@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7194.1.ab4fc81f82

package/src/modules/business_rules/components/InlineRuleEditor.tsx

@@ -0,0 +1,231 @@
+"use client"
+
+import * as React from 'react'
+import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from '@open-mercato/ui/primitives/dialog'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
+import { apiFetch, withScopedApiHeaders } from '@open-mercato/ui/backend/utils/api'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { readJsonSafe } from '@open-mercato/ui/backend/utils/serverErrors'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { ConditionBuilder } from './ConditionBuilder'
+import { ActionBuilder } from './ActionBuilder'
+import {
+  businessRuleFormSchema,
+  createFieldDefinitions,
+  createFormGroups,
+  defaultFormValues,
+  type BusinessRuleFormValues,
+} from './formConfig'
+import { parseRuleToFormValues } from './utils/formHelpers'
+
+/**
+ * Identity of a rule the editor just persisted, handed back to the embedding
+ * module so it can select/refresh without re-reading the API itself.
+ */
+export type InlineRuleEditorSavedRule = {
+  id: string
+  ruleId: string
+  ruleName: string
+}
+
+export type InlineRuleEditorProps = {
+  open: boolean
+  onOpenChange: (open: boolean) => void
+  /** Existing rule UUID to edit. Omit (or pass null) to create a new rule. */
+  recordId?: string | null
+  /** Pre-fills `entityType` on create so a host can scope newly authored rules. */
+  defaultEntityType?: string
+  /** Pre-fills `ruleType` on create. */
+  defaultRuleType?: BusinessRuleFormValues['ruleType']
+  onSaved?: (rule: InlineRuleEditorSavedRule) => void
+  /**
+   * Dependency-visibility slot ("used by: N workflows, M promotions"). Rendered
+   * beside the form. business_rules owns the editor and the slot; each consuming
+   * module owns its own usage lookup and passes the rendered panel in — that is
+   * what keeps this component free of any consumer-module import.
+   */
+  usagePanel?: React.ReactNode
+}
+
+type RuleRecord = Record<string, unknown> & { updatedAt?: string | null; updated_at?: string | null }
+
+function toRulePayload(values: BusinessRuleFormValues): Record<string, unknown> {
+  return {
+    ruleId: values.ruleId,
+    ruleName: values.ruleName,
+    description: values.description || null,
+    ruleType: values.ruleType,
+    ruleCategory: values.ruleCategory || null,
+    entityType: values.entityType,
+    eventType: values.eventType || null,
+    conditionExpression: values.conditionExpression,
+    successActions: values.successActions || null,
+    failureActions: values.failureActions || null,
+    enabled: values.enabled,
+    priority: values.priority,
+    version: values.version,
+    effectiveFrom: values.effectiveFrom || null,
+    effectiveTo: values.effectiveTo || null,
+  }
+}
+
+/**
+ * InlineRuleEditor — create or edit a single business rule inside a dialog,
+ * owned by `business_rules` and embeddable by any module (spec
+ * 2026-07-26-workflows-ux-redesign.md team decision #5, issue #4236).
+ *
+ * It is the same CrudForm the standalone rule pages render, so validation,
+ * condition/action builders and optimistic locking behave identically; the
+ * difference is that it never navigates — it reports the saved rule through
+ * `onSaved` and lets the host refresh its own pickers.
+ */
+export function InlineRuleEditor({
+  open,
+  onOpenChange,
+  recordId,
+  defaultEntityType,
+  defaultRuleType,
+  onSaved,
+  usagePanel,
+}: InlineRuleEditorProps) {
+  const t = useT()
+  const isEdit = Boolean(recordId)
+  const [rule, setRule] = React.useState<RuleRecord | null>(null)
+  const [isLoading, setIsLoading] = React.useState(false)
+  const [loadError, setLoadError] = React.useState<string | null>(null)
+
+  React.useEffect(() => {
+    if (!open) return
+    if (!recordId) {
+      setRule(null)
+      setLoadError(null)
+      setIsLoading(false)
+      return
+    }
+    let cancelled = false
+    setIsLoading(true)
+    setLoadError(null)
+    const load = async () => {
+      try {
+        const response = await apiFetch(`/api/business_rules/rules/${recordId}`)
+        if (!response.ok) {
+          if (!cancelled) setLoadError(t('business_rules.errors.fetchFailed'))
+          return
+        }
+        const body = (await readJsonSafe<RuleRecord>(response)) ?? null
+        if (!cancelled) setRule(body)
+      } catch {
+        if (!cancelled) setLoadError(t('business_rules.errors.fetchFailed'))
+      } finally {
+        if (!cancelled) setIsLoading(false)
+      }
+    }
+    void load()
+    return () => {
+      cancelled = true
+    }
+  }, [open, recordId, t])
+
+  const initialValues = React.useMemo<Partial<BusinessRuleFormValues>>(() => {
+    if (isEdit) {
+      return rule ? parseRuleToFormValues(rule) : {}
+    }
+    return {
+      ...defaultFormValues,
+      ...(defaultEntityType ? { entityType: defaultEntityType } : {}),
+      ...(defaultRuleType ? { ruleType: defaultRuleType } : {}),
+    }
+  }, [defaultEntityType, defaultRuleType, isEdit, rule])
+
+  const fields = React.useMemo(() => createFieldDefinitions(t), [t])
+  const groups = React.useMemo(() => createFormGroups(t, ConditionBuilder, ActionBuilder), [t])
+
+  const lockedUpdatedAt = (rule?.updatedAt ?? rule?.updated_at ?? null) as string | null
+
+  const handleSubmit = React.useCallback(async (values: BusinessRuleFormValues) => {
+    const payload = toRulePayload(values)
+    const request = () => (isEdit
+      ? apiFetch('/api/business_rules/rules', {
+          method: 'PUT',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ ...payload, id: recordId }),
+        })
+      : apiFetch('/api/business_rules/rules', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify(payload),
+        }))
+
+    const lockHeaders = isEdit ? buildOptimisticLockHeader(lockedUpdatedAt) : {}
+    const response = Object.keys(lockHeaders).length
+      ? await withScopedApiHeaders(lockHeaders, request)
+      : await request()
+
+    if (!response.ok) {
+      const body = (await readJsonSafe<Record<string, unknown>>(response)) ?? {}
+      const message =
+        (typeof body.error === 'string' && body.error) ||
+        (typeof body.message === 'string' && body.message) ||
+        t(isEdit ? 'business_rules.errors.updateFailed' : 'business_rules.errors.createFailed')
+      throw new CrudHttpError(response.status, { ...body, error: message })
+    }
+
+    const body = (await readJsonSafe<{ id?: string }>(response)) ?? {}
+    const savedId = (isEdit ? recordId : body.id) ?? ''
+    onSaved?.({ id: savedId, ruleId: values.ruleId, ruleName: values.ruleName })
+    onOpenChange(false)
+  }, [isEdit, lockedUpdatedAt, onOpenChange, onSaved, recordId, t])
+
+  if (!open) return null
+
+  return (
+    <Dialog open={open} onOpenChange={onOpenChange}>
+      <DialogContent className="sm:max-w-4xl max-h-[90vh] overflow-hidden flex flex-col !p-0 [&_.grid]:!grid-cols-1">
+        <DialogHeader className="flex-shrink-0 p-6 pb-4 border-b border-border/70">
+          <DialogTitle>
+            {t(isEdit ? 'business_rules.rules.inline.editTitle' : 'business_rules.rules.inline.createTitle')}
+          </DialogTitle>
+          <DialogDescription>
+            {t(isEdit ? 'business_rules.rules.inline.editDescription' : 'business_rules.rules.inline.createDescription')}
+          </DialogDescription>
+        </DialogHeader>
+
+        <div className="flex flex-1 min-h-0 gap-4 overflow-hidden px-6 pb-6">
+          <div className="min-h-0 flex-1 overflow-y-auto">
+            {isLoading ? (
+              <div className="flex flex-col items-center justify-center gap-2 py-12 text-muted-foreground">
+                <Spinner className="h-6 w-6" />
+                <span className="text-sm">{t('business_rules.rules.edit.loading')}</span>
+              </div>
+            ) : loadError ? (
+              <p className="py-12 text-center text-sm text-status-error-text">{loadError}</p>
+            ) : (
+              <CrudForm
+                key={recordId ?? 'create'}
+                schema={businessRuleFormSchema}
+                fields={fields}
+                groups={groups}
+                initialValues={initialValues}
+                optimisticLockUpdatedAt={lockedUpdatedAt}
+                onSubmit={handleSubmit}
+                embedded
+                submitLabel={t(isEdit ? 'business_rules.rules.form.update' : 'business_rules.rules.form.create')}
+                extraActions={
+                  <Button type="button" variant="outline" onClick={() => onOpenChange(false)}>
+                    {t('business_rules.rules.form.cancel')}
+                  </Button>
+                }
+              />
+            )}
+          </div>
+          {usagePanel ? (
+            <div className="hidden w-64 shrink-0 self-start overflow-y-auto lg:block">{usagePanel}</div>
+          ) : null}
+        </div>
+      </DialogContent>
+    </Dialog>
+  )
+}

package/src/modules/business_rules/data/validators.ts

@@ -389,6 +389,8 @@ export const directRuleExecutionContextSchema = z.object({
   organizationId: z.uuid('organizationId must be a valid UUID'),
   executedBy: z.string().optional(),
   dryRun: z.boolean().optional(),
+  // See `ruleIdExecutionContextSchema.skipActions`.
+  skipActions: z.boolean().optional(),
   entityType: z.string().optional(),
   entityId: z.string().optional(),
   eventType: z.string().optional(),
@@ -409,6 +411,10 @@ export const ruleIdExecutionContextSchema = z.object({
   organizationId: z.uuid('organizationId must be a valid UUID'),
   executedBy: z.string().optional(),
   dryRun: z.boolean().optional(),
+  // Evaluate the conditions but do not run the rule's success/failure ACTIONS.
+  // `dryRun` only suppresses the execution LOG, so it is not the flag a caller
+  // that must produce no side effects can rely on.
+  skipActions: z.boolean().optional(),
   entityType: z.string().optional(),
   entityId: z.string().optional(),
   eventType: z.string().optional(),

package/src/modules/business_rules/i18n/de.json

@@ -241,6 +241,10 @@
   "business_rules.rules.form.ruleType": "Regeltyp",
   "business_rules.rules.form.update": "Regel aktualisieren",
   "business_rules.rules.form.version": "Version",
+  "business_rules.rules.inline.createDescription": "Erstelle eine Regel, ohne den aktuellen Bildschirm zu verlassen. Sie steht danach allen Modulen zur Verfügung, die Geschäftsregeln nutzen.",
+  "business_rules.rules.inline.createTitle": "Neue Geschäftsregel",
+  "business_rules.rules.inline.editDescription": "Aktualisiere diese Regel. Änderungen gelten überall dort, wo die Regel referenziert wird.",
+  "business_rules.rules.inline.editTitle": "Geschäftsregel bearbeiten",
   "business_rules.rules.list.create": "Regel erstellen",
   "business_rules.rules.list.description": "Verwalten Sie Ihre Geschäftsregeln und Automatisierungslogik",
   "business_rules.rules.list.empty": "Keine Regeln gefunden",

package/src/modules/business_rules/i18n/en.json

@@ -241,6 +241,10 @@
   "business_rules.rules.form.ruleType": "Rule Type",
   "business_rules.rules.form.update": "Update Rule",
   "business_rules.rules.form.version": "Version",
+  "business_rules.rules.inline.createDescription": "Create a rule without leaving the current screen. It becomes available to every module that uses business rules.",
+  "business_rules.rules.inline.createTitle": "New business rule",
+  "business_rules.rules.inline.editDescription": "Update this rule. Changes apply everywhere the rule is referenced.",
+  "business_rules.rules.inline.editTitle": "Edit business rule",
   "business_rules.rules.list.create": "Create Rule",
   "business_rules.rules.list.description": "Manage your business rules and automation logic",
   "business_rules.rules.list.empty": "No rules found",

package/src/modules/business_rules/i18n/es.json

@@ -241,6 +241,10 @@
   "business_rules.rules.form.ruleType": "Tipo de Regla",
   "business_rules.rules.form.update": "Actualizar Regla",
   "business_rules.rules.form.version": "Versión",
+  "business_rules.rules.inline.createDescription": "Crea una regla sin salir de la pantalla actual. Quedará disponible para todos los módulos que usan reglas de negocio.",
+  "business_rules.rules.inline.createTitle": "Nueva regla de negocio",
+  "business_rules.rules.inline.editDescription": "Actualiza esta regla. Los cambios se aplican en todos los lugares donde se referencia.",
+  "business_rules.rules.inline.editTitle": "Editar regla de negocio",
   "business_rules.rules.list.create": "Crear Regla",
   "business_rules.rules.list.description": "Gestione sus reglas de negocio y lógica de automatización",
   "business_rules.rules.list.empty": "No se encontraron reglas",

package/src/modules/business_rules/i18n/ko.json

@@ -241,6 +241,10 @@
   "business_rules.rules.form.ruleType": "규칙 유형",
   "business_rules.rules.form.update": "규칙 업데이트",
   "business_rules.rules.form.version": "버전",
+  "business_rules.rules.inline.createDescription": "Create a rule without leaving the current screen. It becomes available to every module that uses business rules.",
+  "business_rules.rules.inline.createTitle": "New business rule",
+  "business_rules.rules.inline.editDescription": "Update this rule. Changes apply everywhere the rule is referenced.",
+  "business_rules.rules.inline.editTitle": "Edit business rule",
   "business_rules.rules.list.create": "규칙 생성",
   "business_rules.rules.list.description": "비즈니스 규칙과 자동화 로직을 관리합니다",
   "business_rules.rules.list.empty": "규칙을 찾을 수 없습니다",

package/src/modules/business_rules/i18n/pl.json

@@ -241,6 +241,10 @@
   "business_rules.rules.form.ruleType": "Typ Reguły",
   "business_rules.rules.form.update": "Zaktualizuj Regułę",
   "business_rules.rules.form.version": "Wersja",
+  "business_rules.rules.inline.createDescription": "Utwórz regułę bez opuszczania bieżącego ekranu. Będzie dostępna dla wszystkich modułów korzystających z reguł biznesowych.",
+  "business_rules.rules.inline.createTitle": "Nowa reguła biznesowa",
+  "business_rules.rules.inline.editDescription": "Zaktualizuj tę regułę. Zmiany obowiązują wszędzie tam, gdzie reguła jest używana.",
+  "business_rules.rules.inline.editTitle": "Edytuj regułę biznesową",
   "business_rules.rules.list.create": "Utwórz Regułę",
   "business_rules.rules.list.description": "Zarządzaj swoimi regułami biznesowymi i logiką automatyzacji",
   "business_rules.rules.list.empty": "Nie znaleziono reguł",

package/src/modules/business_rules/lib/rule-engine.ts

@@ -54,6 +54,14 @@ export interface RuleEngineContext {
   organizationId: string
   executedBy?: string
   dryRun?: boolean
+  /**
+   * Evaluate the conditions but do NOT run the rule's success/failure actions.
+   *
+   * `dryRun` is deliberately not that flag: it only suppresses the execution
+   * LOG, so a caller that must produce no side effects (the workflows dry-run
+   * path, spec section 8.2) needs this one.
+   */
+  skipActions?: boolean
   [key: string]: any
 }
 
@@ -250,6 +258,8 @@ export interface DirectRuleExecutionContext {
   organizationId: string
   executedBy?: string
   dryRun?: boolean
+  /** See `RuleEngineContext.skipActions`. */
+  skipActions?: boolean
   // Optional for logging (falls back to rule's entityType)
   entityType?: string
   entityId?: string
@@ -288,6 +298,8 @@ export interface RuleIdExecutionContext {
   organizationId: string
   executedBy?: string
   dryRun?: boolean
+  /** See `RuleEngineContext.skipActions`. */
+  skipActions?: boolean
   entityType?: string
   entityId?: string
   eventType?: string
@@ -516,7 +528,7 @@ export async function executeSingleRule(
 
       let actionsExecuted: ActionExecutionOutcome | null = null
 
-      if (actions && Array.isArray(actions) && actions.length > 0) {
+      if (actions && Array.isArray(actions) && actions.length > 0 && !context.skipActions) {
         // Build action context
         const actionContext: ActionContext = {
           ...evalContext,
@@ -762,6 +774,7 @@ export async function executeRuleById(
     organizationId: context.organizationId,
     executedBy: context.executedBy,
     dryRun: context.dryRun,
+    skipActions: context.skipActions,
   }
 
   // Execute via existing executeSingleRule
@@ -873,6 +886,7 @@ export async function executeRuleByRuleId(
     organizationId: context.organizationId,
     executedBy: context.executedBy,
     dryRun: context.dryRun,
+    skipActions: context.skipActions,
   }
 
   // Execute via existing executeSingleRule

package/src/modules/catalog/commands/products.ts

@@ -1,4 +1,5 @@
 import { randomUUID } from "node:crypto";
+import { z } from "zod";
 import { registerCommand } from "@open-mercato/shared/lib/commands";
 import type {
   CommandHandler,
@@ -1370,11 +1371,20 @@ function applyProductSnapshot(
   record.updatedAt = new Date(snapshot.updatedAt);
 }
 
+/**
+ * Output contract for the product commands, consumed by the workflows context
+ * ledger through `commandRegistry.outputSchemaOf`. All three commands return
+ * the product id and nothing else — create and update from `record.id`, delete
+ * from the resolved input id.
+ */
+const productIdOutputSchema = z.object({ productId: z.string().uuid() });
+
 const createProductCommand: CommandHandler<
   ProductCreateInput,
   { productId: string }
 > = {
   id: "catalog.products.create",
+  outputSchema: productIdOutputSchema,
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(
       productCreateSchema,
@@ -1649,6 +1659,7 @@ const updateProductCommand: CommandHandler<
   { productId: string }
 > = {
   id: "catalog.products.update",
+  outputSchema: productIdOutputSchema,
   async prepare(input, ctx) {
     const id = requireId(input, "Product id is required");
     const em = ctx.container.resolve("em") as EntityManager;
@@ -2180,6 +2191,7 @@ const deleteProductCommand: CommandHandler<
   { productId: string }
 > = {
   id: "catalog.products.delete",
+  outputSchema: productIdOutputSchema,
   async prepare(input, ctx) {
     const id = requireId(input, "Product id is required");
     const em = ctx.container.resolve("em") as EntityManager;

package/src/modules/catalog/i18n/de.json

@@ -717,6 +717,7 @@
   "catalog.variants.validation.gtinChecksum": "Der Barcode passt nicht zum gewählten Identifikatortyp.",
   "catalog.widgets.productSeo.groupDescription": "Optimiere Produkttitel und -beschreibungen vor der Veröffentlichung.",
   "catalog.widgets.productSeo.groupLabel": "Produkt-SEO-Helfer",
+  "catalog.workflows.commands.products.update": "Produkt aktualisieren",
   "customers~catalog.errors.id_required": "Datensatzkennung ist erforderlich.",
   "customers~catalog.errors.organization_required": "Organisationskontext ist erforderlich.",
   "customers~catalog.errors.tenant_required": "Mandantenkontext ist erforderlich.",

package/src/modules/catalog/i18n/en.json

@@ -717,6 +717,7 @@
   "catalog.variants.validation.gtinChecksum": "The barcode does not match the selected identifier type.",
   "catalog.widgets.productSeo.groupDescription": "Optimize product titles and descriptions before publishing.",
   "catalog.widgets.productSeo.groupLabel": "Product SEO Helper",
+  "catalog.workflows.commands.products.update": "Update product",
   "customers~catalog.errors.id_required": "Record identifier is required.",
   "customers~catalog.errors.organization_required": "Organization context is required.",
   "customers~catalog.errors.tenant_required": "Tenant context is required.",

package/src/modules/catalog/i18n/es.json

@@ -717,6 +717,7 @@
   "catalog.variants.validation.gtinChecksum": "El código de barras no coincide con el tipo de identificador seleccionado.",
   "catalog.widgets.productSeo.groupDescription": "Optimiza los títulos y descripciones de los productos antes de publicar.",
   "catalog.widgets.productSeo.groupLabel": "Asistente SEO del producto",
+  "catalog.workflows.commands.products.update": "Actualizar producto",
   "customers~catalog.errors.id_required": "El identificador del registro es obligatorio.",
   "customers~catalog.errors.organization_required": "El contexto de organización es obligatorio.",
   "customers~catalog.errors.tenant_required": "El contexto de tenant es obligatorio.",

package/src/modules/catalog/i18n/ko.json

@@ -717,6 +717,7 @@
   "catalog.variants.validation.gtinChecksum": "바코드가 선택한 식별자 유형과 일치하지 않습니다.",
   "catalog.widgets.productSeo.groupDescription": "게시하기 전에 상품 제목과 설명을 최적화합니다.",
   "catalog.widgets.productSeo.groupLabel": "상품 SEO 도우미",
+  "catalog.workflows.commands.products.update": "Update product",
   "customers~catalog.errors.id_required": "레코드 식별자가 필요합니다.",
   "customers~catalog.errors.organization_required": "조직 컨텍스트가 필요합니다.",
   "customers~catalog.errors.tenant_required": "테넌트 컨텍스트가 필요합니다.",

package/src/modules/catalog/i18n/pl.json

@@ -717,6 +717,7 @@
   "catalog.variants.validation.gtinChecksum": "Kod kreskowy nie pasuje do wybranego typu identyfikatora.",
   "catalog.widgets.productSeo.groupDescription": "Zoptymalizuj tytuły i opisy produktów przed publikacją.",
   "catalog.widgets.productSeo.groupLabel": "Pomocnik SEO",
+  "catalog.workflows.commands.products.update": "Aktualizuj produkt",
   "customers~catalog.errors.id_required": "Identyfikator rekordu jest wymagany.",
   "customers~catalog.errors.organization_required": "Kontekst organizacji jest wymagany.",
   "customers~catalog.errors.tenant_required": "Kontekst tenanta jest wymagany.",

package/src/modules/catalog/workflows.ts

@@ -0,0 +1,35 @@
+/**
+ * Catalog Module — Workflow Integration
+ *
+ * Declares which catalog commands a workflow's UPDATE_ENTITY activity MAY
+ * execute. A declaration here is a CANDIDATE, not a grant: it is off for every
+ * tenant until an administrator ticks it in Workflow settings, and the acting
+ * user must still hold the declared features at execution time. See
+ * `apps/docs/docs/framework/workflows/entity-updates.mdx` for the reasoning
+ * behind declaring updates only.
+ *
+ * Variants, prices and offers are deliberately NOT declared. They are
+ * sub-resources whose correct value depends on the parent product's state at
+ * the moment of the write, and a workflow reaches them with context captured
+ * before it parked — the same stale-context hazard that keeps deletes out.
+ * Price writes in particular belong behind `salesCalculationService` and the
+ * pricing rules, not behind a workflow activity setting a column.
+ */
+
+import { createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'
+import { registerWorkflowSafeCommands } from '@open-mercato/core/modules/workflows/lib/workflow-safe-commands'
+
+registerWorkflowSafeCommands([
+  {
+    commandId: 'catalog.products.update',
+    requiredFeatures: ['catalog.products.manage'],
+    labelKey: 'catalog.workflows.commands.products.update',
+  },
+])
+
+export const workflowsConfig = createWorkflowsModuleConfig({
+  moduleId: 'catalog',
+  workflows: [],
+})
+
+export default workflowsConfig

package/src/modules/customer_accounts/AGENTS.md

@@ -34,8 +34,11 @@ Customer-facing identity and portal authentication with a two-tier RBAC model. T
 yarn db:generate
 yarn generate
 yarn workspace @open-mercato/core build
+yarn workspace @open-mercato/core test --testPathPatterns='customer_accounts'
 ```
 
+Runbook command (idempotent, safe to re-run): `yarn mercato customer_accounts sync-customer-role-acls [--tenant <tenantId>]` — see § Cross-Module Feature Merging.
+
 ## Data Model
 
 ### Entities
@@ -156,6 +159,14 @@ Treat `portal.*` and `*` as first-class stored ACL grants. Server authorization
 
 Other modules can declare `defaultCustomerRoleFeatures` in their `setup.ts`. During `seedDefaults`, the customer_accounts module collects these from all enabled modules and merges them into the corresponding `CustomerRoleAcl` records.
 
+`seedDefaults` reaches **new** tenants only. Existing tenants replay the identical merge with:
+
+```bash
+yarn mercato customer_accounts sync-customer-role-acls [--tenant <tenantId>]
+```
+
+Both paths call the single helper `lib/customerRoleAclSync.ts` → `syncDefaultCustomerRoleAcls`. MUST route any new customer-role grant flow through that helper rather than writing `CustomerRoleAcl` rows directly, so the contract stays one implementation: additive only (never revokes a hand-added feature), wildcard-aware via `hasFeature` (a role holding `portal.*` gains no redundant concrete grant), never creates a `CustomerRole` or `CustomerRoleAcl`, tenant-scoped on every query, and idempotent. Run it after adding portal features to any module's `acl.ts` + `defaultCustomerRoleFeatures`, the same way `auth sync-role-acls` follows a `defaultRoleFeatures` change. Note `CustomerRbacService` caches ACLs for five minutes, so a fresh grant is not instantly visible to a signed-in portal user.
+
 ### Server-Side Auth Helpers
 
 | Helper | Import | Use |

package/src/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.tsx

@@ -42,6 +42,8 @@ const PORTAL_FEATURES = [
   { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },
   { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },
   { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },
+  { id: 'portal.tasks.view', labelKey: 'customer_accounts.admin.portalFeatures.tasks.view', fallback: 'View tasks', descriptionKey: 'customer_accounts.admin.portalFeatures.tasks.view.description', descriptionFallback: 'Allows viewing workflow tasks assigned to this customer' },
+  { id: 'portal.tasks.complete', labelKey: 'customer_accounts.admin.portalFeatures.tasks.complete', fallback: 'Complete tasks', descriptionKey: 'customer_accounts.admin.portalFeatures.tasks.complete.description', descriptionFallback: 'Allows submitting and completing assigned workflow tasks' },
 ]
 
 const FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {

package/src/modules/customer_accounts/cli.ts

@@ -0,0 +1,96 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { z } from 'zod'
+import type { ModuleCli } from '@open-mercato/shared/modules/registry'
+import { getCliModules } from '@open-mercato/shared/modules/registry'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
+import { syncDefaultCustomerRoleAcls } from './lib/customerRoleAclSync'
+
+const tenantArgSchema = z.string().trim().min(1)
+
+/**
+ * Customer-role counterpart of `mercato auth sync-role-acls`.
+ *
+ * `defaultCustomerRoleFeatures` is merged into seeded customer roles during
+ * tenant setup only, so a tenant that already exists never receives features a
+ * module declares later. This command replays that same merge — through the
+ * same `syncDefaultCustomerRoleAcls` helper `seedDefaults` calls — against
+ * existing tenants.
+ */
+const syncCustomerRoleAcls: ModuleCli = {
+  command: 'sync-customer-role-acls',
+  async run(rest) {
+    const args: Record<string, string> = {}
+    for (let i = 0; i < rest.length; i++) {
+      const token = rest[i]
+      if (!token?.startsWith('--')) continue
+      const key = token.replace(/^--/, '')
+      const next = rest[i + 1]
+      if (next && !next.startsWith('--')) {
+        args[key] = next
+        i++
+      }
+    }
+    const tenantArg = args.tenantId ?? args.tenant ?? args.tenant_id ?? null
+
+    const modules = getCliModules()
+    if (!modules.length) {
+      console.error('❌ No CLI modules registered. Run `yarn generate` first.')
+      return
+    }
+
+    const { resolve } = await createRequestContainer()
+    const em = resolve<EntityManager>('em')
+
+    const targetTenantIds: string[] = []
+    if (tenantArg !== null) {
+      const parsed = tenantArgSchema.safeParse(tenantArg)
+      if (!parsed.success) {
+        console.error(`❌ Invalid --tenant value: ${tenantArg}`)
+        return
+      }
+      const tenant = await em.findOne(Tenant, { id: parsed.data })
+      if (!tenant) {
+        console.error(`❌ Tenant not found: ${parsed.data}`)
+        return
+      }
+      targetTenantIds.push(parsed.data)
+    } else {
+      const tenants = await em.find(Tenant, {})
+      if (!tenants.length) {
+        console.log('No tenants found; nothing to sync.')
+        return
+      }
+      for (const tenant of tenants) {
+        const id = tenant.id ? String(tenant.id) : null
+        if (id) targetTenantIds.push(id)
+      }
+    }
+
+    let updatedRoleCount = 0
+    let updatedTenantCount = 0
+    for (const tenantId of targetTenantIds) {
+      const applied = await syncDefaultCustomerRoleAcls(em, tenantId, modules)
+      if (!applied.length) {
+        console.log(`✅ Customer role ACLs already in sync for tenant ${tenantId}`)
+        continue
+      }
+      updatedTenantCount += 1
+      updatedRoleCount += applied.length
+      console.log(`✅ Synced customer role ACLs for tenant ${tenantId}`)
+      for (const entry of applied) {
+        console.log(`   • ${entry.roleName} (${entry.roleSlug}) gained: ${entry.addedFeatures.join(', ')}`)
+      }
+    }
+
+    if (!updatedRoleCount) {
+      console.log(`Nothing to do — ${targetTenantIds.length} tenant(s) already in sync.`)
+      return
+    }
+    console.log(`Updated ${updatedRoleCount} customer role ACL(s) across ${updatedTenantCount} tenant(s).`)
+  },
+}
+
+const commands: ModuleCli[] = [syncCustomerRoleAcls]
+
+export default commands

package/src/modules/customer_accounts/i18n/de.json

@@ -112,6 +112,7 @@
   "customer_accounts.admin.portalFeatures.groups.orders": "Bestellungen",
   "customer_accounts.admin.portalFeatures.groups.profile": "Profil",
   "customer_accounts.admin.portalFeatures.groups.quotes": "Angebote",
+  "customer_accounts.admin.portalFeatures.groups.tasks": "Aufgaben",
   "customer_accounts.admin.portalFeatures.groups.users": "Benutzer",
   "customer_accounts.admin.portalFeatures.invoices.view": "Rechnungen anzeigen",
   "customer_accounts.admin.portalFeatures.invoices.view.description": "Ermöglicht das Anzeigen von Rechnungen und der Zahlungshistorie",
@@ -127,6 +128,10 @@
   "customer_accounts.admin.portalFeatures.quotes.request.description": "Ermöglicht das Anfordern neuer Angebote vom Unternehmen",
   "customer_accounts.admin.portalFeatures.quotes.view": "Angebote anzeigen",
   "customer_accounts.admin.portalFeatures.quotes.view.description": "Ermöglicht das Anzeigen erhaltener Angebote und deren Details",
+  "customer_accounts.admin.portalFeatures.tasks.complete": "Aufgaben abschließen",
+  "customer_accounts.admin.portalFeatures.tasks.complete.description": "Ermöglicht das Einreichen und Abschließen zugewiesener Workflow-Aufgaben",
+  "customer_accounts.admin.portalFeatures.tasks.view": "Aufgaben anzeigen",
+  "customer_accounts.admin.portalFeatures.tasks.view.description": "Ermöglicht das Anzeigen von Workflow-Aufgaben, die diesem Kunden zugewiesen sind",
   "customer_accounts.admin.portalFeatures.users.invite": "Teammitglieder einladen",
   "customer_accounts.admin.portalFeatures.users.invite.description": "Ermöglicht das Senden von Portaleinladungen an neue Teammitglieder",
   "customer_accounts.admin.portalFeatures.users.manage": "Teammitglieder verwalten",