@open-mercato/core 0.5.1-develop.3036.f02c281f23 → 0.5.1-develop.3045.b4b3320cc2

package/src/helpers/integration/auth.ts

@@ -153,12 +153,19 @@ export async function login(page: Page, role: Role = 'admin'): Promise<void> {
   const apiLoginForm = new URLSearchParams();
   apiLoginForm.set('email', creds.email);
   apiLoginForm.set('password', creds.password);
-  const apiLoginResponse = await page.request.post('/api/auth/login', {
-    headers: {
-      'content-type': 'application/x-www-form-urlencoded',
-    },
-    data: apiLoginForm.toString(),
-  }).catch(() => null);
+  // Retry-on-429 against the auth rate limit (5/60s per email). Capped
+  // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
+  let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
+  for (let retry = 0; retry < 4; retry += 1) {
+    apiLoginResponse = await page.request.post('/api/auth/login', {
+      headers: {
+        'content-type': 'application/x-www-form-urlencoded',
+      },
+      data: apiLoginForm.toString(),
+    }).catch(() => null);
+    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
+    await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
+  }
   if (apiLoginResponse?.ok()) {
     const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
     const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;

package/src/modules/auth/commands/roles.ts

@@ -53,11 +53,14 @@ type RoleSnapshots = {
 
 const RESERVED_ROLE_NAMES = new Set(['superadmin', 'admin'])
 
-function assertRoleNameAllowed(name: string | undefined | null) {
-  if (typeof name !== 'string') return
+function isReservedRoleName(name: string | undefined | null): boolean {
+  if (typeof name !== 'string') return false
   const normalized = name.trim().toLowerCase()
-  if (!normalized) return
-  if (RESERVED_ROLE_NAMES.has(normalized)) {
+  return normalized.length > 0 && RESERVED_ROLE_NAMES.has(normalized)
+}
+
+function assertRoleNameAllowed(name: string | undefined | null) {
+  if (isReservedRoleName(name)) {
     throw new CrudHttpError(400, { error: 'Role name is reserved' })
   }
 }
@@ -220,22 +223,17 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
+    const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
     if (parsed.name !== undefined) {
-      assertRoleNameAllowed(parsed.name)
-      const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
-      if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
-      assertRoleNameAllowed(current.name)
       const nextName = parsed.name
+      if (nextName !== current.name) assertRoleNameAllowed(nextName)
       if (nextName !== current.name) {
         const assignments = await em.count(UserRole, { role: current, deletedAt: null })
         if (assignments > 0) {
           throw new CrudHttpError(400, { error: 'Role name cannot be changed while users are assigned' })
         }
       }
-    } else {
-      const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
-      if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
-      assertRoleNameAllowed(current.name)
     }
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const role = await de.updateOrmEntity({

package/src/modules/catalog/AGENTS.md

@@ -64,3 +64,14 @@ The default pipeline emits `catalog.pricing.resolve.before|after` events.
 Key events follow the standard pattern in `events.ts`:
 - `catalog.product.created/updated/deleted` — CRUD events
 - `catalog.pricing.resolve.before/after` — pricing lifecycle (excluded from workflow triggers)
+
+## AI Agents in This Module
+
+Two typed AI agents ship from `ai-agents.ts`. See `/framework/ai-assistant/agents` for the full guide. Copy `packages/core/src/modules/customers/ai-agents.ts` + `ai-tools.ts` first; use this module's agents as the catalog-specific reference.
+
+| Agent ID | Mode | Policy | Purpose |
+|----------|------|--------|---------|
+| `catalog.catalog_assistant` | chat | `read-only` | General operator explorer for products, categories, variants, prices, offers, product media, tags, option schemas, and unit conversions via the base catalog tool pack + general-purpose packs. |
+| `catalog.merchandising_assistant` | chat | `read-only` (mutation-capable via per-tenant override unlocking `catalog.update_product`, `catalog.bulk_update_products`, `catalog.apply_attribute_extraction`, `catalog.update_product_media_descriptions`) | D18 demo agent: proposes descriptions, attribute extractions, title variants, and price adjustments for the current selection on the products list page. |
+
+The merchandising assistant is the Phase 2 D18 demo. `<AiChat agent="catalog.merchandising_assistant" />` is injected via `MerchandisingAssistantSheet.tsx` on `/backend/catalog/catalog/products` (see `packages/core/src/modules/catalog/backend/catalog/products/page.tsx`). Mutation-capable authoring tools route through `prepareMutation` + the approval-card contract; confirmed batches refresh the DataTable via `catalog.product.updated` events on the DOM event bridge.

package/src/modules/catalog/ai-agents-context.ts

@@ -0,0 +1,239 @@
+/**
+ * Page-context hydration helpers for the catalog agents
+ * (Phase 3 WS-A, Step 5.2).
+ *
+ * Two flavors:
+ *
+ * 1. `hydrateCatalogAssistantContext` — `catalog.catalog_assistant`. Loads
+ *    a lightweight product summary for a single UUID (`catalog.product`),
+ *    or a batch of up to 10 summaries when the request carries a
+ *    comma-separated UUID list keyed as `catalog.products.list`.
+ *
+ * 2. `hydrateMerchandisingAssistantContext` —
+ *    `catalog.merchandising_assistant`. Loads the full
+ *    `catalog.get_product_bundle` aggregate for a single product, or a
+ *    capped-at-10 selection via `catalog.list_selected_products`. When
+ *    the request carries the products-list page view, the incoming
+ *    `pageContext.extra.filter` is pretty-printed into the context block
+ *    so the agent can reason about the narrowed set even when no
+ *    selection is active.
+ *
+ * Both helpers route every read through an existing tool-pack handler
+ * (Step 3.10 base pack + Step 3.11 D18 pack) so the agent-reachable
+ * surface and the hydration surface stay in lock-step. Tenant + org
+ * scope is enforced by the tool handlers themselves; cross-tenant ids
+ * surface as `{ found: false }` / `missingIds`, which we translate to a
+ * silent null return (the runtime then proceeds without hydration).
+ *
+ * Error swallowing is required by the Step 3.2 runtime contract — a
+ * hydration fault MUST NEVER break the chat request.
+ */
+import type { AwilixContainer } from 'awilix'
+import catalogAiTools from './ai-tools'
+import type {
+  CatalogAiToolDefinition,
+  CatalogToolContext,
+} from './ai-tools/types'
+
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+const SELECTION_CAP = 10
+
+function isUuid(value: unknown): value is string {
+  return typeof value === 'string' && UUID_REGEX.test(value)
+}
+
+function parseSelectionIds(raw: string): string[] {
+  if (!raw) return []
+  const unique = new Set<string>()
+  for (const token of raw.split(',')) {
+    const trimmed = token.trim()
+    if (isUuid(trimmed)) unique.add(trimmed)
+    if (unique.size >= SELECTION_CAP) break
+  }
+  return Array.from(unique)
+}
+
+function findTool(name: string): CatalogAiToolDefinition | null {
+  return (
+    (catalogAiTools as CatalogAiToolDefinition[]).find((tool) => tool.name === name) ?? null
+  )
+}
+
+function buildToolContext(
+  container: AwilixContainer,
+  tenantId: string,
+  organizationId: string | null,
+): CatalogToolContext {
+  return {
+    tenantId,
+    organizationId,
+    userId: null,
+    container,
+    userFeatures: [],
+    isSuperAdmin: true,
+    apiKeySecret: undefined,
+    sessionId: undefined,
+  }
+}
+
+function renderContextBlock(label: string, payload: unknown): string {
+  return `## Page context — ${label}\n${JSON.stringify(payload, null, 2)}`
+}
+
+export interface HydrateCatalogContextInput {
+  entityType: string
+  recordId: string
+  container: AwilixContainer
+  tenantId: string | null
+  organizationId: string | null
+}
+
+const SINGLE_PRODUCT_ENTITY_TYPES = new Set([
+  'product',
+  'catalog.product',
+  'catalog:catalog_product',
+])
+
+const PRODUCTS_LIST_ENTITY_TYPES = new Set([
+  'catalog.products.list',
+  'catalog.products.selection',
+  'products.list',
+  'products.selection',
+])
+
+async function invokeTool(
+  toolName: string,
+  args: Record<string, unknown>,
+  toolContext: CatalogToolContext,
+  reasonPrefix: string,
+): Promise<unknown | null> {
+  const tool = findTool(toolName)
+  if (!tool) {
+    console.warn(`[${reasonPrefix}] resolvePageContext: tool "${toolName}" not registered`)
+    return null
+  }
+  try {
+    const result = await tool.handler(args as never, toolContext)
+    return result ?? null
+  } catch (error) {
+    console.warn(
+      `[${reasonPrefix}] resolvePageContext: tool "${toolName}" failed (reason="hydration_error"); skipping`,
+      error instanceof Error ? error.message : error,
+    )
+    return null
+  }
+}
+
+// -----------------------------------------------------------------------------
+// catalog.catalog_assistant hydration
+// -----------------------------------------------------------------------------
+
+export async function hydrateCatalogAssistantContext(
+  input: HydrateCatalogContextInput,
+): Promise<string | null> {
+  const tenantId = input.tenantId
+  if (!tenantId) return null
+  const entityType = input.entityType.trim().toLowerCase()
+  if (!entityType) return null
+  const toolContext = buildToolContext(input.container, tenantId, input.organizationId)
+
+  if (SINGLE_PRODUCT_ENTITY_TYPES.has(entityType)) {
+    if (!isUuid(input.recordId)) return null
+    const result = await invokeTool(
+      'catalog.get_product',
+      { productId: input.recordId },
+      toolContext,
+      'catalog.catalog_assistant',
+    )
+    if (!result || typeof result !== 'object') return null
+    if ((result as { found?: boolean }).found === false) return null
+    return renderContextBlock(`Product ${input.recordId}`, result)
+  }
+
+  if (PRODUCTS_LIST_ENTITY_TYPES.has(entityType)) {
+    const ids = parseSelectionIds(input.recordId)
+    if (ids.length === 0) return null
+    // Reuse the D18 merchandising bundle tool — its result carries
+    // summaries inside full bundles. For the base catalog_assistant we
+    // keep the payload lightweight by projecting each bundle onto the
+    // summary subset the agent cares about.
+    const result = await invokeTool(
+      'catalog.list_selected_products',
+      { productIds: ids },
+      toolContext,
+      'catalog.catalog_assistant',
+    )
+    if (!result || typeof result !== 'object') return null
+    const { items, missingIds } = result as {
+      items?: Array<{ product?: unknown }>
+      missingIds?: string[]
+    }
+    const summaries = Array.isArray(items)
+      ? items
+          .map((item) => (item && typeof item === 'object' ? (item as { product?: unknown }).product ?? null : null))
+          .filter((value) => value !== null)
+      : []
+    if (summaries.length === 0) return null
+    return renderContextBlock(
+      `Products selection (${summaries.length} of ${ids.length})`,
+      { items: summaries, missingIds: missingIds ?? [] },
+    )
+  }
+
+  return null
+}
+
+// -----------------------------------------------------------------------------
+// catalog.merchandising_assistant hydration
+// -----------------------------------------------------------------------------
+
+export async function hydrateMerchandisingAssistantContext(
+  input: HydrateCatalogContextInput,
+): Promise<string | null> {
+  const tenantId = input.tenantId
+  if (!tenantId) return null
+  const entityType = input.entityType.trim().toLowerCase()
+  if (!entityType) return null
+  const toolContext = buildToolContext(input.container, tenantId, input.organizationId)
+
+  if (SINGLE_PRODUCT_ENTITY_TYPES.has(entityType)) {
+    if (!isUuid(input.recordId)) return null
+    const result = await invokeTool(
+      'catalog.get_product_bundle',
+      { productId: input.recordId },
+      toolContext,
+      'catalog.merchandising_assistant',
+    )
+    if (!result || typeof result !== 'object') return null
+    if ((result as { found?: boolean }).found === false) return null
+    return renderContextBlock(`Product bundle ${input.recordId}`, result)
+  }
+
+  if (PRODUCTS_LIST_ENTITY_TYPES.has(entityType)) {
+    const ids = parseSelectionIds(input.recordId)
+    if (ids.length === 0) return null
+    const result = await invokeTool(
+      'catalog.list_selected_products',
+      { productIds: ids },
+      toolContext,
+      'catalog.merchandising_assistant',
+    )
+    if (!result || typeof result !== 'object') return null
+    const { items, missingIds } = result as {
+      items?: unknown[]
+      missingIds?: string[]
+    }
+    const bundles = Array.isArray(items) ? items : []
+    if (bundles.length === 0) return null
+    return renderContextBlock(
+      `Products selection bundles (${bundles.length} of ${ids.length})`,
+      {
+        items: bundles,
+        missingIds: missingIds ?? [],
+      },
+    )
+  }
+
+  return null
+}