@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7179.1.e8c03264b6

package/dist/modules/customer_accounts/setup.js

@@ -1,4 +1,5 @@
 import { hash } from "bcryptjs";
+import { ensureDefaultCustomerRoleAcls } from "@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls";
 import { hashForLookup } from "@open-mercato/shared/lib/encryption/aes";
 import { EXAMPLE_PORTAL_ACCOUNTS } from "@open-mercato/core/modules/customer_accounts/lib/exampleAccounts";
 import {
@@ -102,34 +103,6 @@ const DEFAULT_ROLES = [
 const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
   DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]])
 );
-async function ensureDefaultCustomerRoleAcls(em, tenantId, modules) {
-  const featuresByRole = {};
-  for (const mod of modules) {
-    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures;
-    if (!customerRoleFeatures) continue;
-    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {
-      if (!features || !features.length) continue;
-      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = [];
-      featuresByRole[roleSlug].push(...features);
-    }
-  }
-  const roleSlugs = Object.keys(featuresByRole);
-  if (!roleSlugs.length) return;
-  for (const roleSlug of roleSlugs) {
-    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null });
-    if (!role) continue;
-    const acl = await em.findOne(CustomerRoleAcl, { role: role.id, tenantId });
-    if (!acl) continue;
-    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
-    const merged = Array.from(/* @__PURE__ */ new Set([...currentFeatures, ...featuresByRole[roleSlug]]));
-    const changed = merged.length !== currentFeatures.length || merged.some((value, index) => value !== currentFeatures[index]);
-    if (changed) {
-      acl.featuresJson = merged;
-      em.persist(acl);
-    }
-  }
-  await em.flush();
-}
 async function seedDefaultRoles(em, scope) {
   for (const roleDef of DEFAULT_ROLES) {
     const existing = await em.findOne(CustomerRole, {

package/dist/modules/customer_accounts/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { Module } from '@open-mercato/shared/modules/registry'\nimport { hash } from 'bcryptjs'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\n/**\n * Collect defaultCustomerRoleFeatures from all enabled modules and merge\n * them into the corresponding CustomerRoleAcl records.\n */\nasync function ensureDefaultCustomerRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n): Promise<void> {\n  const featuresByRole: Record<string, string[]> = {}\n\n  for (const mod of modules) {\n    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures\n    if (!customerRoleFeatures) continue\n    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {\n      if (!features || !features.length) continue\n      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []\n      featuresByRole[roleSlug].push(...features)\n    }\n  }\n\n  const roleSlugs = Object.keys(featuresByRole)\n  if (!roleSlugs.length) return\n\n  for (const roleSlug of roleSlugs) {\n    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })\n    if (!role) continue\n\n    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })\n    if (!acl) continue\n\n    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))\n    const changed =\n      merged.length !== currentFeatures.length ||\n      merged.some((value, index) => value !== currentFeatures[index])\n    if (changed) {\n      acl.featuresJson = merged\n      em.persist(acl)\n    }\n  }\n  await em.flush()\n}\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAGA,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAMA,eAAe,8BACb,IACA,UACA,SACe;AACf,QAAM,iBAA2C,CAAC;AAElD,aAAW,OAAO,SAAS;AACzB,UAAM,uBAAuB,IAAI,OAAO;AACxC,QAAI,CAAC,qBAAsB;AAC3B,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,oBAAoB,GAAG;AACvE,UAAI,CAAC,YAAY,CAAC,SAAS,OAAQ;AACnC,UAAI,CAAC,eAAe,QAAQ,EAAG,gBAAe,QAAQ,IAAI,CAAC;AAC3D,qBAAe,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,KAAK,cAAc;AAC5C,MAAI,CAAC,UAAU,OAAQ;AAEvB,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK,CAAC;AACzF,QAAI,CAAC,KAAM;AAEX,UAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB,EAAE,MAAM,KAAK,IAAW,SAAS,CAAC;AAChF,QAAI,CAAC,IAAK;AAEV,UAAM,kBAAkB,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAC9E,UAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC;AACpF,UAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,QAAI,SAAS;AACX,UAAI,eAAe;AACnB,SAAG,QAAQ,GAAG;AAAA,IAChB;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport { ensureDefaultCustomerRoleAcls } from '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAEA,SAAS,YAAY;AACrB,SAAS,qCAAqC;AAC9C,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/staff/acl.js

@@ -16,7 +16,15 @@ const features = [
   { id: "staff.timesheets.projects.manage", title: "Manage time projects", module: "staff" },
   // Timesheets (Phase 2)
   { id: "staff.timesheets.approve", title: "Approve reportee time", module: "staff" },
-  { id: "staff.timesheets.lock", title: "Lock time periods", module: "staff" }
+  { id: "staff.timesheets.lock", title: "Lock time periods", module: "staff" },
+  // Time tracking (Phase 2)
+  { id: "staff.timesheets.tasks.view", title: "View tasks", module: "staff" },
+  { id: "staff.timesheets.tasks.manage", title: "Create/edit tasks", module: "staff" },
+  { id: "staff.timesheets.reports.view", title: "View customer reports", module: "staff" },
+  { id: "staff.timesheets.reports.manage", title: "Create/edit customer reports", module: "staff" },
+  { id: "staff.timesheets.reports.unlock", title: "Unlock reported entries", module: "staff" },
+  { id: "staff.timesheets.settings.manage", title: "Manage time tracking settings", module: "staff" },
+  { id: "staff.timesheets.rates.view", title: "View rates and cost", module: "staff" }
 ];
 var acl_default = features;
 export {

package/dist/modules/staff/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/staff/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'staff.view', title: 'View employees', module: 'staff' },\n  { id: 'staff.manage_team', title: 'Manage employees', module: 'staff' },\n  { id: 'staff.leave_requests.send', title: 'Send leave requests', module: 'staff' },\n  { id: 'staff.leave_requests.manage', title: 'Manage leave requests', module: 'staff' },\n  { id: 'staff.my_availability.view', title: 'View my availability', module: 'staff' },\n  { id: 'staff.my_availability.manage', title: 'Manage my availability', module: 'staff' },\n  { id: 'staff.my_availability.unavailability', title: 'Manage my unavailability', module: 'staff' },\n  { id: 'staff.my_leave_requests.view', title: 'View my leave requests', module: 'staff' },\n  { id: 'staff.my_leave_requests.send', title: 'Send my leave requests', module: 'staff' },\n\n  // Timesheets (Phase 1)\n  { id: 'staff.timesheets.view', title: 'View own time entries', module: 'staff' },\n  { id: 'staff.timesheets.manage_own', title: 'Create/edit/delete own entries', module: 'staff' },\n  { id: 'staff.timesheets.manage_all', title: 'Manage all employees entries', module: 'staff' },\n  { id: 'staff.timesheets.projects.view', title: 'View time projects', module: 'staff' },\n  { id: 'staff.timesheets.projects.manage', title: 'Manage time projects', module: 'staff' },\n\n  // Timesheets (Phase 2)\n  { id: 'staff.timesheets.approve', title: 'Approve reportee time', module: 'staff' },\n  { id: 'staff.timesheets.lock', title: 'Lock time periods', module: 'staff' },\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,cAAc,OAAO,kBAAkB,QAAQ,QAAQ;AAAA,EAC7D,EAAE,IAAI,qBAAqB,OAAO,oBAAoB,QAAQ,QAAQ;AAAA,EACtE,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,QAAQ;AAAA,EACjF,EAAE,IAAI,+BAA+B,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EACrF,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,QAAQ,QAAQ;AAAA,EACnF,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA,EACvF,EAAE,IAAI,wCAAwC,OAAO,4BAA4B,QAAQ,QAAQ;AAAA,EACjG,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA,EACvF,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA;AAAA,EAGvF,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EAC/E,EAAE,IAAI,+BAA+B,OAAO,kCAAkC,QAAQ,QAAQ;AAAA,EAC9F,EAAE,IAAI,+BAA+B,OAAO,gCAAgC,QAAQ,QAAQ;AAAA,EAC5F,EAAE,IAAI,kCAAkC,OAAO,sBAAsB,QAAQ,QAAQ;AAAA,EACrF,EAAE,IAAI,oCAAoC,OAAO,wBAAwB,QAAQ,QAAQ;AAAA;AAAA,EAGzF,EAAE,IAAI,4BAA4B,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EAClF,EAAE,IAAI,yBAAyB,OAAO,qBAAqB,QAAQ,QAAQ;AAC7E;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["export const features = [\n  { id: 'staff.view', title: 'View employees', module: 'staff' },\n  { id: 'staff.manage_team', title: 'Manage employees', module: 'staff' },\n  { id: 'staff.leave_requests.send', title: 'Send leave requests', module: 'staff' },\n  { id: 'staff.leave_requests.manage', title: 'Manage leave requests', module: 'staff' },\n  { id: 'staff.my_availability.view', title: 'View my availability', module: 'staff' },\n  { id: 'staff.my_availability.manage', title: 'Manage my availability', module: 'staff' },\n  { id: 'staff.my_availability.unavailability', title: 'Manage my unavailability', module: 'staff' },\n  { id: 'staff.my_leave_requests.view', title: 'View my leave requests', module: 'staff' },\n  { id: 'staff.my_leave_requests.send', title: 'Send my leave requests', module: 'staff' },\n\n  // Timesheets (Phase 1)\n  { id: 'staff.timesheets.view', title: 'View own time entries', module: 'staff' },\n  { id: 'staff.timesheets.manage_own', title: 'Create/edit/delete own entries', module: 'staff' },\n  { id: 'staff.timesheets.manage_all', title: 'Manage all employees entries', module: 'staff' },\n  { id: 'staff.timesheets.projects.view', title: 'View time projects', module: 'staff' },\n  { id: 'staff.timesheets.projects.manage', title: 'Manage time projects', module: 'staff' },\n\n  // Timesheets (Phase 2)\n  { id: 'staff.timesheets.approve', title: 'Approve reportee time', module: 'staff' },\n  { id: 'staff.timesheets.lock', title: 'Lock time periods', module: 'staff' },\n\n  // Time tracking (Phase 2)\n  { id: 'staff.timesheets.tasks.view', title: 'View tasks', module: 'staff' },\n  { id: 'staff.timesheets.tasks.manage', title: 'Create/edit tasks', module: 'staff' },\n  { id: 'staff.timesheets.reports.view', title: 'View customer reports', module: 'staff' },\n  { id: 'staff.timesheets.reports.manage', title: 'Create/edit customer reports', module: 'staff' },\n  { id: 'staff.timesheets.reports.unlock', title: 'Unlock reported entries', module: 'staff' },\n  { id: 'staff.timesheets.settings.manage', title: 'Manage time tracking settings', module: 'staff' },\n  { id: 'staff.timesheets.rates.view', title: 'View rates and cost', module: 'staff' },\n]\n\nexport default features\n"],
+  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,cAAc,OAAO,kBAAkB,QAAQ,QAAQ;AAAA,EAC7D,EAAE,IAAI,qBAAqB,OAAO,oBAAoB,QAAQ,QAAQ;AAAA,EACtE,EAAE,IAAI,6BAA6B,OAAO,uBAAuB,QAAQ,QAAQ;AAAA,EACjF,EAAE,IAAI,+BAA+B,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EACrF,EAAE,IAAI,8BAA8B,OAAO,wBAAwB,QAAQ,QAAQ;AAAA,EACnF,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA,EACvF,EAAE,IAAI,wCAAwC,OAAO,4BAA4B,QAAQ,QAAQ;AAAA,EACjG,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA,EACvF,EAAE,IAAI,gCAAgC,OAAO,0BAA0B,QAAQ,QAAQ;AAAA;AAAA,EAGvF,EAAE,IAAI,yBAAyB,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EAC/E,EAAE,IAAI,+BAA+B,OAAO,kCAAkC,QAAQ,QAAQ;AAAA,EAC9F,EAAE,IAAI,+BAA+B,OAAO,gCAAgC,QAAQ,QAAQ;AAAA,EAC5F,EAAE,IAAI,kCAAkC,OAAO,sBAAsB,QAAQ,QAAQ;AAAA,EACrF,EAAE,IAAI,oCAAoC,OAAO,wBAAwB,QAAQ,QAAQ;AAAA;AAAA,EAGzF,EAAE,IAAI,4BAA4B,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EAClF,EAAE,IAAI,yBAAyB,OAAO,qBAAqB,QAAQ,QAAQ;AAAA;AAAA,EAG3E,EAAE,IAAI,+BAA+B,OAAO,cAAc,QAAQ,QAAQ;AAAA,EAC1E,EAAE,IAAI,iCAAiC,OAAO,qBAAqB,QAAQ,QAAQ;AAAA,EACnF,EAAE,IAAI,iCAAiC,OAAO,yBAAyB,QAAQ,QAAQ;AAAA,EACvF,EAAE,IAAI,mCAAmC,OAAO,gCAAgC,QAAQ,QAAQ;AAAA,EAChG,EAAE,IAAI,mCAAmC,OAAO,2BAA2B,QAAQ,QAAQ;AAAA,EAC3F,EAAE,IAAI,oCAAoC,OAAO,iCAAiC,QAAQ,QAAQ;AAAA,EAClG,EAAE,IAAI,+BAA+B,OAAO,uBAAuB,QAAQ,QAAQ;AACrF;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/staff/ai-agents.js

@@ -0,0 +1,142 @@
+const AGENT_ID = "staff.time_tracking_assistant";
+const MODULE_ID = "staff";
+const ALLOWED_TOOLS = [
+  "staff.summarize_week",
+  "staff.find_missing_days",
+  "staff.draft_client_report",
+  "staff.log_time",
+  "staff.start_timer",
+  "staff.stop_timer",
+  "meta.describe_agent"
+];
+const REQUIRED_FEATURES = ["staff.timesheets.view"];
+const PROMPT_SECTIONS = [
+  {
+    name: "role",
+    order: 1,
+    content: [
+      "ROLE",
+      "You are the Time Tracking Assistant inside Open Mercato. You help one person",
+      "keep their own timesheet honest: logging work they did, starting and stopping",
+      "timers, summarizing what they logged, and spotting days they missed."
+    ].join("\n")
+  },
+  {
+    name: "scope",
+    order: 2,
+    content: [
+      "SCOPE",
+      "You act as the signed-in user and nobody else. No tool accepts another",
+      "person's staff member id, and you must never offer to log time for a",
+      "colleague \u2014 that is a backoffice action on /backend/staff/time-tracking.",
+      "Respect tenant and organization isolation; the tools enforce it, do not try",
+      "to work around a refusal.",
+      'Act, do not interrogate. "How did my week go?" is a call to',
+      "staff.summarize_week with the current week, not a request for clarification."
+    ].join("\n")
+  },
+  {
+    name: "data",
+    order: 3,
+    content: [
+      "DATA",
+      "You can read the signed-in user's time entries and preview a customer",
+      "report over projects they can already see. All durations are MINUTES.",
+      "You never see rates, costs or amounts: they are gated on a feature this",
+      "agent does not carry, and staff.draft_client_report deliberately asks for a",
+      "preview without them. If the operator asks what something is worth, say the",
+      "figures are on the report screen and give the hours instead.",
+      "Never invent a project id, a task id or a time entry id. Use only ids a",
+      "previous tool call returned."
+    ].join("\n")
+  },
+  {
+    name: "tools",
+    order: 4,
+    content: [
+      "TOOLS",
+      "- staff.summarize_week \u2014 totals per day and per project for a date range.",
+      "- staff.find_missing_days \u2014 days in a range with no logged time.",
+      "- staff.draft_client_report \u2014 what a customer report would contain, without",
+      "  creating one. Nothing is written and nothing is locked.",
+      "- staff.log_time \u2014 create one time entry.",
+      "- staff.start_timer / staff.stop_timer \u2014 begin and end a running timer.",
+      "Prefer the narrowest tool. If a read returns nothing after two different",
+      "ranges, say what you looked for and stop."
+    ].join("\n")
+  },
+  {
+    name: "attachments",
+    order: 5,
+    content: [
+      "ATTACHMENTS",
+      "This agent takes no attachments. If the operator attaches a file, say you",
+      "cannot read it here and point at the time-tracking screens."
+    ].join("\n")
+  },
+  {
+    name: "mutationPolicy",
+    order: 6,
+    content: [
+      "MUTATION POLICY",
+      "staff.log_time, staff.start_timer and staff.stop_timer are mutations. The",
+      "runtime short-circuits each call into an approval card; the write happens",
+      "only after the operator confirms it. Do NOT say the time was logged until a",
+      "mutation-result-card comes back \u2014 say you have prepared it for confirmation.",
+      "Never batch several days into one call hoping they slip through as one",
+      "approval; log one entry per call so each is reviewable.",
+      "If a per-tenant override has downgraded this agent to read-only, the runtime",
+      "refuses the call: tell the operator writes are locked for this tenant and",
+      "point at /backend/staff/time-tracking/timesheet."
+    ].join("\n")
+  },
+  {
+    name: "responseStyle",
+    order: 7,
+    content: [
+      "RESPONSE STYLE",
+      'Answer in hours and minutes, not raw minute counts: 450 minutes is "7h 30m".',
+      "Lead with the number the operator asked for, then the breakdown.",
+      "When you report missing days, list the dates plainly and offer to log them \u2014",
+      "one entry per confirmation.",
+      "Keep it short. A timesheet answer is two or three sentences plus a list."
+    ].join("\n")
+  }
+];
+function compilePromptTemplate(template) {
+  return template.sections.slice().sort((left, right) => left.order - right.order).map((section) => section.content.trim()).join("\n\n");
+}
+const promptTemplate = {
+  id: `${AGENT_ID}.prompt`,
+  sections: PROMPT_SECTIONS
+};
+const agent = {
+  id: AGENT_ID,
+  moduleId: MODULE_ID,
+  label: "Time Tracking Assistant",
+  description: "Logs your time, runs your timer, summarizes what you logged and finds the days you missed. Every write goes through the approval card.",
+  systemPrompt: compilePromptTemplate(promptTemplate),
+  allowedTools: [...ALLOWED_TOOLS],
+  executionMode: "chat",
+  requiredFeatures: [...REQUIRED_FEATURES],
+  readOnly: false,
+  mutationPolicy: "confirm-required",
+  keywords: ["time tracking", "timesheet", "timer", "hours", "timesheets"],
+  domain: "staff",
+  dataCapabilities: {
+    entities: ["staff.staff_time_entry", "staff.staff_time_project", "staff.staff_time_report"],
+    operations: ["read"]
+  },
+  suggestions: [
+    { label: "Summarize my week", prompt: "Summarize the hours I logged this week, per project." },
+    { label: "Find missing days", prompt: "Which working days this month have no time logged?" }
+  ]
+};
+const aiAgents = [agent];
+var ai_agents_default = aiAgents;
+export {
+  aiAgents,
+  ai_agents_default as default,
+  promptTemplate
+};
+//# sourceMappingURL=ai-agents.js.map

package/dist/modules/staff/ai-agents.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/staff/ai-agents.ts"],
+  "sourcesContent": ["/**\n * EP-49 \u2014 `staff.time_tracking_assistant`.\n *\n * A write-capable chat agent over the time-tracking tool pack. Its whole reason\n * to exist is the sentence \"log yesterday afternoon on the Acme migration\" \u2014\n * which is a mutation, so the agent ships `mutationPolicy: 'confirm-required'`\n * and every write surfaces as an approval card before it persists. A per-tenant\n * override can downgrade it to `read-only`, in which case the runtime filters the\n * three write tools out before the model ever sees them.\n *\n * `requiredFeatures` is the read floor. Each individual tool re-declares its own\n * `staff.timesheets.*` gate, and the API operation runner refuses a route whose\n * required features the tool does not carry, so a viewer who reaches the agent\n * still cannot reach `staff.log_time`.\n *\n * The prompt is a structured `PromptTemplate` with the seven named sections the\n * override system addresses by name.\n */\nimport type { AiAgentDefinition } from '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-agent-definition'\n\ntype PromptSectionName =\n  | 'role'\n  | 'scope'\n  | 'data'\n  | 'tools'\n  | 'attachments'\n  | 'mutationPolicy'\n  | 'responseStyle'\n\ninterface PromptSection {\n  name: PromptSectionName\n  content: string\n  order: number\n}\n\ninterface PromptTemplate {\n  id: string\n  sections: PromptSection[]\n}\n\nconst AGENT_ID = 'staff.time_tracking_assistant'\nconst MODULE_ID = 'staff'\n\nconst ALLOWED_TOOLS: readonly string[] = [\n  'staff.summarize_week',\n  'staff.find_missing_days',\n  'staff.draft_client_report',\n  'staff.log_time',\n  'staff.start_timer',\n  'staff.stop_timer',\n  'meta.describe_agent',\n]\n\nconst REQUIRED_FEATURES: readonly string[] = ['staff.timesheets.view']\n\nconst PROMPT_SECTIONS: PromptSection[] = [\n  {\n    name: 'role',\n    order: 1,\n    content: [\n      'ROLE',\n      'You are the Time Tracking Assistant inside Open Mercato. You help one person',\n      'keep their own timesheet honest: logging work they did, starting and stopping',\n      'timers, summarizing what they logged, and spotting days they missed.',\n    ].join('\\n'),\n  },\n  {\n    name: 'scope',\n    order: 2,\n    content: [\n      'SCOPE',\n      'You act as the signed-in user and nobody else. No tool accepts another',\n      \"person's staff member id, and you must never offer to log time for a\",\n      'colleague \u2014 that is a backoffice action on /backend/staff/time-tracking.',\n      'Respect tenant and organization isolation; the tools enforce it, do not try',\n      'to work around a refusal.',\n      'Act, do not interrogate. \"How did my week go?\" is a call to',\n      'staff.summarize_week with the current week, not a request for clarification.',\n    ].join('\\n'),\n  },\n  {\n    name: 'data',\n    order: 3,\n    content: [\n      'DATA',\n      'You can read the signed-in user\\'s time entries and preview a customer',\n      'report over projects they can already see. All durations are MINUTES.',\n      'You never see rates, costs or amounts: they are gated on a feature this',\n      'agent does not carry, and staff.draft_client_report deliberately asks for a',\n      'preview without them. If the operator asks what something is worth, say the',\n      'figures are on the report screen and give the hours instead.',\n      'Never invent a project id, a task id or a time entry id. Use only ids a',\n      'previous tool call returned.',\n    ].join('\\n'),\n  },\n  {\n    name: 'tools',\n    order: 4,\n    content: [\n      'TOOLS',\n      '- staff.summarize_week \u2014 totals per day and per project for a date range.',\n      '- staff.find_missing_days \u2014 days in a range with no logged time.',\n      '- staff.draft_client_report \u2014 what a customer report would contain, without',\n      '  creating one. Nothing is written and nothing is locked.',\n      '- staff.log_time \u2014 create one time entry.',\n      '- staff.start_timer / staff.stop_timer \u2014 begin and end a running timer.',\n      'Prefer the narrowest tool. If a read returns nothing after two different',\n      'ranges, say what you looked for and stop.',\n    ].join('\\n'),\n  },\n  {\n    name: 'attachments',\n    order: 5,\n    content: [\n      'ATTACHMENTS',\n      'This agent takes no attachments. If the operator attaches a file, say you',\n      'cannot read it here and point at the time-tracking screens.',\n    ].join('\\n'),\n  },\n  {\n    name: 'mutationPolicy',\n    order: 6,\n    content: [\n      'MUTATION POLICY',\n      'staff.log_time, staff.start_timer and staff.stop_timer are mutations. The',\n      'runtime short-circuits each call into an approval card; the write happens',\n      'only after the operator confirms it. Do NOT say the time was logged until a',\n      'mutation-result-card comes back \u2014 say you have prepared it for confirmation.',\n      'Never batch several days into one call hoping they slip through as one',\n      'approval; log one entry per call so each is reviewable.',\n      'If a per-tenant override has downgraded this agent to read-only, the runtime',\n      'refuses the call: tell the operator writes are locked for this tenant and',\n      'point at /backend/staff/time-tracking/timesheet.',\n    ].join('\\n'),\n  },\n  {\n    name: 'responseStyle',\n    order: 7,\n    content: [\n      'RESPONSE STYLE',\n      'Answer in hours and minutes, not raw minute counts: 450 minutes is \"7h 30m\".',\n      'Lead with the number the operator asked for, then the breakdown.',\n      'When you report missing days, list the dates plainly and offer to log them \u2014',\n      'one entry per confirmation.',\n      'Keep it short. A timesheet answer is two or three sentences plus a list.',\n    ].join('\\n'),\n  },\n]\n\nfunction compilePromptTemplate(template: PromptTemplate): string {\n  return template.sections\n    .slice()\n    .sort((left, right) => left.order - right.order)\n    .map((section) => section.content.trim())\n    .join('\\n\\n')\n}\n\nexport const promptTemplate: PromptTemplate = {\n  id: `${AGENT_ID}.prompt`,\n  sections: PROMPT_SECTIONS,\n}\n\nconst agent: AiAgentDefinition = {\n  id: AGENT_ID,\n  moduleId: MODULE_ID,\n  label: 'Time Tracking Assistant',\n  description:\n    'Logs your time, runs your timer, summarizes what you logged and finds the days you missed. Every write goes through the approval card.',\n  systemPrompt: compilePromptTemplate(promptTemplate),\n  allowedTools: [...ALLOWED_TOOLS],\n  executionMode: 'chat',\n  requiredFeatures: [...REQUIRED_FEATURES],\n  readOnly: false,\n  mutationPolicy: 'confirm-required',\n  keywords: ['time tracking', 'timesheet', 'timer', 'hours', 'timesheets'],\n  domain: 'staff',\n  dataCapabilities: {\n    entities: ['staff.staff_time_entry', 'staff.staff_time_project', 'staff.staff_time_report'],\n    operations: ['read'],\n  },\n  suggestions: [\n    { label: 'Summarize my week', prompt: 'Summarize the hours I logged this week, per project.' },\n    { label: 'Find missing days', prompt: 'Which working days this month have no time logged?' },\n  ],\n}\n\nexport const aiAgents: AiAgentDefinition[] = [agent]\n\nexport default aiAgents\n"],
+  "mappings": "AAwCA,MAAM,WAAW;AACjB,MAAM,YAAY;AAElB,MAAM,gBAAmC;AAAA,EACvC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,oBAAuC,CAAC,uBAAuB;AAErE,MAAM,kBAAmC;AAAA,EACvC;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,OAAO;AAAA,IACP,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAEA,SAAS,sBAAsB,UAAkC;AAC/D,SAAO,SAAS,SACb,MAAM,EACN,KAAK,CAAC,MAAM,UAAU,KAAK,QAAQ,MAAM,KAAK,EAC9C,IAAI,CAAC,YAAY,QAAQ,QAAQ,KAAK,CAAC,EACvC,KAAK,MAAM;AAChB;AAEO,MAAM,iBAAiC;AAAA,EAC5C,IAAI,GAAG,QAAQ;AAAA,EACf,UAAU;AACZ;AAEA,MAAM,QAA2B;AAAA,EAC/B,IAAI;AAAA,EACJ,UAAU;AAAA,EACV,OAAO;AAAA,EACP,aACE;AAAA,EACF,cAAc,sBAAsB,cAAc;AAAA,EAClD,cAAc,CAAC,GAAG,aAAa;AAAA,EAC/B,eAAe;AAAA,EACf,kBAAkB,CAAC,GAAG,iBAAiB;AAAA,EACvC,UAAU;AAAA,EACV,gBAAgB;AAAA,EAChB,UAAU,CAAC,iBAAiB,aAAa,SAAS,SAAS,YAAY;AAAA,EACvE,QAAQ;AAAA,EACR,kBAAkB;AAAA,IAChB,UAAU,CAAC,0BAA0B,4BAA4B,yBAAyB;AAAA,IAC1F,YAAY,CAAC,MAAM;AAAA,EACrB;AAAA,EACA,aAAa;AAAA,IACX,EAAE,OAAO,qBAAqB,QAAQ,uDAAuD;AAAA,IAC7F,EAAE,OAAO,qBAAqB,QAAQ,qDAAqD;AAAA,EAC7F;AACF;AAEO,MAAM,WAAgC,CAAC,KAAK;AAEnD,IAAO,oBAAQ;",
+  "names": []
+}