@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260723120000_customer_accounts extends Migration {
+  async up() {
+    this.addSql(`alter table "customer_user_invitations" add column "person_entity_id" uuid null;`);
+  }
+  async down() {
+    this.addSql(`alter table "customer_user_invitations" drop column "person_entity_id";`);
+  }
+}
+export {
+  Migration20260723120000_customer_accounts
+};
+//# sourceMappingURL=Migration20260723120000_customer_accounts.js.map

package/dist/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260723120000_customer_accounts extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"customer_user_invitations\" add column \"person_entity_id\" uuid null;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`alter table \"customer_user_invitations\" drop column \"person_entity_id\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,kDAAkD,UAAU;AAAA,EAEvE,MAAe,KAAoB;AACjC,SAAK,OAAO,kFAAkF;AAAA,EAChG;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,yEAAyE;AAAA,EACvF;AAEF;",
+  "names": []
+}

package/dist/modules/customer_accounts/services/customerInvitationService.js

@@ -35,16 +35,28 @@ class CustomerInvitationService {
       { tenantId: scope.tenantId, organizationId: scope.organizationId }
     );
     if (existing) {
+      const rollbackState = {
+        email: existing.email,
+        token: existing.token,
+        customerEntityId: existing.customerEntityId ?? null,
+        personEntityId: existing.personEntityId ?? null,
+        roleIdsJson: [...existing.roleIdsJson ?? []],
+        invitedByUserId: existing.invitedByUserId ?? null,
+        invitedByCustomerUserId: existing.invitedByCustomerUserId ?? null,
+        displayName: existing.displayName ?? null,
+        expiresAt: new Date(existing.expiresAt)
+      };
       existing.email = normalizedEmail;
       existing.token = tokenHashed;
       existing.customerEntityId = options.customerEntityId || null;
+      existing.personEntityId = options.personEntityId || null;
       existing.roleIdsJson = options.roleIds;
       existing.invitedByUserId = options.invitedByUserId || null;
       existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null;
       existing.displayName = options.displayName || null;
       existing.expiresAt = expiresAt;
       await this.em.flush();
-      return { invitation: existing, rawToken: token };
+      return { invitation: existing, rawToken: token, reused: true, rollbackState };
     }
     const invitation = this.em.create(CustomerUserInvitation, {
       tenantId: scope.tenantId,
@@ -53,6 +65,7 @@ class CustomerInvitationService {
       emailHash,
       token: tokenHashed,
       customerEntityId: options.customerEntityId || null,
+      personEntityId: options.personEntityId || null,
       roleIdsJson: options.roleIds,
       invitedByUserId: options.invitedByUserId || null,
       invitedByCustomerUserId: options.invitedByCustomerUserId || null,
@@ -61,7 +74,23 @@ class CustomerInvitationService {
       createdAt: /* @__PURE__ */ new Date()
     });
     await this.em.persist(invitation).flush();
-    return { invitation, rawToken: token };
+    return { invitation, rawToken: token, reused: false, rollbackState: null };
+  }
+  async rollbackInvitation(invitation, rollbackState) {
+    if (!rollbackState) {
+      await this.em.remove(invitation).flush();
+      return;
+    }
+    invitation.email = rollbackState.email;
+    invitation.token = rollbackState.token;
+    invitation.customerEntityId = rollbackState.customerEntityId;
+    invitation.personEntityId = rollbackState.personEntityId;
+    invitation.roleIdsJson = [...rollbackState.roleIdsJson];
+    invitation.invitedByUserId = rollbackState.invitedByUserId;
+    invitation.invitedByCustomerUserId = rollbackState.invitedByCustomerUserId;
+    invitation.displayName = rollbackState.displayName;
+    invitation.expiresAt = new Date(rollbackState.expiresAt);
+    await this.em.flush();
   }
   async findByToken(token) {
     const tokenHashed = hashToken(token);
@@ -89,6 +118,7 @@ class CustomerInvitationService {
       tenantId: invitation.tenantId,
       organizationId: invitation.organizationId,
       customerEntityId: invitation.customerEntityId || null,
+      personEntityId: invitation.personEntityId || null,
       isActive: true,
       emailVerifiedAt: /* @__PURE__ */ new Date(),
       // Invitation implicitly verifies email

package/dist/modules/customer_accounts/services/customerInvitationService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerInvitationService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            organizationId: invitation.organizationId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
-  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,MAAM;AAAA,IACjD;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport type CustomerInvitationRollbackState = {\n  email: string\n  token: string\n  customerEntityId: string | null\n  personEntityId: string | null\n  roleIdsJson: string[]\n  invitedByUserId: string | null\n  invitedByCustomerUserId: string | null\n  displayName: string | null\n  expiresAt: Date\n}\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      personEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{\n    invitation: CustomerUserInvitation\n    rawToken: string\n    reused: boolean\n    rollbackState: CustomerInvitationRollbackState | null\n  }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      const rollbackState: CustomerInvitationRollbackState = {\n        email: existing.email,\n        token: existing.token,\n        customerEntityId: existing.customerEntityId ?? null,\n        personEntityId: existing.personEntityId ?? null,\n        roleIdsJson: [...(existing.roleIdsJson ?? [])],\n        invitedByUserId: existing.invitedByUserId ?? null,\n        invitedByCustomerUserId: existing.invitedByCustomerUserId ?? null,\n        displayName: existing.displayName ?? null,\n        expiresAt: new Date(existing.expiresAt),\n      }\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.personEntityId = options.personEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token, reused: true, rollbackState }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      personEntityId: options.personEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token, reused: false, rollbackState: null }\n  }\n\n  async rollbackInvitation(\n    invitation: CustomerUserInvitation,\n    rollbackState: CustomerInvitationRollbackState | null,\n  ): Promise<void> {\n    if (!rollbackState) {\n      await this.em.remove(invitation).flush()\n      return\n    }\n\n    invitation.email = rollbackState.email\n    invitation.token = rollbackState.token\n    invitation.customerEntityId = rollbackState.customerEntityId\n    invitation.personEntityId = rollbackState.personEntityId\n    invitation.roleIdsJson = [...rollbackState.roleIdsJson]\n    invitation.invitedByUserId = rollbackState.invitedByUserId\n    invitation.invitedByCustomerUserId = rollbackState.invitedByCustomerUserId\n    invitation.displayName = rollbackState.displayName\n    invitation.expiresAt = new Date(rollbackState.expiresAt)\n    await this.em.flush()\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      personEntityId: invitation.personEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            organizationId: invitation.organizationId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAclC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAaC;AACD,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,YAAM,gBAAiD;AAAA,QACrD,OAAO,SAAS;AAAA,QAChB,OAAO,SAAS;AAAA,QAChB,kBAAkB,SAAS,oBAAoB;AAAA,QAC/C,gBAAgB,SAAS,kBAAkB;AAAA,QAC3C,aAAa,CAAC,GAAI,SAAS,eAAe,CAAC,CAAE;AAAA,QAC7C,iBAAiB,SAAS,mBAAmB;AAAA,QAC7C,yBAAyB,SAAS,2BAA2B;AAAA,QAC7D,aAAa,SAAS,eAAe;AAAA,QACrC,WAAW,IAAI,KAAK,SAAS,SAAS;AAAA,MACxC;AACA,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,iBAAiB,QAAQ,kBAAkB;AACpD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,OAAO,QAAQ,MAAM,cAAc;AAAA,IAC9E;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,OAAO,eAAe,KAAK;AAAA,EAC3E;AAAA,EAEA,MAAM,mBACJ,YACA,eACe;AACf,QAAI,CAAC,eAAe;AAClB,YAAM,KAAK,GAAG,OAAO,UAAU,EAAE,MAAM;AACvC;AAAA,IACF;AAEA,eAAW,QAAQ,cAAc;AACjC,eAAW,QAAQ,cAAc;AACjC,eAAW,mBAAmB,cAAc;AAC5C,eAAW,iBAAiB,cAAc;AAC1C,eAAW,cAAc,CAAC,GAAG,cAAc,WAAW;AACtD,eAAW,kBAAkB,cAAc;AAC3C,eAAW,0BAA0B,cAAc;AACnD,eAAW,cAAc,cAAc;AACvC,eAAW,YAAY,IAAI,KAAK,cAAc,SAAS;AACvD,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,gBAAgB,WAAW,kBAAkB;AAAA,MAC7C,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/services/customerRbacService.js

@@ -3,7 +3,10 @@ import {
   CustomerRoleAcl,
   CustomerUserRole
 } from "@open-mercato/core/modules/customer_accounts/data/entities";
-import { hasAllFeatures } from "@open-mercato/shared/lib/auth/featureMatch";
+import {
+  authorizeFeatures,
+  resolveEffectiveFeatures
+} from "@open-mercato/shared/security/featurePolicy";
 function isCustomerAclData(value) {
   if (typeof value !== "object" || value === null) return false;
   const record = value;
@@ -92,8 +95,14 @@ class CustomerRbacService {
   async userHasAllFeatures(userId, required, scope) {
     if (!required.length) return true;
     const acl = await this.loadAcl(userId, scope);
-    if (acl.isPortalAdmin) return true;
-    return hasAllFeatures(required, acl.features);
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isPortalAdmin
+    });
+  }
+  async getEffectiveFeatures(userId, scope) {
+    const acl = await this.loadAcl(userId, scope);
+    return resolveEffectiveFeatures(acl.isPortalAdmin ? ["portal.*"] : acl.features);
   }
   async invalidateUserCache(userId) {
     if (!this.cache) return;

package/dist/modules/customer_accounts/services/customerRbacService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerRbacService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  CustomerUserAcl,\n  CustomerRoleAcl,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'\n\ninterface CustomerAclData {\n  isPortalAdmin: boolean\n  features: string[]\n}\n\nfunction isCustomerAclData(value: unknown): value is CustomerAclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<CustomerAclData>\n  if (typeof record.isPortalAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((f) => typeof f !== 'string')) return false\n  return true\n}\n\nexport class CustomerRbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000\n  private cache: CacheStrategy | null = null\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {\n    // Keep the authorization query versioned in the key so cache entries created\n    // before scope hardening cannot preserve grants that are no longer valid.\n    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `customer_rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `customer_rbac:tenant:${tenantId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<CustomerAclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isCustomerAclData(cached) ? cached : null\n  }\n\n  private async setCache(\n    cacheKey: string,\n    data: CustomerAclData,\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<void> {\n    if (!this.cache) return\n    const tags = [\n      this.getUserTag(userId),\n      this.getTenantTag(scope.tenantId),\n      'customer_rbac:all',\n    ]\n    await this.cache.set(cacheKey, data, { ttl: this.cacheTtlMs, tags })\n  }\n\n  async loadAcl(\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerAclData> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    const em = this.em.fork()\n\n    // Per-user ACL first\n    const userAcl = await em.findOne(CustomerUserAcl, {\n      user: userId as any,\n      tenantId: scope.tenantId,\n    })\n    if (userAcl) {\n      const result: CustomerAclData = {\n        isPortalAdmin: !!userAcl.isPortalAdmin,\n        features: Array.isArray(userAcl.featuresJson) ? userAcl.featuresJson : [],\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await em.find(CustomerUserRole, {\n      user: userId as any,\n      role: {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        deletedAt: null,\n      },\n      deletedAt: null,\n    } as any, { populate: ['role'] })\n    const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)\n\n    let isPortalAdmin = false\n    const features: string[] = []\n    if (roleIds.length) {\n      const roleAcls = await em.find(CustomerRoleAcl, {\n        tenantId: scope.tenantId,\n        role: { $in: roleIds as any },\n      } as any)\n      for (const acl of roleAcls) {\n        isPortalAdmin = isPortalAdmin || !!acl.isPortalAdmin\n        if (Array.isArray(acl.featuresJson)) {\n          for (const f of acl.featuresJson) {\n            if (!features.includes(f)) features.push(f)\n          }\n        }\n      }\n    }\n\n    const result: CustomerAclData = { isPortalAdmin, features }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  async userHasAllFeatures(\n    userId: string,\n    required: string[],\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isPortalAdmin) return true\n    return hasAllFeatures(required, acl.features)\n  }\n\n  async invalidateUserCache(userId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getUserTag(userId)])\n  }\n\n  async invalidateRoleCache(roleId: string): Promise<void> {\n    if (!this.cache) return\n    // When a role changes, invalidate all customer RBAC caches since we don't track role\u2192user mappings\n    await this.cache.deleteByTags(['customer_rbac:all'])\n  }\n\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getTenantTag(tenantId)])\n  }\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAO/B,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,kBAAkB,UAAW,QAAO;AACtD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAG,QAAO;AAClG,SAAO;AACT;AAEO,MAAM,oBAAoB;AAAA,EAI/B,YAAoB,IAAmB,OAAuB;AAA1C;AAHpB,SAAQ,aAAqB,IAAI,KAAK;AACtC,SAAQ,QAA8B;AAGpC,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA,EAEQ,YAAY,QAAgB,OAA6D;AAG/F,WAAO,oBAAoB,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,cAAc;AAAA,EAC7E;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,wBAAwB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,UAAmD;AAC5E,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,kBAAkB,MAAM,IAAI,SAAS;AAAA,EAC9C;AAAA,EAEA,MAAc,SACZ,UACA,MACA,QACA,OACe;AACf,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB,KAAK,aAAa,MAAM,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC;AAAA,EACrE;AAAA,EAEA,MAAM,QACJ,QACA,OAC0B;AAC1B,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK,KAAK,GAAG,KAAK;AAGxB,UAAM,UAAU,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAChD,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,QAAI,SAAS;AACX,YAAMA,UAA0B;AAAA,QAC9B,eAAe,CAAC,CAAC,QAAQ;AAAA,QACzB,UAAU,MAAM,QAAQ,QAAQ,YAAY,IAAI,QAAQ,eAAe,CAAC;AAAA,MAC1E;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM,GAAG,KAAK,kBAAkB;AAAA,MAC5C,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,MACA,WAAW;AAAA,IACb,GAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAChC,UAAM,UAAU,MAAM,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AAEpE,QAAI,gBAAgB;AACpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,GAAG,KAAK,iBAAiB;AAAA,QAC9C,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,QAAe;AAAA,MAC9B,CAAQ;AACR,iBAAW,OAAO,UAAU;AAC1B,wBAAgB,iBAAiB,CAAC,CAAC,IAAI;AACvC,YAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,qBAAW,KAAK,IAAI,cAAc;AAChC,gBAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA0B,EAAE,eAAe,SAAS;AAC1D,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,QACA,UACA,OACkB;AAClB,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,cAAe,QAAO;AAC9B,WAAO,eAAe,UAAU,IAAI,QAAQ;AAAA,EAC9C;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,WAAW,MAAM,CAAC,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,KAAK,MAAM,aAAa,CAAC,mBAAmB,CAAC;AAAA,EACrD;AAAA,EAEA,MAAM,sBAAsB,UAAiC;AAC3D,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,aAAa,QAAQ,CAAC,CAAC;AAAA,EAC7D;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  CustomerUserAcl,\n  CustomerRoleAcl,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport {\n  authorizeFeatures,\n  resolveEffectiveFeatures,\n} from '@open-mercato/shared/security/featurePolicy'\n\ninterface CustomerAclData {\n  isPortalAdmin: boolean\n  features: string[]\n}\n\nfunction isCustomerAclData(value: unknown): value is CustomerAclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<CustomerAclData>\n  if (typeof record.isPortalAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((f) => typeof f !== 'string')) return false\n  return true\n}\n\nexport class CustomerRbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000\n  private cache: CacheStrategy | null = null\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {\n    // Keep the authorization query versioned in the key so cache entries created\n    // before scope hardening cannot preserve grants that are no longer valid.\n    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `customer_rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `customer_rbac:tenant:${tenantId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<CustomerAclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isCustomerAclData(cached) ? cached : null\n  }\n\n  private async setCache(\n    cacheKey: string,\n    data: CustomerAclData,\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<void> {\n    if (!this.cache) return\n    const tags = [\n      this.getUserTag(userId),\n      this.getTenantTag(scope.tenantId),\n      'customer_rbac:all',\n    ]\n    await this.cache.set(cacheKey, data, { ttl: this.cacheTtlMs, tags })\n  }\n\n  async loadAcl(\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerAclData> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    const em = this.em.fork()\n\n    // Per-user ACL first\n    const userAcl = await em.findOne(CustomerUserAcl, {\n      user: userId as any,\n      tenantId: scope.tenantId,\n    })\n    if (userAcl) {\n      const result: CustomerAclData = {\n        isPortalAdmin: !!userAcl.isPortalAdmin,\n        features: Array.isArray(userAcl.featuresJson) ? userAcl.featuresJson : [],\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await em.find(CustomerUserRole, {\n      user: userId as any,\n      role: {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        deletedAt: null,\n      },\n      deletedAt: null,\n    } as any, { populate: ['role'] })\n    const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)\n\n    let isPortalAdmin = false\n    const features: string[] = []\n    if (roleIds.length) {\n      const roleAcls = await em.find(CustomerRoleAcl, {\n        tenantId: scope.tenantId,\n        role: { $in: roleIds as any },\n      } as any)\n      for (const acl of roleAcls) {\n        isPortalAdmin = isPortalAdmin || !!acl.isPortalAdmin\n        if (Array.isArray(acl.featuresJson)) {\n          for (const f of acl.featuresJson) {\n            if (!features.includes(f)) features.push(f)\n          }\n        }\n      }\n    }\n\n    const result: CustomerAclData = { isPortalAdmin, features }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  async userHasAllFeatures(\n    userId: string,\n    required: string[],\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    return authorizeFeatures(required, {\n      grantedFeatures: acl.features,\n      unrestricted: acl.isPortalAdmin,\n    })\n  }\n\n  async getEffectiveFeatures(\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<string[]> {\n    const acl = await this.loadAcl(userId, scope)\n    return resolveEffectiveFeatures(acl.isPortalAdmin ? ['portal.*'] : acl.features)\n  }\n\n  async invalidateUserCache(userId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getUserTag(userId)])\n  }\n\n  async invalidateRoleCache(roleId: string): Promise<void> {\n    if (!this.cache) return\n    // When a role changes, invalidate all customer RBAC caches since we don't track role\u2192user mappings\n    await this.cache.deleteByTags(['customer_rbac:all'])\n  }\n\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getTenantTag(tenantId)])\n  }\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAOP,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,kBAAkB,UAAW,QAAO;AACtD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAG,QAAO;AAClG,SAAO;AACT;AAEO,MAAM,oBAAoB;AAAA,EAI/B,YAAoB,IAAmB,OAAuB;AAA1C;AAHpB,SAAQ,aAAqB,IAAI,KAAK;AACtC,SAAQ,QAA8B;AAGpC,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA,EAEQ,YAAY,QAAgB,OAA6D;AAG/F,WAAO,oBAAoB,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,cAAc;AAAA,EAC7E;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,wBAAwB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,UAAmD;AAC5E,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,kBAAkB,MAAM,IAAI,SAAS;AAAA,EAC9C;AAAA,EAEA,MAAc,SACZ,UACA,MACA,QACA,OACe;AACf,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB,KAAK,aAAa,MAAM,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC;AAAA,EACrE;AAAA,EAEA,MAAM,QACJ,QACA,OAC0B;AAC1B,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK,KAAK,GAAG,KAAK;AAGxB,UAAM,UAAU,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAChD,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,QAAI,SAAS;AACX,YAAMA,UAA0B;AAAA,QAC9B,eAAe,CAAC,CAAC,QAAQ;AAAA,QACzB,UAAU,MAAM,QAAQ,QAAQ,YAAY,IAAI,QAAQ,eAAe,CAAC;AAAA,MAC1E;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM,GAAG,KAAK,kBAAkB;AAAA,MAC5C,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,MACA,WAAW;AAAA,IACb,GAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAChC,UAAM,UAAU,MAAM,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AAEpE,QAAI,gBAAgB;AACpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,GAAG,KAAK,iBAAiB;AAAA,QAC9C,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,QAAe;AAAA,MAC9B,CAAQ;AACR,iBAAW,OAAO,UAAU;AAC1B,wBAAgB,iBAAiB,CAAC,CAAC,IAAI;AACvC,YAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,qBAAW,KAAK,IAAI,cAAc;AAChC,gBAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA0B,EAAE,eAAe,SAAS;AAC1D,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,QACA,UACA,OACkB;AAClB,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,WAAO,kBAAkB,UAAU;AAAA,MACjC,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,IACpB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,qBACJ,QACA,OACmB;AACnB,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,WAAO,yBAAyB,IAAI,gBAAgB,CAAC,UAAU,IAAI,IAAI,QAAQ;AAAA,EACjF;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,WAAW,MAAM,CAAC,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,KAAK,MAAM,aAAa,CAAC,mBAAmB,CAAC;AAAA,EACrD;AAAA,EAEA,MAAM,sBAAsB,UAAiC;AAC3D,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,aAAa,QAAQ,CAAC,CAAC;AAAA,EAC7D;AACF;",
   "names": ["result"]
 }

package/dist/modules/customer_accounts/setup.js

@@ -98,6 +98,9 @@ const DEFAULT_ROLES = [
     }
   }
 ];
+const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
+  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]])
+);
 async function ensureDefaultCustomerRoleAcls(em, tenantId, modules) {
   const featuresByRole = {};
   for (const mod of modules) {
@@ -162,6 +165,9 @@ const setup = {
     superadmin: ["customer_accounts.*"],
     admin: ["customer_accounts.*"]
   },
+  // Keep the portal feature catalog declarative so the shared feature policy
+  // can project portal.* into concrete capabilities without importing core.
+  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,
   async onTenantCreated({ em, tenantId, organizationId }) {
     await seedDefaultRoles(em, { tenantId, organizationId });
   },

package/dist/modules/customer_accounts/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { Module } from '@open-mercato/shared/modules/registry'\nimport { hash } from 'bcryptjs'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\n/**\n * Collect defaultCustomerRoleFeatures from all enabled modules and merge\n * them into the corresponding CustomerRoleAcl records.\n */\nasync function ensureDefaultCustomerRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n): Promise<void> {\n  const featuresByRole: Record<string, string[]> = {}\n\n  for (const mod of modules) {\n    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures\n    if (!customerRoleFeatures) continue\n    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {\n      if (!features || !features.length) continue\n      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []\n      featuresByRole[roleSlug].push(...features)\n    }\n  }\n\n  const roleSlugs = Object.keys(featuresByRole)\n  if (!roleSlugs.length) return\n\n  for (const roleSlug of roleSlugs) {\n    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })\n    if (!role) continue\n\n    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })\n    if (!acl) continue\n\n    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))\n    const changed =\n      merged.length !== currentFeatures.length ||\n      merged.some((value, index) => value !== currentFeatures[index])\n    if (changed) {\n      acl.featuresJson = merged\n      em.persist(acl)\n    }\n  }\n  await em.flush()\n}\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n    const exampleUsers = [\n      { email: 'alice.johnson@example.com', displayName: 'Alice Johnson', password: 'Password123!', roleSlug: 'portal_admin' },\n      { email: 'bob.smith@example.com', displayName: 'Bob Smith', password: 'Password123!', roleSlug: 'buyer' },\n      { email: 'carol.white@example.com', displayName: 'Carol White', password: 'Password123!', roleSlug: 'viewer' },\n    ]\n\n    for (const entry of exampleUsers) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAGA,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAMA,eAAe,8BACb,IACA,UACA,SACe;AACf,QAAM,iBAA2C,CAAC;AAElD,aAAW,OAAO,SAAS;AACzB,UAAM,uBAAuB,IAAI,OAAO;AACxC,QAAI,CAAC,qBAAsB;AAC3B,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,oBAAoB,GAAG;AACvE,UAAI,CAAC,YAAY,CAAC,SAAS,OAAQ;AACnC,UAAI,CAAC,eAAe,QAAQ,EAAG,gBAAe,QAAQ,IAAI,CAAC;AAC3D,qBAAe,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,KAAK,cAAc;AAC5C,MAAI,CAAC,UAAU,OAAQ;AAEvB,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK,CAAC;AACzF,QAAI,CAAC,KAAM;AAEX,UAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB,EAAE,MAAM,KAAK,IAAW,SAAS,CAAC;AAChF,QAAI,CAAC,IAAK;AAEV,UAAM,kBAAkB,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAC9E,UAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC;AACpF,UAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,QAAI,SAAS;AACX,UAAI,eAAe;AACnB,SAAG,QAAQ,GAAG;AAAA,IAChB;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA,EAEA,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AACpB,UAAM,eAAe;AAAA,MACnB,EAAE,OAAO,6BAA6B,aAAa,iBAAiB,UAAU,gBAAgB,UAAU,eAAe;AAAA,MACvH,EAAE,OAAO,yBAAyB,aAAa,aAAa,UAAU,gBAAgB,UAAU,QAAQ;AAAA,MACxG,EAAE,OAAO,2BAA2B,aAAa,eAAe,UAAU,gBAAgB,UAAU,SAAS;AAAA,IAC/G;AAEA,eAAW,SAAS,cAAc;AAChC,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { Module } from '@open-mercato/shared/modules/registry'\nimport { hash } from 'bcryptjs'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\n/**\n * Collect defaultCustomerRoleFeatures from all enabled modules and merge\n * them into the corresponding CustomerRoleAcl records.\n */\nasync function ensureDefaultCustomerRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n): Promise<void> {\n  const featuresByRole: Record<string, string[]> = {}\n\n  for (const mod of modules) {\n    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures\n    if (!customerRoleFeatures) continue\n    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {\n      if (!features || !features.length) continue\n      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []\n      featuresByRole[roleSlug].push(...features)\n    }\n  }\n\n  const roleSlugs = Object.keys(featuresByRole)\n  if (!roleSlugs.length) return\n\n  for (const roleSlug of roleSlugs) {\n    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })\n    if (!role) continue\n\n    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })\n    if (!acl) continue\n\n    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))\n    const changed =\n      merged.length !== currentFeatures.length ||\n      merged.some((value, index) => value !== currentFeatures[index])\n    if (changed) {\n      acl.featuresJson = merged\n      em.persist(acl)\n    }\n  }\n  await em.flush()\n}\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n    const exampleUsers = [\n      { email: 'alice.johnson@example.com', displayName: 'Alice Johnson', password: 'Password123!', roleSlug: 'portal_admin' },\n      { email: 'bob.smith@example.com', displayName: 'Bob Smith', password: 'Password123!', roleSlug: 'buyer' },\n      { email: 'carol.white@example.com', displayName: 'Carol White', password: 'Password123!', roleSlug: 'viewer' },\n    ]\n\n    for (const entry of exampleUsers) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAGA,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAMA,eAAe,8BACb,IACA,UACA,SACe;AACf,QAAM,iBAA2C,CAAC;AAElD,aAAW,OAAO,SAAS;AACzB,UAAM,uBAAuB,IAAI,OAAO;AACxC,QAAI,CAAC,qBAAsB;AAC3B,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,oBAAoB,GAAG;AACvE,UAAI,CAAC,YAAY,CAAC,SAAS,OAAQ;AACnC,UAAI,CAAC,eAAe,QAAQ,EAAG,gBAAe,QAAQ,IAAI,CAAC;AAC3D,qBAAe,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,KAAK,cAAc;AAC5C,MAAI,CAAC,UAAU,OAAQ;AAEvB,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK,CAAC;AACzF,QAAI,CAAC,KAAM;AAEX,UAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB,EAAE,MAAM,KAAK,IAAW,SAAS,CAAC;AAChF,QAAI,CAAC,IAAK;AAEV,UAAM,kBAAkB,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAC9E,UAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC;AACpF,UAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,QAAI,SAAS;AACX,UAAI,eAAe;AACnB,SAAG,QAAQ,GAAG;AAAA,IAChB;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AACpB,UAAM,eAAe;AAAA,MACnB,EAAE,OAAO,6BAA6B,aAAa,iBAAiB,UAAU,gBAAgB,UAAU,eAAe;AAAA,MACvH,EAAE,OAAO,yBAAyB,aAAa,aAAa,UAAU,gBAAgB,UAAU,QAAQ;AAAA,MACxG,EAAE,OAAO,2BAA2B,aAAa,eAAe,UAAU,gBAAgB,UAAU,SAAS;AAAA,IAC/G;AAEA,eAAW,SAAS,cAAc;AAChC,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customer_accounts/subscribers/autoLinkCrm.js

@@ -1,5 +1,6 @@
 import { CustomerUser } from "@open-mercato/core/modules/customer_accounts/data/entities";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveOwnedCompanyForPerson } from "@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customer_accounts").child({ component: "auto-link-crm" });
 const metadata = {
@@ -17,14 +18,51 @@ async function handle(payload, ctx) {
   try {
     const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, void 0, { tenantId, organizationId });
     if (!user) return;
-    if (user.personEntityId) return;
+    const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
+    const ownScope = { tenantId, organizationId: user.organizationId };
+    if (user.customerEntityId) {
+      const linked = await findOneWithDecryption(
+        em,
+        CustomerEntity,
+        { id: user.customerEntityId, tenantId, organizationId: user.organizationId, deletedAt: null },
+        void 0,
+        { tenantId, organizationId }
+      );
+      if (!linked) {
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: null }
+        );
+        user.customerEntityId = null;
+      } else if (linked.kind === "person") {
+        const replacement = await resolveOwnedCompanyForPerson(em, user.customerEntityId, ownScope);
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: replacement }
+        );
+        user.customerEntityId = replacement;
+      }
+    }
+    if (user.personEntityId) {
+      if (user.customerEntityId) return;
+      const recovered = await resolveOwnedCompanyForPerson(em, user.personEntityId, ownScope);
+      if (recovered) {
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: recovered }
+        );
+      }
+      return;
+    }
     const email = (data?.email ? data.email : user.email)?.toLowerCase().trim();
     if (!email) return;
-    const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
     const personEntities = await findWithDecryption(
       em,
       CustomerEntity,
-      { tenantId, kind: "person", deletedAt: null },
+      { tenantId, organizationId: user.organizationId, kind: "person", deletedAt: null },
       { limit: 500 },
       { tenantId, organizationId }
     );
@@ -32,14 +70,16 @@ async function handle(payload, ctx) {
       (e) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email
     );
     if (!matchingEntity) return;
-    const { CustomerPersonProfile } = await import("@open-mercato/core/modules/customers/data/entities");
-    const profile = await em.findOne(CustomerPersonProfile, { entity: matchingEntity.id });
-    const companyEntityId = profile?.companyEntityId;
+    const companyEntityId = await resolveOwnedCompanyForPerson(em, matchingEntity.id, ownScope);
     const updates = { personEntityId: matchingEntity.id };
     if (companyEntityId) {
       updates.customerEntityId = companyEntityId;
     }
-    await em.nativeUpdate(CustomerUser, { id: userId }, updates);
+    await em.nativeUpdate(
+      CustomerUser,
+      { id: userId, tenantId, organizationId: user.organizationId },
+      updates
+    );
   } catch (err) {
     logger.error("Failed to link customer user to CRM person", { err });
   }

package/dist/modules/customer_accounts/subscribers/autoLinkCrm.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/subscribers/autoLinkCrm.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'auto-link-crm' })\n\nexport const metadata = {\n  event: 'customer_accounts.user.created',\n  persistent: true,\n  id: 'customer_accounts:auto-link-crm',\n}\n\nexport default async function handle(\n  payload: unknown,\n  ctx: { resolve: <T = unknown>(name: string) => T; eventName?: string },\n): Promise<void> {\n  const data = payload as Record<string, unknown>\n  const userId = data?.id as string\n  const tenantId = data?.tenantId as string\n  const organizationId = data?.organizationId as string | undefined\n  if (!userId || !tenantId) return\n\n  const em = ctx.resolve<EntityManager>('em')\n\n  try {\n    const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, undefined, { tenantId, organizationId })\n    if (!user) return\n    if (user.personEntityId) return\n\n    const email = (data?.email ? (data.email as string) : user.email)?.toLowerCase().trim()\n    if (!email) return\n\n    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n\n    const personEntities = await findWithDecryption(\n      em,\n      CustomerEntity,\n      { tenantId, kind: 'person', deletedAt: null } as any,\n      { limit: 500 } as any,\n      { tenantId, organizationId },\n    )\n\n    const matchingEntity = personEntities.find(\n      (e: any) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email,\n    ) as any\n\n    if (!matchingEntity) return\n\n    const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')\n    const profile = await em.findOne(CustomerPersonProfile as any, { entity: matchingEntity.id } as any) as any\n    const companyEntityId = profile?.companyEntityId as string | undefined\n\n    const updates: Record<string, unknown> = { personEntityId: matchingEntity.id }\n    if (companyEntityId) {\n      updates.customerEntityId = companyEntityId\n    }\n\n    await em.nativeUpdate(CustomerUser, { id: userId }, updates)\n  } catch (err) {\n    logger.error('Failed to link customer user to CRM person', { err })\n  }\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,eAAO,OACL,SACA,KACe;AACf,QAAM,OAAO;AACb,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAC7B,MAAI,CAAC,UAAU,CAAC,SAAU;AAE1B,QAAM,KAAK,IAAI,QAAuB,IAAI;AAE1C,MAAI;AACF,UAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,UAAU,eAAe,CAAC;AAC7I,QAAI,CAAC,KAAM;AACX,QAAI,KAAK,eAAgB;AAEzB,UAAM,SAAS,MAAM,QAAS,KAAK,QAAmB,KAAK,QAAQ,YAAY,EAAE,KAAK;AACtF,QAAI,CAAC,MAAO;AAEZ,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAE5F,UAAM,iBAAiB,MAAM;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MAC5C,EAAE,OAAO,IAAI;AAAA,MACb,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,iBAAiB,eAAe;AAAA,MACpC,CAAC,MAAW,EAAE,gBAAgB,EAAE,aAAa,YAAY,EAAE,KAAK,MAAM;AAAA,IACxE;AAEA,QAAI,CAAC,eAAgB;AAErB,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,oDAAoD;AACnG,UAAM,UAAU,MAAM,GAAG,QAAQ,uBAA8B,EAAE,QAAQ,eAAe,GAAG,CAAQ;AACnG,UAAM,kBAAkB,SAAS;AAEjC,UAAM,UAAmC,EAAE,gBAAgB,eAAe,GAAG;AAC7E,QAAI,iBAAiB;AACnB,cAAQ,mBAAmB;AAAA,IAC7B;AAEA,UAAM,GAAG,aAAa,cAAc,EAAE,IAAI,OAAO,GAAG,OAAO;AAAA,EAC7D,SAAS,KAAK;AACZ,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'auto-link-crm' })\n\nexport const metadata = {\n  event: 'customer_accounts.user.created',\n  persistent: true,\n  id: 'customer_accounts:auto-link-crm',\n}\n\nexport default async function handle(\n  payload: unknown,\n  ctx: { resolve: <T = unknown>(name: string) => T; eventName?: string },\n): Promise<void> {\n  const data = payload as Record<string, unknown>\n  const userId = data?.id as string\n  const tenantId = data?.tenantId as string\n  const organizationId = data?.organizationId as string | undefined\n  if (!userId || !tenantId) return\n\n  const em = ctx.resolve<EntityManager>('em')\n\n  try {\n    const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, undefined, { tenantId, organizationId })\n    if (!user) return\n\n    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n\n    // Every lookup and write below normalizes against the user's OWN org, not just\n    // the tenant: customerEntityId is the portal's company scope key (portal user\n    // and invite routes filter on it), so adopting an entity from another org would\n    // widen the user's portal access instead of repairing it.\n    const ownScope = { tenantId, organizationId: user.organizationId }\n\n    // Defensive normalization for NEW users only \u2014 this subscriber runs on\n    // `customer_accounts.user.created`, which is never re-emitted for an existing\n    // row. customerEntityId is the CRM company FK, and earlier invite flows (#4362)\n    // could poison it with a person entity id, which then breaks every later user\n    // edit (\"Company not found\"). If the linked entity is a person (not a company)\n    // or sits outside the user's org, drop it \u2014 or recover the person's real company\n    // from their profile. Correct company links are left untouched. Rows created\n    // before this change keep their bad FK; see #4473 for the backfill.\n    if (user.customerEntityId) {\n      const linked = await findOneWithDecryption(\n        em,\n        CustomerEntity,\n        { id: user.customerEntityId, tenantId, organizationId: user.organizationId, deletedAt: null } as any,\n        undefined,\n        { tenantId, organizationId },\n      ) as any\n      if (!linked) {\n        // Not resolvable inside the user's own org \u2014 a cross-org (or deleted)\n        // entity. Clear it rather than leave it: this FK is the portal scope key.\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: null },\n        )\n        user.customerEntityId = null\n      } else if (linked.kind === 'person') {\n        // Only adopt a recovered company that is itself in the user's org.\n        const replacement = await resolveOwnedCompanyForPerson(em, user.customerEntityId, ownScope)\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: replacement },\n        )\n        user.customerEntityId = replacement\n      }\n    }\n\n    // A user invited from a CRM person card arrives with personEntityId already\n    // set, so the email-matching path below never runs for it. Derive the company\n    // FK from that person's own profile instead of leaving it null forever \u2014 the\n    // portal Users page, portal invitations, and the company detail \"Portal users\"\n    // group all key off customerEntityId (#4362).\n    if (user.personEntityId) {\n      if (user.customerEntityId) return\n      const recovered = await resolveOwnedCompanyForPerson(em, user.personEntityId, ownScope)\n      if (recovered) {\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: recovered },\n        )\n      }\n      return\n    }\n\n    const email = (data?.email ? (data.email as string) : user.email)?.toLowerCase().trim()\n    if (!email) return\n\n    // Scope the candidate lookup to the user's own org. The fifth argument is a\n    // decryption scope, not a filter, so without organizationId in the `where`\n    // this matches people across every org in the tenant and writes a cross-org\n    // link that the normalization block above just cleared.\n    const personEntities = await findWithDecryption(\n      em,\n      CustomerEntity,\n      { tenantId, organizationId: user.organizationId, kind: 'person', deletedAt: null } as any,\n      { limit: 500 } as any,\n      { tenantId, organizationId },\n    )\n\n    const matchingEntity = personEntities.find(\n      (e: any) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email,\n    ) as any\n\n    if (!matchingEntity) return\n\n    const companyEntityId = await resolveOwnedCompanyForPerson(em, matchingEntity.id, ownScope)\n\n    const updates: Record<string, unknown> = { personEntityId: matchingEntity.id }\n    if (companyEntityId) {\n      updates.customerEntityId = companyEntityId\n    }\n\n    await em.nativeUpdate(\n      CustomerUser,\n      { id: userId, tenantId, organizationId: user.organizationId },\n      updates,\n    )\n  } catch (err) {\n    logger.error('Failed to link customer user to CRM person', { err })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,eAAO,OACL,SACA,KACe;AACf,QAAM,OAAO;AACb,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAC7B,MAAI,CAAC,UAAU,CAAC,SAAU;AAE1B,QAAM,KAAK,IAAI,QAAuB,IAAI;AAE1C,MAAI;AACF,UAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,UAAU,eAAe,CAAC;AAC7I,QAAI,CAAC,KAAM;AAEX,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAM5F,UAAM,WAAW,EAAE,UAAU,gBAAgB,KAAK,eAAe;AAUjE,QAAI,KAAK,kBAAkB;AACzB,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,kBAAkB,UAAU,gBAAgB,KAAK,gBAAgB,WAAW,KAAK;AAAA,QAC5F;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,QAAQ;AAGX,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,KAAK;AAAA,QAC3B;AACA,aAAK,mBAAmB;AAAA,MAC1B,WAAW,OAAO,SAAS,UAAU;AAEnC,cAAM,cAAc,MAAM,6BAA6B,IAAI,KAAK,kBAAkB,QAAQ;AAC1F,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,YAAY;AAAA,QAClC;AACA,aAAK,mBAAmB;AAAA,MAC1B;AAAA,IACF;AAOA,QAAI,KAAK,gBAAgB;AACvB,UAAI,KAAK,iBAAkB;AAC3B,YAAM,YAAY,MAAM,6BAA6B,IAAI,KAAK,gBAAgB,QAAQ;AACtF,UAAI,WAAW;AACb,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,UAAU;AAAA,QAChC;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,QAAS,KAAK,QAAmB,KAAK,QAAQ,YAAY,EAAE,KAAK;AACtF,QAAI,CAAC,MAAO;AAMZ,UAAM,iBAAiB,MAAM;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,gBAAgB,KAAK,gBAAgB,MAAM,UAAU,WAAW,KAAK;AAAA,MACjF,EAAE,OAAO,IAAI;AAAA,MACb,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,iBAAiB,eAAe;AAAA,MACpC,CAAC,MAAW,EAAE,gBAAgB,EAAE,aAAa,YAAY,EAAE,KAAK,MAAM;AAAA,IACxE;AAEA,QAAI,CAAC,eAAgB;AAErB,UAAM,kBAAkB,MAAM,6BAA6B,IAAI,eAAe,IAAI,QAAQ;AAE1F,UAAM,UAAmC,EAAE,gBAAgB,eAAe,GAAG;AAC7E,QAAI,iBAAiB;AACnB,cAAQ,mBAAmB;AAAA,IAC7B;AAEA,UAAM,GAAG;AAAA,MACP;AAAA,MACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,MAC5D;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/widgets/injection/account-status/widget.client.js

@@ -94,7 +94,7 @@ function InviteForm({ personEntityId, onSuccess }) {
     try {
       await runMutation({
         context: { entityType: "customer_accounts:user" },
-        mutationPayload: { customerEntityId: personEntityId, roleIds: selectedRoleIds },
+        mutationPayload: { personEntityId, roleIds: selectedRoleIds },
         operation: async () => {
           const call = await apiCall(
             "/api/customer_accounts/admin/users-invite",
@@ -105,7 +105,7 @@ function InviteForm({ personEntityId, onSuccess }) {
                 email: trimmedEmail,
                 roleIds: selectedRoleIds,
                 displayName: displayName.trim() || void 0,
-                customerEntityId: personEntityId
+                personEntityId
               })
             }
           );

package/dist/modules/customer_accounts/widgets/injection/account-status/widget.client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/widgets/injection/account-status/widget.client.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport React from 'react'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { StatusBadge } from '@open-mercato/ui/primitives/status-badge'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\ninterface AccountStatusData {\n  id: string\n  email: string\n  isActive: boolean\n  emailVerified: boolean\n  lastLoginAt: string | null\n}\n\ninterface AccountStatusProps {\n  context?: {\n    entityId?: string\n    recordId?: string\n  }\n}\n\ninterface RoleOption {\n  id: string\n  name: string\n}\n\ninterface PersonData {\n  person?: {\n    primaryEmail?: string | null\n    displayName?: string | null\n  }\n  profile?: {\n    firstName?: string | null\n    lastName?: string | null\n  } | null\n}\n\nfunction InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onSuccess: () => void }) {\n  const t = useT()\n  const [isLoadingPerson, setIsLoadingPerson] = React.useState(true)\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [availableRoles, setAvailableRoles] = React.useState<RoleOption[]>([])\n  const [isLoadingRoles, setIsLoadingRoles] = React.useState(true)\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const { runMutation } = useGuardedMutation<{ entityType: string }>({\n    contextId: 'customer_accounts:account-status-invite',\n  })\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadPerson() {\n      try {\n        const call = await apiCall<PersonData>(\n          `/api/customers/people/${encodeURIComponent(personEntityId)}`,\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const person = call.result.person\n          const profile = call.result.profile\n          if (person?.primaryEmail) {\n            setEmail(person.primaryEmail)\n          }\n          const nameParts = [profile?.firstName, profile?.lastName].filter(Boolean)\n          if (nameParts.length > 0) {\n            setDisplayName(nameParts.join(' '))\n          } else if (person?.displayName) {\n            setDisplayName(person.displayName)\n          }\n        }\n      } catch {\n        /* ignore - fields will remain empty for manual entry */\n      } finally {\n        if (!cancelled) setIsLoadingPerson(false)\n      }\n    }\n    loadPerson()\n    return () => { cancelled = true }\n  }, [personEntityId])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadRoles() {\n      try {\n        const call = await apiCall<{ items?: RoleOption[] }>(\n          '/api/customer_accounts/admin/roles?pageSize=100',\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const items = Array.isArray(call.result.items) ? call.result.items : []\n          setAvailableRoles(items.map((role) => ({ id: role.id, name: role.name })))\n        }\n      } catch {\n        /* ignore */\n      } finally {\n        if (!cancelled) setIsLoadingRoles(false)\n      }\n    }\n    loadRoles()\n    return () => { cancelled = true }\n  }, [])\n\n  function toggleRole(roleId: string) {\n    setSelectedRoleIds((prev) =>\n      prev.includes(roleId) ? prev.filter((id) => id !== roleId) : [...prev, roleId],\n    )\n  }\n\n  async function handleSubmit() {\n    const trimmedEmail = email.trim()\n    if (!trimmedEmail) {\n      flash(t('customer_accounts.widgets.invite.error.emailRequired', 'Email is required'), 'error')\n      return\n    }\n    if (selectedRoleIds.length === 0) {\n      flash(t('customer_accounts.widgets.invite.error.roleRequired', 'At least one role must be selected'), 'error')\n      return\n    }\n\n    setIsSubmitting(true)\n    try {\n      await runMutation({\n        context: { entityType: 'customer_accounts:user' },\n        mutationPayload: { customerEntityId: personEntityId, roleIds: selectedRoleIds },\n        operation: async () => {\n          // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit\n          const call = await apiCall<{ ok: boolean; error?: string }>(\n            '/api/customer_accounts/admin/users-invite',\n            {\n              method: 'POST',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({\n                email: trimmedEmail,\n                roleIds: selectedRoleIds,\n                displayName: displayName.trim() || undefined,\n                customerEntityId: personEntityId,\n              }),\n            },\n          )\n\n          if (!call.ok) {\n            const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined\n            flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n            return\n          }\n\n          flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')\n          onSuccess()\n        },\n      })\n    } catch {\n      flash(t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }\n\n  const isLoading = isLoadingPerson || isLoadingRoles\n\n  if (isLoading) {\n    return (\n      <div className=\"text-sm text-muted-foreground py-2\">\n        {t('common.loading', 'Loading...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3 mt-2\">\n      <div>\n        <label htmlFor=\"invite-email\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('common.email', 'Email')}\n        </label>\n        <EmailInput\n          id=\"invite-email\"\n          size=\"sm\"\n          value={email}\n          onChange={(event) => setEmail(event.target.value)}\n          required\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <label htmlFor=\"invite-display-name\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('customer_accounts.widgets.invite.displayName', 'Display Name')}\n        </label>\n        <Input\n          id=\"invite-display-name\"\n          type=\"text\"\n          size=\"sm\"\n          value={displayName}\n          onChange={(event) => setDisplayName(event.target.value)}\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <div className=\"text-xs font-medium text-muted-foreground mb-1.5\">\n          {t('customer_accounts.widgets.invite.roles', 'Roles')}\n        </div>\n        {availableRoles.length === 0 ? (\n          <div className=\"text-xs text-muted-foreground\">\n            {t('customer_accounts.widgets.invite.noRoles', 'No roles available')}\n          </div>\n        ) : (\n          <div className=\"flex flex-wrap gap-1.5\">\n            {availableRoles.map((role) => (\n              <Button\n                key={role.id}\n                type=\"button\"\n                variant={selectedRoleIds.includes(role.id) ? 'default' : 'outline'}\n                size=\"sm\"\n                onClick={() => toggleRole(role.id)}\n                disabled={isSubmitting}\n                className=\"text-xs h-7\"\n              >\n                {role.name}\n              </Button>\n            ))}\n          </div>\n        )}\n      </div>\n\n      <div className=\"flex justify-end gap-2 pt-1\">\n        <Button\n          type=\"button\"\n          size=\"sm\"\n          onClick={handleSubmit}\n          disabled={isSubmitting || !email.trim() || selectedRoleIds.length === 0}\n        >\n          {isSubmitting\n            ? t('common.loading', 'Loading...')\n            : t('customer_accounts.widgets.invite.submit', 'Send Invitation')}\n        </Button>\n      </div>\n    </div>\n  )\n}\n\nexport default function AccountStatusWidget({ context }: AccountStatusProps) {\n  const t = useT()\n  const queryClient = useQueryClient()\n  const personEntityId = context?.recordId\n  const [showInviteForm, setShowInviteForm] = React.useState(false)\n\n  const { data, isLoading } = useQuery({\n    queryKey: ['customer-account-status', personEntityId],\n    queryFn: async (): Promise<AccountStatusData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall(`/api/customer_accounts/admin/users?personEntityId=${personEntityId}&pageSize=1`)\n      if (!result.ok) return null\n      const json = result.result as Record<string, unknown> | null\n      const items = json?.items as AccountStatusData[] | undefined\n      return items?.[0] || null\n    },\n    enabled: !!personEntityId,\n  })\n\n  function handleInviteSuccess() {\n    setShowInviteForm(false)\n    queryClient.invalidateQueries({ queryKey: ['customer-account-status', personEntityId] })\n  }\n\n  if (isLoading) {\n    return <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n  }\n\n  if (!data) {\n    return (\n      <div className=\"rounded-md border p-3\">\n        <div className=\"text-sm font-medium mb-1\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n        <div className=\"text-sm text-muted-foreground\">{t('customer_accounts.widgets.noAccount', 'No portal account linked')}</div>\n        {!showInviteForm && personEntityId && (\n          <div className=\"mt-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => setShowInviteForm(true)}\n            >\n              {t('customer_accounts.widgets.invite.button', 'Invite to Portal')}\n            </Button>\n          </div>\n        )}\n        {showInviteForm && personEntityId && (\n          <InviteForm personEntityId={personEntityId} onSuccess={handleInviteSuccess} />\n        )}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"rounded-md border p-3\">\n      <div className=\"text-sm font-medium mb-2\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n      <div className=\"space-y-1 text-sm\">\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n          <StatusBadge variant={data.isActive ? 'success' : 'error'} dot>\n            {data.isActive ? t('common.active', 'Active') : t('common.inactive', 'Inactive')}\n          </StatusBadge>\n        </div>\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n          <span>{data.email}</span>\n        </div>\n        {data.emailVerified !== undefined && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.emailVerified', 'Email Verified')}</span>\n            <span>{data.emailVerified ? '\u2713' : '\u2717'}</span>\n          </div>\n        )}\n        {data.lastLoginAt && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.lastLogin', 'Last Login')}</span>\n            <span>{new Date(data.lastLoginAt).toLocaleDateString()}</span>\n          </div>\n        )}\n      </div>\n      <div className=\"mt-2\">\n        <a\n          href={`/backend/customer_accounts/users/${data.id}`}\n          className=\"text-xs text-primary hover:underline\"\n        >\n          {t('customer_accounts.widgets.viewAccount', 'View account details \u2192')}\n        </a>\n      </div>\n    </div>\n  )\n}\n"],
-  "mappings": ";AA0KM,cAQA,YARA;AAxKN,OAAO,WAAW;AAClB,SAAS,UAAU,sBAAsB;AACzC,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAiCtB,SAAS,WAAW,EAAE,gBAAgB,UAAU,GAAsD;AACpG,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,IAAI;AACjE,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC3E,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,IAAI;AAC/D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,EAAE,YAAY,IAAI,mBAA2C;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,aAAa;AAC1B,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB,yBAAyB,mBAAmB,cAAc,CAAC;AAAA,QAC7D;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,SAAS,KAAK,OAAO;AAC3B,gBAAM,UAAU,KAAK,OAAO;AAC5B,cAAI,QAAQ,cAAc;AACxB,qBAAS,OAAO,YAAY;AAAA,UAC9B;AACA,gBAAM,YAAY,CAAC,SAAS,WAAW,SAAS,QAAQ,EAAE,OAAO,OAAO;AACxE,cAAI,UAAU,SAAS,GAAG;AACxB,2BAAe,UAAU,KAAK,GAAG,CAAC;AAAA,UACpC,WAAW,QAAQ,aAAa;AAC9B,2BAAe,OAAO,WAAW;AAAA,UACnC;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,oBAAmB,KAAK;AAAA,MAC1C;AAAA,IACF;AACA,eAAW;AACX,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,QAAQ,MAAM,QAAQ,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACtE,4BAAkB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,mBAAkB,KAAK;AAAA,MACzC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW,QAAgB;AAClC;AAAA,MAAmB,CAAC,SAClB,KAAK,SAAS,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,IAC/E;AAAA,EACF;AAEA,iBAAe,eAAe;AAC5B,UAAM,eAAe,MAAM,KAAK;AAChC,QAAI,CAAC,cAAc;AACjB,YAAM,EAAE,wDAAwD,mBAAmB,GAAG,OAAO;AAC7F;AAAA,IACF;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,EAAE,uDAAuD,oCAAoC,GAAG,OAAO;AAC7G;AAAA,IACF;AAEA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,SAAS,EAAE,YAAY,yBAAyB;AAAA,QAChD,iBAAiB,EAAE,kBAAkB,gBAAgB,SAAS,gBAAgB;AAAA,QAC9E,WAAW,YAAY;AAErB,gBAAM,OAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,OAAO;AAAA,gBACP,SAAS;AAAA,gBACT,aAAa,YAAY,KAAK,KAAK;AAAA,gBACnC,kBAAkB;AAAA,cACpB,CAAC;AAAA,YACH;AAAA,UACF;AAEA,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,eAAgB,KAAK,QAA2C;AACtE,kBAAM,gBAAgB,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAC9G;AAAA,UACF;AAEA,gBAAM,EAAE,4CAA4C,8BAA8B,GAAG,SAAS;AAC9F,oBAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAAA,IAChG,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB;AAErC,MAAI,WAAW;AACb,WACE,oBAAC,SAAI,WAAU,sCACZ,YAAE,kBAAkB,YAAY,GACnC;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,kBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,gBAAe,WAAU,wDACrC,YAAE,gBAAgB,OAAO,GAC5B;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,UAChD,UAAQ;AAAA,UACR,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,uBAAsB,WAAU,wDAC5C,YAAE,gDAAgD,cAAc,GACnE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,UACtD,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,SAAI,WAAU,oDACZ,YAAE,0CAA0C,OAAO,GACtD;AAAA,MACC,eAAe,WAAW,IACzB,oBAAC,SAAI,WAAU,iCACZ,YAAE,4CAA4C,oBAAoB,GACrE,IAEA,oBAAC,SAAI,WAAU,0BACZ,yBAAe,IAAI,CAAC,SACnB;AAAA,QAAC;AAAA;AAAA,UAEC,MAAK;AAAA,UACL,SAAS,gBAAgB,SAAS,KAAK,EAAE,IAAI,YAAY;AAAA,UACzD,MAAK;AAAA,UACL,SAAS,MAAM,WAAW,KAAK,EAAE;AAAA,UACjC,UAAU;AAAA,UACV,WAAU;AAAA,UAET,eAAK;AAAA;AAAA,QARD,KAAK;AAAA,MASZ,CACD,GACH;AAAA,OAEJ;AAAA,IAEA,oBAAC,SAAI,WAAU,+BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS;AAAA,QACT,UAAU,gBAAgB,CAAC,MAAM,KAAK,KAAK,gBAAgB,WAAW;AAAA,QAErE,yBACG,EAAE,kBAAkB,YAAY,IAChC,EAAE,2CAA2C,iBAAiB;AAAA;AAAA,IACpE,GACF;AAAA,KACF;AAEJ;AAEe,SAAR,oBAAqC,EAAE,QAAQ,GAAuB;AAC3E,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,eAAe;AACnC,QAAM,iBAAiB,SAAS;AAChC,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,KAAK;AAEhE,QAAM,EAAE,MAAM,UAAU,IAAI,SAAS;AAAA,IACnC,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAA+C;AACtD,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM,QAAQ,qDAAqD,cAAc,aAAa;AAC7G,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO,QAAQ,CAAC,KAAK;AAAA,IACvB;AAAA,IACA,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AAED,WAAS,sBAAsB;AAC7B,sBAAkB,KAAK;AACvB,gBAAY,kBAAkB,EAAE,UAAU,CAAC,2BAA2B,cAAc,EAAE,CAAC;AAAA,EACzF;AAEA,MAAI,WAAW;AACb,WAAO,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE;AAAA,EAC3F;AAEA,MAAI,CAAC,MAAM;AACT,WACE,qBAAC,SAAI,WAAU,yBACb;AAAA,0BAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,MAC1G,oBAAC,SAAI,WAAU,iCAAiC,YAAE,uCAAuC,0BAA0B,GAAE;AAAA,MACpH,CAAC,kBAAkB,kBAClB,oBAAC,SAAI,WAAU,QACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,kBAAkB,IAAI;AAAA,UAEpC,YAAE,2CAA2C,kBAAkB;AAAA;AAAA,MAClE,GACF;AAAA,MAED,kBAAkB,kBACjB,oBAAC,cAAW,gBAAgC,WAAW,qBAAqB;AAAA,OAEhF;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,yBACb;AAAA,wBAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,IAC1G,qBAAC,SAAI,WAAU,qBACb;AAAA,2BAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,QACtE,oBAAC,eAAY,SAAS,KAAK,WAAW,YAAY,SAAS,KAAG,MAC3D,eAAK,WAAW,EAAE,iBAAiB,QAAQ,IAAI,EAAE,mBAAmB,UAAU,GACjF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,QACpE,oBAAC,UAAM,eAAK,OAAM;AAAA,SACpB;AAAA,MACC,KAAK,kBAAkB,UACtB,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,QACxG,oBAAC,UAAM,eAAK,gBAAgB,WAAM,UAAI;AAAA,SACxC;AAAA,MAED,KAAK,eACJ,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,uCAAuC,YAAY,GAAE;AAAA,QAChG,oBAAC,UAAM,cAAI,KAAK,KAAK,WAAW,EAAE,mBAAmB,GAAE;AAAA,SACzD;AAAA,OAEJ;AAAA,IACA,oBAAC,SAAI,WAAU,QACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oCAAoC,KAAK,EAAE;AAAA,QACjD,WAAU;AAAA,QAET,YAAE,yCAAyC,6BAAwB;AAAA;AAAA,IACtE,GACF;AAAA,KACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport React from 'react'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { StatusBadge } from '@open-mercato/ui/primitives/status-badge'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\ninterface AccountStatusData {\n  id: string\n  email: string\n  isActive: boolean\n  emailVerified: boolean\n  lastLoginAt: string | null\n}\n\ninterface AccountStatusProps {\n  context?: {\n    entityId?: string\n    recordId?: string\n  }\n}\n\ninterface RoleOption {\n  id: string\n  name: string\n}\n\ninterface PersonData {\n  person?: {\n    primaryEmail?: string | null\n    displayName?: string | null\n  }\n  profile?: {\n    firstName?: string | null\n    lastName?: string | null\n  } | null\n}\n\nfunction InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onSuccess: () => void }) {\n  const t = useT()\n  const [isLoadingPerson, setIsLoadingPerson] = React.useState(true)\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [availableRoles, setAvailableRoles] = React.useState<RoleOption[]>([])\n  const [isLoadingRoles, setIsLoadingRoles] = React.useState(true)\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const { runMutation } = useGuardedMutation<{ entityType: string }>({\n    contextId: 'customer_accounts:account-status-invite',\n  })\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadPerson() {\n      try {\n        const call = await apiCall<PersonData>(\n          `/api/customers/people/${encodeURIComponent(personEntityId)}`,\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const person = call.result.person\n          const profile = call.result.profile\n          if (person?.primaryEmail) {\n            setEmail(person.primaryEmail)\n          }\n          const nameParts = [profile?.firstName, profile?.lastName].filter(Boolean)\n          if (nameParts.length > 0) {\n            setDisplayName(nameParts.join(' '))\n          } else if (person?.displayName) {\n            setDisplayName(person.displayName)\n          }\n        }\n      } catch {\n        /* ignore - fields will remain empty for manual entry */\n      } finally {\n        if (!cancelled) setIsLoadingPerson(false)\n      }\n    }\n    loadPerson()\n    return () => { cancelled = true }\n  }, [personEntityId])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadRoles() {\n      try {\n        const call = await apiCall<{ items?: RoleOption[] }>(\n          '/api/customer_accounts/admin/roles?pageSize=100',\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const items = Array.isArray(call.result.items) ? call.result.items : []\n          setAvailableRoles(items.map((role) => ({ id: role.id, name: role.name })))\n        }\n      } catch {\n        /* ignore */\n      } finally {\n        if (!cancelled) setIsLoadingRoles(false)\n      }\n    }\n    loadRoles()\n    return () => { cancelled = true }\n  }, [])\n\n  function toggleRole(roleId: string) {\n    setSelectedRoleIds((prev) =>\n      prev.includes(roleId) ? prev.filter((id) => id !== roleId) : [...prev, roleId],\n    )\n  }\n\n  async function handleSubmit() {\n    const trimmedEmail = email.trim()\n    if (!trimmedEmail) {\n      flash(t('customer_accounts.widgets.invite.error.emailRequired', 'Email is required'), 'error')\n      return\n    }\n    if (selectedRoleIds.length === 0) {\n      flash(t('customer_accounts.widgets.invite.error.roleRequired', 'At least one role must be selected'), 'error')\n      return\n    }\n\n    setIsSubmitting(true)\n    try {\n      await runMutation({\n        context: { entityType: 'customer_accounts:user' },\n        mutationPayload: { personEntityId, roleIds: selectedRoleIds },\n        operation: async () => {\n          // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit\n          const call = await apiCall<{ ok: boolean; error?: string }>(\n            '/api/customer_accounts/admin/users-invite',\n            {\n              method: 'POST',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({\n                email: trimmedEmail,\n                roleIds: selectedRoleIds,\n                displayName: displayName.trim() || undefined,\n                personEntityId,\n              }),\n            },\n          )\n\n          if (!call.ok) {\n            const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined\n            flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n            return\n          }\n\n          flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')\n          onSuccess()\n        },\n      })\n    } catch {\n      flash(t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }\n\n  const isLoading = isLoadingPerson || isLoadingRoles\n\n  if (isLoading) {\n    return (\n      <div className=\"text-sm text-muted-foreground py-2\">\n        {t('common.loading', 'Loading...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3 mt-2\">\n      <div>\n        <label htmlFor=\"invite-email\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('common.email', 'Email')}\n        </label>\n        <EmailInput\n          id=\"invite-email\"\n          size=\"sm\"\n          value={email}\n          onChange={(event) => setEmail(event.target.value)}\n          required\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <label htmlFor=\"invite-display-name\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('customer_accounts.widgets.invite.displayName', 'Display Name')}\n        </label>\n        <Input\n          id=\"invite-display-name\"\n          type=\"text\"\n          size=\"sm\"\n          value={displayName}\n          onChange={(event) => setDisplayName(event.target.value)}\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <div className=\"text-xs font-medium text-muted-foreground mb-1.5\">\n          {t('customer_accounts.widgets.invite.roles', 'Roles')}\n        </div>\n        {availableRoles.length === 0 ? (\n          <div className=\"text-xs text-muted-foreground\">\n            {t('customer_accounts.widgets.invite.noRoles', 'No roles available')}\n          </div>\n        ) : (\n          <div className=\"flex flex-wrap gap-1.5\">\n            {availableRoles.map((role) => (\n              <Button\n                key={role.id}\n                type=\"button\"\n                variant={selectedRoleIds.includes(role.id) ? 'default' : 'outline'}\n                size=\"sm\"\n                onClick={() => toggleRole(role.id)}\n                disabled={isSubmitting}\n                className=\"text-xs h-7\"\n              >\n                {role.name}\n              </Button>\n            ))}\n          </div>\n        )}\n      </div>\n\n      <div className=\"flex justify-end gap-2 pt-1\">\n        <Button\n          type=\"button\"\n          size=\"sm\"\n          onClick={handleSubmit}\n          disabled={isSubmitting || !email.trim() || selectedRoleIds.length === 0}\n        >\n          {isSubmitting\n            ? t('common.loading', 'Loading...')\n            : t('customer_accounts.widgets.invite.submit', 'Send Invitation')}\n        </Button>\n      </div>\n    </div>\n  )\n}\n\nexport default function AccountStatusWidget({ context }: AccountStatusProps) {\n  const t = useT()\n  const queryClient = useQueryClient()\n  const personEntityId = context?.recordId\n  const [showInviteForm, setShowInviteForm] = React.useState(false)\n\n  const { data, isLoading } = useQuery({\n    queryKey: ['customer-account-status', personEntityId],\n    queryFn: async (): Promise<AccountStatusData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall(`/api/customer_accounts/admin/users?personEntityId=${personEntityId}&pageSize=1`)\n      if (!result.ok) return null\n      const json = result.result as Record<string, unknown> | null\n      const items = json?.items as AccountStatusData[] | undefined\n      return items?.[0] || null\n    },\n    enabled: !!personEntityId,\n  })\n\n  function handleInviteSuccess() {\n    setShowInviteForm(false)\n    queryClient.invalidateQueries({ queryKey: ['customer-account-status', personEntityId] })\n  }\n\n  if (isLoading) {\n    return <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n  }\n\n  if (!data) {\n    return (\n      <div className=\"rounded-md border p-3\">\n        <div className=\"text-sm font-medium mb-1\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n        <div className=\"text-sm text-muted-foreground\">{t('customer_accounts.widgets.noAccount', 'No portal account linked')}</div>\n        {!showInviteForm && personEntityId && (\n          <div className=\"mt-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => setShowInviteForm(true)}\n            >\n              {t('customer_accounts.widgets.invite.button', 'Invite to Portal')}\n            </Button>\n          </div>\n        )}\n        {showInviteForm && personEntityId && (\n          <InviteForm personEntityId={personEntityId} onSuccess={handleInviteSuccess} />\n        )}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"rounded-md border p-3\">\n      <div className=\"text-sm font-medium mb-2\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n      <div className=\"space-y-1 text-sm\">\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n          <StatusBadge variant={data.isActive ? 'success' : 'error'} dot>\n            {data.isActive ? t('common.active', 'Active') : t('common.inactive', 'Inactive')}\n          </StatusBadge>\n        </div>\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n          <span>{data.email}</span>\n        </div>\n        {data.emailVerified !== undefined && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.emailVerified', 'Email Verified')}</span>\n            <span>{data.emailVerified ? '\u2713' : '\u2717'}</span>\n          </div>\n        )}\n        {data.lastLoginAt && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.lastLogin', 'Last Login')}</span>\n            <span>{new Date(data.lastLoginAt).toLocaleDateString()}</span>\n          </div>\n        )}\n      </div>\n      <div className=\"mt-2\">\n        <a\n          href={`/backend/customer_accounts/users/${data.id}`}\n          className=\"text-xs text-primary hover:underline\"\n        >\n          {t('customer_accounts.widgets.viewAccount', 'View account details \u2192')}\n        </a>\n      </div>\n    </div>\n  )\n}\n"],
+  "mappings": ";AA0KM,cAQA,YARA;AAxKN,OAAO,WAAW;AAClB,SAAS,UAAU,sBAAsB;AACzC,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAiCtB,SAAS,WAAW,EAAE,gBAAgB,UAAU,GAAsD;AACpG,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAS,IAAI;AACjE,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC3E,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,IAAI;AAC/D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,EAAE,YAAY,IAAI,mBAA2C;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,aAAa;AAC1B,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB,yBAAyB,mBAAmB,cAAc,CAAC;AAAA,QAC7D;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,SAAS,KAAK,OAAO;AAC3B,gBAAM,UAAU,KAAK,OAAO;AAC5B,cAAI,QAAQ,cAAc;AACxB,qBAAS,OAAO,YAAY;AAAA,UAC9B;AACA,gBAAM,YAAY,CAAC,SAAS,WAAW,SAAS,QAAQ,EAAE,OAAO,OAAO;AACxE,cAAI,UAAU,SAAS,GAAG;AACxB,2BAAe,UAAU,KAAK,GAAG,CAAC;AAAA,UACpC,WAAW,QAAQ,aAAa;AAC9B,2BAAe,OAAO,WAAW;AAAA,UACnC;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,oBAAmB,KAAK;AAAA,MAC1C;AAAA,IACF;AACA,eAAW;AACX,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,cAAc,CAAC;AAEnB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,QAAQ,MAAM,QAAQ,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACtE,4BAAkB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,mBAAkB,KAAK;AAAA,MACzC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW,QAAgB;AAClC;AAAA,MAAmB,CAAC,SAClB,KAAK,SAAS,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,IAC/E;AAAA,EACF;AAEA,iBAAe,eAAe;AAC5B,UAAM,eAAe,MAAM,KAAK;AAChC,QAAI,CAAC,cAAc;AACjB,YAAM,EAAE,wDAAwD,mBAAmB,GAAG,OAAO;AAC7F;AAAA,IACF;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,EAAE,uDAAuD,oCAAoC,GAAG,OAAO;AAC7G;AAAA,IACF;AAEA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,SAAS,EAAE,YAAY,yBAAyB;AAAA,QAChD,iBAAiB,EAAE,gBAAgB,SAAS,gBAAgB;AAAA,QAC5D,WAAW,YAAY;AAErB,gBAAM,OAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,OAAO;AAAA,gBACP,SAAS;AAAA,gBACT,aAAa,YAAY,KAAK,KAAK;AAAA,gBACnC;AAAA,cACF,CAAC;AAAA,YACH;AAAA,UACF;AAEA,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,eAAgB,KAAK,QAA2C;AACtE,kBAAM,gBAAgB,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAC9G;AAAA,UACF;AAEA,gBAAM,EAAE,4CAA4C,8BAA8B,GAAG,SAAS;AAC9F,oBAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAAA,IAChG,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB;AAErC,MAAI,WAAW;AACb,WACE,oBAAC,SAAI,WAAU,sCACZ,YAAE,kBAAkB,YAAY,GACnC;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,kBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,gBAAe,WAAU,wDACrC,YAAE,gBAAgB,OAAO,GAC5B;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,UAChD,UAAQ;AAAA,UACR,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,uBAAsB,WAAU,wDAC5C,YAAE,gDAAgD,cAAc,GACnE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,UACtD,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,SAAI,WAAU,oDACZ,YAAE,0CAA0C,OAAO,GACtD;AAAA,MACC,eAAe,WAAW,IACzB,oBAAC,SAAI,WAAU,iCACZ,YAAE,4CAA4C,oBAAoB,GACrE,IAEA,oBAAC,SAAI,WAAU,0BACZ,yBAAe,IAAI,CAAC,SACnB;AAAA,QAAC;AAAA;AAAA,UAEC,MAAK;AAAA,UACL,SAAS,gBAAgB,SAAS,KAAK,EAAE,IAAI,YAAY;AAAA,UACzD,MAAK;AAAA,UACL,SAAS,MAAM,WAAW,KAAK,EAAE;AAAA,UACjC,UAAU;AAAA,UACV,WAAU;AAAA,UAET,eAAK;AAAA;AAAA,QARD,KAAK;AAAA,MASZ,CACD,GACH;AAAA,OAEJ;AAAA,IAEA,oBAAC,SAAI,WAAU,+BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS;AAAA,QACT,UAAU,gBAAgB,CAAC,MAAM,KAAK,KAAK,gBAAgB,WAAW;AAAA,QAErE,yBACG,EAAE,kBAAkB,YAAY,IAChC,EAAE,2CAA2C,iBAAiB;AAAA;AAAA,IACpE,GACF;AAAA,KACF;AAEJ;AAEe,SAAR,oBAAqC,EAAE,QAAQ,GAAuB;AAC3E,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,eAAe;AACnC,QAAM,iBAAiB,SAAS;AAChC,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,KAAK;AAEhE,QAAM,EAAE,MAAM,UAAU,IAAI,SAAS;AAAA,IACnC,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAA+C;AACtD,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM,QAAQ,qDAAqD,cAAc,aAAa;AAC7G,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO,QAAQ,CAAC,KAAK;AAAA,IACvB;AAAA,IACA,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AAED,WAAS,sBAAsB;AAC7B,sBAAkB,KAAK;AACvB,gBAAY,kBAAkB,EAAE,UAAU,CAAC,2BAA2B,cAAc,EAAE,CAAC;AAAA,EACzF;AAEA,MAAI,WAAW;AACb,WAAO,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE;AAAA,EAC3F;AAEA,MAAI,CAAC,MAAM;AACT,WACE,qBAAC,SAAI,WAAU,yBACb;AAAA,0BAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,MAC1G,oBAAC,SAAI,WAAU,iCAAiC,YAAE,uCAAuC,0BAA0B,GAAE;AAAA,MACpH,CAAC,kBAAkB,kBAClB,oBAAC,SAAI,WAAU,QACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,kBAAkB,IAAI;AAAA,UAEpC,YAAE,2CAA2C,kBAAkB;AAAA;AAAA,MAClE,GACF;AAAA,MAED,kBAAkB,kBACjB,oBAAC,cAAW,gBAAgC,WAAW,qBAAqB;AAAA,OAEhF;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,yBACb;AAAA,wBAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,IAC1G,qBAAC,SAAI,WAAU,qBACb;AAAA,2BAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,QACtE,oBAAC,eAAY,SAAS,KAAK,WAAW,YAAY,SAAS,KAAG,MAC3D,eAAK,WAAW,EAAE,iBAAiB,QAAQ,IAAI,EAAE,mBAAmB,UAAU,GACjF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,QACpE,oBAAC,UAAM,eAAK,OAAM;AAAA,SACpB;AAAA,MACC,KAAK,kBAAkB,UACtB,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,QACxG,oBAAC,UAAM,eAAK,gBAAgB,WAAM,UAAI;AAAA,SACxC;AAAA,MAED,KAAK,eACJ,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,uCAAuC,YAAY,GAAE;AAAA,QAChG,oBAAC,UAAM,cAAI,KAAK,KAAK,WAAW,EAAE,mBAAmB,GAAE;AAAA,SACzD;AAAA,OAEJ;AAAA,IACA,oBAAC,SAAI,WAAU,QACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oCAAoC,KAAK,EAAE;AAAA,QACjD,WAAU;AAAA,QAET,YAAE,yCAAyC,6BAAwB;AAAA;AAAA,IACtE,GACF;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/widgets/injection/portal-ai-assistant-trigger/widget.client.js

@@ -25,7 +25,7 @@ function PortalAiAssistantTriggerWidget({ context }) {
   const t = useT();
   const [open, setOpen] = React.useState(false);
   const resolvedFeatures = Array.isArray(context?.resolvedFeatures) ? context?.resolvedFeatures : [];
-  const featureAllowed = context?.isPortalAdmin === true || hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE);
+  const featureAllowed = hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE);
   const pageContext = React.useMemo(() => ({
     view: "portal.profile",
     recordType: "customer",