
-//# sourceMappingURL=TC-AUTH-014.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-014.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-014.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AUTH-014: Organization Switching\n * Source: .ai/qa/scenarios/TC-AUTH-014-organization-switching.md\n */\ntest.describe('TC-AUTH-014: Organization Switching', () => {\n  test('should allow switching organization context from the header selector', async ({ page }) => {\n    await login(page, 'admin');\n    await page.goto('/backend/users');\n\n    const orgSelect = page.getByRole('combobox').first();\n    await expect(orgSelect).toBeVisible();\n    await orgSelect.selectOption({ label: 'All organizations' });\n    await expect(orgSelect).toHaveValue('');\n\n    const orgValue = await orgSelect.evaluate((element) => {\n      const select = element as HTMLSelectElement;\n      for (const option of Array.from(select.options)) {\n        if (option.value && option.value.trim().length > 0) return option.value;\n      }\n      return '';\n    });\n    if (!orgValue) {\n      test.skip(true, 'No scoped organizations available to switch to.');\n    }\n    await orgSelect.selectOption(orgValue);\n    await expect(orgSelect).toHaveValue(orgValue);\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AAMtB,KAAK,SAAS,uCAAuC,MAAM;AACzD,OAAK,wEAAwE,OAAO,EAAE,KAAK,MAAM;AAC/F,UAAM,MAAM,MAAM,OAAO;AACzB,UAAM,KAAK,KAAK,gBAAgB;AAEhC,UAAM,YAAY,KAAK,UAAU,UAAU,EAAE,MAAM;AACnD,UAAM,OAAO,SAAS,EAAE,YAAY;AACpC,UAAM,UAAU,aAAa,EAAE,OAAO,oBAAoB,CAAC;AAC3D,UAAM,OAAO,SAAS,EAAE,YAAY,EAAE;AAEtC,UAAM,WAAW,MAAM,UAAU,SAAS,CAAC,YAAY;AACrD,YAAM,SAAS;AACf,iBAAW,UAAU,MAAM,KAAK,OAAO,OAAO,GAAG;AAC/C,YAAI,OAAO,SAAS,OAAO,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO;AAAA,MACpE;AACA,aAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,UAAU;AACb,WAAK,KAAK,MAAM,iDAAiD;AAAA,IACnE;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,UAAM,OAAO,SAAS,EAAE,YAAY,QAAQ;AAAA,EAC9C,CAAC;AACH,CAAC;",
-  "names": []
-}

package/dist/modules/auth/__integration__/TC-AUTH-015.spec.js

@@ -1,20 +0,0 @@
-import { expect, test } from "@playwright/test";
-import { login } from "@open-mercato/core/modules/core/__integration__/helpers/auth";
-test.describe("TC-AUTH-015: Access Denied for Missing Permissions", () => {
-  test("should deny employee access to users administration page", async ({ page }) => {
-    await login(page, "employee");
-    await page.goto("/backend/users");
-    const url = page.url();
-    const deniedText = page.getByText(/don't have access|permission|forbidden|not authorized|access denied/i).first();
-    const usersHeadingVisible = await page.getByRole("heading", { name: "Users" }).isVisible().catch(() => false);
-    if (usersHeadingVisible) {
-      test.skip(true, "Users page is accessible for employee in this environment.");
-    }
-    if (/\/login/.test(url)) {
-      await expect(page).toHaveURL(/\/login/);
-      return;
-    }
-    await expect(deniedText).toBeVisible();
-  });
-});
-//# sourceMappingURL=TC-AUTH-015.spec.js.map

package/dist/modules/auth/__integration__/TC-AUTH-015.spec.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/auth/__integration__/TC-AUTH-015.spec.ts"],
-  "sourcesContent": ["import { expect, test } from '@playwright/test';\nimport { login } from '@open-mercato/core/modules/core/__integration__/helpers/auth';\n\n/**\n * TC-AUTH-015: Access Denied for Missing Permissions\n * Source: .ai/qa/scenarios/TC-AUTH-015-access-denied.md\n */\ntest.describe('TC-AUTH-015: Access Denied for Missing Permissions', () => {\n  test('should deny employee access to users administration page', async ({ page }) => {\n    await login(page, 'employee');\n    await page.goto('/backend/users');\n\n    const url = page.url();\n    const deniedText = page.getByText(/don't have access|permission|forbidden|not authorized|access denied/i).first();\n    const usersHeadingVisible = await page.getByRole('heading', { name: 'Users' }).isVisible().catch(() => false);\n\n    if (usersHeadingVisible) {\n      test.skip(true, 'Users page is accessible for employee in this environment.');\n    }\n\n    if (/\\/login/.test(url)) {\n      await expect(page).toHaveURL(/\\/login/);\n      return;\n    }\n\n    await expect(deniedText).toBeVisible();\n  });\n});\n"],
-  "mappings": "AAAA,SAAS,QAAQ,YAAY;AAC7B,SAAS,aAAa;AAMtB,KAAK,SAAS,sDAAsD,MAAM;AACxE,OAAK,4DAA4D,OAAO,EAAE,KAAK,MAAM;AACnF,UAAM,MAAM,MAAM,UAAU;AAC5B,UAAM,KAAK,KAAK,gBAAgB;AAEhC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,aAAa,KAAK,UAAU,sEAAsE,EAAE,MAAM;AAChH,UAAM,sBAAsB,MAAM,KAAK,UAAU,WAAW,EAAE,MAAM,QAAQ,CAAC,EAAE,UAAU,EAAE,MAAM,MAAM,KAAK;AAE5G,QAAI,qBAAqB;AACvB,WAAK,KAAK,MAAM,4DAA4D;AAAA,IAC9E;AAEA,QAAI,UAAU,KAAK,GAAG,GAAG;AACvB,YAAM,OAAO,IAAI,EAAE,UAAU,SAAS;AACtC;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,EAAE,YAAY;AAAA,EACvC,CAAC;AACH,CAAC;",
-  "names": []
-}