@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/dist/modules/customer_accounts/setup.js

@@ -1,4 +1,5 @@
 import { hash } from "bcryptjs";
+import { ensureDefaultCustomerRoleAcls } from "@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls";
 import { hashForLookup } from "@open-mercato/shared/lib/encryption/aes";
 import { EXAMPLE_PORTAL_ACCOUNTS } from "@open-mercato/core/modules/customer_accounts/lib/exampleAccounts";
 import {
@@ -102,34 +103,6 @@ const DEFAULT_ROLES = [
 const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
   DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]])
 );
-async function ensureDefaultCustomerRoleAcls(em, tenantId, modules) {
-  const featuresByRole = {};
-  for (const mod of modules) {
-    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures;
-    if (!customerRoleFeatures) continue;
-    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {
-      if (!features || !features.length) continue;
-      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = [];
-      featuresByRole[roleSlug].push(...features);
-    }
-  }
-  const roleSlugs = Object.keys(featuresByRole);
-  if (!roleSlugs.length) return;
-  for (const roleSlug of roleSlugs) {
-    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null });
-    if (!role) continue;
-    const acl = await em.findOne(CustomerRoleAcl, { role: role.id, tenantId });
-    if (!acl) continue;
-    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
-    const merged = Array.from(/* @__PURE__ */ new Set([...currentFeatures, ...featuresByRole[roleSlug]]));
-    const changed = merged.length !== currentFeatures.length || merged.some((value, index) => value !== currentFeatures[index]);
-    if (changed) {
-      acl.featuresJson = merged;
-      em.persist(acl);
-    }
-  }
-  await em.flush();
-}
 async function seedDefaultRoles(em, scope) {
   for (const roleDef of DEFAULT_ROLES) {
     const existing = await em.findOne(CustomerRole, {

package/dist/modules/customer_accounts/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { Module } from '@open-mercato/shared/modules/registry'\nimport { hash } from 'bcryptjs'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\n/**\n * Collect defaultCustomerRoleFeatures from all enabled modules and merge\n * them into the corresponding CustomerRoleAcl records.\n */\nasync function ensureDefaultCustomerRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n): Promise<void> {\n  const featuresByRole: Record<string, string[]> = {}\n\n  for (const mod of modules) {\n    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures\n    if (!customerRoleFeatures) continue\n    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {\n      if (!features || !features.length) continue\n      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []\n      featuresByRole[roleSlug].push(...features)\n    }\n  }\n\n  const roleSlugs = Object.keys(featuresByRole)\n  if (!roleSlugs.length) return\n\n  for (const roleSlug of roleSlugs) {\n    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })\n    if (!role) continue\n\n    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })\n    if (!acl) continue\n\n    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))\n    const changed =\n      merged.length !== currentFeatures.length ||\n      merged.some((value, index) => value !== currentFeatures[index])\n    if (changed) {\n      acl.featuresJson = merged\n      em.persist(acl)\n    }\n  }\n  await em.flush()\n}\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAGA,SAAS,YAAY;AACrB,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAMA,eAAe,8BACb,IACA,UACA,SACe;AACf,QAAM,iBAA2C,CAAC;AAElD,aAAW,OAAO,SAAS;AACzB,UAAM,uBAAuB,IAAI,OAAO;AACxC,QAAI,CAAC,qBAAsB;AAC3B,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,oBAAoB,GAAG;AACvE,UAAI,CAAC,YAAY,CAAC,SAAS,OAAQ;AACnC,UAAI,CAAC,eAAe,QAAQ,EAAG,gBAAe,QAAQ,IAAI,CAAC;AAC3D,qBAAe,QAAQ,EAAE,KAAK,GAAG,QAAQ;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,YAAY,OAAO,KAAK,cAAc;AAC5C,MAAI,CAAC,UAAU,OAAQ;AAEvB,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK,CAAC;AACzF,QAAI,CAAC,KAAM;AAEX,UAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB,EAAE,MAAM,KAAK,IAAW,SAAS,CAAC;AAChF,QAAI,CAAC,IAAK;AAEV,UAAM,kBAAkB,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAC9E,UAAM,SAAS,MAAM,KAAK,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,eAAe,QAAQ,CAAC,CAAC,CAAC;AACpF,UAAM,UACJ,OAAO,WAAW,gBAAgB,UAClC,OAAO,KAAK,CAAC,OAAO,UAAU,UAAU,gBAAgB,KAAK,CAAC;AAChE,QAAI,SAAS;AACX,UAAI,eAAe;AACnB,SAAG,QAAQ,GAAG;AAAA,IAChB;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AACjB;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport { ensureDefaultCustomerRoleAcls } from '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAEA,SAAS,YAAY;AACrB,SAAS,qCAAqC;AAC9C,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/data_sync/api/options.js

@@ -4,6 +4,7 @@ import { organizationScopeRequiredResponse, resolveActiveOrganizationId } from "
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAllIntegrations } from "@open-mercato/shared/modules/integrations/types";
 import { getDataSyncAdapter } from "../lib/adapter-registry.js";
+import { resolveStartControlMap } from "../lib/start-controls.js";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["data_sync.view"] }
 };
@@ -42,6 +43,7 @@ async function GET(req) {
         canStartRun: adapter.runMode !== "provider",
         supportedEntities: adapter.supportedEntities,
         runParameters: adapter.runParameters ?? [],
+        startControls: resolveStartControlMap(adapter),
         hasCredentials: Boolean(credentials),
         isEnabled,
         settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`

package/dist/modules/data_sync/api/options.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/data_sync/api/options.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          runParameters: adapter.runParameters ?? [],\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AAE5B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,eAAe,QAAQ,iBAAiB,CAAC;AAAA,QACzC,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { organizationScopeRequiredResponse, resolveActiveOrganizationId } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAllIntegrations } from '@open-mercato/shared/modules/integrations/types'\nimport type { CredentialsService } from '../../integrations/lib/credentials-service'\nimport type { IntegrationStateService } from '../../integrations/lib/state-service'\nimport { getDataSyncAdapter } from '../lib/adapter-registry'\nimport { resolveStartControlMap } from '../lib/start-controls'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['data_sync.view'] },\n}\n\nexport const openApi = {\n  tags: ['DataSync'],\n  summary: 'List data sync integration options',\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) {\n    return organizationScopeRequiredResponse()\n  }\n\n  const container = await createRequestContainer()\n  const credentialsService = container.resolve('integrationCredentialsService') as CredentialsService\n  const stateService = container.resolve('integrationStateService') as IntegrationStateService\n  const scope = { organizationId, tenantId: auth.tenantId }\n\n  const items = await Promise.all(\n    getAllIntegrations()\n      .filter((integration) => integration.hub === 'data_sync' && integration.providerKey)\n      .map(async (integration) => {\n        const adapter = getDataSyncAdapter(integration.providerKey as string)\n        if (!adapter) return null\n\n        const [credentials, isEnabled] = await Promise.all([\n          credentialsService.resolve(integration.id, scope).catch(() => null),\n          stateService\n            .resolveState(integration.id, scope)\n            .then((state) => state.isEnabled)\n            .catch(() => false),\n        ])\n\n        return {\n          integrationId: integration.id,\n          title: integration.title,\n          description: integration.description ?? null,\n          providerKey: integration.providerKey ?? null,\n          direction: adapter.direction,\n          runMode: adapter.runMode ?? 'generic',\n          canStartRun: adapter.runMode !== 'provider',\n          supportedEntities: adapter.supportedEntities,\n          runParameters: adapter.runParameters ?? [],\n          startControls: resolveStartControlMap(adapter),\n          hasCredentials: Boolean(credentials),\n          isEnabled,\n          settingsPath: `/backend/integrations/${encodeURIComponent(integration.id)}`,\n        }\n      }),\n  )\n\n  return NextResponse.json({\n    items: items.filter((item): item is NonNullable<typeof item> => Boolean(item)),\n  })\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,mCAAmC,mCAAmC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEhC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAChE;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,UAAU;AAAA,EACjB,SAAS;AACX;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,UAAU;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,gBAAgB;AACnB,WAAO,kCAAkC;AAAA,EAC3C;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,QAAM,eAAe,UAAU,QAAQ,yBAAyB;AAChE,QAAM,QAAQ,EAAE,gBAAgB,UAAU,KAAK,SAAS;AAExD,QAAM,QAAQ,MAAM,QAAQ;AAAA,IAC1B,mBAAmB,EAChB,OAAO,CAAC,gBAAgB,YAAY,QAAQ,eAAe,YAAY,WAAW,EAClF,IAAI,OAAO,gBAAgB;AAC1B,YAAM,UAAU,mBAAmB,YAAY,WAAqB;AACpE,UAAI,CAAC,QAAS,QAAO;AAErB,YAAM,CAAC,aAAa,SAAS,IAAI,MAAM,QAAQ,IAAI;AAAA,QACjD,mBAAmB,QAAQ,YAAY,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAAA,QAClE,aACG,aAAa,YAAY,IAAI,KAAK,EAClC,KAAK,CAAC,UAAU,MAAM,SAAS,EAC/B,MAAM,MAAM,KAAK;AAAA,MACtB,CAAC;AAED,aAAO;AAAA,QACL,eAAe,YAAY;AAAA,QAC3B,OAAO,YAAY;AAAA,QACnB,aAAa,YAAY,eAAe;AAAA,QACxC,aAAa,YAAY,eAAe;AAAA,QACxC,WAAW,QAAQ;AAAA,QACnB,SAAS,QAAQ,WAAW;AAAA,QAC5B,aAAa,QAAQ,YAAY;AAAA,QACjC,mBAAmB,QAAQ;AAAA,QAC3B,eAAe,QAAQ,iBAAiB,CAAC;AAAA,QACzC,eAAe,uBAAuB,OAAO;AAAA,QAC7C,gBAAgB,QAAQ,WAAW;AAAA,QACnC;AAAA,QACA,cAAc,yBAAyB,mBAAmB,YAAY,EAAE,CAAC;AAAA,MAC3E;AAAA,IACF,CAAC;AAAA,EACL;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,MAAM,OAAO,CAAC,SAA2C,QAAQ,IAAI,CAAC;AAAA,EAC/E,CAAC;AACH;",
   "names": []
 }

package/dist/modules/data_sync/backend/data-sync/page.js

@@ -30,6 +30,7 @@ import { surfaceRecordConflict } from "@open-mercato/ui/backend/conflicts";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useOrganizationScopeVersion } from "@open-mercato/shared/lib/frontend/useOrganizationScope";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { cn } from "@open-mercato/shared/lib/utils";
 import {
   ArrowRightLeft,
   Boxes,
@@ -44,6 +45,9 @@ import {
 } from "lucide-react";
 import { getSyncRunStatusVariant, getSyncSummaryVariant } from "../../lib/syncRunStatus.js";
 import { getApplicableRunParameters } from "../../lib/run-parameters.js";
+import {
+  applicableStartControls
+} from "../../lib/start-controls.js";
 import {
   RunParameterFields,
   buildDefaultRunParameterValues,
@@ -52,6 +56,12 @@ import {
   buildRunParametersPayload
 } from "../../components/RunParameterFields.js";
 const DEFAULT_TIMEZONE = Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+const DEFAULT_BATCH_SIZE = "100";
+function startControlsGridClass(controls) {
+  if (controls.batchSize && controls.fullSync) return "sm:grid-cols-[minmax(0,180px)_1fr]";
+  if (controls.batchSize) return "sm:grid-cols-[minmax(0,180px)]";
+  return void 0;
+}
 function formatEntityTypeLabel(entityType) {
   return entityType.replace(/[_-]+/g, " ").replace(/\b\w/g, (letter) => letter.toUpperCase());
 }
@@ -83,7 +93,7 @@ function SyncRunsDashboardPage() {
   const [selectedIntegrationId, setSelectedIntegrationId] = React.useState("");
   const [selectedEntityType, setSelectedEntityType] = React.useState("");
   const [selectedDirection, setSelectedDirection] = React.useState("import");
-  const [batchSize, setBatchSize] = React.useState("100");
+  const [batchSize, setBatchSize] = React.useState(DEFAULT_BATCH_SIZE);
   const [fullSync, setFullSync] = React.useState(false);
   const [paramValues, setParamValues] = React.useState({});
   const [scheduleEditor, setScheduleEditor] = React.useState(() => buildDefaultScheduleState(""));
@@ -178,9 +188,19 @@ function SyncRunsDashboardPage() {
     ),
     [selectedIntegration, selectedDirection, selectedEntityType]
   );
+  const startControls = React.useMemo(
+    () => applicableStartControls(selectedIntegration?.startControls, selectedEntityType),
+    [selectedIntegration, selectedEntityType]
+  );
   React.useEffect(() => {
     setParamValues(buildDefaultRunParameterValues(runParameters));
   }, [runParameters]);
+  React.useEffect(() => {
+    if (!startControls.fullSync) setFullSync(false);
+  }, [startControls.fullSync]);
+  React.useEffect(() => {
+    if (!startControls.batchSize) setBatchSize(DEFAULT_BATCH_SIZE);
+  }, [startControls.batchSize]);
   const updateParamValue = React.useCallback((key, value) => {
     setParamValues((current) => ({ ...current, [key]: value }));
   }, []);
@@ -281,19 +301,21 @@ function SyncRunsDashboardPage() {
   }, []);
   const handleStartSync = React.useCallback(async () => {
     if (!selectedIntegration || !selectedEntityType) return;
-    const parsedBatchSize = Number.parseInt(batchSize, 10);
-    if (!Number.isFinite(parsedBatchSize) || parsedBatchSize < 1 || parsedBatchSize > 1e3) {
-      flash(t("data_sync.dashboard.start.invalidBatchSize", "Batch size must be between 1 and 1000."), "error");
-      return;
-    }
     const parameters = buildRunParametersPayload(runParameters, paramValues);
     const requestBody = {
       integrationId: selectedIntegration.integrationId,
       entityType: selectedEntityType,
-      direction: selectedDirection,
-      batchSize: parsedBatchSize,
-      fullSync
+      direction: selectedDirection
     };
+    if (startControls.batchSize) {
+      const parsedBatchSize = Number.parseInt(batchSize, 10);
+      if (!Number.isFinite(parsedBatchSize) || parsedBatchSize < 1 || parsedBatchSize > 1e3) {
+        flash(t("data_sync.dashboard.start.invalidBatchSize", "Batch size must be between 1 and 1000."), "error");
+        return;
+      }
+      requestBody.batchSize = parsedBatchSize;
+    }
+    if (startControls.fullSync) requestBody.fullSync = fullSync;
     if (runParameters.length > 0) requestBody.parameters = parameters;
     try {
       const call = await runMutation({
@@ -325,7 +347,7 @@ function SyncRunsDashboardPage() {
       const message = error instanceof Error ? error.message : t("data_sync.dashboard.start.error", "Failed to start sync run");
       flash(message, "error");
     }
-  }, [batchSize, fullSync, paramValues, router, runMutation, runParameters, selectedDirection, selectedEntityType, selectedIntegration, t]);
+  }, [batchSize, fullSync, paramValues, router, runMutation, runParameters, selectedDirection, selectedEntityType, selectedIntegration, startControls, t]);
   const handleSaveSchedule = React.useCallback(async () => {
     if (!selectedIntegration || !selectedEntityType) return;
     if (scheduleEditor.scheduleValue.trim().length === 0) {
@@ -625,13 +647,13 @@ function SyncRunsDashboardPage() {
                   /* @__PURE__ */ jsx(Play, { className: "size-4 text-primary" }),
                   /* @__PURE__ */ jsx("h3", { className: "text-sm font-semibold", children: t("data_sync.dashboard.start.runNowTitle", "Run once now") })
                 ] }),
-                /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: t("data_sync.dashboard.start.runNowDescription", "Use this for the next immediate sync. Batch size and full-sync mode apply only to this manual run.") })
+                /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: startControls.batchSize && startControls.fullSync ? t("data_sync.dashboard.start.runNowDescription", "Use this for the next immediate sync. Batch size and full-sync mode apply only to this manual run.") : t("data_sync.dashboard.start.runNowDescriptionScoped", "Use this for the next immediate sync. Anything set here applies only to this manual run.") })
               ] }),
               /* @__PURE__ */ jsx(Badge, { variant: "outline", children: selectedEntityLabel })
             ] }),
             /* @__PURE__ */ jsx(Separator, { className: "my-4" }),
-            /* @__PURE__ */ jsxs("div", { className: "grid gap-4 sm:grid-cols-[minmax(0,180px)_1fr]", children: [
-              /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+            startControls.batchSize || startControls.fullSync ? /* @__PURE__ */ jsxs("div", { className: cn("grid gap-4", startControlsGridClass(startControls)), children: [
+              startControls.batchSize ? /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
                 /* @__PURE__ */ jsxs(Label, { className: "flex items-center gap-2 text-sm font-medium", children: [
                   /* @__PURE__ */ jsx(Gauge, { className: "size-4 text-muted-foreground" }),
                   /* @__PURE__ */ jsx("span", { children: t("data_sync.dashboard.start.batchSize", "Batch size") })
@@ -644,15 +666,15 @@ function SyncRunsDashboardPage() {
                     inputMode: "numeric"
                   }
                 )
-              ] }),
-              /* @__PURE__ */ jsx("div", { className: "rounded-lg border bg-background p-3", children: /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between gap-3", children: [
+              ] }) : null,
+              startControls.fullSync ? /* @__PURE__ */ jsx("div", { className: "rounded-lg border bg-background p-3", children: /* @__PURE__ */ jsxs("div", { className: "flex items-center justify-between gap-3", children: [
                 /* @__PURE__ */ jsxs("div", { className: "space-y-1", children: [
                   /* @__PURE__ */ jsx(Label, { className: "text-sm font-medium", children: t("data_sync.dashboard.start.fullSync", "Run as full sync") }),
                   /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t("data_sync.dashboard.start.fullSyncHelp", "Ignore the saved cursor and process the entire source again for this run.") })
                 ] }),
                 /* @__PURE__ */ jsx(Switch, { checked: fullSync, onCheckedChange: setFullSync })
-              ] }) })
-            ] }),
+              ] }) }) : null
+            ] }) : null,
             runParameters.length > 0 ? /* @__PURE__ */ jsxs("div", { className: "mt-4 space-y-3", children: [
               /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
                 /* @__PURE__ */ jsx(Settings2, { className: "size-4 text-muted-foreground" }),