@open-mercato/core 0.7.1-develop.7193.1.910a5b0a1e → 0.7.1-develop.7195.1.b5efd1d51a

package/dist/modules/catalog/workflows.js

@@ -0,0 +1,19 @@
+import { createWorkflowsModuleConfig } from "@open-mercato/shared/modules/workflows";
+import { registerWorkflowSafeCommands } from "@open-mercato/core/modules/workflows/lib/workflow-safe-commands";
+registerWorkflowSafeCommands([
+  {
+    commandId: "catalog.products.update",
+    requiredFeatures: ["catalog.products.manage"],
+    labelKey: "catalog.workflows.commands.products.update"
+  }
+]);
+const workflowsConfig = createWorkflowsModuleConfig({
+  moduleId: "catalog",
+  workflows: []
+});
+var workflows_default = workflowsConfig;
+export {
+  workflows_default as default,
+  workflowsConfig
+};
+//# sourceMappingURL=workflows.js.map

package/dist/modules/catalog/workflows.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/catalog/workflows.ts"],
+  "sourcesContent": ["/**\n * Catalog Module \u2014 Workflow Integration\n *\n * Declares which catalog commands a workflow's UPDATE_ENTITY activity MAY\n * execute. A declaration here is a CANDIDATE, not a grant: it is off for every\n * tenant until an administrator ticks it in Workflow settings, and the acting\n * user must still hold the declared features at execution time. See\n * `apps/docs/docs/framework/workflows/entity-updates.mdx` for the reasoning\n * behind declaring updates only.\n *\n * Variants, prices and offers are deliberately NOT declared. They are\n * sub-resources whose correct value depends on the parent product's state at\n * the moment of the write, and a workflow reaches them with context captured\n * before it parked \u2014 the same stale-context hazard that keeps deletes out.\n * Price writes in particular belong behind `salesCalculationService` and the\n * pricing rules, not behind a workflow activity setting a column.\n */\n\nimport { createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\nimport { registerWorkflowSafeCommands } from '@open-mercato/core/modules/workflows/lib/workflow-safe-commands'\n\nregisterWorkflowSafeCommands([\n  {\n    commandId: 'catalog.products.update',\n    requiredFeatures: ['catalog.products.manage'],\n    labelKey: 'catalog.workflows.commands.products.update',\n  },\n])\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'catalog',\n  workflows: [],\n})\n\nexport default workflowsConfig\n"],
+  "mappings": "AAkBA,SAAS,mCAAmC;AAC5C,SAAS,oCAAoC;AAE7C,6BAA6B;AAAA,EAC3B;AAAA,IACE,WAAW;AAAA,IACX,kBAAkB,CAAC,yBAAyB;AAAA,IAC5C,UAAU;AAAA,EACZ;AACF,CAAC;AAEM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC;AACd,CAAC;AAED,IAAO,oBAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js

@@ -26,7 +26,9 @@ const PORTAL_FEATURES = [
   { id: "portal.addresses.manage", labelKey: "customer_accounts.admin.portalFeatures.addresses.manage", fallback: "Manage addresses", descriptionKey: "customer_accounts.admin.portalFeatures.addresses.manage.description", descriptionFallback: "Allows adding, editing, and removing addresses" },
   { id: "portal.users.view", labelKey: "customer_accounts.admin.portalFeatures.users.view", fallback: "View team members", descriptionKey: "customer_accounts.admin.portalFeatures.users.view.description", descriptionFallback: "Allows viewing other team members in the organization" },
   { id: "portal.users.invite", labelKey: "customer_accounts.admin.portalFeatures.users.invite", fallback: "Invite team members", descriptionKey: "customer_accounts.admin.portalFeatures.users.invite.description", descriptionFallback: "Allows sending portal invitations to new team members" },
-  { id: "portal.users.manage", labelKey: "customer_accounts.admin.portalFeatures.users.manage", fallback: "Manage team members", descriptionKey: "customer_accounts.admin.portalFeatures.users.manage.description", descriptionFallback: "Allows editing roles and removing team members" }
+  { id: "portal.users.manage", labelKey: "customer_accounts.admin.portalFeatures.users.manage", fallback: "Manage team members", descriptionKey: "customer_accounts.admin.portalFeatures.users.manage.description", descriptionFallback: "Allows editing roles and removing team members" },
+  { id: "portal.tasks.view", labelKey: "customer_accounts.admin.portalFeatures.tasks.view", fallback: "View tasks", descriptionKey: "customer_accounts.admin.portalFeatures.tasks.view.description", descriptionFallback: "Allows viewing workflow tasks assigned to this customer" },
+  { id: "portal.tasks.complete", labelKey: "customer_accounts.admin.portalFeatures.tasks.complete", fallback: "Complete tasks", descriptionKey: "customer_accounts.admin.portalFeatures.tasks.complete.description", descriptionFallback: "Allows submitting and completing assigned workflow tasks" }
 ];
 const FEATURE_GROUPS = (() => {
   const groups = /* @__PURE__ */ new Map();

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/backend/customer_accounts/roles/%5Bid%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n  updatedAt?: string | null\n  updated_at?: string | null\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <Checkbox\n                  checked={allSelected ? true : (someSelected ? 'indeterminate' : false)}\n                  onCheckedChange={() => handleGroupToggle(groupFeatures)}\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <Checkbox\n                      checked={features.includes(featureId)}\n                      onCheckedChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n\n  React.useEffect(() => {\n    if (!id) {\n      setIsNotFound(true)\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      setIsNotFound(false)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        if ((err as { status?: number }).status === 404) {\n          setIsNotFound(true)\n        } else {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n          setError(message)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n      updatedAt: data.updatedAt ?? data.updated_at ?? null,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const roleCall = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        {\n          method: 'PUT',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({\n            name: (values.name as string)?.trim(),\n            description: (values.description as string)?.trim() || null,\n            isDefault: values.isDefault,\n            customerAssignable: values.customerAssignable,\n          }),\n        },\n      )\n    ))\n    if (!roleCall.ok) {\n      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    // The role PUT just bumped the aggregate's `updatedAt`; the ACL write guards\n    // the SAME role aggregate, so send its NEW version (not the stale pre-edit one)\n    // to avoid a false 409 while still blocking a concurrent overwrite (#3194).\n    const roleResult = (roleCall.result ?? null) as { updatedAt?: string | null } | null\n    const aclHeaders = buildOptimisticLockHeader(roleResult?.updatedAt ?? data?.updatedAt ?? data?.updated_at ?? null)\n    const aclCall = await withScopedApiRequestHeaders(aclHeaders, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n        {\n          method: 'PUT',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ features }),\n        },\n      )\n    ))\n    if (!aclCall.ok) {\n      if (surfaceRecordConflict({ status: aclCall.status, body: aclCall.result }, t)) return\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const call = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        { method: 'DELETE' },\n      )\n    ))\n    if (!call.ok) {\n      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            backHref=\"/backend/customer_accounts/roles\"\n            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <ErrorMessage\n            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            action={\n              <Button asChild variant=\"outline\" size=\"sm\">\n                <Link href=\"/backend/customer_accounts/roles\">\n                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n                </Link>\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          titleHeadingLevel={1}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          optimisticLockUpdatedAt={data.updatedAt ?? data.updated_at ?? null}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isDefault ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AA2Gc,cACA,YADA;AAzGd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,gBAAgB;AACzB,SAAS,eAAe;AACxB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AACtC,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,qBAAqB,oBAAoB;AAelD,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAC1R;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,cAAc,OAAQ,eAAe,kBAAkB;AAAA,cAChE,iBAAiB,MAAM,kBAAkB,aAAa;AAAA;AAAA,UACxD;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,iBAAiB,MAAM,oBAAoB,SAAS;AAAA,cACpD,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAXU,SAYZ;AAAA,MAEJ,CAAC,GACH;AAAA,SA9BQ,MAAM,EA+BhB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AAExD,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,oBAAc,IAAI;AAClB,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,oBAAc,KAAK;AACnB,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAK,IAA4B,WAAW,KAAK;AAC/C,wBAAc,IAAI;AAAA,QACpB,OAAO;AACL,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,MACf,WAAW,KAAK,aAAa,KAAK,cAAc;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,WAAW,MAAM,4BAA4B,SAAS,MAC1D;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF,CACD;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,sBAAsB,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC,EAAG;AAClF,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AAIrE,UAAM,aAAc,SAAS,UAAU;AACvC,UAAM,aAAa,0BAA0B,YAAY,aAAa,MAAM,aAAa,MAAM,cAAc,IAAI;AACjH,UAAM,UAAU,MAAM,4BAA4B,YAAY,MAC5D;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF,CACD;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,UAAI,sBAAsB,EAAE,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,OAAO,GAAG,CAAC,EAAG;AAChF,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,OAAO,MAAM,4BAA4B,SAAS,MACtD;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB,CACD;AACD,QAAI,CAAC,KAAK,IAAI;AACZ,UAAI,sBAAsB,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,OAAO,GAAG,CAAC,EAAG;AAC1E,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qDAAqD,gBAAgB;AAAA,QAC9E,UAAS;AAAA,QACT,WAAW,EAAE,yDAAyD,eAAe;AAAA;AAAA,IACvF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS,EAAE,qDAAqD,gBAAgB;AAAA,QACvF,QACE,oBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA;AAAA,IAEJ,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,mBAAmB;AAAA,MACnB,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB,KAAK,aAAa,KAAK,cAAc;AAAA,MAC9D,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,YAAY,eAAe;AAAA,MAC3C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Checkbox } from '@open-mercato/ui/primitives/checkbox'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n  updatedAt?: string | null\n  updated_at?: string | null\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n  { id: 'portal.tasks.view', labelKey: 'customer_accounts.admin.portalFeatures.tasks.view', fallback: 'View tasks', descriptionKey: 'customer_accounts.admin.portalFeatures.tasks.view.description', descriptionFallback: 'Allows viewing workflow tasks assigned to this customer' },\n  { id: 'portal.tasks.complete', labelKey: 'customer_accounts.admin.portalFeatures.tasks.complete', fallback: 'Complete tasks', descriptionKey: 'customer_accounts.admin.portalFeatures.tasks.complete.description', descriptionFallback: 'Allows submitting and completing assigned workflow tasks' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <Checkbox\n                  checked={allSelected ? true : (someSelected ? 'indeterminate' : false)}\n                  onCheckedChange={() => handleGroupToggle(groupFeatures)}\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <Checkbox\n                      checked={features.includes(featureId)}\n                      onCheckedChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n\n  React.useEffect(() => {\n    if (!id) {\n      setIsNotFound(true)\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      setIsNotFound(false)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        if ((err as { status?: number }).status === 404) {\n          setIsNotFound(true)\n        } else {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n          setError(message)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n      updatedAt: data.updatedAt ?? data.updated_at ?? null,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const roleCall = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        {\n          method: 'PUT',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({\n            name: (values.name as string)?.trim(),\n            description: (values.description as string)?.trim() || null,\n            isDefault: values.isDefault,\n            customerAssignable: values.customerAssignable,\n          }),\n        },\n      )\n    ))\n    if (!roleCall.ok) {\n      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    // The role PUT just bumped the aggregate's `updatedAt`; the ACL write guards\n    // the SAME role aggregate, so send its NEW version (not the stale pre-edit one)\n    // to avoid a false 409 while still blocking a concurrent overwrite (#3194).\n    const roleResult = (roleCall.result ?? null) as { updatedAt?: string | null } | null\n    const aclHeaders = buildOptimisticLockHeader(roleResult?.updatedAt ?? data?.updatedAt ?? data?.updated_at ?? null)\n    const aclCall = await withScopedApiRequestHeaders(aclHeaders, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n        {\n          method: 'PUT',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({ features }),\n        },\n      )\n    ))\n    if (!aclCall.ok) {\n      if (surfaceRecordConflict({ status: aclCall.status, body: aclCall.result }, t)) return\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const call = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        { method: 'DELETE' },\n      )\n    ))\n    if (!call.ok) {\n      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            backHref=\"/backend/customer_accounts/roles\"\n            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <ErrorMessage\n            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            action={\n              <Button asChild variant=\"outline\" size=\"sm\">\n                <Link href=\"/backend/customer_accounts/roles\">\n                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n                </Link>\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          titleHeadingLevel={1}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          optimisticLockUpdatedAt={data.updatedAt ?? data.updated_at ?? null}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isDefault ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA6Gc,cACA,YADA;AA3Gd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,gBAAgB;AACzB,SAAS,eAAe;AACxB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AACtC,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,qBAAqB,oBAAoB;AAelD,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAAA,EACxR,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,cAAc,gBAAgB,iEAAiE,qBAAqB,0DAA0D;AAAA,EAClR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,2DAA2D;AACrS;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,cAAc,OAAQ,eAAe,kBAAkB;AAAA,cAChE,iBAAiB,MAAM,kBAAkB,aAAa;AAAA;AAAA,UACxD;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,iBAAiB,MAAM,oBAAoB,SAAS;AAAA,cACpD,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAXU,SAYZ;AAAA,MAEJ,CAAC,GACH;AAAA,SA9BQ,MAAM,EA+BhB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AAExD,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,oBAAc,IAAI;AAClB,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,oBAAc,KAAK;AACnB,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAK,IAA4B,WAAW,KAAK;AAC/C,wBAAc,IAAI;AAAA,QACpB,OAAO;AACL,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,MACf,WAAW,KAAK,aAAa,KAAK,cAAc;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,WAAW,MAAM,4BAA4B,SAAS,MAC1D;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF,CACD;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,sBAAsB,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC,EAAG;AAClF,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AAIrE,UAAM,aAAc,SAAS,UAAU;AACvC,UAAM,aAAa,0BAA0B,YAAY,aAAa,MAAM,aAAa,MAAM,cAAc,IAAI;AACjH,UAAM,UAAU,MAAM,4BAA4B,YAAY,MAC5D;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF,CACD;AACD,QAAI,CAAC,QAAQ,IAAI;AACf,UAAI,sBAAsB,EAAE,QAAQ,QAAQ,QAAQ,MAAM,QAAQ,OAAO,GAAG,CAAC,EAAG;AAChF,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,OAAO,MAAM,4BAA4B,SAAS,MACtD;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB,CACD;AACD,QAAI,CAAC,KAAK,IAAI;AACZ,UAAI,sBAAsB,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,OAAO,GAAG,CAAC,EAAG;AAC1E,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qDAAqD,gBAAgB;AAAA,QAC9E,UAAS;AAAA,QACT,WAAW,EAAE,yDAAyD,eAAe;AAAA;AAAA,IACvF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS,EAAE,qDAAqD,gBAAgB;AAAA,QACvF,QACE,oBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA;AAAA,IAEJ,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,mBAAmB;AAAA,MACnB,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB,KAAK,aAAa,KAAK,cAAc;AAAA,MAC9D,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,YAAY,eAAe;AAAA,MAC3C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/cli.js

@@ -0,0 +1,80 @@
+import { z } from "zod";
+import { getCliModules } from "@open-mercato/shared/modules/registry";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { Tenant } from "@open-mercato/core/modules/directory/data/entities";
+import { syncDefaultCustomerRoleAcls } from "./lib/customerRoleAclSync.js";
+const tenantArgSchema = z.string().trim().min(1);
+const syncCustomerRoleAcls = {
+  command: "sync-customer-role-acls",
+  async run(rest) {
+    const args = {};
+    for (let i = 0; i < rest.length; i++) {
+      const token = rest[i];
+      if (!token?.startsWith("--")) continue;
+      const key = token.replace(/^--/, "");
+      const next = rest[i + 1];
+      if (next && !next.startsWith("--")) {
+        args[key] = next;
+        i++;
+      }
+    }
+    const tenantArg = args.tenantId ?? args.tenant ?? args.tenant_id ?? null;
+    const modules = getCliModules();
+    if (!modules.length) {
+      console.error("\u274C No CLI modules registered. Run `yarn generate` first.");
+      return;
+    }
+    const { resolve } = await createRequestContainer();
+    const em = resolve("em");
+    const targetTenantIds = [];
+    if (tenantArg !== null) {
+      const parsed = tenantArgSchema.safeParse(tenantArg);
+      if (!parsed.success) {
+        console.error(`\u274C Invalid --tenant value: ${tenantArg}`);
+        return;
+      }
+      const tenant = await em.findOne(Tenant, { id: parsed.data });
+      if (!tenant) {
+        console.error(`\u274C Tenant not found: ${parsed.data}`);
+        return;
+      }
+      targetTenantIds.push(parsed.data);
+    } else {
+      const tenants = await em.find(Tenant, {});
+      if (!tenants.length) {
+        console.log("No tenants found; nothing to sync.");
+        return;
+      }
+      for (const tenant of tenants) {
+        const id = tenant.id ? String(tenant.id) : null;
+        if (id) targetTenantIds.push(id);
+      }
+    }
+    let updatedRoleCount = 0;
+    let updatedTenantCount = 0;
+    for (const tenantId of targetTenantIds) {
+      const applied = await syncDefaultCustomerRoleAcls(em, tenantId, modules);
+      if (!applied.length) {
+        console.log(`\u2705 Customer role ACLs already in sync for tenant ${tenantId}`);
+        continue;
+      }
+      updatedTenantCount += 1;
+      updatedRoleCount += applied.length;
+      console.log(`\u2705 Synced customer role ACLs for tenant ${tenantId}`);
+      for (const entry of applied) {
+        console.log(`   \u2022 ${entry.roleName} (${entry.roleSlug}) gained: ${entry.addedFeatures.join(", ")}`);
+      }
+    }
+    if (!updatedRoleCount) {
+      console.log(`Nothing to do \u2014 ${targetTenantIds.length} tenant(s) already in sync.`);
+      return;
+    }
+    console.log(`Updated ${updatedRoleCount} customer role ACL(s) across ${updatedTenantCount} tenant(s).`);
+  }
+};
+const commands = [syncCustomerRoleAcls];
+var cli_default = commands;
+export {
+  cli_default as default
+};
+//# sourceMappingURL=cli.js.map

package/dist/modules/customer_accounts/cli.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/customer_accounts/cli.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { z } from 'zod'\nimport type { ModuleCli } from '@open-mercato/shared/modules/registry'\nimport { getCliModules } from '@open-mercato/shared/modules/registry'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { syncDefaultCustomerRoleAcls } from './lib/customerRoleAclSync'\n\nconst tenantArgSchema = z.string().trim().min(1)\n\n/**\n * Customer-role counterpart of `mercato auth sync-role-acls`.\n *\n * `defaultCustomerRoleFeatures` is merged into seeded customer roles during\n * tenant setup only, so a tenant that already exists never receives features a\n * module declares later. This command replays that same merge \u2014 through the\n * same `syncDefaultCustomerRoleAcls` helper `seedDefaults` calls \u2014 against\n * existing tenants.\n */\nconst syncCustomerRoleAcls: ModuleCli = {\n  command: 'sync-customer-role-acls',\n  async run(rest) {\n    const args: Record<string, string> = {}\n    for (let i = 0; i < rest.length; i++) {\n      const token = rest[i]\n      if (!token?.startsWith('--')) continue\n      const key = token.replace(/^--/, '')\n      const next = rest[i + 1]\n      if (next && !next.startsWith('--')) {\n        args[key] = next\n        i++\n      }\n    }\n    const tenantArg = args.tenantId ?? args.tenant ?? args.tenant_id ?? null\n\n    const modules = getCliModules()\n    if (!modules.length) {\n      console.error('\u274C No CLI modules registered. Run `yarn generate` first.')\n      return\n    }\n\n    const { resolve } = await createRequestContainer()\n    const em = resolve<EntityManager>('em')\n\n    const targetTenantIds: string[] = []\n    if (tenantArg !== null) {\n      const parsed = tenantArgSchema.safeParse(tenantArg)\n      if (!parsed.success) {\n        console.error(`\u274C Invalid --tenant value: ${tenantArg}`)\n        return\n      }\n      const tenant = await em.findOne(Tenant, { id: parsed.data })\n      if (!tenant) {\n        console.error(`\u274C Tenant not found: ${parsed.data}`)\n        return\n      }\n      targetTenantIds.push(parsed.data)\n    } else {\n      const tenants = await em.find(Tenant, {})\n      if (!tenants.length) {\n        console.log('No tenants found; nothing to sync.')\n        return\n      }\n      for (const tenant of tenants) {\n        const id = tenant.id ? String(tenant.id) : null\n        if (id) targetTenantIds.push(id)\n      }\n    }\n\n    let updatedRoleCount = 0\n    let updatedTenantCount = 0\n    for (const tenantId of targetTenantIds) {\n      const applied = await syncDefaultCustomerRoleAcls(em, tenantId, modules)\n      if (!applied.length) {\n        console.log(`\u2705 Customer role ACLs already in sync for tenant ${tenantId}`)\n        continue\n      }\n      updatedTenantCount += 1\n      updatedRoleCount += applied.length\n      console.log(`\u2705 Synced customer role ACLs for tenant ${tenantId}`)\n      for (const entry of applied) {\n        console.log(`   \u2022 ${entry.roleName} (${entry.roleSlug}) gained: ${entry.addedFeatures.join(', ')}`)\n      }\n    }\n\n    if (!updatedRoleCount) {\n      console.log(`Nothing to do \u2014 ${targetTenantIds.length} tenant(s) already in sync.`)\n      return\n    }\n    console.log(`Updated ${updatedRoleCount} customer role ACL(s) across ${updatedTenantCount} tenant(s).`)\n  },\n}\n\nconst commands: ModuleCli[] = [syncCustomerRoleAcls]\n\nexport default commands\n"],
+  "mappings": "AACA,SAAS,SAAS;AAElB,SAAS,qBAAqB;AAC9B,SAAS,8BAA8B;AACvC,SAAS,cAAc;AACvB,SAAS,mCAAmC;AAE5C,MAAM,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAW/C,MAAM,uBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,MAAM,IAAI,MAAM;AACd,UAAM,OAA+B,CAAC;AACtC,aAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,YAAM,QAAQ,KAAK,CAAC;AACpB,UAAI,CAAC,OAAO,WAAW,IAAI,EAAG;AAC9B,YAAM,MAAM,MAAM,QAAQ,OAAO,EAAE;AACnC,YAAM,OAAO,KAAK,IAAI,CAAC;AACvB,UAAI,QAAQ,CAAC,KAAK,WAAW,IAAI,GAAG;AAClC,aAAK,GAAG,IAAI;AACZ;AAAA,MACF;AAAA,IACF;AACA,UAAM,YAAY,KAAK,YAAY,KAAK,UAAU,KAAK,aAAa;AAEpE,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,QAAQ,QAAQ;AACnB,cAAQ,MAAM,8DAAyD;AACvE;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,UAAM,KAAK,QAAuB,IAAI;AAEtC,UAAM,kBAA4B,CAAC;AACnC,QAAI,cAAc,MAAM;AACtB,YAAM,SAAS,gBAAgB,UAAU,SAAS;AAClD,UAAI,CAAC,OAAO,SAAS;AACnB,gBAAQ,MAAM,kCAA6B,SAAS,EAAE;AACtD;AAAA,MACF;AACA,YAAM,SAAS,MAAM,GAAG,QAAQ,QAAQ,EAAE,IAAI,OAAO,KAAK,CAAC;AAC3D,UAAI,CAAC,QAAQ;AACX,gBAAQ,MAAM,4BAAuB,OAAO,IAAI,EAAE;AAClD;AAAA,MACF;AACA,sBAAgB,KAAK,OAAO,IAAI;AAAA,IAClC,OAAO;AACL,YAAM,UAAU,MAAM,GAAG,KAAK,QAAQ,CAAC,CAAC;AACxC,UAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAQ,IAAI,oCAAoC;AAChD;AAAA,MACF;AACA,iBAAW,UAAU,SAAS;AAC5B,cAAM,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,IAAI;AAC3C,YAAI,GAAI,iBAAgB,KAAK,EAAE;AAAA,MACjC;AAAA,IACF;AAEA,QAAI,mBAAmB;AACvB,QAAI,qBAAqB;AACzB,eAAW,YAAY,iBAAiB;AACtC,YAAM,UAAU,MAAM,4BAA4B,IAAI,UAAU,OAAO;AACvE,UAAI,CAAC,QAAQ,QAAQ;AACnB,gBAAQ,IAAI,wDAAmD,QAAQ,EAAE;AACzE;AAAA,MACF;AACA,4BAAsB;AACtB,0BAAoB,QAAQ;AAC5B,cAAQ,IAAI,+CAA0C,QAAQ,EAAE;AAChE,iBAAW,SAAS,SAAS;AAC3B,gBAAQ,IAAI,aAAQ,MAAM,QAAQ,KAAK,MAAM,QAAQ,aAAa,MAAM,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,MACpG;AAAA,IACF;AAEA,QAAI,CAAC,kBAAkB;AACrB,cAAQ,IAAI,wBAAmB,gBAAgB,MAAM,6BAA6B;AAClF;AAAA,IACF;AACA,YAAQ,IAAI,WAAW,gBAAgB,gCAAgC,kBAAkB,aAAa;AAAA,EACxG;AACF;AAEA,MAAM,WAAwB,CAAC,oBAAoB;AAEnD,IAAO,cAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/customerRoleAclSync.js

@@ -0,0 +1,59 @@
+import { hasFeature } from "@open-mercato/shared/security/features";
+import { z } from "zod";
+import {
+  CustomerRole,
+  CustomerRoleAcl
+} from "@open-mercato/core/modules/customer_accounts/data/entities";
+const declaredCustomerRoleFeaturesSchema = z.record(
+  z.string().trim().min(1),
+  z.array(z.string().trim().min(1))
+);
+function collectDefaultCustomerRoleFeatures(modules) {
+  const featuresByRole = {};
+  for (const mod of modules) {
+    const declared = mod.setup?.defaultCustomerRoleFeatures;
+    if (!declared) continue;
+    const parsed = declaredCustomerRoleFeaturesSchema.safeParse(declared);
+    if (!parsed.success) continue;
+    for (const [roleSlug, features] of Object.entries(parsed.data)) {
+      if (!features.length) continue;
+      const bucket = featuresByRole[roleSlug] ?? [];
+      bucket.push(...features);
+      featuresByRole[roleSlug] = bucket;
+    }
+  }
+  for (const roleSlug of Object.keys(featuresByRole)) {
+    featuresByRole[roleSlug] = Array.from(new Set(featuresByRole[roleSlug]));
+  }
+  return featuresByRole;
+}
+async function syncDefaultCustomerRoleAcls(em, tenantId, modules) {
+  const featuresByRole = collectDefaultCustomerRoleFeatures(modules);
+  const roleSlugs = Object.keys(featuresByRole);
+  if (!roleSlugs.length) return [];
+  const applied = [];
+  for (const roleSlug of roleSlugs) {
+    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null });
+    if (!role) continue;
+    const acl = await em.findOne(CustomerRoleAcl, { role, tenantId });
+    if (!acl) continue;
+    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : [];
+    const addedFeatures = [];
+    for (const feature of featuresByRole[roleSlug]) {
+      if (hasFeature(currentFeatures, feature)) continue;
+      if (hasFeature(addedFeatures, feature)) continue;
+      addedFeatures.push(feature);
+    }
+    if (!addedFeatures.length) continue;
+    acl.featuresJson = [...currentFeatures, ...addedFeatures];
+    em.persist(acl);
+    applied.push({ roleSlug, roleName: role.name, addedFeatures });
+  }
+  if (applied.length) await em.flush();
+  return applied;
+}
+export {
+  collectDefaultCustomerRoleFeatures,
+  syncDefaultCustomerRoleAcls
+};
+//# sourceMappingURL=customerRoleAclSync.js.map

package/dist/modules/customer_accounts/lib/customerRoleAclSync.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/customerRoleAclSync.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { Module } from '@open-mercato/shared/modules/registry'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { z } from 'zod'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\nconst declaredCustomerRoleFeaturesSchema = z.record(\n  z.string().trim().min(1),\n  z.array(z.string().trim().min(1)),\n)\n\nexport type CustomerRoleAclSyncEntry = {\n  roleSlug: string\n  roleName: string\n  addedFeatures: string[]\n}\n\n/**\n * Collects `defaultCustomerRoleFeatures` from every enabled module, keyed by\n * customer role slug. Third-party modules can declare anything, so the shape is\n * validated rather than trusted; a malformed declaration is skipped instead of\n * poisoning the whole sync.\n */\nexport function collectDefaultCustomerRoleFeatures(modules: Module[]): Record<string, string[]> {\n  const featuresByRole: Record<string, string[]> = {}\n  for (const mod of modules) {\n    const declared = mod.setup?.defaultCustomerRoleFeatures\n    if (!declared) continue\n    const parsed = declaredCustomerRoleFeaturesSchema.safeParse(declared)\n    if (!parsed.success) continue\n    for (const [roleSlug, features] of Object.entries(parsed.data)) {\n      if (!features.length) continue\n      const bucket = featuresByRole[roleSlug] ?? []\n      bucket.push(...features)\n      featuresByRole[roleSlug] = bucket\n    }\n  }\n  for (const roleSlug of Object.keys(featuresByRole)) {\n    featuresByRole[roleSlug] = Array.from(new Set(featuresByRole[roleSlug]))\n  }\n  return featuresByRole\n}\n\n/**\n * Merges the modules' declared `defaultCustomerRoleFeatures` into the matching\n * `CustomerRoleAcl` rows of a single tenant.\n *\n * Contract, relied on by both tenant setup and `mercato customer_accounts\n * sync-customer-role-acls`:\n * - additive only \u2014 a feature an operator added by hand is never removed;\n * - never creates a `CustomerRole` or a `CustomerRoleAcl`, so a slug with no\n *   matching seeded role is a no-op;\n * - wildcard-aware \u2014 a role already holding `portal.*` (or `*`) does not gain a\n *   redundant concrete grant;\n * - idempotent \u2014 a second run finds nothing left to add and writes nothing.\n */\nexport async function syncDefaultCustomerRoleAcls(\n  em: EntityManager,\n  tenantId: string,\n  modules: Module[],\n): Promise<CustomerRoleAclSyncEntry[]> {\n  const featuresByRole = collectDefaultCustomerRoleFeatures(modules)\n  const roleSlugs = Object.keys(featuresByRole)\n  if (!roleSlugs.length) return []\n\n  const applied: CustomerRoleAclSyncEntry[] = []\n  for (const roleSlug of roleSlugs) {\n    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })\n    if (!role) continue\n    const acl = await em.findOne(CustomerRoleAcl, { role, tenantId })\n    if (!acl) continue\n\n    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n    const addedFeatures: string[] = []\n    for (const feature of featuresByRole[roleSlug]) {\n      if (hasFeature(currentFeatures, feature)) continue\n      if (hasFeature(addedFeatures, feature)) continue\n      addedFeatures.push(feature)\n    }\n    if (!addedFeatures.length) continue\n\n    acl.featuresJson = [...currentFeatures, ...addedFeatures]\n    em.persist(acl)\n    applied.push({ roleSlug, roleName: role.name, addedFeatures })\n  }\n\n  if (applied.length) await em.flush()\n  return applied\n}\n"],
+  "mappings": "AAEA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,qCAAqC,EAAE;AAAA,EAC3C,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAAA,EACvB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAClC;AAcO,SAAS,mCAAmC,SAA6C;AAC9F,QAAM,iBAA2C,CAAC;AAClD,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI,OAAO;AAC5B,QAAI,CAAC,SAAU;AACf,UAAM,SAAS,mCAAmC,UAAU,QAAQ;AACpE,QAAI,CAAC,OAAO,QAAS;AACrB,eAAW,CAAC,UAAU,QAAQ,KAAK,OAAO,QAAQ,OAAO,IAAI,GAAG;AAC9D,UAAI,CAAC,SAAS,OAAQ;AACtB,YAAM,SAAS,eAAe,QAAQ,KAAK,CAAC;AAC5C,aAAO,KAAK,GAAG,QAAQ;AACvB,qBAAe,QAAQ,IAAI;AAAA,IAC7B;AAAA,EACF;AACA,aAAW,YAAY,OAAO,KAAK,cAAc,GAAG;AAClD,mBAAe,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,eAAe,QAAQ,CAAC,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAeA,eAAsB,4BACpB,IACA,UACA,SACqC;AACrC,QAAM,iBAAiB,mCAAmC,OAAO;AACjE,QAAM,YAAY,OAAO,KAAK,cAAc;AAC5C,MAAI,CAAC,UAAU,OAAQ,QAAO,CAAC;AAE/B,QAAM,UAAsC,CAAC;AAC7C,aAAW,YAAY,WAAW;AAChC,UAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK,CAAC;AACzF,QAAI,CAAC,KAAM;AACX,UAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAChE,QAAI,CAAC,IAAK;AAEV,UAAM,kBAAkB,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAC9E,UAAM,gBAA0B,CAAC;AACjC,eAAW,WAAW,eAAe,QAAQ,GAAG;AAC9C,UAAI,WAAW,iBAAiB,OAAO,EAAG;AAC1C,UAAI,WAAW,eAAe,OAAO,EAAG;AACxC,oBAAc,KAAK,OAAO;AAAA,IAC5B;AACA,QAAI,CAAC,cAAc,OAAQ;AAE3B,QAAI,eAAe,CAAC,GAAG,iBAAiB,GAAG,aAAa;AACxD,OAAG,QAAQ,GAAG;AACd,YAAQ,KAAK,EAAE,UAAU,UAAU,KAAK,MAAM,cAAc,CAAC;AAAA,EAC/D;AAEA,MAAI,QAAQ,OAAQ,OAAM,GAAG,MAAM;AACnC,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/customer_accounts/setup.js

@@ -1,5 +1,4 @@
 import { hash } from "bcryptjs";
-import { ensureDefaultCustomerRoleAcls } from "@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls";
 import { hashForLookup } from "@open-mercato/shared/lib/encryption/aes";
 import { EXAMPLE_PORTAL_ACCOUNTS } from "@open-mercato/core/modules/customer_accounts/lib/exampleAccounts";
 import {
@@ -8,6 +7,7 @@ import {
   CustomerUser,
   CustomerUserRole
 } from "@open-mercato/core/modules/customer_accounts/data/entities";
+import { syncDefaultCustomerRoleAcls } from "./lib/customerRoleAclSync.js";
 const DOMAIN_VERIFICATION_SCHEDULE_ID = "5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001";
 const DOMAIN_TLS_RETRY_SCHEDULE_ID = "5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002";
 function intervalSecondsFromEnv(envName, fallbackSeconds) {
@@ -49,6 +49,7 @@ async function registerDomainSchedules(container) {
     isEnabled: true
   });
 }
+const DEFAULT_CUSTOMER_ROLE_SLUGS = ["portal_admin", "buyer", "viewer"];
 const DEFAULT_ROLES = [
   {
     name: "Portal Admin",
@@ -150,7 +151,7 @@ const setup = {
     try {
       const { getModules } = await import("@open-mercato/shared/lib/modules/registry");
       const allModules = getModules();
-      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules);
+      await syncDefaultCustomerRoleAcls(em, tenantId, allModules);
     } catch {
     }
     try {
@@ -195,6 +196,7 @@ const setup = {
 };
 var setup_default = setup;
 export {
+  DEFAULT_CUSTOMER_ROLE_SLUGS,
   setup_default as default,
   setup
 };

package/dist/modules/customer_accounts/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/customer_accounts/setup.ts"],
-  "sourcesContent": ["import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport { ensureDefaultCustomerRoleAcls } from '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await ensureDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAEA,SAAS,YAAY;AACrB,SAAS,qCAAqC;AAC9C,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BP,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AAEA,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAEvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,8BAA8B,IAAI,UAAU,UAAU;AAAA,IAC9D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport { ensureDefaultCustomerRoleAcls } from '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'\nimport {\n  CustomerRole,\n  CustomerRoleAcl,\n  CustomerUser,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { syncDefaultCustomerRoleAcls } from './lib/customerRoleAclSync'\n\ninterface SeedScope {\n  tenantId: string\n  organizationId: string\n}\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    description?: string\n    scopeType: 'system'\n    scheduleType: 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue'\n    targetQueue: string\n    targetPayload?: Record<string, unknown>\n    sourceType: 'module'\n    sourceModule: string\n    isEnabled?: boolean\n  }) => Promise<void>\n}\n\n// Stable, deterministic UUIDs for the two domain-routing system schedules so\n// re-running setup re-upserts the same rows instead of creating duplicates.\nconst DOMAIN_VERIFICATION_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1001'\nconst DOMAIN_TLS_RETRY_SCHEDULE_ID = '5e9ef5fc-1f4d-5b3d-8b58-8e1a5a4d1002'\n\nfunction intervalSecondsFromEnv(envName: string, fallbackSeconds: number): string {\n  const parsed = Number.parseInt(process.env[envName] ?? '', 10)\n  const seconds = Number.isFinite(parsed) && parsed > 0 ? parsed : fallbackSeconds\n  return `${seconds}s`\n}\n\nasync function registerDomainSchedules(\n  container: { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n): Promise<void> {\n  if (typeof container.hasRegistration !== 'function' || !container.hasRegistration('schedulerService')) {\n    return\n  }\n  const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n\n  await schedulerService.register({\n    id: DOMAIN_VERIFICATION_SCHEDULE_ID,\n    name: 'Custom domain \u2014 DNS auto-verification',\n    description:\n      'Re-runs DNS verification for custom-domain mappings stuck in pending or dns_failed, and triggers TLS health checks on success.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_AUTO_VERIFY_INTERVAL_SECONDS', 300),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-verification',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n\n  await schedulerService.register({\n    id: DOMAIN_TLS_RETRY_SCHEDULE_ID,\n    name: 'Custom domain \u2014 TLS retry',\n    description:\n      'Retries TLS certificate provisioning for verified or tls_failed custom-domain mappings, with batch cap and adaptive backoff on Let\\'s Encrypt rate limits.',\n    scopeType: 'system',\n    scheduleType: 'interval',\n    scheduleValue: intervalSecondsFromEnv('DOMAIN_TLS_RETRY_INTERVAL_SECONDS', 1800),\n    timezone: 'UTC',\n    targetType: 'queue',\n    targetQueue: 'domain-tls-retry',\n    sourceType: 'module',\n    sourceModule: 'customer_accounts',\n    isEnabled: true,\n  })\n}\n\n/**\n * The customer roles this module seeds, and therefore the ONLY slugs another\n * module's `defaultCustomerRoleFeatures` can target: the merge below skips a\n * slug with no matching role (`if (!role) continue`), so a typo is a silent\n * no-op rather than an error. Exported so a contributing module can assert its\n * keys against the real list instead of hoping.\n */\nexport const DEFAULT_CUSTOMER_ROLE_SLUGS = ['portal_admin', 'buyer', 'viewer'] as const\n\nconst DEFAULT_ROLES = [\n  {\n    name: 'Portal Admin',\n    slug: 'portal_admin',\n    description: 'Full portal administration access',\n    isSystem: true,\n    customerAssignable: false,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: true,\n      features: ['portal.*'],\n    },\n  },\n  {\n    name: 'Buyer',\n    slug: 'buyer',\n    description: 'Standard buyer access with ordering capabilities',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: true,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.orders.create',\n        'portal.quotes.view',\n        'portal.quotes.request',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n  {\n    name: 'Viewer',\n    slug: 'viewer',\n    description: 'Read-only portal access',\n    isSystem: true,\n    customerAssignable: true,\n    isDefault: false,\n    acl: {\n      isPortalAdmin: false,\n      features: [\n        'portal.account.manage',\n        'portal.orders.view',\n        'portal.invoices.view',\n        'portal.catalog.view',\n      ],\n    },\n  },\n]\n\nconst DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(\n  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),\n)\n\nasync function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {\n  for (const roleDef of DEFAULT_ROLES) {\n    const existing = await em.findOne(CustomerRole, {\n      tenantId: scope.tenantId,\n      slug: roleDef.slug,\n      deletedAt: null,\n    })\n    if (existing) continue\n\n    const role = em.create(CustomerRole, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      name: roleDef.name,\n      slug: roleDef.slug,\n      description: roleDef.description,\n      isSystem: roleDef.isSystem,\n      customerAssignable: roleDef.customerAssignable,\n      isDefault: roleDef.isDefault,\n      createdAt: new Date(),\n    } as any)\n    em.persist(role)\n\n    const acl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: scope.tenantId,\n      featuresJson: roleDef.acl.features,\n      isPortalAdmin: roleDef.acl.isPortalAdmin,\n      createdAt: new Date(),\n    } as any)\n    em.persist(acl)\n  }\n  await em.flush()\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: ['customer_accounts.*'],\n    admin: ['customer_accounts.*'],\n  },\n  // Keep the portal feature catalog declarative so the shared feature policy\n  // can project portal.* into concrete capabilities without importing core.\n  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,\n\n  async onTenantCreated({ em, tenantId, organizationId }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n  },\n\n  async seedDefaults({ em, tenantId, organizationId, container }) {\n    await seedDefaultRoles(em, { tenantId, organizationId })\n    // Merge defaultCustomerRoleFeatures from all enabled modules. Existing\n    // tenants replay the same merge via `mercato customer_accounts\n    // sync-customer-role-acls`.\n    try {\n      const { getModules } = await import('@open-mercato/shared/lib/modules/registry')\n      const allModules = getModules()\n      await syncDefaultCustomerRoleAcls(em, tenantId, allModules)\n    } catch {\n      // Modules may not be registered yet during initial setup\n    }\n\n    // System-scoped schedules: register is idempotent, so re-running setup\n    // (or running it for additional tenants) just upserts the same two rows.\n    try {\n      await registerDomainSchedules(\n        container as { hasRegistration?: (name: string) => boolean; resolve: (name: string) => unknown },\n      )\n    } catch {\n      // Scheduler may not be installed in this deployment; ignore.\n    }\n  },\n\n  async seedExamples({ em, tenantId, organizationId }) {\n    const BCRYPT_COST = 10\n\n    for (const entry of EXAMPLE_PORTAL_ACCOUNTS) {\n      const emailHash = hashForLookup(entry.email)\n      const existing = await em.findOne(CustomerUser, { emailHash, tenantId, deletedAt: null })\n      if (existing) continue\n\n      const passwordHash = await hash(entry.password, BCRYPT_COST)\n      const user = em.create(CustomerUser, {\n        email: entry.email,\n        emailHash,\n        passwordHash,\n        displayName: entry.displayName,\n        tenantId,\n        organizationId,\n        isActive: true,\n        failedLoginAttempts: 0,\n        emailVerifiedAt: new Date(),\n        createdAt: new Date(),\n      } as any)\n      em.persist(user)\n\n      const role = await em.findOne(CustomerRole, { tenantId, slug: entry.roleSlug, deletedAt: null })\n      if (role) {\n        const userRole = em.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        em.persist(userRole)\n      }\n    }\n    await em.flush()\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAEA,SAAS,YAAY;AAErB,SAAS,qBAAqB;AAC9B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mCAAmC;AA2B5C,MAAM,kCAAkC;AACxC,MAAM,+BAA+B;AAErC,SAAS,uBAAuB,SAAiB,iBAAiC;AAChF,QAAM,SAAS,OAAO,SAAS,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE;AAC7D,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,SAAS;AACjE,SAAO,GAAG,OAAO;AACnB;AAEA,eAAe,wBACb,WACe;AACf,MAAI,OAAO,UAAU,oBAAoB,cAAc,CAAC,UAAU,gBAAgB,kBAAkB,GAAG;AACrG;AAAA,EACF;AACA,QAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAE7D,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,uCAAuC,GAAG;AAAA,IAChF,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AAED,QAAM,iBAAiB,SAAS;AAAA,IAC9B,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,aACE;AAAA,IACF,WAAW;AAAA,IACX,cAAc;AAAA,IACd,eAAe,uBAAuB,qCAAqC,IAAI;AAAA,IAC/E,UAAU;AAAA,IACV,YAAY;AAAA,IACZ,aAAa;AAAA,IACb,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,WAAW;AAAA,EACb,CAAC;AACH;AASO,MAAM,8BAA8B,CAAC,gBAAgB,SAAS,QAAQ;AAE7E,MAAM,gBAAgB;AAAA,EACpB;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU,CAAC,UAAU;AAAA,IACvB;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU;AAAA,IACV,oBAAoB;AAAA,IACpB,WAAW;AAAA,IACX,KAAK;AAAA,MACH,eAAe;AAAA,MACf,UAAU;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,MAAM,iCAAiC,OAAO;AAAA,EAC5C,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,IAAI,QAAQ,CAAC,CAAC;AACjE;AAEA,eAAe,iBAAiB,IAAmB,OAAiC;AAClF,aAAW,WAAW,eAAe;AACnC,UAAM,WAAW,MAAM,GAAG,QAAQ,cAAc;AAAA,MAC9C,UAAU,MAAM;AAAA,MAChB,MAAM,QAAQ;AAAA,MACd,WAAW;AAAA,IACb,CAAC;AACD,QAAI,SAAU;AAEd,UAAM,OAAO,GAAG,OAAO,cAAc;AAAA,MACnC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,oBAAoB,QAAQ;AAAA,MAC5B,WAAW,QAAQ;AAAA,MACnB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,IAAI;AAEf,UAAM,MAAM,GAAG,OAAO,iBAAiB;AAAA,MACrC;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,cAAc,QAAQ,IAAI;AAAA,MAC1B,eAAe,QAAQ,IAAI;AAAA,MAC3B,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,GAAG;AAAA,EAChB;AACA,QAAM,GAAG,MAAM;AACjB;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY,CAAC,qBAAqB;AAAA,IAClC,OAAO,CAAC,qBAAqB;AAAA,EAC/B;AAAA;AAAA;AAAA,EAGA,6BAA6B;AAAA,EAE7B,MAAM,gBAAgB,EAAE,IAAI,UAAU,eAAe,GAAG;AACtD,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,gBAAgB,UAAU,GAAG;AAC9D,UAAM,iBAAiB,IAAI,EAAE,UAAU,eAAe,CAAC;AAIvD,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,OAAO,2CAA2C;AAC/E,YAAM,aAAa,WAAW;AAC9B,YAAM,4BAA4B,IAAI,UAAU,UAAU;AAAA,IAC5D,QAAQ;AAAA,IAER;AAIA,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,IAAI,UAAU,eAAe,GAAG;AACnD,UAAM,cAAc;AAEpB,eAAW,SAAS,yBAAyB;AAC3C,YAAM,YAAY,cAAc,MAAM,KAAK;AAC3C,YAAM,WAAW,MAAM,GAAG,QAAQ,cAAc,EAAE,WAAW,UAAU,WAAW,KAAK,CAAC;AACxF,UAAI,SAAU;AAEd,YAAM,eAAe,MAAM,KAAK,MAAM,UAAU,WAAW;AAC3D,YAAM,OAAO,GAAG,OAAO,cAAc;AAAA,QACnC,OAAO,MAAM;AAAA,QACb;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,UAAU;AAAA,QACV,qBAAqB;AAAA,QACrB,iBAAiB,oBAAI,KAAK;AAAA,QAC1B,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,IAAI;AAEf,YAAM,OAAO,MAAM,GAAG,QAAQ,cAAc,EAAE,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK,CAAC;AAC/F,UAAI,MAAM;AACR,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customers/commands/deals.js

@@ -1,3 +1,4 @@
+import { z } from "zod";
 import { registerCommand } from "@open-mercato/shared/lib/commands";
 import {
   parseWithCustomFields,
@@ -45,6 +46,7 @@ import {
 import { canonicalDealStatus, isClosedDealStatus } from "../lib/dealStatus.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customers");
+const dealCommandOutputSchema = z.object({ dealId: z.string().uuid() });
 const DEAL_ENTITY_ID = "customers:customer_deal";
 const dealCrudIndexer = {
   entityType: E.customers.customer_deal
@@ -363,6 +365,7 @@ async function syncDealCompanies(em, deal, companyIds, options) {
 }
 const createDealCommand = {
   id: "customers.deals.create",
+  outputSchema: dealCommandOutputSchema,
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(dealCreateSchema, rawInput);
     ensureTenantScope(ctx, parsed.tenantId);
@@ -554,6 +557,7 @@ const createDealCommand = {
 };
 const updateDealCommand = {
   id: "customers.deals.update",
+  outputSchema: dealCommandOutputSchema,
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(dealUpdateSchema, rawInput);
     const em = ctx.container.resolve("em").fork();