@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/src/modules/catalog/i18n/pl.json

@@ -86,35 +86,17 @@
   "catalog.errors.id_required": "Wymagany jest identyfikator rekordu.",
   "catalog.errors.organization_required": "Wymagany jest kontekst organizacji.",
   "catalog.errors.tenant_required": "Wymagany jest kontekst dzierżawy.",
-  "catalog.merchandising_assistant.agents.merchandising.description": "Przygotuj treści, uporządkuj atrybuty i zaproponuj zmiany cen dla bieżącego wyboru.",
-  "catalog.merchandising_assistant.agents.merchandising.label": "Asystent merchandisingu",
   "catalog.merchandising_assistant.context.filteredByCategory": "Filtrowane po kategorii",
-  "catalog.merchandising_assistant.context.matchingProducts": "{count} produktów w widoku",
-  "catalog.merchandising_assistant.context.selectedProducts": "Wybrano {count} produktów",
   "catalog.merchandising_assistant.context.tags": "Tagi: {count}",
   "catalog.merchandising_assistant.dock.subtitle": "Katalog",
   "catalog.merchandising_assistant.popover.heading": "Asystenci AI",
   "catalog.merchandising_assistant.sheet.composerPlaceholder": "Poproś o opisy, atrybuty, tytuły lub propozycje cen…",
   "catalog.merchandising_assistant.sheet.description": "Demo tylko do odczytu. Proponuje opisy, atrybuty, tytuły i korekty cen dla bieżącego wyboru. Na tym etapie żadne zmiany nie są zapisywane.",
-  "catalog.merchandising_assistant.sheet.descriptionWithSelection": "Praca na {count} wybranych produktach. Poproś o opisy, wyodrębnienie atrybutów, propozycje tytułów lub analizę cen.",
   "catalog.merchandising_assistant.sheet.dock": "Przypnij z boku",
   "catalog.merchandising_assistant.sheet.selectionPill": "Działa na {count} produktach",
   "catalog.merchandising_assistant.sheet.title": "Asystent merchandisingu katalogu",
-  "catalog.merchandising_assistant.sheet.welcomeDescriptionAll": "Wybierz produkty, aby wykonać na nich działania, albo przejrzyj swój katalog:",
-  "catalog.merchandising_assistant.sheet.welcomeDescriptionSelection": "Gotowe do pracy na Twoich {count} wybranych produktach. Wypróbuj jedną z opcji:",
-  "catalog.merchandising_assistant.sheet.welcomeTitle": "Asystent merchandisingu",
-  "catalog.merchandising_assistant.suggestions.analyzeAttributes": "Przeanalizuj pokrycie atrybutów",
-  "catalog.merchandising_assistant.suggestions.browseProducts": "Pokaż mi przegląd mojego katalogu produktów",
-  "catalog.merchandising_assistant.suggestions.draftDescriptions": "Przygotuj opisy produktów dla wybranych pozycji",
-  "catalog.merchandising_assistant.suggestions.extractAttributes": "Wyodrębnij atrybuty z opisów",
-  "catalog.merchandising_assistant.suggestions.findMissingDescriptions": "Znajdź produkty bez opisów",
-  "catalog.merchandising_assistant.suggestions.priceAdjustments": "Zaproponuj korekty cen",
-  "catalog.merchandising_assistant.suggestions.pricingOverview": "Pokaż rozkład cen",
-  "catalog.merchandising_assistant.suggestions.showStats": "Pokaż przegląd katalogu",
-  "catalog.merchandising_assistant.suggestions.titleVariants": "Wygeneruj warianty tytułów pod SEO",
   "catalog.merchandising_assistant.trigger.ariaLabel": "Otwórz asystenta merchandisingu AI",
   "catalog.merchandising_assistant.trigger.label": "AI",
-  "catalog.merchandising_assistant.trigger.moreAgentsAriaLabel": "Wybierz asystenta AI",
   "catalog.module.description": "Zarządzaj produktami, wariantami i cennikami wykorzystywanymi w sprzedaży.",
   "catalog.module.title": "Katalog produktów",
   "catalog.nav.group": "Katalog",

package/src/modules/catalog/widgets/injection/product-seo/widget.ts

@@ -8,7 +8,7 @@ const widget: InjectionWidgetModule<any, any> = {
     id: 'catalog.injection.product-seo',
     title: 'Product SEO Helper',
     description: 'Helps optimize product metadata for search engines',
-    features: ['catalog.products.manage'],
+    features: ['catalog.products.edit'],
     priority: 90,
     enabled: true,
     requiredFields: ['description'],

package/src/modules/communication_channels/api/post/test-seed/route.ts

@@ -5,14 +5,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import {
-  ChannelThreadMapping,
-  CommunicationChannel,
-  ExternalConversation,
-  MessageChannelLink,
-} from '../../../data/entities'
-import { ChannelAccessDeniedError, assertCanManageChannel } from '../../../lib/access-control'
+import { ChannelThreadMapping, ExternalConversation, MessageChannelLink } from '../../../data/entities'
 import {
   COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,
   type ConnectCredentialChannelInput,
@@ -42,13 +35,6 @@ import {
  *     customers link-channel-message subscriber runs against real Postgres. Enables
  *     the inbound auto-link tests (TC-CRM-EMAIL-002..005).
  */
-type RbacServiceLike = {
-  loadAcl: (
-    userId: string,
-    scope: { tenantId: string | null; organizationId: string | null },
-  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
-}
-
 export const metadata = {
   path: '/communication_channels/test-seed',
   POST: {
@@ -178,55 +164,6 @@ export async function POST(req: Request): Promise<Response> {
   const em = (container.resolve('em') as EntityManager).fork()
   const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY
 
-  // `channelId` is caller-supplied, so confirm it names a channel this tenant/org
-  // actually owns before seeding rows that reference it. Mirrors the ownership
-  // lookup every other per-channel route performs (see channels/[id]/test-send).
-  const ownedChannel = await findOneWithDecryption(
-    em,
-    CommunicationChannel,
-    {
-      id: body.channelId,
-      tenantId,
-      organizationId,
-      deletedAt: null,
-    },
-    undefined,
-    { tenantId, organizationId },
-  )
-  if (!ownedChannel) {
-    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })
-  }
-
-  // Tenant/org scope alone does not authorize: `connect_user_channel` is granted
-  // broadly, so a same-tenant caller could otherwise seed against a colleague's
-  // personal mailbox. Enforce the module's owner-only contract — personal
-  // channels are owner-restricted, shared channels need `manage`.
-  let userFeatures: string[] = []
-  try {
-    const rbac = container.resolve('rbacService') as RbacServiceLike
-    const acl = await rbac.loadAcl(userId, { tenantId, organizationId })
-    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []
-  } catch {
-    userFeatures = []
-  }
-  try {
-    assertCanManageChannel(
-      { userId: ownedChannel.userId },
-      userId,
-      userFeatures,
-      'communication_channels.manage',
-    )
-  } catch (err) {
-    if (err instanceof ChannelAccessDeniedError) {
-      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })
-    }
-    const status = (err as { statusCode?: number }).statusCode ?? 403
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : 'Access denied' },
-      { status },
-    )
-  }
-
   // A MessageChannelLink requires a non-null external_conversation_id (FK) and
   // message_id. Create a synthetic conversation + (optionally threaded) message
   // so the link is shaped like a real inbound row the subscriber can consume.
@@ -346,11 +283,7 @@ export const openApi = {
       responses: [
         { status: 201, description: 'Channel seeded / inbound message emitted' },
         { status: 401, description: 'Unauthorized' },
-        {
-          status: 404,
-          description:
-            'Test channel seeding disabled (production default), or the requested channel does not belong to the caller',
-        },
+        { status: 404, description: 'Test channel seeding disabled (production default)' },
         { status: 422, description: 'Invalid request body' },
         { status: 500, description: 'Seed failed' },
       ],

package/src/modules/communication_channels/api/post/webhook/[provider]/route.ts

@@ -12,7 +12,6 @@ import type { InboundMessage } from '../../../../lib/adapter'
 import type { InboundProcessorPayload } from '../../../../workers/inbound-processor'
 import type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
 
 const logger = createLogger('communication_channels').child({ component: 'inbound-webhook' })
 
@@ -61,15 +60,7 @@ export async function POST(req: Request, { params }: RouteContext): Promise<Resp
     )
   }
 
-  let rawBody: string
-  try {
-    rawBody = await readBoundedRequestBody(req)
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })
-    }
-    throw error
-  }
+  const rawBody = await req.text()
   const headers: Record<string, string> = {}
   req.headers.forEach((value, key) => {
     headers[key] = value
@@ -231,7 +222,6 @@ export const openApi = {
       responses: [
         { status: 202, description: 'Webhook accepted for async processing' },
         { status: 401, description: 'Signature verification failed against every candidate channel' },
-        { status: 413, description: 'Webhook payload too large' },
         { status: 404, description: 'Unknown provider' },
       ],
     },

package/src/modules/communication_channels/api/post/webhooks/gmail/route.ts

@@ -13,7 +13,6 @@ import {
   GmailPubSubJwtError,
 } from '../../../../lib/gmail-pubsub-jwt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
 
 const logger = createLogger('communication_channels').child({ component: 'gmail-webhook' })
 
@@ -25,14 +24,13 @@ const logger = createLogger('communication_channels').child({ component: 'gmail-
  * header, which we verify against Google's public certs.
  *
  * Validation pipeline:
- *   1. Bound the raw request body before cryptographic work.
- *   2. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and
+ *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and
  *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).
- *   3. Decode the Pub/Sub envelope → `{ emailAddress, historyId }`.
- *   4. Look up every active Gmail channel matching `emailAddress`. Multiple
+ *   2. Decode the Pub/Sub envelope → `{ emailAddress, historyId }`.
+ *   3. Look up every active Gmail channel matching `emailAddress`. Multiple
  *      tenants may have the same mailbox connected — we enqueue one sync
  *      job per matching channel (each tenant sees their own data).
- *   5. Return `204 No Content` even when no channels match — returning 4xx
+ *   4. Return `204 No Content` even when no channels match — returning 4xx
  *      would cause Pub/Sub to retry forever on a permanently-orphaned
  *      registration.
  */
@@ -60,16 +58,6 @@ export async function POST(req: Request): Promise<Response> {
     return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })
   }
 
-  let rawBody: string
-  try {
-    rawBody = await readBoundedRequestBody(req)
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })
-    }
-    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })
-  }
-
   const verifier = getGmailPubSubVerifier()
   try {
     await verifier.verify({
@@ -88,6 +76,13 @@ export async function POST(req: Request): Promise<Response> {
     throw err
   }
 
+  let rawBody: string
+  try {
+    rawBody = await req.text()
+  } catch {
+    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })
+  }
+
   let payload: { emailAddress: string; historyId: string | number }
   try {
     payload = decodeGmailPubSubBody(rawBody)
@@ -158,7 +153,6 @@ export const openApi = {
         { status: 400, description: 'Body not a valid Pub/Sub envelope' },
         { status: 401, description: 'Invalid JWT or email claim' },
         { status: 403, description: 'Wrong audience' },
-        { status: 413, description: 'Webhook payload too large' },
         { status: 503, description: 'Webhook not configured / Google certs unreachable' },
       ],
     },

package/src/modules/communication_channels/backend/communication_channels/channels/page.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
@@ -115,7 +114,7 @@ export default function ChannelsListPage() {
       <PageBody>
         <DataTable<ChannelRow>
           title={t('communication_channels.nav.title', 'Communication Channels')}
-          extensionTableId={extensionPoints.hosts.channelsTable.tableId}
+          extensionTableId="communication_channels.channels"
           columns={columns}
           data={rows}
           isLoading={isLoading}

package/src/modules/communication_channels/backend/profile/communication-channels/page.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -470,7 +469,7 @@ export default function ProfileCommunicationChannelsPage() {
           {/* Provider connect entry points injected by each channel-* package
               (channel-gmail, channel-imap) via UMES. */}
           <InjectionSpot
-            spotId={extensionPoints.hosts.profileConnect.spotId}
+            spotId="profile:communication-channels:connect"
             context={{ reload: () => setReloadKey((k) => k + 1) }}
             data={{}}
           />
@@ -490,7 +489,7 @@ export default function ProfileCommunicationChannelsPage() {
 
         <DataTable<ChannelRow>
           title={t('communication_channels.profile.tableTitle', 'Your channels')}
-          extensionTableId={extensionPoints.hosts.profileChannelsTable.tableId}
+          extensionTableId="communication_channels.profile.channels"
           columns={columns}
           data={rows}
           isLoading={isLoading}
@@ -871,7 +870,7 @@ function DisconnectChannelDialog({
           <Button type="button" variant="outline" onClick={onClose} disabled={submitting}>
             {t('communication_channels.profile.disconnect.cancel', 'Cancel')}
           </Button>
-          <Button type="button" variant="destructive-solid" onClick={() => void handleConfirm()} disabled={submitting}>
+          <Button type="button" variant="destructive" onClick={() => void handleConfirm()} disabled={submitting}>
             {submitting
               ? t('communication_channels.profile.disconnect.submitting', 'Disconnecting…')
               : t('communication_channels.profile.disconnect.confirm', 'Disconnect')}

package/src/modules/communication_channels/data/enrichers.ts

@@ -1,10 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { EnricherContext, ResponseEnricher } from '@open-mercato/shared/lib/crud/response-enricher'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import {
-  applyMessageParticipantScope,
-  type MessagesParticipantScopeDatabase,
-} from '../../messages/lib/participantScope'
 import { sanitizeChannelHtml } from '../lib/sanitize-channel-html'
 import {
   CommunicationChannel,
@@ -47,6 +43,21 @@ type MessageRecord = Record<string, unknown> & {
   threadId?: string | null
 }
 
+type MessageParticipantDatabase = {
+  messages: {
+    id: string
+    tenant_id: string
+    organization_id: string | null
+    sender_user_id: string
+    deleted_at: Date | null
+  }
+  message_recipients: {
+    message_id: string
+    recipient_user_id: string
+    deleted_at: Date | null
+  }
+}
+
 type ResolvedCtx = EnricherContext & {
   em: EntityManager
 }
@@ -140,13 +151,22 @@ const messageChannelEnricher: ResponseEnricher<
       }))
     }
 
-    const db = em.getKysely<MessagesParticipantScopeDatabase>()
-    let participantQuery = applyMessageParticipantScope(db.selectFrom('messages as m'), userId)
+    const db = em.getKysely<MessageParticipantDatabase>()
+    let participantQuery = db
+      .selectFrom('messages as m')
+      .leftJoin('message_recipients as r', (join) => join
+        .onRef('m.id', '=', 'r.message_id')
+        .on('r.recipient_user_id', '=', userId)
+        .on('r.deleted_at', 'is', null))
       .select('m.id')
       .distinct()
       .where('m.id', 'in', messageIds)
       .where('m.tenant_id', '=', tenantId)
       .where('m.deleted_at', 'is', null)
+      .where((eb) => eb.or([
+        eb('m.sender_user_id', '=', userId),
+        eb('r.message_id', 'is not', null),
+      ]))
 
     participantQuery = organizationId !== null
       ? participantQuery.where('m.organization_id', '=', organizationId)

package/src/modules/communication_channels/lib/access-control.ts

@@ -1,4 +1,4 @@
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import { hasFeature } from '@open-mercato/shared/security/features'
 
 /**
  * Per-user channel access control — service-layer authorization helpers.
@@ -67,7 +67,7 @@ export function assertCanAccessChannel(
  *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp
  *     Business / Slack workspaces): requires the route's `elevatedFeature`
  *     (`communication_channels.manage`, `…channel.push.manage`, or
- *     `…channel.import_history`). Evaluated by the shared feature policy.
+ *     `…channel.import_history`). Wildcard-aware via {@link hasFeature}.
  *
  * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking
  * existence) when the caller may not manage the channel.
@@ -94,7 +94,7 @@ export function assertCanManageChannel(
   }
   // Tenant-wide / shared channel — requires the elevated management feature.
   const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []
-  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {
+  if (!hasFeature(grantedFeatures, elevatedFeature)) {
     throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)
   }
 }

package/src/modules/configs/backend/config/system-status/page.tsx

@@ -1,6 +1,5 @@
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
-import { extensionPoints } from '@open-mercato/core/modules/configs/extension-points'
 import SystemStatusPanel from '../../../components/SystemStatusPanel'
 
 export default function SystemStatusPage() {
@@ -9,7 +8,7 @@ export default function SystemStatusPage() {
       <PageBody>
         <SystemStatusPanel />
         <InjectionSpot
-          spotId={extensionPoints.hosts.systemStatusDetails.spotId}
+          spotId="configs.system_status:details"
           context={{ path: '/backend/config/system-status' }}
         />
       </PageBody>

package/src/modules/configs/lib/upgrade-actions.ts

@@ -91,20 +91,6 @@ export const upgradeActions: UpgradeActionDefinition[] = [
       }
     },
   },
-  {
-    id: 'payment_gateways.register-session-initialization-prune',
-    version: '0.6.6',
-    messageKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.message',
-    ctaKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.cta',
-    successKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.success',
-    loadingKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.loading',
-    run: async ({ container, tenantId, organizationId }) => {
-      const { registerSessionInitializationPruneSchedule } = await import(
-        '@open-mercato/core/modules/payment_gateways/setup'
-      )
-      await registerSessionInitializationPruneSchedule(container, { tenantId, organizationId })
-    },
-  },
 ]
 
 export function actionsUpToVersion(version: string): UpgradeActionDefinition[] {

package/src/modules/currencies/backend/currencies/page.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/currencies/extension-points'
 import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
@@ -344,7 +343,7 @@ export default function CurrenciesPage() {
           )}
           pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
-          perspective={{ tableId: extensionPoints.hosts.currenciesTable.tableId }}
+          perspective={{ tableId: 'currencies.list' }}
         />
       </PageBody>
       {ConfirmDialogElement}

package/src/modules/currencies/backend/exchange-rates/page.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/currencies/extension-points'
 import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
@@ -334,7 +333,7 @@ export default function ExchangeRatesPage() {
           )}
           pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
-          perspective={{ tableId: extensionPoints.hosts.exchangeRatesTable.tableId }}
+          perspective={{ tableId: 'exchange-rates.list' }}
         />
       </PageBody>
       {ConfirmDialogElement}

package/src/modules/currencies/di.ts

@@ -4,7 +4,6 @@ import { RateFetchingService } from './services/rateFetchingService'
 import { ExchangeRateService } from './services/exchangeRateService'
 import { NBPProvider } from './services/providers/nbp'
 import { RaiffeisenPolandProvider } from './services/providers/raiffeisen'
-import { BaseCurrencyService } from './services/baseCurrencyService'
 
 export function register(container: AppContainer) {
   container.register({
@@ -27,8 +26,6 @@ export function register(container: AppContainer) {
         return new ExchangeRateService(em, rateFetchingService)
       },
     },
-    baseCurrencyService: {
-      resolve: (c) => new BaseCurrencyService(c.resolve<EntityManager>('em')),
-    },
   })
 }
+

package/src/modules/currencies/i18n/de.json

@@ -73,7 +73,6 @@
   "currencies.list.columns.symbol": "Symbol",
   "currencies.list.columns.updatedAt": "Aktualisiert am",
   "currencies.list.confirmDelete": "Währung {{code}} löschen? Dadurch werden auch alle Wechselkurse für diese Währung entfernt.",
-  "currencies.list.description": "Wechselkurse werden jede Nacht aktualisiert.",
   "currencies.list.error.load": "Währungen konnten nicht geladen werden",
   "currencies.list.filters.active": "Aktiv",
   "currencies.list.filters.all": "Alle",

package/src/modules/currencies/i18n/en.json

@@ -73,7 +73,6 @@
   "currencies.list.columns.symbol": "Symbol",
   "currencies.list.columns.updatedAt": "Updated At",
   "currencies.list.confirmDelete": "Delete currency {{code}}? This will also remove all exchange rates for this currency.",
-  "currencies.list.description": "Exchange rates refresh nightly.",
   "currencies.list.error.load": "Failed to load currencies",
   "currencies.list.filters.active": "Active",
   "currencies.list.filters.all": "All",

package/src/modules/currencies/i18n/es.json

@@ -73,7 +73,6 @@
   "currencies.list.columns.symbol": "Símbolo",
   "currencies.list.columns.updatedAt": "Fecha de actualización",
   "currencies.list.confirmDelete": "¿Eliminar moneda {{code}}? Esto también eliminará todos los tipos de cambio para esta moneda.",
-  "currencies.list.description": "Los tipos de cambio se actualizan cada noche.",
   "currencies.list.error.load": "Error al cargar monedas",
   "currencies.list.filters.active": "Activa",
   "currencies.list.filters.all": "Todas",

package/src/modules/currencies/i18n/pl.json

@@ -73,7 +73,6 @@
   "currencies.list.columns.symbol": "Symbol",
   "currencies.list.columns.updatedAt": "Data aktualizacji",
   "currencies.list.confirmDelete": "Usunąć walutę {{code}}? Spowoduje to również usunięcie wszystkich kursów wymiany dla tej waluty.",
-  "currencies.list.description": "Kursy wymiany są odświeżane każdej nocy.",
   "currencies.list.error.load": "Nie udało się załadować walut",
   "currencies.list.filters.active": "Aktywne",
   "currencies.list.filters.all": "Wszystkie",

package/src/modules/customer_accounts/AGENTS.md

@@ -136,7 +136,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 ### Portal Admin Flag
 
-`isPortalAdmin: true` on a role/user ACL bypasses stored-grant matching (equivalent to staff `isSuperAdmin`). Nulled ACL features and disabled modules remain denied.
+`isPortalAdmin: true` on a role/user ACL bypasses all feature checks (equivalent to staff `isSuperAdmin`).
 
 ### Default Roles (seeded on tenant creation)
 
@@ -150,7 +150,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 Customer portal features use the `portal.<area>.<action>` naming convention (e.g., `portal.orders.view`, `portal.catalog.view`).
 
-Treat `portal.*` and `*` as first-class stored ACL grants. Server authorization calls `CustomerRbacService.userHasAllFeatures`; already-loaded snapshots call shared `authorizeFeatures`. Portal UI and navigation consume `getEffectiveFeatures`, which returns concrete active IDs without wildcards.
+Treat `portal.*` and `*` as first-class ACL grants. When portal code reads raw feature arrays directly (for example menu filtering, injected portal navigation, or local runtime guards), use shared wildcard-aware matching instead of exact `includes(...)` checks.
 
 ### Cross-Module Feature Merging
 
@@ -172,7 +172,7 @@ const customerRbacService = container.resolve('customerRbacService')
 const hasAccess = await customerRbacService.userHasAllFeatures(userId, ['portal.orders.view'], { tenantId, organizationId })
 ```
 
-When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. Client helpers receive concrete effective features and may use the pure shared matcher without implementing portal-admin or removal bypasses.
+When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. If it evaluates raw granted features directly, it must preserve wildcard semantics.
 
 ## Services and DI
 

package/src/modules/customer_accounts/api/admin/users/[id].ts

@@ -11,7 +11,7 @@ import { CustomerRbacService } from '@open-mercato/core/modules/customer_account
 import { adminUpdateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { isOwnedCompanyEntity, isOwnedPersonEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
+import { isOwnedCompanyEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
@@ -168,21 +168,6 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     }
   }
 
-  // Same guard for the person FK. Without it the invite-side check is trivially
-  // bypassable: create the user normally, then PUT an unowned personEntityId.
-  // It persists (autoLinkCrm short-circuits on any non-null value) and leaks
-  // account status into the other org's people list via the account-status
-  // enricher. A null value (unlink) needs no ownership check.
-  if (parsed.data.personEntityId) {
-    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId,
-    })
-    if (!owned) {
-      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
-    }
-  }
-
   // Always bump updated_at so the optimistic-lock version advances on every save.
   // `nativeUpdate` bypasses MikroORM's `onUpdate` hook, so set it explicitly — without
   // this the version never changes and concurrent edits cannot be detected (#2055).