@open-mercato/core 0.6.3-develop.3810.1.ad92c339f5 → 0.6.3-develop.3820.1.636677865b

package/dist/modules/staff/api/team-members/assignable/route.js

@@ -0,0 +1,214 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { createPagedListResponseSchema as createSharedPagedListResponseSchema } from "@open-mercato/shared/lib/openapi/crud";
+import { User } from "@open-mercato/core/modules/auth/data/entities";
+import {
+  resolveAuthActorId,
+  resolveCustomersRequestContext
+} from "@open-mercato/core/modules/customers/lib/interactionRequestContext";
+import { StaffTeam, StaffTeamMember } from "../../../data/entities.js";
+const querySchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(24),
+  search: z.string().optional()
+}).passthrough();
+const itemSchema = z.object({
+  id: z.string().uuid(),
+  teamMemberId: z.string().uuid(),
+  userId: z.string().uuid(),
+  displayName: z.string(),
+  email: z.string().nullable().optional(),
+  teamName: z.string().nullable().optional(),
+  user: z.object({
+    id: z.string().uuid(),
+    email: z.string().nullable().optional()
+  }).nullable().optional(),
+  team: z.object({
+    id: z.string().uuid(),
+    name: z.string().nullable().optional()
+  }).nullable().optional()
+});
+const errorSchema = z.object({ error: z.string() });
+const pagedListSchema = createSharedPagedListResponseSchema(itemSchema, {
+  paginationMetaOptional: true
+});
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["customers.roles.view"] }
+};
+async function canAccessAssignableStaff(rbac, userId, scope) {
+  if (!rbac) return false;
+  if (await rbac.userHasAllFeatures(userId, ["customers.roles.manage"], scope)) {
+    return true;
+  }
+  return rbac.userHasAllFeatures(userId, ["customers.activities.manage"], scope);
+}
+async function GET(request) {
+  const { translate } = await resolveTranslations();
+  try {
+    const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams));
+    const { container, em, auth, selectedOrganizationId } = await resolveCustomersRequestContext(request);
+    if (!selectedOrganizationId) {
+      throw new CrudHttpError(
+        400,
+        { error: translate("customers.errors.organization_required", "Organization context is required") }
+      );
+    }
+    const actorId = resolveAuthActorId(auth);
+    const rbacService = container.resolve("rbacService");
+    const scope = { tenantId: auth.tenantId, organizationId: selectedOrganizationId };
+    const hasAccess = await canAccessAssignableStaff(rbacService, actorId, scope);
+    if (!hasAccess) {
+      throw new CrudHttpError(
+        403,
+        {
+          error: translate(
+            "customers.assignableStaff.forbidden",
+            "Insufficient permissions to load assignable staff."
+          )
+        }
+      );
+    }
+    const normalizedSearch = query.search?.trim().toLowerCase() ?? "";
+    const members = await findWithDecryption(
+      em,
+      StaffTeamMember,
+      {
+        tenantId: auth.tenantId,
+        organizationId: selectedOrganizationId,
+        deletedAt: null,
+        isActive: true
+      },
+      { orderBy: { displayName: "asc" } },
+      scope
+    );
+    const userIds = Array.from(
+      new Set(
+        members.map((member) => typeof member.userId === "string" && member.userId.trim().length > 0 ? member.userId : null).filter((value) => typeof value === "string")
+      )
+    );
+    const teamIds = Array.from(
+      new Set(
+        members.map((member) => typeof member.teamId === "string" && member.teamId.trim().length > 0 ? member.teamId : null).filter((value) => typeof value === "string")
+      )
+    );
+    const [users, teams] = await Promise.all([
+      userIds.length > 0 ? findWithDecryption(
+        em,
+        User,
+        {
+          id: { $in: userIds },
+          deletedAt: null,
+          tenantId: auth.tenantId,
+          organizationId: selectedOrganizationId
+        },
+        void 0,
+        scope
+      ) : Promise.resolve([]),
+      teamIds.length > 0 ? findWithDecryption(
+        em,
+        StaffTeam,
+        {
+          id: { $in: teamIds },
+          deletedAt: null,
+          tenantId: auth.tenantId,
+          organizationId: selectedOrganizationId
+        },
+        void 0,
+        scope
+      ) : Promise.resolve([])
+    ]);
+    const userById = new Map(
+      users.map((user) => [
+        user.id,
+        {
+          id: user.id,
+          email: user.email ?? null
+        }
+      ])
+    );
+    const teamById = new Map(
+      teams.map((team) => [
+        team.id,
+        {
+          id: team.id,
+          name: team.name ?? null
+        }
+      ])
+    );
+    const items = members.filter((member) => typeof member.userId === "string" && member.userId.trim().length > 0).map((member) => {
+      const userId = member.userId;
+      const user = userById.get(userId) ?? { id: userId, email: null };
+      const team = member.teamId ? teamById.get(member.teamId) ?? null : null;
+      return {
+        id: member.id,
+        teamMemberId: member.id,
+        userId,
+        displayName: member.displayName?.trim() || user.email || userId,
+        email: user.email,
+        teamName: team?.name ?? null,
+        user,
+        team
+      };
+    }).filter((item) => {
+      if (!normalizedSearch) return true;
+      const haystack = [item.displayName, item.email, item.teamName].filter((value) => typeof value === "string" && value.length > 0).join(" ").toLowerCase();
+      return haystack.includes(normalizedSearch);
+    });
+    const deduped = Array.from(
+      items.reduce((acc, item) => {
+        if (!acc.has(item.userId)) {
+          acc.set(item.userId, item);
+        }
+        return acc;
+      }, /* @__PURE__ */ new Map())
+    ).map(([, item]) => item);
+    const start = (query.page - 1) * query.pageSize;
+    return NextResponse.json({
+      items: deduped.slice(start, start + query.pageSize),
+      total: deduped.length,
+      page: query.page,
+      pageSize: query.pageSize
+    });
+  } catch (error) {
+    if (isCrudHttpError(error)) {
+      return NextResponse.json(error.body, { status: error.status });
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: translate("customers.errors.validationFailed", "Validation failed") }, { status: 400 });
+    }
+    console.error("staff.assignable-team-members.get failed", error);
+    return NextResponse.json({ error: translate("customers.errors.assignable_staff_load_failed", "Failed to load assignable staff") }, { status: 500 });
+  }
+}
+const openApi = {
+  tag: "Staff",
+  summary: "Assignable staff candidates",
+  methods: {
+    GET: {
+      summary: "List staff members that can be assigned from customer flows",
+      query: querySchema,
+      description: "Returns active staff members linked to auth users. Access requires either customers.roles.manage or customers.activities.manage. Owned by the staff module; consumed from customer flows via this canonical URL. Replaces the deprecated /api/customers/assignable-staff route.",
+      responses: [
+        {
+          status: 200,
+          description: "Assignable staff members",
+          schema: pagedListSchema
+        }
+      ],
+      errors: [
+        { status: 400, description: "Invalid request", schema: errorSchema },
+        { status: 401, description: "Unauthorized", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/team-members/assignable/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/staff/api/team-members/assignable/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createPagedListResponseSchema as createSharedPagedListResponseSchema } from '@open-mercato/shared/lib/openapi/crud'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  resolveAuthActorId,\n  resolveCustomersRequestContext,\n} from '@open-mercato/core/modules/customers/lib/interactionRequestContext'\nimport { StaffTeam, StaffTeamMember } from '../../../data/entities'\n\nconst querySchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(24),\n    search: z.string().optional(),\n  })\n  .passthrough()\n\nconst itemSchema = z.object({\n  id: z.string().uuid(),\n  teamMemberId: z.string().uuid(),\n  userId: z.string().uuid(),\n  displayName: z.string(),\n  email: z.string().nullable().optional(),\n  teamName: z.string().nullable().optional(),\n  user: z\n    .object({\n      id: z.string().uuid(),\n      email: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n  team: z\n    .object({\n      id: z.string().uuid(),\n      name: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nconst pagedListSchema = createSharedPagedListResponseSchema(itemSchema, {\n  paginationMetaOptional: true,\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.roles.view'] },\n}\n\nasync function canAccessAssignableStaff(\n  rbac: RbacService | undefined,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  if (!rbac) return false\n  if (\n    await rbac.userHasAllFeatures(userId, ['customers.roles.manage'], scope)\n  ) {\n    return true\n  }\n  return rbac.userHasAllFeatures(userId, ['customers.activities.manage'], scope)\n}\n\nexport async function GET(request: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n    const { container, em, auth, selectedOrganizationId } = await resolveCustomersRequestContext(request)\n\n    if (!selectedOrganizationId) {\n      throw new CrudHttpError(\n        400,\n        { error: translate('customers.errors.organization_required', 'Organization context is required') },\n      )\n    }\n\n    const actorId = resolveAuthActorId(auth)\n    const rbacService = container.resolve('rbacService') as RbacService | undefined\n    const scope = { tenantId: auth.tenantId, organizationId: selectedOrganizationId }\n    const hasAccess = await canAccessAssignableStaff(rbacService, actorId, scope)\n    if (!hasAccess) {\n      throw new CrudHttpError(\n        403,\n        {\n          error: translate(\n            'customers.assignableStaff.forbidden',\n            'Insufficient permissions to load assignable staff.',\n          ),\n        },\n      )\n    }\n\n    const normalizedSearch = query.search?.trim().toLowerCase() ?? ''\n\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      {\n        tenantId: auth.tenantId,\n        organizationId: selectedOrganizationId,\n        deletedAt: null,\n        isActive: true,\n      },\n      { orderBy: { displayName: 'asc' } },\n      scope,\n    )\n\n    const userIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.userId === 'string' && member.userId.trim().length > 0 ? member.userId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n    const teamIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.teamId === 'string' && member.teamId.trim().length > 0 ? member.teamId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n\n    const [users, teams] = await Promise.all([\n      userIds.length > 0\n        ? findWithDecryption(\n            em,\n            User,\n            {\n              id: { $in: userIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              organizationId: selectedOrganizationId,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n      teamIds.length > 0\n        ? findWithDecryption(\n            em,\n            StaffTeam,\n            {\n              id: { $in: teamIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              organizationId: selectedOrganizationId,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n    ])\n\n    const userById = new Map(\n      users.map((user) => [\n        user.id,\n        {\n          id: user.id,\n          email: user.email ?? null,\n        },\n      ]),\n    )\n    const teamById = new Map(\n      teams.map((team) => [\n        team.id,\n        {\n          id: team.id,\n          name: team.name ?? null,\n        },\n      ]),\n    )\n\n    const items = members\n      .filter((member) => typeof member.userId === 'string' && member.userId.trim().length > 0)\n      .map((member) => {\n        const userId = member.userId as string\n        const user = userById.get(userId) ?? { id: userId, email: null }\n        const team = member.teamId ? teamById.get(member.teamId) ?? null : null\n        return {\n          id: member.id,\n          teamMemberId: member.id,\n          userId,\n          displayName: member.displayName?.trim() || user.email || userId,\n          email: user.email,\n          teamName: team?.name ?? null,\n          user,\n          team,\n        }\n      })\n      .filter((item) => {\n        if (!normalizedSearch) return true\n        const haystack = [item.displayName, item.email, item.teamName]\n          .filter((value): value is string => typeof value === 'string' && value.length > 0)\n          .join(' ')\n          .toLowerCase()\n        return haystack.includes(normalizedSearch)\n      })\n\n    const deduped = Array.from(\n      items.reduce((acc, item) => {\n        if (!acc.has(item.userId)) {\n          acc.set(item.userId, item)\n        }\n        return acc\n      }, new Map<string, (typeof items)[number]>()),\n    ).map(([, item]) => item)\n\n    const start = (query.page - 1) * query.pageSize\n    return NextResponse.json({\n      items: deduped.slice(start, start + query.pageSize),\n      total: deduped.length,\n      page: query.page,\n      pageSize: query.pageSize,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('customers.errors.validationFailed', 'Validation failed') }, { status: 400 })\n    }\n    console.error('staff.assignable-team-members.get failed', error)\n    return NextResponse.json({ error: translate('customers.errors.assignable_staff_load_failed', 'Failed to load assignable staff') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Assignable staff candidates',\n  methods: {\n    GET: {\n      summary: 'List staff members that can be assigned from customer flows',\n      query: querySchema,\n      description:\n        'Returns active staff members linked to auth users. Access requires either customers.roles.manage or customers.activities.manage. Owned by the staff module; consumed from customer flows via this canonical URL. Replaces the deprecated /api/customers/assignable-staff route.',\n      responses: [\n        {\n          status: 200,\n          description: 'Assignable staff members',\n          schema: pagedListSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC,2CAA2C;AAErF,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,uBAAuB;AAE3C,MAAM,cAAc,EACjB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY;AAEf,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,EACZ,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,MAAM,kBAAkB,oCAAoC,YAAY;AAAA,EACtE,wBAAwB;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAe,yBACb,MACA,QACA,OACkB;AAClB,MAAI,CAAC,KAAM,QAAO;AAClB,MACE,MAAM,KAAK,mBAAmB,QAAQ,CAAC,wBAAwB,GAAG,KAAK,GACvE;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,mBAAmB,QAAQ,CAAC,6BAA6B,GAAG,KAAK;AAC/E;AAEA,eAAsB,IAAI,SAAkB;AAC1C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AACrF,UAAM,EAAE,WAAW,IAAI,MAAM,uBAAuB,IAAI,MAAM,+BAA+B,OAAO;AAEpG,QAAI,CAAC,wBAAwB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE;AAAA,MACnG;AAAA,IACF;AAEA,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,QAAQ,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB;AAChF,UAAM,YAAY,MAAM,yBAAyB,aAAa,SAAS,KAAK;AAC5E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,MAAM,QAAQ,KAAK,EAAE,YAAY,KAAK;AAE/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,MACA,EAAE,SAAS,EAAE,aAAa,MAAM,EAAE;AAAA,MAClC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AAEA,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACtB,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,OAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,MAAM,KAAK,QAAQ;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,QACX,OAAO,CAAC,WAAW,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,WAAW;AACf,YAAM,SAAS,OAAO;AACtB,YAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,QAAQ,OAAO,KAAK;AAC/D,YAAM,OAAO,OAAO,SAAS,SAAS,IAAI,OAAO,MAAM,KAAK,OAAO;AACnE,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,cAAc,OAAO;AAAA,QACrB;AAAA,QACA,aAAa,OAAO,aAAa,KAAK,KAAK,KAAK,SAAS;AAAA,QACzD,OAAO,KAAK;AAAA,QACZ,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAS;AAChB,UAAI,CAAC,iBAAkB,QAAO;AAC9B,YAAM,WAAW,CAAC,KAAK,aAAa,KAAK,OAAO,KAAK,QAAQ,EAC1D,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,GAAG,EACR,YAAY;AACf,aAAO,SAAS,SAAS,gBAAgB;AAAA,IAC3C,CAAC;AAEH,UAAM,UAAU,MAAM;AAAA,MACpB,MAAM,OAAO,CAAC,KAAK,SAAS;AAC1B,YAAI,CAAC,IAAI,IAAI,KAAK,MAAM,GAAG;AACzB,cAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,GAAG,oBAAI,IAAoC,CAAC;AAAA,IAC9C,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,IAAI;AAExB,UAAM,SAAS,MAAM,OAAO,KAAK,MAAM;AACvC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,OAAO,QAAQ;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AACA,YAAQ,MAAM,4CAA4C,KAAK;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iDAAiD,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpJ;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/di.js

@@ -0,0 +1,14 @@
+import { asValue } from "awilix";
+import {
+  resolveAvailabilityWriteAccess
+} from "./lib/availabilityAccess.js";
+function register(container) {
+  const resolver = { resolveAvailabilityWriteAccess };
+  container.register({
+    availabilityAccessResolver: asValue(resolver)
+  });
+}
+export {
+  register
+};
+//# sourceMappingURL=di.js.map

package/dist/modules/staff/di.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/staff/di.ts"],
+  "sourcesContent": ["import { asValue } from 'awilix'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport {\n  resolveAvailabilityWriteAccess,\n  type AvailabilityAccessContext,\n  type AvailabilityWriteAccess,\n} from './lib/availabilityAccess'\n\nexport type AvailabilityAccessResolver = {\n  resolveAvailabilityWriteAccess(\n    ctx: AvailabilityAccessContext,\n  ): Promise<AvailabilityWriteAccess>\n}\n\nexport function register(container: AppContainer) {\n  const resolver: AvailabilityAccessResolver = { resolveAvailabilityWriteAccess }\n  container.register({\n    availabilityAccessResolver: asValue(resolver),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAExB;AAAA,EACE;AAAA,OAGK;AAQA,SAAS,SAAS,WAAyB;AAChD,QAAM,WAAuC,EAAE,+BAA+B;AAC9E,YAAU,SAAS;AAAA,IACjB,4BAA4B,QAAQ,QAAQ;AAAA,EAC9C,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/staff/lib/availabilityAccess.js

@@ -0,0 +1,73 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { StaffTeamMember } from "../data/entities.js";
+const MANAGE_AVAILABILITY_FEATURE = "planner.manage_availability";
+const SELF_MANAGE_FEATURE = "staff.my_availability.manage";
+const SELF_UNAVAILABILITY_FEATURE = "staff.my_availability.unavailability";
+async function resolveAvailabilityWriteAccess(ctx) {
+  const auth = ctx.auth;
+  const tenantId = auth?.tenantId ?? null;
+  const organizationId = ctx.selectedOrganizationId ?? auth?.orgId ?? null;
+  if (!auth || !auth.sub || auth.isApiKey) {
+    return {
+      canManageAll: false,
+      canManageSelf: false,
+      canManageUnavailability: false,
+      memberId: null,
+      tenantId,
+      organizationId
+    };
+  }
+  const rbac = ctx.container.resolve("rbacService");
+  const canManageAll = await rbac.userHasAllFeatures(
+    auth.sub,
+    [MANAGE_AVAILABILITY_FEATURE],
+    { tenantId, organizationId }
+  );
+  if (canManageAll) {
+    return {
+      canManageAll: true,
+      canManageSelf: true,
+      canManageUnavailability: true,
+      memberId: null,
+      tenantId,
+      organizationId
+    };
+  }
+  const [canManageSelf, canManageUnavailability] = await Promise.all([
+    rbac.userHasAllFeatures(auth.sub, [SELF_MANAGE_FEATURE], { tenantId, organizationId }),
+    rbac.userHasAllFeatures(auth.sub, [SELF_UNAVAILABILITY_FEATURE], { tenantId, organizationId })
+  ]);
+  if (!canManageSelf) {
+    return {
+      canManageAll: false,
+      canManageSelf: false,
+      canManageUnavailability: false,
+      memberId: null,
+      tenantId,
+      organizationId
+    };
+  }
+  const em = ctx.container.resolve("em");
+  const member = await findOneWithDecryption(
+    em,
+    StaffTeamMember,
+    { userId: auth.sub, deletedAt: null },
+    void 0,
+    { tenantId, organizationId }
+  );
+  return {
+    canManageAll: false,
+    canManageSelf,
+    canManageUnavailability,
+    memberId: member?.id ?? null,
+    tenantId,
+    organizationId
+  };
+}
+export {
+  MANAGE_AVAILABILITY_FEATURE,
+  SELF_MANAGE_FEATURE,
+  SELF_UNAVAILABILITY_FEATURE,
+  resolveAvailabilityWriteAccess
+};
+//# sourceMappingURL=availabilityAccess.js.map

package/dist/modules/staff/lib/availabilityAccess.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/staff/lib/availabilityAccess.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { StaffTeamMember } from '../data/entities'\n\nexport type AvailabilityAccessContext = {\n  container: AwilixContainer\n  auth: AuthContext | null\n  selectedOrganizationId?: string | null\n}\n\nexport type AvailabilityWriteAccess = {\n  canManageAll: boolean\n  canManageSelf: boolean\n  canManageUnavailability: boolean\n  memberId: string | null\n  tenantId: string | null\n  organizationId: string | null\n  unregistered?: boolean\n}\n\nexport const MANAGE_AVAILABILITY_FEATURE = 'planner.manage_availability'\nexport const SELF_MANAGE_FEATURE = 'staff.my_availability.manage'\nexport const SELF_UNAVAILABILITY_FEATURE = 'staff.my_availability.unavailability'\n\nexport async function resolveAvailabilityWriteAccess(\n  ctx: AvailabilityAccessContext,\n): Promise<AvailabilityWriteAccess> {\n  const auth = ctx.auth\n  const tenantId = auth?.tenantId ?? null\n  const organizationId = ctx.selectedOrganizationId ?? auth?.orgId ?? null\n  if (!auth || !auth.sub || auth.isApiKey) {\n    return {\n      canManageAll: false,\n      canManageSelf: false,\n      canManageUnavailability: false,\n      memberId: null,\n      tenantId,\n      organizationId,\n    }\n  }\n  const rbac = ctx.container.resolve('rbacService') as RbacService\n  const canManageAll = await rbac.userHasAllFeatures(\n    auth.sub,\n    [MANAGE_AVAILABILITY_FEATURE],\n    { tenantId, organizationId },\n  )\n  if (canManageAll) {\n    return {\n      canManageAll: true,\n      canManageSelf: true,\n      canManageUnavailability: true,\n      memberId: null,\n      tenantId,\n      organizationId,\n    }\n  }\n  const [canManageSelf, canManageUnavailability] = await Promise.all([\n    rbac.userHasAllFeatures(auth.sub, [SELF_MANAGE_FEATURE], { tenantId, organizationId }),\n    rbac.userHasAllFeatures(auth.sub, [SELF_UNAVAILABILITY_FEATURE], { tenantId, organizationId }),\n  ])\n  if (!canManageSelf) {\n    return {\n      canManageAll: false,\n      canManageSelf: false,\n      canManageUnavailability: false,\n      memberId: null,\n      tenantId,\n      organizationId,\n    }\n  }\n  const em = ctx.container.resolve('em') as EntityManager\n  const member = await findOneWithDecryption(\n    em,\n    StaffTeamMember,\n    { userId: auth.sub, deletedAt: null },\n    undefined,\n    { tenantId, organizationId },\n  )\n  return {\n    canManageAll: false,\n    canManageSelf,\n    canManageUnavailability,\n    memberId: member?.id ?? null,\n    tenantId,\n    organizationId,\n  }\n}\n"],
+  "mappings": "AAIA,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAkBzB,MAAM,8BAA8B;AACpC,MAAM,sBAAsB;AAC5B,MAAM,8BAA8B;AAE3C,eAAsB,+BACpB,KACkC;AAClC,QAAM,OAAO,IAAI;AACjB,QAAM,WAAW,MAAM,YAAY;AACnC,QAAM,iBAAiB,IAAI,0BAA0B,MAAM,SAAS;AACpE,MAAI,CAAC,QAAQ,CAAC,KAAK,OAAO,KAAK,UAAU;AACvC,WAAO;AAAA,MACL,cAAc;AAAA,MACd,eAAe;AAAA,MACf,yBAAyB;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,OAAO,IAAI,UAAU,QAAQ,aAAa;AAChD,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,KAAK;AAAA,IACL,CAAC,2BAA2B;AAAA,IAC5B,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,cAAc;AAChB,WAAO;AAAA,MACL,cAAc;AAAA,MACd,eAAe;AAAA,MACf,yBAAyB;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,CAAC,eAAe,uBAAuB,IAAI,MAAM,QAAQ,IAAI;AAAA,IACjE,KAAK,mBAAmB,KAAK,KAAK,CAAC,mBAAmB,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,IACrF,KAAK,mBAAmB,KAAK,KAAK,CAAC,2BAA2B,GAAG,EAAE,UAAU,eAAe,CAAC;AAAA,EAC/F,CAAC;AACD,MAAI,CAAC,eAAe;AAClB,WAAO;AAAA,MACL,cAAc;AAAA,MACd,eAAe;AAAA,MACf,yBAAyB;AAAA,MACzB,UAAU;AAAA,MACV;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,QAAQ,KAAK,KAAK,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO;AAAA,IACL,cAAc;AAAA,IACd;AAAA,IACA;AAAA,IACA,UAAU,QAAQ,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,EACF;AACF;",
+  "names": []
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.3-develop.3810.1.ad92c339f5",
+  "version": "0.6.3-develop.3820.1.636677865b",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -243,16 +243,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3810.1.ad92c339f5",
-    "@open-mercato/shared": "0.6.3-develop.3810.1.ad92c339f5",
-    "@open-mercato/ui": "0.6.3-develop.3810.1.ad92c339f5",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3820.1.636677865b",
+    "@open-mercato/shared": "0.6.3-develop.3820.1.636677865b",
+    "@open-mercato/ui": "0.6.3-develop.3820.1.636677865b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.3-develop.3810.1.ad92c339f5",
-    "@open-mercato/shared": "0.6.3-develop.3810.1.ad92c339f5",
-    "@open-mercato/ui": "0.6.3-develop.3810.1.ad92c339f5",
+    "@open-mercato/ai-assistant": "0.6.3-develop.3820.1.636677865b",
+    "@open-mercato/shared": "0.6.3-develop.3820.1.636677865b",
+    "@open-mercato/ui": "0.6.3-develop.3820.1.636677865b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/AGENTS.md

@@ -2,6 +2,33 @@
 
 The auth module handles authentication, authorization, users, roles, and RBAC.
 
+## Always
+
+1. Hash passwords with `bcryptjs` using cost >= 10.
+2. Use `findWithDecryption` / `findOneWithDecryption` for user queries.
+3. Prefer `requireFeatures` in page/API metadata for access control.
+4. Declare every module feature in `acl.ts` and seed role grants through `setup.ts`.
+5. Use wildcard-aware helpers such as `matchFeature`, `hasFeature`, and `hasAllFeatures` when inspecting raw granted features.
+
+## Ask First
+
+- Ask before changing session token format, RBAC semantics, wildcard matching, super-admin behavior, or tenant provisioning outputs.
+- Ask before changing login/reset/invitation error messages because auth messages can leak account existence.
+
+## Never
+
+- Never log credentials, password reset tokens, session tokens, or decrypted user secrets.
+- Never reveal whether an email exists through auth error messages.
+- Never check raw ACL arrays with `includes(...)`, `Set.has(...)`, or ad hoc wildcard logic.
+
+## Validation Commands
+
+```bash
+yarn generate
+yarn workspace @open-mercato/core build
+yarn workspace @open-mercato/core test
+```
+
 ## Data Model
 
 - **Users** — system users with credentials, profile, preferences

package/src/modules/catalog/AGENTS.md

@@ -2,14 +2,33 @@
 
 Use the catalog module for products, categories, pricing, variants, and offers.
 
-## MUST Rules
+## Always
 
-1. **MUST NOT reimplement pricing logic** — use `selectBestPrice` and the resolver pipeline from `lib/pricing.ts`
+1. **MUST use `selectBestPrice` and the resolver pipeline from `lib/pricing.ts`** for pricing logic.
 2. **MUST use the DI token `catalogPricingService`** when resolving prices — ensures overrides take effect
 3. **MUST register custom pricing resolvers** with explicit priority (`registerCatalogPricingResolver(resolver, { priority })`)
 4. **MUST declare widget injections** in `widgets/injection/` and map via `injection-table.ts`
 5. **MUST follow the standard event pattern** in `events.ts` for all CRUD and lifecycle events
 
+## Ask First
+
+- Ask before changing price-layer precedence, resolver priority semantics, event IDs, or released widget spot IDs.
+- Ask before deleting or changing option schemas that existing variants may reference.
+
+## Never
+
+- Never reimplement catalog pricing inline.
+- Never delete option schemas while variants reference them.
+- Never bypass `prepareMutation` for catalog AI tools that mutate products, prices, or media.
+
+## Validation Commands
+
+```bash
+yarn db:generate
+yarn generate
+yarn workspace @open-mercato/core build
+```
+
 ## When You Need Pricing Logic
 
 1. Resolve `catalogPricingService` from DI

package/src/modules/currencies/AGENTS.md

@@ -2,13 +2,32 @@
 
 Use the currencies module for multi-currency support, exchange rates, and currency conversion.
 
-## MUST Rules
+## Always
 
 1. **MUST store currency amounts with 4 decimal precision** — never truncate to 2 decimals internally
 2. **MUST use date-based exchange rates** — always resolve rates for the transaction date, not "current" rate
 3. **MUST record both transaction currency and base currency amounts** — dual recording is mandatory for reporting
 4. **MUST calculate realized gains/losses** on payment: `(payment rate - invoice rate) × foreign amount`
-5. **MUST NOT hard-delete exchange rate records** — rates are historical reference data
+5. **MUST keep financial postings atomic** — full transaction rollback on error
+
+## Ask First
+
+- Ask before changing precision, exchange-rate lookup semantics, realized gain/loss formulas, or financial reporting fields.
+- Ask before changing historical exchange-rate retention behavior.
+
+## Never
+
+- Never truncate internal currency amounts to 2 decimals.
+- Never hard-delete exchange rate records — rates are historical reference data.
+- Never delete posted transactions or audit-trail entries.
+
+## Validation Commands
+
+```bash
+yarn db:generate
+yarn generate
+yarn workspace @open-mercato/core build
+```
 
 ## Key Files
 

package/src/modules/customer_accounts/AGENTS.md

@@ -2,7 +2,7 @@
 
 Customer-facing identity and portal authentication with a two-tier RBAC model. This module manages customer user accounts, sessions, roles, invitations, and the authentication flow for the customer portal. It is separate from the internal `auth` module, which handles staff authentication.
 
-## MUST Rules
+## Always
 
 1. **MUST hash passwords with `bcryptjs` (cost >= 10)** — never store plaintext passwords
 2. **MUST return minimal error messages on auth endpoints** — never reveal whether an email exists (use generic "Invalid email or password")
@@ -10,11 +10,31 @@ Customer-facing identity and portal authentication with a two-tier RBAC model. T
 4. **MUST validate all inputs with zod** — schemas live in `data/validators.ts`
 5. **MUST export `openApi`** from every API route file
 6. **MUST scope all queries by `tenantId`** and filter `deletedAt: null` for soft-deleted records
-7. **MUST NOT expose cross-tenant data** — session validation checks tenant match
-8. **MUST use `hashForLookup` for email-based lookups** — emails are stored with a deterministic hash for indexed queries
-9. **MUST use `hashToken` for storing session/verification/reset tokens** — raw tokens are never persisted
-10. **MUST emit events via `emitCustomerAccountsEvent`** for all state changes (login, signup, lock, password reset)
-11. **MUST NOT import staff auth services** — customer auth is a fully separate identity system
+7. **MUST use `hashForLookup` for email-based lookups** — emails are stored with a deterministic hash for indexed queries
+8. **MUST use `hashToken` for storing session/verification/reset tokens** — raw tokens are never persisted
+9. **MUST emit events via `emitCustomerAccountsEvent`** for all state changes (login, signup, lock, password reset)
+
+## Ask First
+
+- Ask before changing cookie names, token TTLs, JWT claim shape, rate limits, lockout thresholds, or portal RBAC semantics.
+- Ask before moving customer portal navigation into a different staff IA group.
+- Ask before changing CRM auto-linking behavior.
+
+## Never
+
+- Never store plaintext passwords or raw tokens.
+- Never reveal whether an email exists.
+- Never expose cross-tenant data — session validation checks tenant match.
+- Never import staff auth services; customer auth is a fully separate identity system.
+- Never use exact `includes(...)` checks for portal wildcard ACL matching.
+
+## Validation Commands
+
+```bash
+yarn db:generate
+yarn generate
+yarn workspace @open-mercato/core build
+```
 
 ## Data Model
 

package/src/modules/customers/AGENTS.md

@@ -2,7 +2,7 @@
 
 **This is the reference CRUD module.** When building new modules, copy patterns from here first.
 
-## MUST Rules
+## Always
 
 1. **MUST use this module as the template** for new CRUD modules — copy file structure and patterns
 2. **MUST include all standard module files** — use the list below as a checklist
@@ -11,6 +11,25 @@
 5. **MUST capture custom field snapshots** in command `before`/`after` payloads for undo support
 6. **MUST use `useGuardedMutation` for non-`CrudForm` backend writes** (`POST`/`PUT`/`PATCH`/`DELETE`) and pass `retryLastMutation` in injection context
 
+## Ask First
+
+- Ask before changing this module's reference patterns, standard module-file checklist, or AI mutation policies.
+- Ask before changing customer data model relationships that downstream modules may copy.
+
+## Never
+
+- Never bypass custom field normalization in CRUD create/update/read responses.
+- Never omit undo snapshots for custom field mutations.
+- Never write backend `POST`/`PUT`/`PATCH`/`DELETE` actions outside `CrudForm` without `useGuardedMutation`.
+
+## Validation Commands
+
+```bash
+yarn db:generate
+yarn generate
+yarn workspace @open-mercato/core build
+```
+
 ## Key Reference Files — Copy From Here
 
 | When you need | Copy from |