@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/dist/helpers/integration/api.js

@@ -59,7 +59,8 @@ async function getAuthToken(request, roleOrEmail = "admin", password) {
 async function apiRequest(request, method, path, options) {
   const headers = {
     Authorization: `Bearer ${options.token}`,
-    "Content-Type": "application/json"
+    "Content-Type": "application/json",
+    ...options.headers ?? {}
   };
   const timeout = options.timeout ?? 3e4;
   let lastError = null;

package/dist/helpers/integration/api.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/api.ts"],
-  "sourcesContent": ["import { type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\n/**\n * Drops cached tokens so the next getAuthToken() mints a fresh session.\n *\n * A cached token points at a `sessions` row. Anything that deletes those rows \u2014\n * deactivating the user, a password change, an explicit session purge \u2014 leaves the\n * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither\n * retries nor re-mints. A spec that revokes sessions for an account other specs also\n * use MUST call this afterwards.\n */\nexport function clearAuthTokenCache(): void {\n  tokenCache.clear();\n}\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; data?: unknown; timeout?: number },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n  };\n  const timeout = options.timeout ?? 30_000;\n  let lastError: unknown = null;\n  for (let attempt = 0; attempt < 2; attempt += 1) {\n    try {\n      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });\n    } catch (error) {\n      lastError = error;\n      const message = error instanceof Error ? error.message : '';\n      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);\n      if (!retryable || attempt === 1) throw error;\n      await new Promise((resolve) => setTimeout(resolve, 250));\n    }\n  }\n  throw lastError;\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n"],
-  "mappings": "AACA,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAWxB,SAAS,sBAA4B;AAC1C,aAAW,MAAM;AACnB;AAEA,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,EAClB;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAqB;AACzB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,QAAI;AACF,aAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/F,SAAS,OAAO;AACd,kBAAY;AACZ,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,YAAY,0FAA0F,KAAK,OAAO;AACxH,UAAI,CAAC,aAAa,YAAY,EAAG,OAAM;AACvC,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;",
+  "sourcesContent": ["import { type APIRequestContext } from '@playwright/test';\nimport { DEFAULT_CREDENTIALS, type Role } from './auth';\n\nconst BASE_URL = process.env.BASE_URL?.trim() || null;\n\nfunction resolveUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path;\n}\n\n// Cached tokens per credential to dodge the login rate limit\n// (5 attempts/60s per email). Tokens are reused across tests in the same\n// Playwright worker; each worker still mints its own.\nconst tokenCache = new Map<string, { token: string; mintedAt: number }>();\nconst TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.\n\n/**\n * Drops cached tokens so the next getAuthToken() mints a fresh session.\n *\n * A cached token points at a `sessions` row. Anything that deletes those rows \u2014\n * deactivating the user, a password change, an explicit session purge \u2014 leaves the\n * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither\n * retries nor re-mints. A spec that revokes sessions for an account other specs also\n * use MUST call this afterwards.\n */\nexport function clearAuthTokenCache(): void {\n  tokenCache.clear();\n}\n\nexport async function getAuthToken(\n  request: APIRequestContext,\n  roleOrEmail: Role | string = 'admin',\n  password?: string,\n): Promise<string> {\n  const role = roleOrEmail in DEFAULT_CREDENTIALS ? (roleOrEmail as Role) : null;\n  const credentialAttempts: Array<{ email: string; password: string }> = [];\n\n  if (role) {\n    const configured = DEFAULT_CREDENTIALS[role];\n    credentialAttempts.push({ email: configured.email, password: password ?? configured.password });\n    if (!password) {\n      credentialAttempts.push({ email: `${role}@acme.com`, password: 'secret' });\n    }\n  } else {\n    credentialAttempts.push({ email: roleOrEmail, password: password ?? 'secret' });\n  }\n\n  const cacheKey = credentialAttempts\n    .map((entry) => `${entry.email}:${entry.password}`)\n    .join('|');\n  const cached = tokenCache.get(cacheKey);\n  if (cached && Date.now() - cached.mintedAt < TOKEN_TTL_MS) {\n    return cached.token;\n  }\n\n  let lastStatus = 0;\n\n  for (const attempt of credentialAttempts) {\n    const form = new URLSearchParams();\n    form.set('email', attempt.email);\n    form.set('password', attempt.password);\n\n    // Retry on 429 (auth rate limit kicks in after ~25-30 rapid attempts from\n    // the same test run). Capped exponential backoff: 1s, 2s, 4s; 3 retries.\n    for (let retry = 0; retry < 4; retry += 1) {\n      const response = await request.post(resolveUrl('/api/auth/login'), {\n        headers: {\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        data: form.toString(),\n      });\n\n      const raw = await response.text();\n      let body: Record<string, unknown> | null = null;\n      try {\n        body = raw ? (JSON.parse(raw) as Record<string, unknown>) : null;\n      } catch {\n        body = null;\n      }\n\n      lastStatus = response.status();\n      if (response.ok() && body && typeof body.token === 'string' && body.token) {\n        tokenCache.set(cacheKey, { token: body.token, mintedAt: Date.now() });\n        return body.token;\n      }\n      if (response.status() !== 429) break;\n      const backoffMs = 1000 * 2 ** retry;\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n    }\n  }\n\n  throw new Error(`Failed to obtain auth token (status ${lastStatus})`);\n}\n\nexport async function apiRequest(\n  request: APIRequestContext,\n  method: string,\n  path: string,\n  options: { token: string; data?: unknown; timeout?: number; headers?: Record<string, string> },\n) {\n  const headers = {\n    Authorization: `Bearer ${options.token}`,\n    'Content-Type': 'application/json',\n    ...(options.headers ?? {}),\n  };\n  const timeout = options.timeout ?? 30_000;\n  let lastError: unknown = null;\n  for (let attempt = 0; attempt < 2; attempt += 1) {\n    try {\n      return await request.fetch(resolveUrl(path), { method, headers, data: options.data, timeout });\n    } catch (error) {\n      lastError = error;\n      const message = error instanceof Error ? error.message : '';\n      const retryable = /timeout|idle-session|socket|ECONNRESET|Target page, context or browser has been closed/i.test(message);\n      if (!retryable || attempt === 1) throw error;\n      await new Promise((resolve) => setTimeout(resolve, 250));\n    }\n  }\n  throw lastError;\n}\n\nexport async function postForm(\n  request: APIRequestContext,\n  path: string,\n  data: Record<string, string>,\n  options?: { headers?: Record<string, string> },\n) {\n  const form = new URLSearchParams();\n  for (const [key, value] of Object.entries(data)) form.set(key, value);\n  return request.post(resolveUrl(path), {\n    headers: {\n      'content-type': 'application/x-www-form-urlencoded',\n      ...(options?.headers ?? {}),\n    },\n    data: form.toString(),\n  });\n}\n"],
+  "mappings": "AACA,SAAS,2BAAsC;AAE/C,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAEjD,SAAS,WAAW,MAAsB;AACxC,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAKA,MAAM,aAAa,oBAAI,IAAiD;AACxE,MAAM,eAAe,KAAK,KAAK;AAWxB,SAAS,sBAA4B;AAC1C,aAAW,MAAM;AACnB;AAEA,eAAsB,aACpB,SACA,cAA6B,SAC7B,UACiB;AACjB,QAAM,OAAO,eAAe,sBAAuB,cAAuB;AAC1E,QAAM,qBAAiE,CAAC;AAExE,MAAI,MAAM;AACR,UAAM,aAAa,oBAAoB,IAAI;AAC3C,uBAAmB,KAAK,EAAE,OAAO,WAAW,OAAO,UAAU,YAAY,WAAW,SAAS,CAAC;AAC9F,QAAI,CAAC,UAAU;AACb,yBAAmB,KAAK,EAAE,OAAO,GAAG,IAAI,aAAa,UAAU,SAAS,CAAC;AAAA,IAC3E;AAAA,EACF,OAAO;AACL,uBAAmB,KAAK,EAAE,OAAO,aAAa,UAAU,YAAY,SAAS,CAAC;AAAA,EAChF;AAEA,QAAM,WAAW,mBACd,IAAI,CAAC,UAAU,GAAG,MAAM,KAAK,IAAI,MAAM,QAAQ,EAAE,EACjD,KAAK,GAAG;AACX,QAAM,SAAS,WAAW,IAAI,QAAQ;AACtC,MAAI,UAAU,KAAK,IAAI,IAAI,OAAO,WAAW,cAAc;AACzD,WAAO,OAAO;AAAA,EAChB;AAEA,MAAI,aAAa;AAEjB,aAAW,WAAW,oBAAoB;AACxC,UAAM,OAAO,IAAI,gBAAgB;AACjC,SAAK,IAAI,SAAS,QAAQ,KAAK;AAC/B,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAIrC,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,WAAW,MAAM,QAAQ,KAAK,WAAW,iBAAiB,GAAG;AAAA,QACjE,SAAS;AAAA,UACP,gBAAgB;AAAA,QAClB;AAAA,QACA,MAAM,KAAK,SAAS;AAAA,MACtB,CAAC;AAED,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,UAAI,OAAuC;AAC3C,UAAI;AACF,eAAO,MAAO,KAAK,MAAM,GAAG,IAAgC;AAAA,MAC9D,QAAQ;AACN,eAAO;AAAA,MACT;AAEA,mBAAa,SAAS,OAAO;AAC7B,UAAI,SAAS,GAAG,KAAK,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,OAAO;AACzE,mBAAW,IAAI,UAAU,EAAE,OAAO,KAAK,OAAO,UAAU,KAAK,IAAI,EAAE,CAAC;AACpE,eAAO,KAAK;AAAA,MACd;AACA,UAAI,SAAS,OAAO,MAAM,IAAK;AAC/B,YAAM,YAAY,MAAO,KAAK;AAC9B,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,uCAAuC,UAAU,GAAG;AACtE;AAEA,eAAsB,WACpB,SACA,QACA,MACA,SACA;AACA,QAAM,UAAU;AAAA,IACd,eAAe,UAAU,QAAQ,KAAK;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAI,QAAQ,WAAW,CAAC;AAAA,EAC1B;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,YAAqB;AACzB,WAAS,UAAU,GAAG,UAAU,GAAG,WAAW,GAAG;AAC/C,QAAI;AACF,aAAO,MAAM,QAAQ,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,SAAS,MAAM,QAAQ,MAAM,QAAQ,CAAC;AAAA,IAC/F,SAAS,OAAO;AACd,kBAAY;AACZ,YAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,YAAM,YAAY,0FAA0F,KAAK,OAAO;AACxH,UAAI,CAAC,aAAa,YAAY,EAAG,OAAM;AACvC,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAG,CAAC;AAAA,IACzD;AAAA,EACF;AACA,QAAM;AACR;AAEA,eAAsB,SACpB,SACA,MACA,MACA,SACA;AACA,QAAM,OAAO,IAAI,gBAAgB;AACjC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,EAAG,MAAK,IAAI,KAAK,KAAK;AACpE,SAAO,QAAQ,KAAK,WAAW,IAAI,GAAG;AAAA,IACpC,SAAS;AAAA,MACP,gBAAgB;AAAA,MAChB,GAAI,SAAS,WAAW,CAAC;AAAA,IAC3B;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AACH;",
   "names": []
 }

package/dist/helpers/integration/appRoot.js

@@ -0,0 +1,9 @@
+import path from "node:path";
+function resolveAppRoot(input) {
+  const explicit = input?.trim() || process.env.OM_TEST_APP_ROOT?.trim();
+  return explicit ? path.resolve(explicit) : path.resolve(process.cwd(), "apps/mercato");
+}
+export {
+  resolveAppRoot
+};
+//# sourceMappingURL=appRoot.js.map

package/dist/helpers/integration/appRoot.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/appRoot.ts"],
+  "sourcesContent": ["import path from 'node:path'\n\n/**\n * The app root an integration test targets: `OM_TEST_APP_ROOT` when a standalone app is under test,\n * else the monorepo's `apps/mercato` (the Playwright process runs from the repo root, so its `cwd` is\n * not the app root).\n *\n * Single source for what was previously re-derived in `queue.ts`, `dbFixtures.ts`, and `pushFake.ts`.\n */\nexport function resolveAppRoot(input?: string): string {\n  const explicit = input?.trim() || process.env.OM_TEST_APP_ROOT?.trim()\n  return explicit ? path.resolve(explicit) : path.resolve(process.cwd(), 'apps/mercato')\n}\n"],
+  "mappings": "AAAA,OAAO,UAAU;AASV,SAAS,eAAe,OAAwB;AACrD,QAAM,WAAW,OAAO,KAAK,KAAK,QAAQ,IAAI,kBAAkB,KAAK;AACrE,SAAO,WAAW,KAAK,QAAQ,QAAQ,IAAI,KAAK,QAAQ,QAAQ,IAAI,GAAG,cAAc;AACvF;",
+  "names": []
+}

package/dist/helpers/integration/dbFixtures.js

@@ -1,10 +1,7 @@
 import { readFileSync } from "node:fs";
 import path from "node:path";
 import { Client } from "pg";
-function resolveAppRoot() {
-  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();
-  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), "apps/mercato");
-}
+import { resolveAppRoot } from "./appRoot.js";
 function readEnvValue(key) {
   if (process.env[key]) return process.env[key];
   const candidatePaths = [

package/dist/helpers/integration/dbFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/dbFixtures.ts"],
-  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { Client } from 'pg';\n\n/**\n * Database fixtures for the org-scope fail-open hardening tests.\n *\n * These helpers talk to Postgres directly via `pg` rather than bootstrapping the\n * app DI container, because:\n *  - the directory create command denies non-super-admin actors (the only\n *    loginable accounts here), so orgs cannot be created over the API; and\n *  - granting `customers.*` through the ACL API requires a super-admin actor.\n * Raw SQL keeps the test self-contained and avoids depending on built package\n * `dist/` output for an in-process MikroORM bootstrap.\n */\n\nfunction resolveAppRoot(): string {\n  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();\n  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), 'apps/mercato');\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const candidatePaths = [\n    path.resolve(resolveAppRoot(), '.env'),\n    path.resolve(process.cwd(), 'apps/mercato/.env'),\n    path.resolve(process.cwd(), '.env'),\n  ];\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n      if (match?.[1]) return match[1].trim();\n    } catch {\n      continue;\n    }\n  }\n  return undefined;\n}\n\nfunction resolveDatabaseUrl(): string {\n  const url = readEnvValue('DATABASE_URL');\n  if (!url) throw new Error('[internal] DATABASE_URL is not configured for integration DB fixtures');\n  return url;\n}\n\n/**\n * The slice of `pg`'s client these fixtures use, declared structurally.\n *\n * `pg` publishes `Client` as a class merged with a namespace, and the app project's module\n * resolution picks the namespace half in type position (`TS2709`), so naming the class here made\n * every caller outside `packages/core` fail to typecheck. A structural type is resolvable from\n * every project and keeps `query<T>()` generic, which `InstanceType<typeof Client>` did not.\n */\nexport type IntegrationDbClient = {\n  query<T = Record<string, unknown>>(\n    text: string,\n    values?: readonly unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n};\n\nexport async function withClient<T>(run: (client: IntegrationDbClient) => Promise<T>): Promise<T> {\n  const client = new Client({ connectionString: resolveDatabaseUrl() }) as unknown as IntegrationDbClient & {\n    connect: () => Promise<void>;\n    end: () => Promise<void>;\n  };\n  await client.connect();\n  try {\n    return await run(client);\n  } finally {\n    await client.end();\n  }\n}\n\n/**\n * Nulls a user's home organization (`organization_id`) directly in the database.\n *\n * Required to construct the \"floating restricted user\" precondition: the JWT\n * `auth.orgId` is minted from `users.organization_id` at login, so this MUST run\n * BEFORE the user logs in.\n */\nexport async function clearUserHomeOrganization(userId: string): Promise<void> {\n  await withClient(async (client) => {\n    await client.query('update users set organization_id = null where id = $1', [userId]);\n  });\n}\n\n/**\n * Upserts a per-user ACL row, setting the effective feature list and the\n * organization-visibility list.\n *\n * `organizations` maps to `OrganizationScope.allowedIds` (write path) and\n * `filterIds` (read path):\n *   - `[orgA]` => restricted to orgA (write fail-open precondition, #2239)\n *   - `[]`     => restricted to zero orgs (read fail-open precondition, #2245)\n *   - `null`   => unrestricted\n */\nexport async function setUserAclInDb(input: {\n  userId: string;\n  tenantId: string;\n  features: string[];\n  organizations: string[] | null;\n}): Promise<void> {\n  await withClient(async (client) => {\n    const existing = await client.query<{ id: string }>(\n      'select id from user_acls where user_id = $1 and tenant_id = $2 limit 1',\n      [input.userId, input.tenantId],\n    );\n    const featuresJson = JSON.stringify(input.features);\n    const organizationsJson = input.organizations === null ? null : JSON.stringify(input.organizations);\n    if (existing.rows.length > 0) {\n      await client.query(\n        'update user_acls set features_json = $2::jsonb, organizations_json = $3::jsonb, is_super_admin = false, updated_at = now() where id = $1',\n        [existing.rows[0].id, featuresJson, organizationsJson],\n      );\n      return;\n    }\n    await client.query(\n      `insert into user_acls (id, user_id, tenant_id, features_json, organizations_json, is_super_admin, created_at)\n       values (gen_random_uuid(), $1, $2, $3::jsonb, $4::jsonb, false, now())`,\n      [input.userId, input.tenantId, featuresJson, organizationsJson],\n    );\n  });\n}\n\n/** Removes any per-user ACL rows for the user (best-effort test cleanup). */\nexport async function deleteUserAclInDb(userId: string): Promise<void> {\n  if (!userId) return;\n  await withClient(async (client) => {\n    await client.query('delete from user_acls where user_id = $1', [userId]);\n  });\n}\n\n/**\n * Creates an organization directly in the database within the given tenant.\n *\n * The directory create command routes through `enforceTenantSelection`, which\n * denies the (non-super-admin) accounts loginable on this instance. Landing the\n * org in a known tenant lets the floating user (created under it) share the\n * tenant \u2014 required because cross-tenant access returns 404 before the\n * org-scope guard ever runs.\n */\nexport async function createOrganizationInDb(input: { name: string; tenantId: string }): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `insert into organizations\n         (id, tenant_id, name, is_active, ancestor_ids, child_ids, descendant_ids, depth, created_at, updated_at)\n       values (gen_random_uuid(), $1, $2, true, '[]'::jsonb, '[]'::jsonb, '[]'::jsonb, 0, now(), now())\n       returning id`,\n      [input.tenantId, input.name],\n    );\n    return result.rows[0].id;\n  });\n}\n\n/** Hard-deletes an organization row (best-effort test cleanup). */\nexport async function deleteOrganizationInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from organizations where id = $1', [organizationId]);\n  });\n}\n\n/**\n * Hard-deletes integration credential rows for an organization (best-effort test\n * cleanup). Integration credentials are stored per (integration_id,\n * organization_id, tenant_id, user_id) with no FK to organizations, so a\n * throwaway org's credential rows must be removed explicitly when the org row is\n * torn down.\n */\nexport async function deleteIntegrationCredentialsInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from integration_credentials where organization_id = $1', [organizationId]);\n  });\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,OAAO,UAAU;AACjB,SAAS,cAAc;AAcvB,SAAS,iBAAyB;AAChC,QAAM,UAAU,QAAQ,IAAI,kBAAkB,KAAK;AACnD,SAAO,UAAU,KAAK,QAAQ,OAAO,IAAI,KAAK,QAAQ,QAAQ,IAAI,GAAG,cAAc;AACrF;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,iBAAiB;AAAA,IACrB,KAAK,QAAQ,eAAe,GAAG,MAAM;AAAA,IACrC,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC/C,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACpC;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,YAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,UAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvC,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAA6B;AACpC,QAAM,MAAM,aAAa,cAAc;AACvC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAO;AACT;AAiBA,eAAsB,WAAc,KAA8D;AAChG,QAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,mBAAmB,EAAE,CAAC;AAIpE,QAAM,OAAO,QAAQ;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,MAAM;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,IAAI;AAAA,EACnB;AACF;AASA,eAAsB,0BAA0B,QAA+B;AAC7E,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,yDAAyD,CAAC,MAAM,CAAC;AAAA,EACtF,CAAC;AACH;AAYA,eAAsB,eAAe,OAKnB;AAChB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,WAAW,MAAM,OAAO;AAAA,MAC5B;AAAA,MACA,CAAC,MAAM,QAAQ,MAAM,QAAQ;AAAA,IAC/B;AACA,UAAM,eAAe,KAAK,UAAU,MAAM,QAAQ;AAClD,UAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO,KAAK,UAAU,MAAM,aAAa;AAClG,QAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,YAAM,OAAO;AAAA,QACX;AAAA,QACA,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,cAAc,iBAAiB;AAAA,MACvD;AACA;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX;AAAA;AAAA,MAEA,CAAC,MAAM,QAAQ,MAAM,UAAU,cAAc,iBAAiB;AAAA,IAChE;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,kBAAkB,QAA+B;AACrE,MAAI,CAAC,OAAQ;AACb,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,4CAA4C,CAAC,MAAM,CAAC;AAAA,EACzE,CAAC;AACH;AAWA,eAAsB,uBAAuB,OAA4D;AACvG,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,UAAU,MAAM,IAAI;AAAA,IAC7B;AACA,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAGA,eAAsB,uBAAuB,gBAA8C;AACzF,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,2CAA2C,CAAC,cAAc,CAAC;AAAA,EAChF,CAAC;AACH;AASA,eAAsB,iCAAiC,gBAA8C;AACnG,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,kEAAkE,CAAC,cAAc,CAAC;AAAA,EACvG,CAAC;AACH;",
+  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { Client } from 'pg';\nimport { resolveAppRoot } from './appRoot';\n\n/**\n * Database fixtures for the org-scope fail-open hardening tests.\n *\n * These helpers talk to Postgres directly via `pg` rather than bootstrapping the\n * app DI container, because:\n *  - the directory create command denies non-super-admin actors (the only\n *    loginable accounts here), so orgs cannot be created over the API; and\n *  - granting `customers.*` through the ACL API requires a super-admin actor.\n * Raw SQL keeps the test self-contained and avoids depending on built package\n * `dist/` output for an in-process MikroORM bootstrap.\n */\n\nfunction readEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const candidatePaths = [\n    path.resolve(resolveAppRoot(), '.env'),\n    path.resolve(process.cwd(), 'apps/mercato/.env'),\n    path.resolve(process.cwd(), '.env'),\n  ];\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n      if (match?.[1]) return match[1].trim();\n    } catch {\n      continue;\n    }\n  }\n  return undefined;\n}\n\nfunction resolveDatabaseUrl(): string {\n  const url = readEnvValue('DATABASE_URL');\n  if (!url) throw new Error('[internal] DATABASE_URL is not configured for integration DB fixtures');\n  return url;\n}\n\n/**\n * The slice of `pg`'s client these fixtures use, declared structurally.\n *\n * `pg` publishes `Client` as a class merged with a namespace, and the app project's module\n * resolution picks the namespace half in type position (`TS2709`), so naming the class here made\n * every caller outside `packages/core` fail to typecheck. A structural type is resolvable from\n * every project and keeps `query<T>()` generic, which `InstanceType<typeof Client>` did not.\n */\nexport type IntegrationDbClient = {\n  query<T = Record<string, unknown>>(\n    text: string,\n    values?: readonly unknown[],\n  ): Promise<{ rows: T[]; rowCount: number | null }>;\n};\n\nexport async function withClient<T>(run: (client: IntegrationDbClient) => Promise<T>): Promise<T> {\n  const client = new Client({ connectionString: resolveDatabaseUrl() }) as unknown as IntegrationDbClient & {\n    connect: () => Promise<void>;\n    end: () => Promise<void>;\n  };\n  await client.connect();\n  try {\n    return await run(client);\n  } finally {\n    await client.end();\n  }\n}\n\n/**\n * Nulls a user's home organization (`organization_id`) directly in the database.\n *\n * Required to construct the \"floating restricted user\" precondition: the JWT\n * `auth.orgId` is minted from `users.organization_id` at login, so this MUST run\n * BEFORE the user logs in.\n */\nexport async function clearUserHomeOrganization(userId: string): Promise<void> {\n  await withClient(async (client) => {\n    await client.query('update users set organization_id = null where id = $1', [userId]);\n  });\n}\n\n/**\n * Upserts a per-user ACL row, setting the effective feature list and the\n * organization-visibility list.\n *\n * `organizations` maps to `OrganizationScope.allowedIds` (write path) and\n * `filterIds` (read path):\n *   - `[orgA]` => restricted to orgA (write fail-open precondition, #2239)\n *   - `[]`     => restricted to zero orgs (read fail-open precondition, #2245)\n *   - `null`   => unrestricted\n */\nexport async function setUserAclInDb(input: {\n  userId: string;\n  tenantId: string;\n  features: string[];\n  organizations: string[] | null;\n}): Promise<void> {\n  await withClient(async (client) => {\n    const existing = await client.query<{ id: string }>(\n      'select id from user_acls where user_id = $1 and tenant_id = $2 limit 1',\n      [input.userId, input.tenantId],\n    );\n    const featuresJson = JSON.stringify(input.features);\n    const organizationsJson = input.organizations === null ? null : JSON.stringify(input.organizations);\n    if (existing.rows.length > 0) {\n      await client.query(\n        'update user_acls set features_json = $2::jsonb, organizations_json = $3::jsonb, is_super_admin = false, updated_at = now() where id = $1',\n        [existing.rows[0].id, featuresJson, organizationsJson],\n      );\n      return;\n    }\n    await client.query(\n      `insert into user_acls (id, user_id, tenant_id, features_json, organizations_json, is_super_admin, created_at)\n       values (gen_random_uuid(), $1, $2, $3::jsonb, $4::jsonb, false, now())`,\n      [input.userId, input.tenantId, featuresJson, organizationsJson],\n    );\n  });\n}\n\n/** Removes any per-user ACL rows for the user (best-effort test cleanup). */\nexport async function deleteUserAclInDb(userId: string): Promise<void> {\n  if (!userId) return;\n  await withClient(async (client) => {\n    await client.query('delete from user_acls where user_id = $1', [userId]);\n  });\n}\n\n/**\n * Creates an organization directly in the database within the given tenant.\n *\n * The directory create command routes through `enforceTenantSelection`, which\n * denies the (non-super-admin) accounts loginable on this instance. Landing the\n * org in a known tenant lets the floating user (created under it) share the\n * tenant \u2014 required because cross-tenant access returns 404 before the\n * org-scope guard ever runs.\n */\nexport async function createOrganizationInDb(input: { name: string; tenantId: string }): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `insert into organizations\n         (id, tenant_id, name, is_active, ancestor_ids, child_ids, descendant_ids, depth, created_at, updated_at)\n       values (gen_random_uuid(), $1, $2, true, '[]'::jsonb, '[]'::jsonb, '[]'::jsonb, 0, now(), now())\n       returning id`,\n      [input.tenantId, input.name],\n    );\n    return result.rows[0].id;\n  });\n}\n\n/** Hard-deletes an organization row (best-effort test cleanup). */\nexport async function deleteOrganizationInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from organizations where id = $1', [organizationId]);\n  });\n}\n\n/**\n * Hard-deletes integration credential rows for an organization (best-effort test\n * cleanup). Integration credentials are stored per (integration_id,\n * organization_id, tenant_id, user_id) with no FK to organizations, so a\n * throwaway org's credential rows must be removed explicitly when the org row is\n * torn down.\n */\nexport async function deleteIntegrationCredentialsInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from integration_credentials where organization_id = $1', [organizationId]);\n  });\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,OAAO,UAAU;AACjB,SAAS,cAAc;AACvB,SAAS,sBAAsB;AAc/B,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,iBAAiB;AAAA,IACrB,KAAK,QAAQ,eAAe,GAAG,MAAM;AAAA,IACrC,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC/C,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACpC;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,YAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,UAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvC,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAA6B;AACpC,QAAM,MAAM,aAAa,cAAc;AACvC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAO;AACT;AAiBA,eAAsB,WAAc,KAA8D;AAChG,QAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,mBAAmB,EAAE,CAAC;AAIpE,QAAM,OAAO,QAAQ;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,MAAM;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,IAAI;AAAA,EACnB;AACF;AASA,eAAsB,0BAA0B,QAA+B;AAC7E,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,yDAAyD,CAAC,MAAM,CAAC;AAAA,EACtF,CAAC;AACH;AAYA,eAAsB,eAAe,OAKnB;AAChB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,WAAW,MAAM,OAAO;AAAA,MAC5B;AAAA,MACA,CAAC,MAAM,QAAQ,MAAM,QAAQ;AAAA,IAC/B;AACA,UAAM,eAAe,KAAK,UAAU,MAAM,QAAQ;AAClD,UAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO,KAAK,UAAU,MAAM,aAAa;AAClG,QAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,YAAM,OAAO;AAAA,QACX;AAAA,QACA,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,cAAc,iBAAiB;AAAA,MACvD;AACA;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX;AAAA;AAAA,MAEA,CAAC,MAAM,QAAQ,MAAM,UAAU,cAAc,iBAAiB;AAAA,IAChE;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,kBAAkB,QAA+B;AACrE,MAAI,CAAC,OAAQ;AACb,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,4CAA4C,CAAC,MAAM,CAAC;AAAA,EACzE,CAAC;AACH;AAWA,eAAsB,uBAAuB,OAA4D;AACvG,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,UAAU,MAAM,IAAI;AAAA,IAC7B;AACA,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAGA,eAAsB,uBAAuB,gBAA8C;AACzF,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,2CAA2C,CAAC,cAAc,CAAC;AAAA,EAChF,CAAC;AACH;AASA,eAAsB,iCAAiC,gBAA8C;AACnG,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,kEAAkE,CAAC,cAAc,CAAC;AAAA,EACvG,CAAC;AACH;",
   "names": []
 }

package/dist/helpers/integration/pushFake.js

@@ -0,0 +1,126 @@
+import { generateKeyPairSync } from "node:crypto";
+import path from "node:path";
+import { expect } from "@playwright/test";
+import {
+  findFakePush,
+  resolveQueueBaseDir,
+  uniquePushTokenTail
+} from "../../modules/push_notifications/lib/fake-provider-recorder.js";
+import { apiRequest } from "./api.js";
+import { resolveAppRoot } from "./appRoot.js";
+import { deleteEntityByPathIfExists, expectId, readJsonSafe } from "./generalFixtures.js";
+import { withClient } from "./dbFixtures.js";
+if (!process.env.QUEUE_BASE_DIR?.trim()) {
+  process.env.QUEUE_BASE_DIR = path.resolve(resolveAppRoot(), ".mercato/queue");
+}
+import { deleteChannelIfExists } from "./communicationChannelsFixtures.js";
+const TENANT_CONNECT_PATH = "/api/communication_channels/channels/connect/tenant-credentials";
+const DEVICES_PATH = "/api/devices";
+const NOTIFICATIONS_PATH = "/api/notifications";
+function makeFakePushToken(provider) {
+  const tokenTail = uniquePushTokenTail();
+  return { pushToken: `qa-${provider}-token-${tokenTail}`, tokenTail };
+}
+function makeFakePushTokenFor(provider, sentinel) {
+  const tokenTail = uniquePushTokenTail();
+  return { pushToken: `qa-${provider}-${sentinel}-token-${tokenTail}`, tokenTail };
+}
+const FAKE_APNS_P8_KEY = generateKeyPairSync("ec", {
+  namedCurve: "P-256",
+  privateKeyEncoding: { type: "pkcs8", format: "pem" },
+  publicKeyEncoding: { type: "spki", format: "pem" }
+}).privateKey;
+const FAKE_PUSH_CREDENTIALS = {
+  fcm: {
+    serviceAccountJson: JSON.stringify({
+      project_id: "om-fake-project",
+      client_email: "fake@om-fake-project.iam.gserviceaccount.com",
+      private_key: "-----BEGIN PRIVATE KEY-----\nom-fake-key\n-----END PRIVATE KEY-----\n"
+    })
+  },
+  apns: {
+    p8Key: FAKE_APNS_P8_KEY,
+    keyId: "FAKEKEYID1",
+    teamId: "FAKETEAMID",
+    bundleId: "com.openmercato.fake",
+    production: false
+  },
+  expo: {
+    accessToken: "om-fake-expo-token"
+  }
+};
+async function connectFakePushChannel(request, token, provider, displayName) {
+  const response = await apiRequest(request, "POST", TENANT_CONNECT_PATH, {
+    token,
+    data: { providerKey: provider, displayName, credentials: FAKE_PUSH_CREDENTIALS[provider] }
+  });
+  expect(response.status(), `connect ${provider} channel`).toBe(201);
+  const body = await readJsonSafe(response);
+  return expectId(body?.channelId, `connect ${provider} response should include channelId`);
+}
+async function registerFakePushDevice(request, token, provider, pushToken, deviceId) {
+  const response = await apiRequest(request, "POST", DEVICES_PATH, {
+    token,
+    data: { deviceId, platform: provider === "apns" ? "ios" : "android", pushToken, pushProvider: provider }
+  });
+  expect(response.status(), `register ${provider} device`).toBe(201);
+  const body = await readJsonSafe(response);
+  return expectId(body?.id, `register ${provider} device response should include id`);
+}
+async function deleteFakePushDevice(request, token, userDeviceId) {
+  if (!userDeviceId) return;
+  await deleteEntityByPathIfExists(request, token, `${DEVICES_PATH}/${userDeviceId}`);
+}
+async function deleteDeliveriesForDevice(userDeviceId) {
+  if (!userDeviceId) return;
+  await withClient(async (client) => {
+    await client.query("delete from push_notification_deliveries where user_device_id = $1", [userDeviceId]);
+  }).catch(() => void 0);
+}
+async function readLatestDelivery(tenantId, userDeviceId) {
+  return withClient(async (client) => {
+    const res = await client.query(
+      `select status, token_snapshot, organization_id, provider, attempts, silent, sent_at, last_error, provider_response
+         from push_notification_deliveries
+        where tenant_id = $1 and user_device_id = $2
+        order by created_at desc
+        limit 1`,
+      [tenantId, userDeviceId]
+    );
+    return res.rows[0] ?? null;
+  });
+}
+async function isDeviceSoftDeleted(userDeviceId) {
+  return withClient(async (client) => {
+    const res = await client.query("select deleted_at from user_devices where id = $1", [userDeviceId]);
+    if (res.rows.length === 0) return false;
+    return res.rows[0].deleted_at != null;
+  });
+}
+function readNativeMessage(provider, tokenTail, sinceIso) {
+  return findFakePush(provider, tokenTail, sinceIso);
+}
+async function expectNativeMessage(provider, tokenTail, sinceIso = (/* @__PURE__ */ new Date(0)).toISOString()) {
+  await expect.poll(() => readNativeMessage(provider, tokenTail, sinceIso)?.native ?? null, { timeout: 3e4 }).not.toBeNull();
+  return readNativeMessage(provider, tokenTail, sinceIso).native;
+}
+export {
+  DEVICES_PATH,
+  FAKE_PUSH_CREDENTIALS,
+  NOTIFICATIONS_PATH,
+  TENANT_CONNECT_PATH,
+  connectFakePushChannel,
+  deleteChannelIfExists,
+  deleteDeliveriesForDevice,
+  deleteFakePushDevice,
+  expectNativeMessage,
+  isDeviceSoftDeleted,
+  makeFakePushToken,
+  makeFakePushTokenFor,
+  readLatestDelivery,
+  readNativeMessage,
+  registerFakePushDevice,
+  resolveQueueBaseDir,
+  uniquePushTokenTail
+};
+//# sourceMappingURL=pushFake.js.map

package/dist/helpers/integration/pushFake.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/pushFake.ts"],
+  "sourcesContent": ["import { generateKeyPairSync } from 'node:crypto'\nimport path from 'node:path'\nimport { expect, type APIRequestContext } from '@playwright/test'\nimport {\n  findFakePush,\n  resolveQueueBaseDir,\n  uniquePushTokenTail,\n  type FakePushEntry,\n  type FakePushProvider,\n} from '../../modules/push_notifications/lib/fake-provider-recorder'\nimport { apiRequest } from './api'\nimport { resolveAppRoot } from './appRoot'\nimport { deleteEntityByPathIfExists, expectId, readJsonSafe } from './generalFixtures'\nimport { withClient } from './dbFixtures'\n\n/**\n * Harness for the `OM_PUSH_FAKE_PROVIDERS` integration specs (TC-PUSH-004+, TC-CHANNEL-PUSH-005+).\n *\n * The fake replaces each provider's SDK client, so the REAL adapter runs and records the\n * provider-native message it built. The worker does that in a different process than the spec, so the\n * message travels through a JSONL sink under the queue's own base dir rather than the delivery row \u2014\n * no adapter returns `metadata` on success, and APNs deliberately reports an empty `externalMessageId`.\n */\n/**\n * The Playwright process runs from the repo root, so its `cwd` is not the app root. Pin `QUEUE_BASE_DIR`\n * once, before anything resolves it, so the spec, the worker, and the drain child all agree on the queue\n * dir and the sink inside it. Never overrides a dir the harness already chose (the ephemeral runner\n * sets its own).\n */\nif (!process.env.QUEUE_BASE_DIR?.trim()) {\n  process.env.QUEUE_BASE_DIR = path.resolve(resolveAppRoot(), '.mercato/queue')\n}\n\n/** Re-exported so specs never hand-roll a second, divergent fallback (see TC-PUSH-008). */\nexport { resolveQueueBaseDir, uniquePushTokenTail }\n\n/** The canonical channel teardown \u2014 API-based, not raw SQL. Re-exported so specs import one module. */\nexport { deleteChannelIfExists } from './communicationChannelsFixtures'\n\nexport const TENANT_CONNECT_PATH = '/api/communication_channels/channels/connect/tenant-credentials'\nexport const DEVICES_PATH = '/api/devices'\nexport const NOTIFICATIONS_PATH = '/api/notifications'\n\n/** A push token whose last 8 chars are unique to this run \u2014 the sink and delivery row are keyed on them. */\nexport function makeFakePushToken(provider: FakePushProvider): { pushToken: string; tokenTail: string } {\n  const tokenTail = uniquePushTokenTail()\n  return { pushToken: `qa-${provider}-token-${tokenTail}`, tokenTail }\n}\n\n/** A push token that drives the given branch, keeping the run-unique tail. */\nexport function makeFakePushTokenFor(\n  provider: FakePushProvider,\n  sentinel: 'unregistered' | 'fail',\n): { pushToken: string; tokenTail: string } {\n  const tokenTail = uniquePushTokenTail()\n  return { pushToken: `qa-${provider}-${sentinel}-token-${tokenTail}`, tokenTail }\n}\n\nexport type PushDeliveryRow = {\n  status: string\n  token_snapshot: string\n  organization_id: string | null\n  provider: string\n  attempts: number\n  silent: boolean\n  sent_at: string | null\n  last_error: string | null\n  provider_response: Record<string, unknown> | null\n}\n\n/**\n * A throwaway ES256 (P-256) key in PKCS#8 PEM \u2014 the curve Apple's `.p8` signing\n * keys use. `apnsCredentialsSchema` structurally parses `p8Key`, so the fixture\n * must be a genuinely parseable key; generating it per process keeps a private\n * key out of the repository.\n */\nconst FAKE_APNS_P8_KEY = generateKeyPairSync('ec', {\n  namedCurve: 'P-256',\n  privateKeyEncoding: { type: 'pkcs8', format: 'pem' },\n  publicKeyEncoding: { type: 'spki', format: 'pem' },\n}).privateKey\n\n/**\n * Valid-*shaped* fake credentials. `validateCredentials` is schema-only \u2014 it checks\n * structure (APNs additionally parses the `.p8` and pins Apple's identifier formats),\n * never that the provider accepts them; real parsing lives in the faked SDK client.\n */\nexport const FAKE_PUSH_CREDENTIALS: Record<FakePushProvider, Record<string, unknown>> = {\n  fcm: {\n    serviceAccountJson: JSON.stringify({\n      project_id: 'om-fake-project',\n      client_email: 'fake@om-fake-project.iam.gserviceaccount.com',\n      private_key: '-----BEGIN PRIVATE KEY-----\\nom-fake-key\\n-----END PRIVATE KEY-----\\n',\n    }),\n  },\n  apns: {\n    p8Key: FAKE_APNS_P8_KEY,\n    keyId: 'FAKEKEYID1',\n    teamId: 'FAKETEAMID',\n    bundleId: 'com.openmercato.fake',\n    production: false,\n  },\n  expo: {\n    accessToken: 'om-fake-expo-token',\n  },\n}\n\n/**\n * Connect a tenant-wide push channel through the real credential-connect route.\n *\n * Not `seedConnectedChannel` from `communicationChannelsFixtures`: that seeds the `__test_seed__`\n * provider, whereas these specs must drive the real `fcm`/`apns`/`expo` connect path so the adapter's own\n * `validateCredentials` runs. Tear down with `deleteChannelIfExists` from that same module.\n */\nexport async function connectFakePushChannel(\n  request: APIRequestContext,\n  token: string,\n  provider: FakePushProvider,\n  displayName: string,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TENANT_CONNECT_PATH, {\n    token,\n    data: { providerKey: provider, displayName, credentials: FAKE_PUSH_CREDENTIALS[provider] },\n  })\n  expect(response.status(), `connect ${provider} channel`).toBe(201)\n  const body = await readJsonSafe<{ channelId?: string }>(response)\n  return expectId(body?.channelId, `connect ${provider} response should include channelId`)\n}\n\n/**\n * Register a device routed to `provider`. The token tail keys both the delivery row's\n * `token_snapshot` and the recorded native message, isolating concurrent specs.\n */\nexport async function registerFakePushDevice(\n  request: APIRequestContext,\n  token: string,\n  provider: FakePushProvider,\n  pushToken: string,\n  deviceId: string,\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', DEVICES_PATH, {\n    token,\n    data: { deviceId, platform: provider === 'apns' ? 'ios' : 'android', pushToken, pushProvider: provider },\n  })\n  expect(response.status(), `register ${provider} device`).toBe(201)\n  const body = await readJsonSafe<{ id?: string }>(response)\n  return expectId(body?.id, `register ${provider} device response should include id`)\n}\n\n/** Teardown counterpart to {@link registerFakePushDevice}. */\nexport async function deleteFakePushDevice(\n  request: APIRequestContext,\n  token: string | null,\n  userDeviceId: string | null,\n): Promise<void> {\n  if (!userDeviceId) return\n  await deleteEntityByPathIfExists(request, token, `${DEVICES_PATH}/${userDeviceId}`)\n}\n\nexport async function deleteDeliveriesForDevice(userDeviceId: string | null): Promise<void> {\n  if (!userDeviceId) return\n  await withClient(async (client) => {\n    await client.query('delete from push_notification_deliveries where user_device_id = $1', [userDeviceId])\n  }).catch(() => undefined)\n}\n\nexport async function readLatestDelivery(tenantId: string, userDeviceId: string): Promise<PushDeliveryRow | null> {\n  return withClient(async (client) => {\n    const res = await client.query(\n      `select status, token_snapshot, organization_id, provider, attempts, silent, sent_at, last_error, provider_response\n         from push_notification_deliveries\n        where tenant_id = $1 and user_device_id = $2\n        order by created_at desc\n        limit 1`,\n      [tenantId, userDeviceId],\n    )\n    return (res.rows[0] as PushDeliveryRow | undefined) ?? null\n  })\n}\n\n/**\n * True once the device has been soft-deleted (the `device_unregistered` contract).\n *\n * A MISSING row returns `false`, not `true`: soft-delete keeps the row, so an absent one means the\n * device was never created or a neighbouring teardown hard-deleted it. Returning `true` there would let\n * the central assertion of TC-PUSH-004/008 pass vacuously.\n */\nexport async function isDeviceSoftDeleted(userDeviceId: string): Promise<boolean> {\n  return withClient(async (client) => {\n    const res = await client.query('select deleted_at from user_devices where id = $1', [userDeviceId])\n    if (res.rows.length === 0) return false\n    return res.rows[0].deleted_at != null\n  })\n}\n\n/** The provider-native message the REAL adapter handed the faked SDK client. */\nexport function readNativeMessage(\n  provider: FakePushProvider,\n  tokenTail: string,\n  sinceIso?: string,\n): FakePushEntry | undefined {\n  return findFakePush(provider, tokenTail, sinceIso)\n}\n\n/**\n * Wait for the message this run's worker recorded. Pass `sinceIso` to reject entries from an earlier\n * run \u2014 the sink is append-only and the reused-environment path never truncates it. The default\n * (epoch) accepts every recorded entry.\n */\nexport async function expectNativeMessage(\n  provider: FakePushProvider,\n  tokenTail: string,\n  sinceIso: string = new Date(0).toISOString(),\n): Promise<Record<string, unknown>> {\n  await expect\n    .poll(() => readNativeMessage(provider, tokenTail, sinceIso)?.native ?? null, { timeout: 30_000 })\n    .not.toBeNull()\n  return readNativeMessage(provider, tokenTail, sinceIso)!.native\n}\n"],
+  "mappings": "AAAA,SAAS,2BAA2B;AACpC,OAAO,UAAU;AACjB,SAAS,cAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,kBAAkB;AAC3B,SAAS,sBAAsB;AAC/B,SAAS,4BAA4B,UAAU,oBAAoB;AACnE,SAAS,kBAAkB;AAgB3B,IAAI,CAAC,QAAQ,IAAI,gBAAgB,KAAK,GAAG;AACvC,UAAQ,IAAI,iBAAiB,KAAK,QAAQ,eAAe,GAAG,gBAAgB;AAC9E;AAMA,SAAS,6BAA6B;AAE/B,MAAM,sBAAsB;AAC5B,MAAM,eAAe;AACrB,MAAM,qBAAqB;AAG3B,SAAS,kBAAkB,UAAsE;AACtG,QAAM,YAAY,oBAAoB;AACtC,SAAO,EAAE,WAAW,MAAM,QAAQ,UAAU,SAAS,IAAI,UAAU;AACrE;AAGO,SAAS,qBACd,UACA,UAC0C;AAC1C,QAAM,YAAY,oBAAoB;AACtC,SAAO,EAAE,WAAW,MAAM,QAAQ,IAAI,QAAQ,UAAU,SAAS,IAAI,UAAU;AACjF;AAoBA,MAAM,mBAAmB,oBAAoB,MAAM;AAAA,EACjD,YAAY;AAAA,EACZ,oBAAoB,EAAE,MAAM,SAAS,QAAQ,MAAM;AAAA,EACnD,mBAAmB,EAAE,MAAM,QAAQ,QAAQ,MAAM;AACnD,CAAC,EAAE;AAOI,MAAM,wBAA2E;AAAA,EACtF,KAAK;AAAA,IACH,oBAAoB,KAAK,UAAU;AAAA,MACjC,YAAY;AAAA,MACZ,cAAc;AAAA,MACd,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EACA,MAAM;AAAA,IACJ,OAAO;AAAA,IACP,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,YAAY;AAAA,EACd;AAAA,EACA,MAAM;AAAA,IACJ,aAAa;AAAA,EACf;AACF;AASA,eAAsB,uBACpB,SACA,OACA,UACA,aACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,qBAAqB;AAAA,IACtE;AAAA,IACA,MAAM,EAAE,aAAa,UAAU,aAAa,aAAa,sBAAsB,QAAQ,EAAE;AAAA,EAC3F,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,WAAW,QAAQ,UAAU,EAAE,KAAK,GAAG;AACjE,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,WAAW,QAAQ,oCAAoC;AAC1F;AAMA,eAAsB,uBACpB,SACA,OACA,UACA,WACA,UACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,cAAc;AAAA,IAC/D;AAAA,IACA,MAAM,EAAE,UAAU,UAAU,aAAa,SAAS,QAAQ,WAAW,WAAW,cAAc,SAAS;AAAA,EACzG,CAAC;AACD,SAAO,SAAS,OAAO,GAAG,YAAY,QAAQ,SAAS,EAAE,KAAK,GAAG;AACjE,QAAM,OAAO,MAAM,aAA8B,QAAQ;AACzD,SAAO,SAAS,MAAM,IAAI,YAAY,QAAQ,oCAAoC;AACpF;AAGA,eAAsB,qBACpB,SACA,OACA,cACe;AACf,MAAI,CAAC,aAAc;AACnB,QAAM,2BAA2B,SAAS,OAAO,GAAG,YAAY,IAAI,YAAY,EAAE;AACpF;AAEA,eAAsB,0BAA0B,cAA4C;AAC1F,MAAI,CAAC,aAAc;AACnB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,sEAAsE,CAAC,YAAY,CAAC;AAAA,EACzG,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAEA,eAAsB,mBAAmB,UAAkB,cAAuD;AAChH,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,MAAM,MAAM,OAAO;AAAA,MACvB;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,CAAC,UAAU,YAAY;AAAA,IACzB;AACA,WAAQ,IAAI,KAAK,CAAC,KAAqC;AAAA,EACzD,CAAC;AACH;AASA,eAAsB,oBAAoB,cAAwC;AAChF,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,MAAM,MAAM,OAAO,MAAM,qDAAqD,CAAC,YAAY,CAAC;AAClG,QAAI,IAAI,KAAK,WAAW,EAAG,QAAO;AAClC,WAAO,IAAI,KAAK,CAAC,EAAE,cAAc;AAAA,EACnC,CAAC;AACH;AAGO,SAAS,kBACd,UACA,WACA,UAC2B;AAC3B,SAAO,aAAa,UAAU,WAAW,QAAQ;AACnD;AAOA,eAAsB,oBACpB,UACA,WACA,YAAmB,oBAAI,KAAK,CAAC,GAAE,YAAY,GACT;AAClC,QAAM,OACH,KAAK,MAAM,kBAAkB,UAAU,WAAW,QAAQ,GAAG,UAAU,MAAM,EAAE,SAAS,IAAO,CAAC,EAChG,IAAI,SAAS;AAChB,SAAO,kBAAkB,UAAU,WAAW,QAAQ,EAAG;AAC3D;",
+  "names": []
+}

package/dist/modules/auth/notifications.js

@@ -1,6 +1,8 @@
 const notificationTypes = [
   {
     type: "auth.password_reset.requested",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.passwordReset.requested.title",
     bodyKey: "auth.notifications.passwordReset.requested.body",
@@ -20,6 +22,8 @@ const notificationTypes = [
   },
   {
     type: "auth.password_reset.completed",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.passwordReset.completed.title",
     bodyKey: "auth.notifications.passwordReset.completed.body",
@@ -30,11 +34,15 @@ const notificationTypes = [
   },
   {
     type: "auth.account.locked",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.account.locked.title",
     bodyKey: "auth.notifications.account.locked.body",
     icon: "lock",
     severity: "warning",
+    // Security alert — the user must not be able to silence it.
+    nonOptOut: true,
     actions: [
       {
         id: "contact_support",
@@ -48,11 +56,15 @@ const notificationTypes = [
   },
   {
     type: "auth.login.new_device",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.login.newDevice.title",
     bodyKey: "auth.notifications.login.newDevice.body",
     icon: "smartphone",
     severity: "info",
+    // Security alert — the user must not be able to silence it.
+    nonOptOut: true,
     actions: [
       {
         id: "view_sessions",
@@ -68,6 +80,8 @@ const notificationTypes = [
   },
   {
     type: "auth.role.assigned",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.role.assigned.title",
     bodyKey: "auth.notifications.role.assigned.body",
@@ -87,6 +101,8 @@ const notificationTypes = [
   },
   {
     type: "auth.role.revoked",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "auth",
     titleKey: "auth.notifications.role.revoked.title",
     bodyKey: "auth.notifications.role.revoked.body",

package/dist/modules/auth/notifications.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/auth/notifications.ts"],
-  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'auth.password_reset.requested',\n    module: 'auth',\n    titleKey: 'auth.notifications.passwordReset.requested.title',\n    bodyKey: 'auth.notifications.passwordReset.requested.body',\n    icon: 'key',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 24,\n  },\n  {\n    type: 'auth.password_reset.completed',\n    module: 'auth',\n    titleKey: 'auth.notifications.passwordReset.completed.title',\n    bodyKey: 'auth.notifications.passwordReset.completed.body',\n    icon: 'check-circle',\n    severity: 'success',\n    actions: [],\n    expiresAfterHours: 72,\n  },\n  {\n    type: 'auth.account.locked',\n    module: 'auth',\n    titleKey: 'auth.notifications.account.locked.title',\n    bodyKey: 'auth.notifications.account.locked.body',\n    icon: 'lock',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'contact_support',\n        labelKey: 'auth.actions.contactSupport',\n        variant: 'default',\n        href: '/backend/support',\n        icon: 'mail',\n      },\n    ],\n    linkHref: '/backend/support',\n  },\n  {\n    type: 'auth.login.new_device',\n    module: 'auth',\n    titleKey: 'auth.notifications.login.newDevice.title',\n    bodyKey: 'auth.notifications.login.newDevice.body',\n    icon: 'smartphone',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view_sessions',\n        labelKey: 'auth.actions.viewSessions',\n        variant: 'outline',\n        href: '/backend/auth/sessions',\n        icon: 'list',\n      },\n    ],\n    linkHref: '/backend/auth/sessions',\n    expiresAfterHours: 168, // 7 days\n  },\n  {\n    type: 'auth.role.assigned',\n    module: 'auth',\n    titleKey: 'auth.notifications.role.assigned.title',\n    bodyKey: 'auth.notifications.role.assigned.body',\n    icon: 'user-plus',\n    severity: 'success',\n    actions: [\n      {\n        id: 'view_permissions',\n        labelKey: 'auth.actions.viewPermissions',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n        icon: 'shield',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 168,\n  },\n  {\n    type: 'auth.role.revoked',\n    module: 'auth',\n    titleKey: 'auth.notifications.role.revoked.title',\n    bodyKey: 'auth.notifications.role.revoked.body',\n    icon: 'user-minus',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'view_profile',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 168,\n  },\n]\n\nexport default notificationTypes\n"],
-  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS,CAAC;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
+  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'auth.password_reset.requested',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.passwordReset.requested.title',\n    bodyKey: 'auth.notifications.passwordReset.requested.body',\n    icon: 'key',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 24,\n  },\n  {\n    type: 'auth.password_reset.completed',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.passwordReset.completed.title',\n    bodyKey: 'auth.notifications.passwordReset.completed.body',\n    icon: 'check-circle',\n    severity: 'success',\n    actions: [],\n    expiresAfterHours: 72,\n  },\n  {\n    type: 'auth.account.locked',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.account.locked.title',\n    bodyKey: 'auth.notifications.account.locked.body',\n    icon: 'lock',\n    severity: 'warning',\n    // Security alert \u2014 the user must not be able to silence it.\n    nonOptOut: true,\n    actions: [\n      {\n        id: 'contact_support',\n        labelKey: 'auth.actions.contactSupport',\n        variant: 'default',\n        href: '/backend/support',\n        icon: 'mail',\n      },\n    ],\n    linkHref: '/backend/support',\n  },\n  {\n    type: 'auth.login.new_device',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.login.newDevice.title',\n    bodyKey: 'auth.notifications.login.newDevice.body',\n    icon: 'smartphone',\n    severity: 'info',\n    // Security alert \u2014 the user must not be able to silence it.\n    nonOptOut: true,\n    actions: [\n      {\n        id: 'view_sessions',\n        labelKey: 'auth.actions.viewSessions',\n        variant: 'outline',\n        href: '/backend/auth/sessions',\n        icon: 'list',\n      },\n    ],\n    linkHref: '/backend/auth/sessions',\n    expiresAfterHours: 168, // 7 days\n  },\n  {\n    type: 'auth.role.assigned',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.role.assigned.title',\n    bodyKey: 'auth.notifications.role.assigned.body',\n    icon: 'user-plus',\n    severity: 'success',\n    actions: [\n      {\n        id: 'view_permissions',\n        labelKey: 'auth.actions.viewPermissions',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n        icon: 'shield',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 168,\n  },\n  {\n    type: 'auth.role.revoked',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'auth',\n    titleKey: 'auth.notifications.role.revoked.title',\n    bodyKey: 'auth.notifications.role.revoked.body',\n    icon: 'user-minus',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'view_profile',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/auth/profile',\n      },\n    ],\n    linkHref: '/backend/auth/profile',\n    expiresAfterHours: 168,\n  },\n]\n\nexport default notificationTypes\n"],
+  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS,CAAC;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA;AAAA,IAEV,WAAW;AAAA,IACX,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,EACZ;AAAA,EACA;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA;AAAA,IAEV,WAAW;AAAA,IACX,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AAAA,EACA;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
   "names": []
 }

package/dist/modules/business_rules/notifications.js

@@ -1,6 +1,8 @@
 const notificationTypes = [
   {
     type: "business_rules.rule.execution_failed",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "business_rules",
     titleKey: "businessRules.notifications.rule.executionFailed.title",
     bodyKey: "businessRules.notifications.rule.executionFailed.body",

package/dist/modules/business_rules/notifications.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/business_rules/notifications.ts"],
-  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'business_rules.rule.execution_failed',\n    module: 'business_rules',\n    titleKey: 'businessRules.notifications.rule.executionFailed.title',\n    bodyKey: 'businessRules.notifications.rule.executionFailed.body',\n    icon: 'alert-triangle',\n    severity: 'error',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/business-rules/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/business-rules/{sourceEntityId}',\n    expiresAfterHours: 168, // 7 days\n  },\n]\n\nexport default notificationTypes\n"],
-  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
+  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'business_rules.rule.execution_failed',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'business_rules',\n    titleKey: 'businessRules.notifications.rule.executionFailed.title',\n    bodyKey: 'businessRules.notifications.rule.executionFailed.body',\n    icon: 'alert-triangle',\n    severity: 'error',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/business-rules/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/business-rules/{sourceEntityId}',\n    expiresAfterHours: 168, // 7 days\n  },\n]\n\nexport default notificationTypes\n"],
+  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
   "names": []
 }

package/dist/modules/catalog/notifications.js

@@ -1,6 +1,8 @@
 const notificationTypes = [
   {
     type: "catalog.product.low_stock",
+    // Ships without push — operators re-enable it per type from the Notification Delivery settings.
+    channels: ["in_app", "email"],
     module: "catalog",
     titleKey: "catalog.notifications.product.lowStock.title",
     bodyKey: "catalog.notifications.product.lowStock.body",

package/dist/modules/catalog/notifications.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/catalog/notifications.ts"],
-  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'catalog.product.low_stock',\n    module: 'catalog',\n    titleKey: 'catalog.notifications.product.lowStock.title',\n    bodyKey: 'catalog.notifications.product.lowStock.body',\n    icon: 'package-x',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/catalog/products/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/catalog/products/{sourceEntityId}',\n    expiresAfterHours: 72, // 3 days\n  },\n]\n\nexport default notificationTypes\n"],
-  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
+  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'catalog.product.low_stock',\n    // Ships without push \u2014 operators re-enable it per type from the Notification Delivery settings.\n    channels: ['in_app', 'email'],\n    module: 'catalog',\n    titleKey: 'catalog.notifications.product.lowStock.title',\n    bodyKey: 'catalog.notifications.product.lowStock.body',\n    icon: 'package-x',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/catalog/products/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/catalog/products/{sourceEntityId}',\n    expiresAfterHours: 72, // 3 days\n  },\n]\n\nexport default notificationTypes\n"],
+  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA;AAAA,IAEN,UAAU,CAAC,UAAU,OAAO;AAAA,IAC5B,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/acl.js

@@ -12,6 +12,15 @@ const features = [
    * Default-granted to all roles in `setup.ts`.
    */
   { id: "communication_channels.connect_user_channel", title: "Connect own communication channel", module: "communication_channels" },
+  /**
+   * Connect a tenant-wide channel (`CommunicationChannel.user_id IS NULL`) that
+   * serves every user in the tenant — used for push providers (FCM/APNs/Expo)
+   * whose service account / signing key is shared tenant infrastructure. Gates
+   * `POST /channels/connect/tenant-credentials`. Admin/superadmin only: unlike
+   * `connect_user_channel` (everyone links their own mailbox), connecting shared
+   * push credentials is an administrative action.
+   */
+  { id: "communication_channels.connect_tenant_channel", title: "Connect tenant-wide communication channel", module: "communication_channels" },
   /**
    * Reserved for a future v2 team-oversight capability. NOT consulted in v1:
    * personal mailboxes (`CommunicationChannel.user_id` set) follow the strict

package/dist/modules/communication_channels/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/communication_channels/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'communication_channels.view', title: 'View communication channels', module: 'communication_channels' },\n  { id: 'communication_channels.manage', title: 'Manage communication channels', module: 'communication_channels' },\n  { id: 'communication_channels.react', title: 'React to channel messages', module: 'communication_channels' },\n  { id: 'communication_channels.assign', title: 'Assign channel conversations', module: 'communication_channels' },\n  /**\n   * Per-user channel ownership (added by the email integration spec).\n   *\n   * Gates the \"Connect my mailbox\" flow on the per-user profile page. Split from\n   * `communication_channels.manage` so policy can disable new linking while\n   * preserving existing accounts (e.g. during a security incident response).\n   * Default-granted to all roles in `setup.ts`.\n   */\n  { id: 'communication_channels.connect_user_channel', title: 'Connect own communication channel', module: 'communication_channels' },\n  /**\n   * Reserved for a future v2 team-oversight capability. NOT consulted in v1:\n   * personal mailboxes (`CommunicationChannel.user_id` set) follow the strict\n   * owner-only privacy model, so this feature grants NO cross-user channel view.\n   * The admin channels list (`GET /api/communication_channels/channels`) returns\n   * `user_id IS NULL` rows only; personal mailboxes surface exclusively on the\n   * owner's profile page and are never exposed to admins/superadmins in v1.\n   * Granted to `superadmin` + `admin` only so the inert grant is in place ahead\n   * of the audited v2 oversight feature that will re-activate it.\n   */\n  { id: 'communication_channels.admin', title: 'Administer all communication channels (tenant-wide)', module: 'communication_channels' },\n  /**\n   * Trigger the \"Import history\" job for a channel \u2014 fetch older messages\n   * the channel never saw at bootstrap (Spec B \u00A7 Phase B6). Separate from\n   * `manage` so policy can gate bulk historical imports during quiet hours\n   * or cost-controlled rollouts while leaving normal channel CRUD open.\n   */\n  { id: 'communication_channels.channel.import_history', title: 'Import channel history', module: 'communication_channels' },\n  /**\n   * Manage provider push delivery (Spec C \u2014 Gmail Pub/Sub push\n   * subscriptions). Gates the \"Re-register push\" operator button and any\n   * future push-status manipulation. Granted to admin + superadmin only \u2014\n   * regular users don't need to think about whether mail arrives via\n   * push or polling, the system handles it.\n   */\n  { id: 'communication_channels.channel.push.manage', title: 'Manage push delivery', module: 'communication_channels' },\n] as const\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,+BAA+B,OAAO,+BAA+B,QAAQ,yBAAyB;AAAA,EAC5G,EAAE,IAAI,iCAAiC,OAAO,iCAAiC,QAAQ,yBAAyB;AAAA,EAChH,EAAE,IAAI,gCAAgC,OAAO,6BAA6B,QAAQ,yBAAyB;AAAA,EAC3G,EAAE,IAAI,iCAAiC,OAAO,gCAAgC,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/G,EAAE,IAAI,+CAA+C,OAAO,qCAAqC,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWlI,EAAE,IAAI,gCAAgC,OAAO,uDAAuD,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrI,EAAE,IAAI,iDAAiD,OAAO,0BAA0B,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzH,EAAE,IAAI,8CAA8C,OAAO,wBAAwB,QAAQ,yBAAyB;AACtH;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  { id: 'communication_channels.view', title: 'View communication channels', module: 'communication_channels' },\n  { id: 'communication_channels.manage', title: 'Manage communication channels', module: 'communication_channels' },\n  { id: 'communication_channels.react', title: 'React to channel messages', module: 'communication_channels' },\n  { id: 'communication_channels.assign', title: 'Assign channel conversations', module: 'communication_channels' },\n  /**\n   * Per-user channel ownership (added by the email integration spec).\n   *\n   * Gates the \"Connect my mailbox\" flow on the per-user profile page. Split from\n   * `communication_channels.manage` so policy can disable new linking while\n   * preserving existing accounts (e.g. during a security incident response).\n   * Default-granted to all roles in `setup.ts`.\n   */\n  { id: 'communication_channels.connect_user_channel', title: 'Connect own communication channel', module: 'communication_channels' },\n  /**\n   * Connect a tenant-wide channel (`CommunicationChannel.user_id IS NULL`) that\n   * serves every user in the tenant \u2014 used for push providers (FCM/APNs/Expo)\n   * whose service account / signing key is shared tenant infrastructure. Gates\n   * `POST /channels/connect/tenant-credentials`. Admin/superadmin only: unlike\n   * `connect_user_channel` (everyone links their own mailbox), connecting shared\n   * push credentials is an administrative action.\n   */\n  { id: 'communication_channels.connect_tenant_channel', title: 'Connect tenant-wide communication channel', module: 'communication_channels' },\n  /**\n   * Reserved for a future v2 team-oversight capability. NOT consulted in v1:\n   * personal mailboxes (`CommunicationChannel.user_id` set) follow the strict\n   * owner-only privacy model, so this feature grants NO cross-user channel view.\n   * The admin channels list (`GET /api/communication_channels/channels`) returns\n   * `user_id IS NULL` rows only; personal mailboxes surface exclusively on the\n   * owner's profile page and are never exposed to admins/superadmins in v1.\n   * Granted to `superadmin` + `admin` only so the inert grant is in place ahead\n   * of the audited v2 oversight feature that will re-activate it.\n   */\n  { id: 'communication_channels.admin', title: 'Administer all communication channels (tenant-wide)', module: 'communication_channels' },\n  /**\n   * Trigger the \"Import history\" job for a channel \u2014 fetch older messages\n   * the channel never saw at bootstrap (Spec B \u00A7 Phase B6). Separate from\n   * `manage` so policy can gate bulk historical imports during quiet hours\n   * or cost-controlled rollouts while leaving normal channel CRUD open.\n   */\n  { id: 'communication_channels.channel.import_history', title: 'Import channel history', module: 'communication_channels' },\n  /**\n   * Manage provider push delivery (Spec C \u2014 Gmail Pub/Sub push\n   * subscriptions). Gates the \"Re-register push\" operator button and any\n   * future push-status manipulation. Granted to admin + superadmin only \u2014\n   * regular users don't need to think about whether mail arrives via\n   * push or polling, the system handles it.\n   */\n  { id: 'communication_channels.channel.push.manage', title: 'Manage push delivery', module: 'communication_channels' },\n] as const\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,+BAA+B,OAAO,+BAA+B,QAAQ,yBAAyB;AAAA,EAC5G,EAAE,IAAI,iCAAiC,OAAO,iCAAiC,QAAQ,yBAAyB;AAAA,EAChH,EAAE,IAAI,gCAAgC,OAAO,6BAA6B,QAAQ,yBAAyB;AAAA,EAC3G,EAAE,IAAI,iCAAiC,OAAO,gCAAgC,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS/G,EAAE,IAAI,+CAA+C,OAAO,qCAAqC,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASlI,EAAE,IAAI,iDAAiD,OAAO,6CAA6C,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAW5I,EAAE,IAAI,gCAAgC,OAAO,uDAAuD,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOrI,EAAE,IAAI,iDAAiD,OAAO,0BAA0B,QAAQ,yBAAyB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQzH,EAAE,IAAI,8CAA8C,OAAO,wBAAwB,QAAQ,yBAAyB;AACtH;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/api/delete/admin/channels/[id]/route.js

@@ -0,0 +1,133 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../../../../../data/entities.js";
+import {
+  ChannelAccessDeniedError,
+  assertCanManageChannel,
+  channelOrgScopeWhere
+} from "../../../../../lib/access-control.js";
+import {
+  COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID
+} from "../../../../../commands/admin-delete-channel.js";
+import { validateRouteMutationGuard } from "../../../../../lib/route-mutation-guard.js";
+const metadata = {
+  path: "/communication_channels/admin/channels/[id]",
+  DELETE: {
+    requireAuth: true,
+    requireFeatures: ["communication_channels.admin"]
+  }
+};
+async function DELETE(req, context) {
+  const { id } = await context.params;
+  if (!z.string().uuid().safeParse(id).success) {
+    return NextResponse.json({ error: "Invalid channel id" }, { status: 400 });
+  }
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em").fork();
+  const organizationId = auth.orgId ?? null;
+  const dscope = { tenantId: auth.tenantId, organizationId };
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id,
+      tenantId: auth.tenantId,
+      ...channelOrgScopeWhere(organizationId),
+      deletedAt: null
+    },
+    void 0,
+    dscope
+  );
+  if (!channel || channel.userId != null) {
+    return NextResponse.json({ error: "Channel not found" }, { status: 404 });
+  }
+  let userFeatures = [];
+  try {
+    const rbac = container.resolve("rbacService");
+    const acl = await rbac.loadAcl(auth.sub, {
+      tenantId: auth.tenantId,
+      organizationId
+    });
+    userFeatures = acl?.isSuperAdmin ? ["*"] : Array.isArray(acl?.features) ? acl.features : [];
+  } catch {
+    userFeatures = [];
+  }
+  try {
+    assertCanManageChannel(
+      { userId: channel.userId },
+      auth.sub,
+      userFeatures,
+      "communication_channels.manage"
+    );
+  } catch (err) {
+    if (err instanceof ChannelAccessDeniedError) {
+      return NextResponse.json({ error: "Channel not found" }, { status: 404 });
+    }
+    throw err;
+  }
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: "communication_channels.channel",
+      resourceId: id,
+      operation: "delete"
+    }
+  });
+  if ("response" in guard) return guard.response;
+  const commandBus = container.resolve("commandBus");
+  const channelOrganizationId = channel.organizationId ?? null;
+  const input = {
+    channelId: id,
+    scope: { tenantId: auth.tenantId, organizationId: channelOrganizationId }
+  };
+  const { result } = await commandBus.execute(
+    COMMUNICATION_CHANNELS_ADMIN_DELETE_CHANNEL_COMMAND_ID,
+    {
+      input,
+      ctx: {
+        container,
+        auth,
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: organizationId ? [organizationId] : null
+      }
+    }
+  );
+  if (result.status !== "deleted") {
+    return NextResponse.json({ error: "Channel not found" }, { status: 404 });
+  }
+  await guard.afterSuccess();
+  return new NextResponse(null, { status: 204 });
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    DELETE: {
+      summary: "Admin delete (soft-delete) a tenant-wide communication channel",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 204, description: "Channel deleted" },
+        { status: 400, description: "Invalid channel id" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Channel not found or not a tenant-wide channel" }
+      ]
+    }
+  }
+};
+var route_default = DELETE;
+export {
+  DELETE,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map