@open-mercato/core 0.6.6-develop.6551.1.1511bfa890 → 0.6.6

package/dist/modules/workflows/migrations/Migration20260716120000.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/migrations/Migration20260716120000.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations'\n\nconst CODE_WORKFLOW_ID = 'workflows.checkout-demo'\n\n/**\n * Retires the persisted checkout-demo seed rows so runtime resolves the\n * maintained CODE definition instead (issue #4211).\n *\n * Background: `workflows.checkout-demo` is now code-defined\n * (`packages/core/src/modules/workflows/workflows.ts`), and only the code\n * definition forwards the cart's line items + shipping/tax adjustments to\n * `POST /api/sales/orders`. But existing tenants still carry a persisted\n * `workflow_definitions` row from the old seed \u2014 originally seeded under ids\n * like `checkout_simple_v1` / names like `Simple Checkout Flow` and later\n * `Checkout with Payment Webhook`, then renamed to `workflows.checkout-demo`\n * by Migration20260428102318. Its `create_order` body never sent `lines`, and\n * because `findWorkflowDefinition` resolves the DB row first, that stale row\n * SHADOWS the code definition \u2014 so orders come out with zero line items and\n * $0.00 totals. Patching the persisted body is unreliable: the seed's name and\n * body shape vary across historical versions, so a fingerprint on either misses\n * whole cohorts of tenants (the defect QA hit).\n *\n * Instead, soft-delete the seeded rows. This is body/name-agnostic, so it fixes\n * every historical seed variant:\n *   - New instances: `findWorkflowDefinition` filters `deleted_at IS NULL`, so\n *     the retired row is skipped and the code definition is used (correct body).\n *   - In-flight instances: `findDefinitionForInstance` loads the definition by\n *     `id` with no soft-delete filter (WorkflowDefinition has no global filter),\n *     so instances that reference the row keep resolving and advancing.\n *\n * Scope is limited to `code_workflow_id IS NULL` rows \u2014 user customizations of\n * the code definition set `code_workflow_id` and MUST NOT be retired. The\n * `deleted_at IS NULL` guard makes the migration idempotent.\n */\nexport function buildRetireSeededCheckoutDemoSql(): string {\n  return `\n    update \"workflow_definitions\" as \"wf\"\n    set \"deleted_at\" = current_timestamp,\n        \"updated_at\" = current_timestamp\n    where \"wf\".\"workflow_id\" = '${CODE_WORKFLOW_ID}'\n      and \"wf\".\"code_workflow_id\" is null\n      and \"wf\".\"deleted_at\" is null;\n  `.trim()\n}\n\nexport class Migration20260716120000 extends Migration {\n  override async up(): Promise<void> {\n    this.addSql(buildRetireSeededCheckoutDemoSql())\n  }\n\n  override async down(): Promise<void> {\n    // Forward-only. Restoring `deleted_at = null` would re-shadow the maintained\n    // code definition with the stale seed body and re-introduce zero-line orders\n    // (#4211). The code definition supersedes the seed, so there is nothing to\n    // restore.\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAE1B,MAAM,mBAAmB;AAgClB,SAAS,mCAA2C;AACzD,SAAO;AAAA;AAAA;AAAA;AAAA,kCAIyB,gBAAgB;AAAA;AAAA;AAAA,IAG9C,KAAK;AACT;AAEO,MAAM,gCAAgC,UAAU;AAAA,EACrD,MAAe,KAAoB;AACjC,SAAK,OAAO,iCAAiC,CAAC;AAAA,EAChD;AAAA,EAEA,MAAe,OAAsB;AAAA,EAKrC;AACF;",
+  "names": []
+}

package/dist/modules/workflows/workflows.js

@@ -222,6 +222,8 @@ const checkoutDemo = defineWorkflow({
               customerEntityId: "{{context.customer.id}}",
               currencyCode: "{{context.cart.currency}}",
               placedAt: "{{now}}",
+              lines: "{{context.cart.orderLines}}",
+              adjustments: "{{context.cart.orderAdjustments}}",
               grandTotalGrossAmount: "{{context.cart.total}}"
             },
             validateTenantMatch: true

package/dist/modules/workflows/workflows.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/workflows/workflows.ts"],
-  "sourcesContent": ["/**\n * Workflows Module \u2014 Code-Based Workflow Definitions\n *\n * Demo workflows shipped with the workflows module.\n * These are auto-discovered by the generator and loaded into the in-memory registry.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\n\n// ============================================================================\n// Simple Approval Workflow\n// ============================================================================\n\nconst simpleApproval = defineWorkflow({\n  workflowId: 'workflows.simple-approval',\n  workflowName: 'Simple Approval Workflow',\n  description: 'Basic three-step approval workflow: Start \u2192 Approval \u2192 End',\n  metadata: { category: 'Testing', tags: ['test', 'approval', 'simple'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize workflow' },\n    {\n      stepId: 'approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Approve or reject request',\n      userTaskConfig: { assignedTo: 'approver', slaDuration: 'PT1H' },\n    },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_approval',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'approval',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_approver',\n          activityName: 'Notify Approver',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.approver.email}}',\n            subject: 'Approval Required: {{context.request.title}}',\n            template: 'approval_request',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              requester: '{{context.requester.name}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.requested',\n            payload: { requestId: '{{context.request.id}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n          async: true,\n        },\n      ],\n    },\n    {\n      transitionId: 'approval_to_end',\n      transitionName: 'Approval Decision',\n      fromStepId: 'approval',\n      toStepId: 'end',\n      trigger: 'manual',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_requester',\n          activityName: 'Notify Requester of Decision',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.requester.email}}',\n            subject: 'Approval Decision: {{context.request.title}}',\n            template: 'approval_decision',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              decision: '{{task.result.approved}}',\n              comments: '{{task.result.comments}}',\n              approver: '{{task.completedBy}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n        },\n        {\n          activityId: 'emit_approval_completed',\n          activityName: 'Emit Approval Completed Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.completed',\n            payload: {\n              requestId: '{{context.request.id}}',\n              approved: '{{task.result.approved}}',\n              approvedBy: '{{task.completedBy}}',\n              timestamp: '{{now}}',\n            },\n          },\n          async: true,\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Checkout Demo Workflow\n// ============================================================================\n\nconst checkoutDemo = defineWorkflow({\n  workflowId: 'workflows.checkout-demo',\n  workflowName: 'Checkout with Payment Webhook',\n  description: 'Realistic checkout workflow with signal-based payment confirmation',\n  metadata: { category: 'E-commerce', tags: ['checkout', 'demo', 'payments', 'signals'], icon: 'ShoppingCart' },\n  steps: [\n    {\n      stepId: 'start',\n      stepName: 'Start',\n      stepType: 'START',\n      description: 'Checkout process initiated',\n      preConditions: [{\n        ruleId: 'workflow_checkout_cart_not_empty',\n        required: true,\n        validationMessage: {\n          en: 'Your shopping cart is empty. Please add items before starting checkout.',\n          pl: 'Tw\u00F3j koszyk jest pusty. Dodaj produkty przed rozpocz\u0119ciem zakupu.',\n        },\n      }],\n    },\n    { stepId: 'cart_validation', stepName: 'Cart Validation', stepType: 'AUTOMATED', description: 'Validate cart has items and inventory is available', timeout: 'PT10S' },\n    {\n      stepId: 'customer_info',\n      stepName: 'Customer Information',\n      stepType: 'USER_TASK',\n      description: 'Collect customer shipping and contact information',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          properties: {\n            fullName: { type: 'string', title: 'Full Name', description: \"Customer's full legal name\" },\n            email: { type: 'string', format: 'email', title: 'Email Address', description: 'Email for order confirmation' },\n            phone: { type: 'string', title: 'Phone Number', description: 'Contact number for delivery' },\n            comment: { type: 'string', title: 'Order Comment', maxLength: 500, description: 'Special instructions or notes' },\n          },\n          required: ['fullName', 'email'],\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'payment_initiation', stepName: 'Initiate Payment', stepType: 'AUTOMATED', description: 'Send payment request to payment provider', timeout: 'PT10S' },\n    {\n      stepId: 'wait_payment_confirmation',\n      stepName: 'Wait for Payment Confirmation',\n      stepType: 'WAIT_FOR_SIGNAL',\n      description: 'Waiting for payment provider webhook confirmation',\n      signalConfig: { signalName: 'payment_confirmed', timeout: 'PT5M' },\n    },\n    { stepId: 'order_confirmation', stepName: 'Order Confirmation', stepType: 'AUTOMATED', description: 'Create order record and send confirmation', timeout: 'PT15S' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Checkout completed successfully' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_cart',\n      transitionName: 'Initialize Checkout',\n      fromStepId: 'start',\n      toStepId: 'cart_validation',\n      trigger: 'auto',\n      priority: 100,\n      activities: [{\n        activityId: 'log_checkout_start',\n        activityName: 'Log Checkout Start',\n        activityType: 'EMIT_EVENT',\n        config: {\n          eventName: 'checkout.started',\n          payload: { customerId: '{{context.customerId}}', cartId: '{{context.cartId}}', currency: '{{context.currency}}', timestamp: '{{now}}' },\n        },\n        async: false,\n      }],\n    },\n    {\n      transitionId: 'cart_to_customer_info',\n      transitionName: 'Collect Customer Information',\n      fromStepId: 'cart_validation',\n      toStepId: 'customer_info',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_checkout_cart_not_empty', required: true }],\n    },\n    {\n      transitionId: 'customer_info_to_payment',\n      transitionName: 'Initiate Payment',\n      fromStepId: 'customer_info',\n      toStepId: 'payment_initiation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'payment_to_wait_confirmation',\n      transitionName: 'Wait for Confirmation',\n      fromStepId: 'payment_initiation',\n      toStepId: 'wait_payment_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_order',\n      transitionName: 'Payment Confirmed',\n      fromStepId: 'wait_payment_confirmation',\n      toStepId: 'order_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_end',\n      transitionName: 'Finalize Order',\n      fromStepId: 'order_confirmation',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'create_order',\n          activityName: 'Create Order Record',\n          activityType: 'CALL_API',\n          config: {\n            endpoint: '/api/sales/orders',\n            method: 'POST',\n            body: {\n              customerEntityId: '{{context.customer.id}}',\n              currencyCode: '{{context.cart.currency}}',\n              placedAt: '{{now}}',\n              grandTotalGrossAmount: '{{context.cart.total}}',\n            },\n            validateTenantMatch: true,\n          },\n          timeout: 'PT10S',\n          async: false,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'send_confirmation_email',\n          activityName: 'Send Order Confirmation Email',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.customer.email}}',\n            subject: 'Order Confirmation',\n            template: 'order_confirmation',\n            data: { customerName: '{{context.customer.name}}', total: '{{context.cart.total}}' },\n          },\n          timeout: 'PT15S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Module Export\n// ============================================================================\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'workflows',\n  workflows: [simpleApproval, checkoutDemo],\n})\n\nexport default workflowsConfig\n"],
-  "mappings": "AAOA,SAAS,gBAAgB,mCAAmC;AAM5D,MAAM,iBAAiB,eAAe;AAAA,EACpC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,WAAW,MAAM,CAAC,QAAQ,YAAY,QAAQ,GAAG,MAAM,eAAe;AAAA,EAC5F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,sBAAsB;AAAA,IAC5F;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB,EAAE,YAAY,YAAY,aAAa,OAAO;AAAA,IAChE;AAAA,IACA,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,WAAW,0BAA0B,oBAAoB,0BAA0B;AAAA,UAChG;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,UAAU;AAAA,cACV,UAAU;AAAA,cACV,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,WAAW;AAAA,cACX,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMD,MAAM,eAAe,eAAe;AAAA,EAClC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,cAAc,MAAM,CAAC,YAAY,QAAQ,YAAY,SAAS,GAAG,MAAM,eAAe;AAAA,EAC5G,OAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,QACd,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,mBAAmB;AAAA,UACjB,IAAI;AAAA,UACJ,IAAI;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,EAAE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,aAAa,aAAa,sDAAsD,SAAS,QAAQ;AAAA,IACrK;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,aAAa,aAAa,6BAA6B;AAAA,YAC1F,OAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO,iBAAiB,aAAa,+BAA+B;AAAA,YAC9G,OAAO,EAAE,MAAM,UAAU,OAAO,gBAAgB,aAAa,8BAA8B;AAAA,YAC3F,SAAS,EAAE,MAAM,UAAU,OAAO,iBAAiB,WAAW,KAAK,aAAa,gCAAgC;AAAA,UAClH;AAAA,UACA,UAAU,CAAC,YAAY,OAAO;AAAA,QAChC;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,oBAAoB,UAAU,aAAa,aAAa,4CAA4C,SAAS,QAAQ;AAAA,IAC/J;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,cAAc,EAAE,YAAY,qBAAqB,SAAS,OAAO;AAAA,IACnE;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,sBAAsB,UAAU,aAAa,aAAa,6CAA6C,SAAS,QAAQ;AAAA,IAClK,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,kCAAkC;AAAA,EACzG;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY,CAAC;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,QACd,QAAQ;AAAA,UACN,WAAW;AAAA,UACX,SAAS,EAAE,YAAY,0BAA0B,QAAQ,sBAAsB,UAAU,wBAAwB,WAAW,UAAU;AAAA,QACxI;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,oCAAoC,UAAU,KAAK,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,kBAAkB;AAAA,cAClB,cAAc;AAAA,cACd,UAAU;AAAA,cACV,uBAAuB;AAAA,YACzB;AAAA,YACA,qBAAqB;AAAA,UACvB;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM,EAAE,cAAc,6BAA6B,OAAO,yBAAyB;AAAA,UACrF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,gBAAgB,YAAY;AAC1C,CAAC;AAED,IAAO,oBAAQ;",
+  "sourcesContent": ["/**\n * Workflows Module \u2014 Code-Based Workflow Definitions\n *\n * Demo workflows shipped with the workflows module.\n * These are auto-discovered by the generator and loaded into the in-memory registry.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\n\n// ============================================================================\n// Simple Approval Workflow\n// ============================================================================\n\nconst simpleApproval = defineWorkflow({\n  workflowId: 'workflows.simple-approval',\n  workflowName: 'Simple Approval Workflow',\n  description: 'Basic three-step approval workflow: Start \u2192 Approval \u2192 End',\n  metadata: { category: 'Testing', tags: ['test', 'approval', 'simple'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize workflow' },\n    {\n      stepId: 'approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Approve or reject request',\n      userTaskConfig: { assignedTo: 'approver', slaDuration: 'PT1H' },\n    },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_approval',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'approval',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_approver',\n          activityName: 'Notify Approver',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.approver.email}}',\n            subject: 'Approval Required: {{context.request.title}}',\n            template: 'approval_request',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              requester: '{{context.requester.name}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.requested',\n            payload: { requestId: '{{context.request.id}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n          async: true,\n        },\n      ],\n    },\n    {\n      transitionId: 'approval_to_end',\n      transitionName: 'Approval Decision',\n      fromStepId: 'approval',\n      toStepId: 'end',\n      trigger: 'manual',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_requester',\n          activityName: 'Notify Requester of Decision',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.requester.email}}',\n            subject: 'Approval Decision: {{context.request.title}}',\n            template: 'approval_decision',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              decision: '{{task.result.approved}}',\n              comments: '{{task.result.comments}}',\n              approver: '{{task.completedBy}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n        },\n        {\n          activityId: 'emit_approval_completed',\n          activityName: 'Emit Approval Completed Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.completed',\n            payload: {\n              requestId: '{{context.request.id}}',\n              approved: '{{task.result.approved}}',\n              approvedBy: '{{task.completedBy}}',\n              timestamp: '{{now}}',\n            },\n          },\n          async: true,\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Checkout Demo Workflow\n// ============================================================================\n\nconst checkoutDemo = defineWorkflow({\n  workflowId: 'workflows.checkout-demo',\n  workflowName: 'Checkout with Payment Webhook',\n  description: 'Realistic checkout workflow with signal-based payment confirmation',\n  metadata: { category: 'E-commerce', tags: ['checkout', 'demo', 'payments', 'signals'], icon: 'ShoppingCart' },\n  steps: [\n    {\n      stepId: 'start',\n      stepName: 'Start',\n      stepType: 'START',\n      description: 'Checkout process initiated',\n      preConditions: [{\n        ruleId: 'workflow_checkout_cart_not_empty',\n        required: true,\n        validationMessage: {\n          en: 'Your shopping cart is empty. Please add items before starting checkout.',\n          pl: 'Tw\u00F3j koszyk jest pusty. Dodaj produkty przed rozpocz\u0119ciem zakupu.',\n        },\n      }],\n    },\n    { stepId: 'cart_validation', stepName: 'Cart Validation', stepType: 'AUTOMATED', description: 'Validate cart has items and inventory is available', timeout: 'PT10S' },\n    {\n      stepId: 'customer_info',\n      stepName: 'Customer Information',\n      stepType: 'USER_TASK',\n      description: 'Collect customer shipping and contact information',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          properties: {\n            fullName: { type: 'string', title: 'Full Name', description: \"Customer's full legal name\" },\n            email: { type: 'string', format: 'email', title: 'Email Address', description: 'Email for order confirmation' },\n            phone: { type: 'string', title: 'Phone Number', description: 'Contact number for delivery' },\n            comment: { type: 'string', title: 'Order Comment', maxLength: 500, description: 'Special instructions or notes' },\n          },\n          required: ['fullName', 'email'],\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'payment_initiation', stepName: 'Initiate Payment', stepType: 'AUTOMATED', description: 'Send payment request to payment provider', timeout: 'PT10S' },\n    {\n      stepId: 'wait_payment_confirmation',\n      stepName: 'Wait for Payment Confirmation',\n      stepType: 'WAIT_FOR_SIGNAL',\n      description: 'Waiting for payment provider webhook confirmation',\n      signalConfig: { signalName: 'payment_confirmed', timeout: 'PT5M' },\n    },\n    { stepId: 'order_confirmation', stepName: 'Order Confirmation', stepType: 'AUTOMATED', description: 'Create order record and send confirmation', timeout: 'PT15S' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Checkout completed successfully' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_cart',\n      transitionName: 'Initialize Checkout',\n      fromStepId: 'start',\n      toStepId: 'cart_validation',\n      trigger: 'auto',\n      priority: 100,\n      activities: [{\n        activityId: 'log_checkout_start',\n        activityName: 'Log Checkout Start',\n        activityType: 'EMIT_EVENT',\n        config: {\n          eventName: 'checkout.started',\n          payload: { customerId: '{{context.customerId}}', cartId: '{{context.cartId}}', currency: '{{context.currency}}', timestamp: '{{now}}' },\n        },\n        async: false,\n      }],\n    },\n    {\n      transitionId: 'cart_to_customer_info',\n      transitionName: 'Collect Customer Information',\n      fromStepId: 'cart_validation',\n      toStepId: 'customer_info',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_checkout_cart_not_empty', required: true }],\n    },\n    {\n      transitionId: 'customer_info_to_payment',\n      transitionName: 'Initiate Payment',\n      fromStepId: 'customer_info',\n      toStepId: 'payment_initiation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'payment_to_wait_confirmation',\n      transitionName: 'Wait for Confirmation',\n      fromStepId: 'payment_initiation',\n      toStepId: 'wait_payment_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_order',\n      transitionName: 'Payment Confirmed',\n      fromStepId: 'wait_payment_confirmation',\n      toStepId: 'order_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_end',\n      transitionName: 'Finalize Order',\n      fromStepId: 'order_confirmation',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'create_order',\n          activityName: 'Create Order Record',\n          activityType: 'CALL_API',\n          config: {\n            endpoint: '/api/sales/orders',\n            method: 'POST',\n            body: {\n              customerEntityId: '{{context.customer.id}}',\n              currencyCode: '{{context.cart.currency}}',\n              placedAt: '{{now}}',\n              lines: '{{context.cart.orderLines}}',\n              adjustments: '{{context.cart.orderAdjustments}}',\n              grandTotalGrossAmount: '{{context.cart.total}}',\n            },\n            validateTenantMatch: true,\n          },\n          timeout: 'PT10S',\n          async: false,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'send_confirmation_email',\n          activityName: 'Send Order Confirmation Email',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.customer.email}}',\n            subject: 'Order Confirmation',\n            template: 'order_confirmation',\n            data: { customerName: '{{context.customer.name}}', total: '{{context.cart.total}}' },\n          },\n          timeout: 'PT15S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Module Export\n// ============================================================================\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'workflows',\n  workflows: [simpleApproval, checkoutDemo],\n})\n\nexport default workflowsConfig\n"],
+  "mappings": "AAOA,SAAS,gBAAgB,mCAAmC;AAM5D,MAAM,iBAAiB,eAAe;AAAA,EACpC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,WAAW,MAAM,CAAC,QAAQ,YAAY,QAAQ,GAAG,MAAM,eAAe;AAAA,EAC5F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,sBAAsB;AAAA,IAC5F;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB,EAAE,YAAY,YAAY,aAAa,OAAO;AAAA,IAChE;AAAA,IACA,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,WAAW,0BAA0B,oBAAoB,0BAA0B;AAAA,UAChG;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,UAAU;AAAA,cACV,UAAU;AAAA,cACV,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,WAAW;AAAA,cACX,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMD,MAAM,eAAe,eAAe;AAAA,EAClC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,cAAc,MAAM,CAAC,YAAY,QAAQ,YAAY,SAAS,GAAG,MAAM,eAAe;AAAA,EAC5G,OAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,QACd,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,mBAAmB;AAAA,UACjB,IAAI;AAAA,UACJ,IAAI;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,EAAE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,aAAa,aAAa,sDAAsD,SAAS,QAAQ;AAAA,IACrK;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,aAAa,aAAa,6BAA6B;AAAA,YAC1F,OAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO,iBAAiB,aAAa,+BAA+B;AAAA,YAC9G,OAAO,EAAE,MAAM,UAAU,OAAO,gBAAgB,aAAa,8BAA8B;AAAA,YAC3F,SAAS,EAAE,MAAM,UAAU,OAAO,iBAAiB,WAAW,KAAK,aAAa,gCAAgC;AAAA,UAClH;AAAA,UACA,UAAU,CAAC,YAAY,OAAO;AAAA,QAChC;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,oBAAoB,UAAU,aAAa,aAAa,4CAA4C,SAAS,QAAQ;AAAA,IAC/J;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,cAAc,EAAE,YAAY,qBAAqB,SAAS,OAAO;AAAA,IACnE;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,sBAAsB,UAAU,aAAa,aAAa,6CAA6C,SAAS,QAAQ;AAAA,IAClK,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,kCAAkC;AAAA,EACzG;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY,CAAC;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,QACd,QAAQ;AAAA,UACN,WAAW;AAAA,UACX,SAAS,EAAE,YAAY,0BAA0B,QAAQ,sBAAsB,UAAU,wBAAwB,WAAW,UAAU;AAAA,QACxI;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,oCAAoC,UAAU,KAAK,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,kBAAkB;AAAA,cAClB,cAAc;AAAA,cACd,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,uBAAuB;AAAA,YACzB;AAAA,YACA,qBAAqB;AAAA,UACvB;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM,EAAE,cAAc,6BAA6B,OAAO,yBAAyB;AAAA,UACrF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,gBAAgB,YAAY;AAC1C,CAAC;AAED,IAAO,oBAAQ;",
   "names": []
 }

package/generated/entities.ids.generated.ts

@@ -267,7 +267,6 @@ export const M = {
     },
     "payment_gateways": {
       "gateway_transaction": "payment_gateways:gateway_transaction",
-      "gateway_session_initialization": "payment_gateways:gateway_session_initialization",
       "webhook_processed_event": "payment_gateways:webhook_processed_event"
     },
     "shipping_carriers": {

package/generated/entity-fields-registry.ts

@@ -1225,18 +1225,6 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "value": "value"
     },
-    "gateway_session_initialization": {
-      "id": "id",
-      "operation_key": "operation_key",
-      "provider_key": "provider_key",
-      "claim_token": "claim_token",
-      "claimed_at": "claimed_at",
-      "gateway_transaction_id": "gateway_transaction_id",
-      "organization_id": "organization_id",
-      "tenant_id": "tenant_id",
-      "created_at": "created_at",
-      "updated_at": "updated_at"
-    },
     "gateway_transaction": {
       "id": "id",
       "payment_id": "payment_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6551.1.1511bfa890",
+  "version": "0.6.6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6551.1.1511bfa890",
-    "@open-mercato/shared": "0.6.6-develop.6551.1.1511bfa890",
-    "@open-mercato/ui": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/ai-assistant": "0.6.6",
+    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/ui": "0.6.6",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6551.1.1511bfa890",
-    "@open-mercato/shared": "0.6.6-develop.6551.1.1511bfa890",
-    "@open-mercato/ui": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/ai-assistant": "0.6.6",
+    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/ui": "0.6.6",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",
@@ -285,6 +285,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/core"
-  },
-  "stableVersion": "0.6.5"
+  }
 }

package/src/modules/api_keys/api/keys/route.ts

@@ -13,8 +13,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'
-import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 type ApiKeyCrudCtx = CrudCtx & {
   __apiKeySecret?: { secret: string; prefix: string }
@@ -299,15 +297,10 @@ const crud = makeCrudRoute<
 
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
       const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null
-      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
-      if (
-        !isOrganizationAccessAllowed({
-          isSuperAdmin,
-          allowedOrganizationIds: allowedIds,
-          targetOrganizationId: organizationId,
-        })
-      ) {
-        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
+      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
+        if (!allowedIds.includes(organizationId)) {
+          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
+        }
       }
       scopedCtx.__apiKeyOrganizationId = organizationId ?? null
 
@@ -329,34 +322,18 @@ const crud = makeCrudRoute<
       const { translate } = await resolveTranslations()
       if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })
       const em = (ctx.container.resolve('em') as EntityManager)
+      const record = await em.findOne(ApiKey, { id, deletedAt: null })
+      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       const scopedCtx = ctx as ApiKeyCrudCtx
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
-      const allowedIds = ctx.organizationScope?.allowedIds ?? null
-      const recordFilter: FilterQuery<ApiKey> = {
-        id,
-        tenantId: auth.tenantId,
-        deletedAt: null,
-      }
-      if (!isSuperAdmin && Array.isArray(allowedIds)) {
-        recordFilter.organizationId = { $in: allowedIds }
+      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
+        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })
       }
-      const record = await findOneWithDecryption(
-        em,
-        ApiKey,
-        recordFilter,
-        undefined,
-        { tenantId: auth.tenantId, organizationId: null },
-      )
-      if (
-        !record ||
-        record.tenantId !== auth.tenantId ||
-        !isOrganizationAccessAllowed({
-          isSuperAdmin,
-          allowedOrganizationIds: allowedIds,
-          targetOrganizationId: record.organizationId ?? null,
-        })
-      ) {
-        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
+      const allowedIds = ctx.organizationScope?.allowedIds ?? null
+      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
+        if (!allowedIds.includes(record.organizationId)) {
+          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
+        }
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null
     },

package/src/modules/api_keys/cli.ts

@@ -3,7 +3,6 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createApiKey } from './services/apiKeyService'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
-import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 function parseArgs(rest: string[]): Record<string, string> {
   const args: Record<string, string> = {}
@@ -48,7 +47,9 @@ const addApiKey: ModuleCli = {
       return
     }
 
-    const roleInputs = parseCommaSeparatedList(rolesCsv)
+    const roleInputs = rolesCsv
+      ? rolesCsv.split(',').map((value) => value.trim()).filter(Boolean)
+      : []
     const roleIds: string[] = []
     if (roleInputs.length) {
       for (const token of roleInputs) {

package/src/modules/attachments/api/file/[id]/route.ts

@@ -15,7 +15,6 @@ import {
   canRenderInlineAttachment,
 } from "@open-mercato/core/modules/attachments/lib/security";
 import { StorageDriverFactory } from '../../../lib/drivers';
-import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope';
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -33,19 +32,16 @@ export async function GET(
     );
   }
   const auth = await getAuthFromRequest(req);
-  const container = await createRequestContainer();
-  const em = container.resolve("em") as EntityManager;
+  const { resolve } = await createRequestContainer();
+  const em = resolve("em") as EntityManager;
   const storageDriverFactory =
-    (container.resolve("storageDriverFactory") as StorageDriverFactory | null) ??
+    (resolve("storageDriverFactory") as StorageDriverFactory | null) ??
     new StorageDriverFactory(em);
 
-  const scopedAuth = auth
-    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
-    : auth;
   const findFilter: Record<string, unknown> = { id };
-  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
-    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;
-    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
+    if (auth.orgId) findFilter.organizationId = auth.orgId;
   }
   const attachment = await em.findOne(Attachment, findFilter);
   if (!attachment) {
@@ -64,7 +60,7 @@ export async function GET(
     );
   }
 
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
+  const access = checkAttachmentAccess(auth, attachment, partition);
   if (!access.ok) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -20,7 +20,6 @@ import {
   validateImageMagicBytes,
 } from '@open-mercato/core/modules/attachments/lib/imageSafety'
 import { StorageDriverFactory } from '../../../../lib/drivers'
-import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('attachments').child({ component: 'image' })
@@ -52,18 +51,15 @@ export async function GET(
   }
   const { width, height, cropType } = parsedQuery.data
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
 
-  const scopedAuth = auth
-    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
-    : auth
   const findFilter: Record<string, unknown> = { id }
-  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
-    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId
-    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId
+    if (auth.orgId) findFilter.organizationId = auth.orgId
   }
   const attachment = await em.findOne(Attachment, findFilter)
   if (!attachment) {
@@ -76,7 +72,7 @@ export async function GET(
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition)
+  const access = checkAttachmentAccess(auth, attachment, partition)
   if (!access.ok) {
     const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'
     return NextResponse.json({ error: message }, { status: access.status })

package/src/modules/attachments/api/route.ts

@@ -13,7 +13,6 @@ import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
 import { assertAttachmentScopeInvariant } from '../lib/access'
-import { resolveAttachmentOrganizationId } from '../lib/requestScope'
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -199,11 +198,10 @@ export async function GET(req: Request) {
   }
   const { entityId, recordId, page, pageSize } = parsedQuery.data
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
   const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }
-  if (orgId) filter.organizationId = orgId
+  if (auth.orgId) filter.organizationId = auth.orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
   const total = usePaging ? await em.count(Attachment, filter) : null
@@ -226,7 +224,7 @@ export async function GET(req: Request) {
     },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: orgId ?? null,
+      organizationId: auth.orgId ?? null,
     },
   )
   return NextResponse.json({
@@ -277,6 +275,7 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
   const tenantId = auth.tenantId
+  const orgId = auth.orgId
 
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
@@ -302,13 +301,11 @@ export async function POST(req: Request) {
   const tags = parseFormTags(form.get('tags'))
   const assignmentsFromForm = parseFormAssignments(form.get('assignments'))
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const dataEngine = container.resolve('dataEngine')
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
+  const dataEngine = resolve('dataEngine')
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
-  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
   await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
@@ -439,12 +436,12 @@ export async function POST(req: Request) {
   }
   const metadata = mergeAttachmentMetadata(null, { assignments, tags })
   const attachmentId = randomUUID()
-  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,
     recordId,
-    organizationId: orgId,
+    organizationId: auth.orgId!,
     tenantId: auth.tenantId!,
     fileName: safeName,
     mimeType: fileMimeType,
@@ -548,19 +545,17 @@ export async function DELETE(req: Request) {
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const dataEngine = container.resolve('dataEngine')
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
+  const dataEngine = resolve('dataEngine')
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  // Resolve the currently selected organization (#3765) so a multi-org admin who
-  // switched the header org deletes within that org, not their pinned home org.
-  // A superadmin browsing with "All organizations" selected has no concrete org,
-  // so resolution returns null and the delete falls back to a tenant-only scope
-  // (#3764) — letting them remove any attachment in the tenant.
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
+  // organizations" selected has no concrete org, so scope the delete by tenant
+  // only and let them remove any attachment in the tenant. Non-superadmins stay
+  // scoped to their own organization (#3764).
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
-  if (orgId) deleteFilter.organizationId = orgId
+  if (auth.orgId) deleteFilter.organizationId = auth.orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -570,7 +565,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? orgId ?? '',
+      organizationId: record.organizationId ?? auth.orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/attachments/components/AttachmentContentPreview.tsx

@@ -1,7 +1,6 @@
 import * as React from 'react'
 import { MarkdownContent } from '@open-mercato/ui/backend/markdown'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 type Props = {
   content?: string | null
@@ -26,6 +25,12 @@ export function AttachmentContentPreview({
   const [tab, setTab] = React.useState<'source' | 'preview'>('source')
   const text = (content ?? '').trim()
 
+  // ARIA IDs for accessibility
+  const sourceTabId = 'attachment-content-preview-tab-source'
+  const previewTabId = 'attachment-content-preview-tab-preview'
+  const sourcePanelId = 'attachment-content-preview-panel-source'
+  const previewPanelId = 'attachment-content-preview-panel-preview'
+
   if (!text) {
     return <div className="text-xs text-muted-foreground italic">{emptyLabel}</div>
   }
@@ -36,18 +41,47 @@ export function AttachmentContentPreview({
   return (
     <div className="space-y-2">
       {/* Tab Navigation */}
-      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant="underline">
-        <TabsList className="w-full">
-          <TabsTrigger value="source">{sourceLabel}</TabsTrigger>
-          <TabsTrigger value="preview">{previewLabel}</TabsTrigger>
-        </TabsList>
-      </Tabs>
+      <div className="border-b border-border">
+        <nav className="flex items-center gap-4 text-xs" role="tablist" aria-label="Content preview mode">
+          <button
+            type="button"
+            id={sourceTabId}
+            role="tab"
+            aria-selected={tab === 'source'}
+            aria-controls={sourcePanelId}
+            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
+              tab === 'source'
+                ? 'border-accent-indigo text-foreground'
+                : 'border-transparent text-muted-foreground hover:text-foreground'
+            }`}
+            onClick={() => setTab('source')}
+          >
+            {sourceLabel}
+          </button>
+          <button
+            type="button"
+            id={previewTabId}
+            role="tab"
+            aria-selected={tab === 'preview'}
+            aria-controls={previewPanelId}
+            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
+              tab === 'preview'
+                ? 'border-accent-indigo text-foreground'
+                : 'border-transparent text-muted-foreground hover:text-foreground'
+            }`}
+            onClick={() => setTab('preview')}
+          >
+            {previewLabel}
+          </button>
+        </nav>
+      </div>
 
       {/* Tab Panels */}
       {tab === 'source' ? (
         <div
           role="tabpanel"
-          aria-label={sourceLabel}
+          id={sourcePanelId}
+          aria-labelledby={sourceTabId}
           data-testid="attachment-content-preview"
           className="whitespace-pre-wrap text-sm text-muted-foreground"
         >
@@ -56,7 +90,8 @@ export function AttachmentContentPreview({
       ) : (
         <div
           role="tabpanel"
-          aria-label={previewLabel}
+          id={previewPanelId}
+          aria-labelledby={previewTabId}
           data-testid="markdown-preview"
         >
           <MarkdownContent

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -4,7 +4,6 @@ import React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { ActionLogItem } from '../../components/AuditLogsActions'
 import { AuditLogsActions } from '../../components/AuditLogsActions'
@@ -183,17 +182,28 @@ export default function AuditLogsPage() {
   return (
     <Page>
       <PageBody>
-        <Tabs
-          value={tab}
-          onValueChange={(value) => setTab(value as TabOption)}
-          variant="underline"
-          className="mb-6"
-        >
-          <TabsList className="w-full flex-wrap" aria-label={t('audit_logs.tabs.label')}>
-            <TabsTrigger value="actions">{t('audit_logs.actions.title')}</TabsTrigger>
-            <TabsTrigger value="access">{t('audit_logs.access.title')}</TabsTrigger>
-          </TabsList>
-        </Tabs>
+        <div className="mb-6 border-b border-border">
+      <nav className="flex items-center gap-6 text-sm" role="tablist" aria-label={t('audit_logs.tabs.label')}>
+            <button
+              type="button"
+              role="tab"
+              aria-selected={tab === 'actions'}
+              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'actions' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
+              onClick={() => setTab('actions')}
+            >
+              {t('audit_logs.actions.title')}
+            </button>
+            <button
+              type="button"
+              role="tab"
+              aria-selected={tab === 'access'}
+              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'access' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
+              onClick={() => setTab('access')}
+            >
+              {t('audit_logs.access.title')}
+            </button>
+          </nav>
+        </div>
 
         {error && <div className="mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text">{error}</div>}