@open-mercato/core 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6784.1.f80b9afce5

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3727 entry points
+[build:core] found 3731 entry points
 [build:core] built successfully
 [build:core:generated] found 197 entry points
 [build:core:generated] built successfully

package/AGENTS.md

@@ -502,9 +502,9 @@ When extending another module's data, add a separate extension entity — never
 - RBAC is two-layered: Role ACLs and User ACLs per tenant
 - Features declared per module in `acl.ts`, naming: `<module>.<action>`
 - Server-side check: `rbacService.userHasAllFeatures(userId, features, { tenantId, organizationId })`
-- Special flags: `isSuperAdmin` (all features), organization visibility list
-- Treat wildcard grants as part of the ACL contract: `module.*` and `*` satisfy matching concrete features.
-- When a runtime helper evaluates raw granted feature arrays directly (for example nav builders, notification handlers, mutation guards, command interceptors, or AI tools), MUST use the shared wildcard-aware matcher instead of exact string comparisons.
+- Special flags: `isSuperAdmin` (all active features), organization visibility list
+- Policy order: invalid scope and nulled/disabled features deny before super-admin or wildcard grants.
+- For loaded ACL snapshots use shared `authorizeFeatures`; browser payloads use realm `getEffectiveFeatures` (concrete IDs only).
 
 ```typescript
 // acl.ts

package/agentic/standalone-guide.md

@@ -217,6 +217,19 @@ import { registerCommand } from '@open-mercato/shared/lib/commands'
 
 Include `indexer: { entityType, cacheAliases }` in `emitCrudSideEffects` for query index refresh.
 
+## Entity Update Safety
+
+When a command mutates entities across multiple phases that include queries, use
+`withAtomicFlush(em, phases, { transaction: true })` from
+`@open-mercato/shared/lib/commands/flush`. Never run `em.find`/`em.findOne`
+between scalar mutations and `em.flush()` without it; MikroORM can silently lose
+pending scalar changes.
+
+Keep `emitCrudSideEffects`, `emitCrudUndoSideEffects`, and cache invalidation
+after the domain write commits, outside the `withAtomicFlush` block. The opt-in
+`OM_CACHE_SAFETY_ALWAYS_CONSISTENT` mode (default OFF) makes the query-index tail
+synchronous and loud after commit; it does not join the domain-write transaction.
+
 ## Customer Accounts
 
 The `customer_accounts` module provides customer-facing authentication, sessions, RBAC, and account management. App modules build on top of it to add portal features.

package/dist/generated/entities/organization/index.js

@@ -3,6 +3,7 @@ const tenant = "tenant";
 const name = "name";
 const slug = "slug";
 const logo_url = "logo_url";
+const logo_preserve_aspect_ratio = "logo_preserve_aspect_ratio";
 const is_active = "is_active";
 const parent_id = "parent_id";
 const root_id = "root_id";
@@ -23,6 +24,7 @@ export {
   descendant_ids,
   id,
   is_active,
+  logo_preserve_aspect_ratio,
   logo_url,
   name,
   parent_id,

package/dist/generated/entities/organization/index.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../generated/entities/organization/index.ts"],
-  "sourcesContent": ["export const id = \"id\";\nexport const tenant = \"tenant\";\nexport const name = \"name\";\nexport const slug = \"slug\";\nexport const logo_url = \"logo_url\";\nexport const is_active = \"is_active\";\nexport const parent_id = \"parent_id\";\nexport const root_id = \"root_id\";\nexport const tree_path = \"tree_path\";\nexport const depth = \"depth\";\nexport const ancestor_ids = \"ancestor_ids\";\nexport const child_ids = \"child_ids\";\nexport const descendant_ids = \"descendant_ids\";\nexport const created_at = \"created_at\";\nexport const updated_at = \"updated_at\";\nexport const deleted_at = \"deleted_at\";\n"],
-  "mappings": "AAAO,MAAM,KAAK;AACX,MAAM,SAAS;AACf,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,WAAW;AACjB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,aAAa;",
+  "sourcesContent": ["export const id = \"id\";\nexport const tenant = \"tenant\";\nexport const name = \"name\";\nexport const slug = \"slug\";\nexport const logo_url = \"logo_url\";\nexport const logo_preserve_aspect_ratio = \"logo_preserve_aspect_ratio\";\nexport const is_active = \"is_active\";\nexport const parent_id = \"parent_id\";\nexport const root_id = \"root_id\";\nexport const tree_path = \"tree_path\";\nexport const depth = \"depth\";\nexport const ancestor_ids = \"ancestor_ids\";\nexport const child_ids = \"child_ids\";\nexport const descendant_ids = \"descendant_ids\";\nexport const created_at = \"created_at\";\nexport const updated_at = \"updated_at\";\nexport const deleted_at = \"deleted_at\";\n"],
+  "mappings": "AAAO,MAAM,KAAK;AACX,MAAM,SAAS;AACf,MAAM,OAAO;AACb,MAAM,OAAO;AACb,MAAM,WAAW;AACjB,MAAM,6BAA6B;AACnC,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,UAAU;AAChB,MAAM,YAAY;AAClB,MAAM,QAAQ;AACd,MAAM,eAAe;AACrB,MAAM,YAAY;AAClB,MAAM,iBAAiB;AACvB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,aAAa;",
   "names": []
 }

package/dist/generated/entity-fields-registry.js

@@ -1663,6 +1663,7 @@ const entityFieldsRegistry = {
     "name": "name",
     "slug": "slug",
     "logo_url": "logo_url",
+    "logo_preserve_aspect_ratio": "logo_preserve_aspect_ratio",
     "is_active": "is_active",
     "parent_id": "parent_id",
     "root_id": "root_id",