@open-mercato/core 0.8.1-develop.7263.1.bbc6db3437 → 0.8.1-develop.7267.1.2e95af80a6

package/src/modules/auth/i18n/de.json

@@ -62,9 +62,6 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
-  "auth.acl.features.availability.check": "Run availability checks",
-  "auth.acl.features.availability.policies.manage": "Manage availability policies",
-  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/en.json

@@ -62,9 +62,6 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
-  "auth.acl.features.availability.check": "Run availability checks",
-  "auth.acl.features.availability.policies.manage": "Manage availability policies",
-  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/es.json

@@ -62,9 +62,6 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
-  "auth.acl.features.availability.check": "Run availability checks",
-  "auth.acl.features.availability.policies.manage": "Manage availability policies",
-  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/ko.json

@@ -62,9 +62,6 @@
   "auth.acl.features.auth.users.delete": "Delete users",
   "auth.acl.features.auth.users.edit": "Edit users",
   "auth.acl.features.auth.users.list": "List users",
-  "auth.acl.features.availability.check": "Run availability checks",
-  "auth.acl.features.availability.policies.manage": "Manage availability policies",
-  "auth.acl.features.availability.policies.view": "View availability policies",
   "auth.acl.features.business_rules.execute": "Execute business rules manually",
   "auth.acl.features.business_rules.manage": "Create, edit, and delete business rules",
   "auth.acl.features.business_rules.manage_sets": "Manage rule sets",

package/src/modules/auth/i18n/pl.json

@@ -62,9 +62,6 @@
   "auth.acl.features.auth.users.delete": "Usuwaj użytkowników",
   "auth.acl.features.auth.users.edit": "Edytuj użytkowników",
   "auth.acl.features.auth.users.list": "Wyświetl listę użytkowników",
-  "auth.acl.features.availability.check": "Uruchamiaj sprawdzenia dostępności",
-  "auth.acl.features.availability.policies.manage": "Zarządzaj politykami dostępności",
-  "auth.acl.features.availability.policies.view": "Wyświetl polityki dostępności",
   "auth.acl.features.business_rules.execute": "Uruchamiaj reguły biznesowe ręcznie",
   "auth.acl.features.business_rules.manage": "Twórz, edytuj i usuwaj reguły biznesowe",
   "auth.acl.features.business_rules.manage_sets": "Zarządzaj zestawami reguł",

package/src/modules/communication_channels/commands/deliver-outbound-message.ts

@@ -530,6 +530,14 @@ const deliverOutboundMessageCommand: CommandHandler<
           providerKey: channel.providerKey,
           channelType: channel.channelType,
           direction: 'outbound',
+          // #6095: same contract as the inbound path — the send time travels on
+          // the event so consumers (the customers timeline) date their rows
+          // from it instead of reading the ExternalMessage row across the
+          // module boundary. ISO string because this event is persistent.
+          providerTimestamp:
+            externalMessage.providerTimestamp instanceof Date
+              ? externalMessage.providerTimestamp.toISOString()
+              : null,
           tenantId: input.scope.tenantId,
           organizationId: input.scope.organizationId ?? null,
         },

package/src/modules/communication_channels/commands/ingest-inbound-message.ts

@@ -417,6 +417,12 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
       // when the matcher returned null (no token / JWZ / subject hit).
       parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,
       isDraft: false,
+      // #6095: the platform message is dated when the provider received the
+      // mail, not when this worker ran. Otherwise a history import lands every
+      // message on the import minute and the inbox (sorted on `sent_at`) shows
+      // a 90-day mailbox as one block in import order. Adapters without a
+      // timestamp fall through to compose's own `new Date()`.
+      sentAt: m.timestamp ?? undefined,
       // Stable dedup key so a retried ingest (after a transient failure between
       // compose and the ExternalMessage anchor insert) reuses the message
       // composed by the first attempt instead of duplicating it. Mirrors the
@@ -576,6 +582,16 @@ const ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, Ing
         providerKey: input.providerKey,
         channelType: input.channelType,
         direction: 'inbound',
+        // #6095: subscribers that date their own rows from this message (the
+        // customers timeline) need the provider's receive time, not the moment
+        // this worker ran. Carried here so no consumer has to read the
+        // ExternalMessage row across the module boundary. ISO string because a
+        // persistent event is serialized onto the queue; null when the adapter
+        // supplied no timestamp, which leaves the consumer's own fallback.
+        providerTimestamp:
+          externalMessage.providerTimestamp instanceof Date
+            ? externalMessage.providerTimestamp.toISOString()
+            : null,
         tenantId: input.scope.tenantId,
         organizationId: input.scope.organizationId ?? null,
       },

package/src/modules/communication_channels/lib/email-mime.ts

@@ -414,7 +414,19 @@ export interface NormalizeMimeInboundOptions {
   fallbackMessageId: string
   /** Compute the conversation grouping id from the resolved message id + references. */
   resolveConversationId: (context: { messageId: string; references: string[] }) => string
-  /** Fallback timestamp when the parsed message has no Date header. */
+  /**
+   * When the provider received the message (Gmail `internalDate`, IMAP
+   * `INTERNALDATE`). Preferred over the MIME `Date` header for the message
+   * timestamp: the header is written by the sender's client and can be forged
+   * or skewed, and since #6095 the timestamp also dates the platform message
+   * and the CRM interaction, so a bad header would pin a message in the future
+   * or hide it in the past.
+   */
+  receivedAt?: Date
+  /**
+   * Fallback timestamp when neither `receivedAt` nor a usable Date header is
+   * available.
+   */
   fallbackDate?: Date
   /** Provider-specific fields merged into `channelMetadata`. */
   channelMetadata?: (parsed: ParsedMail) => Record<string, unknown>
@@ -422,6 +434,40 @@ export interface NormalizeMimeInboundOptions {
   channelPayload?: (parsed: ParsedMail) => Record<string, unknown>
 }
 
+/**
+ * A MIME `Date` header this far ahead of the clock is treated as bogus. Clock
+ * skew between real mail servers is seconds to minutes; a day of tolerance
+ * keeps legitimate mail while stopping a forged header from pinning a message
+ * to the top of a `sent_at`-sorted inbox for weeks.
+ */
+const MAX_MIME_DATE_FUTURE_SKEW_MS = 24 * 60 * 60 * 1000
+
+function isValidDate(value: unknown): value is Date {
+  return value instanceof Date && !Number.isNaN(value.getTime())
+}
+
+/**
+ * Pick the timestamp for an inbound message.
+ *
+ * Order: the provider's receipt time; then the sender's MIME `Date` header,
+ * unless it is unparsable or more than a day in the future; then the caller's
+ * fallback; then now. Exported for tests.
+ */
+export function resolveInboundTimestamp(input: {
+  receivedAt?: Date
+  mimeDate?: Date
+  fallbackDate?: Date
+  now?: Date
+}): Date {
+  if (isValidDate(input.receivedAt)) return input.receivedAt
+  const now = input.now ?? new Date()
+  if (isValidDate(input.mimeDate) && input.mimeDate.getTime() <= now.getTime() + MAX_MIME_DATE_FUTURE_SKEW_MS) {
+    return input.mimeDate
+  }
+  if (isValidDate(input.fallbackDate)) return input.fallbackDate
+  return now
+}
+
 /**
  * Build the hub's canonical `NormalizedInboundMessage` from a parsed MIME
  * message. Providers supply the bits that genuinely differ (message-id
@@ -474,7 +520,11 @@ export function normalizeMimeInbound(options: NormalizeMimeInboundOptions): Norm
     body,
     bodyFormat,
     attachments,
-    timestamp: parsed.date ? new Date(parsed.date) : options.fallbackDate ?? new Date(),
+    timestamp: resolveInboundTimestamp({
+      receivedAt: options.receivedAt,
+      mimeDate: parsed.date ? new Date(parsed.date) : undefined,
+      fallbackDate: options.fallbackDate,
+    }),
     replyToExternalId: inReplyTo ?? undefined,
     channelPayload,
     channelContentType: 'email/mime',

package/src/modules/customers/lib/link-channel-message-handler.ts

@@ -34,6 +34,13 @@ type LinkChannelMessagePayload = {
   organizationId?: string | null
   providerKey?: string | null
   direction?: 'inbound' | 'outbound' | null
+  /**
+   * The provider's own receive/send time, carried by the hub on the event
+   * (#6095). An ISO string when the event rode the queue, a Date for an
+   * in-process emit. Absent on events enqueued before the field existed and on
+   * adapters that supply no timestamp.
+   */
+  providerTimestamp?: string | Date | null
 }
 
 type SubscriberContext = {
@@ -88,6 +95,17 @@ export default async function handler(
   const metaJson = (link.channelMetadata ?? null) as Record<string, unknown> | null
   const payloadJson = (link.channelPayload ?? null) as Record<string, unknown> | null
 
+  // ── (1b) Resolve when the email actually happened ─────────────────────
+  //
+  // `link.createdAt` is when the hub ingested the message, which for a history
+  // import is the import minute, not the day the mail arrived (#6095). The hub
+  // carries the provider's own timestamp on the event payload, so take it from
+  // there: reading the communication_channels ExternalMessage row here would
+  // cross the storage boundary (Cross-Module Coupling in AGENTS.md) and add a
+  // peer-table query per event. Resolved once and threaded through every branch
+  // below so the address-match and threading-inheritance paths agree.
+  const occurredAt = resolveOccurredAt(payload, link)
+
   // ── (2) Resolve the channel to get its owner userId ───────────────────
   //
   // The channel.userId is needed for two purposes:
@@ -172,7 +190,7 @@ export default async function handler(
   // Early exit: no addresses AND no hint → nothing to link.
   if (normalized.length === 0 && !crmPersonId) {
     // Before giving up, try threading-inheritance (TC-CRM-EMAIL-005).
-    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson)
+    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson, occurredAt)
     return
   }
 
@@ -183,7 +201,7 @@ export default async function handler(
 
   if (personIdSet.size === 0) {
     // Try threading-inheritance before giving up.
-    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson)
+    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson, occurredAt)
     return
   }
 
@@ -211,7 +229,6 @@ export default async function handler(
         ? (payloadJson!.text as string)
         : null
 
-  const occurredAt = link.createdAt instanceof Date ? link.createdAt : new Date()
   const providerKey =
     typeof link.providerKey === 'string' ? (link.providerKey as string) : null
 
@@ -257,6 +274,7 @@ async function handleThreadingInheritance(
   channelUserId: string | null,
   metaJson: Record<string, unknown> | null,
   payloadJson: Record<string, unknown> | null,
+  occurredAt: Date,
 ): Promise<void> {
   // ── Primary: inherit Person(s) from the hub's authoritative thread ──────
   //
@@ -325,7 +343,6 @@ async function handleThreadingInheritance(
           : typeof metaJson?.bodyText === 'string'
             ? (metaJson.bodyText as string)
             : null
-      const occurredAt = _link.createdAt instanceof Date ? (_link.createdAt as Date) : new Date()
       const providerKey = typeof _link.providerKey === 'string' ? (_link.providerKey as string) : null
       await persistInteractions(em, threadPersonIds, {
         linkId,
@@ -420,7 +437,6 @@ async function handleThreadingInheritance(
   const inheritedMeta = (link.channelMetadata ?? null) as Record<string, unknown> | null
   const subject =
     typeof inheritedMeta?.subject === 'string' ? (inheritedMeta.subject as string) : null
-  const occurredAt = link.createdAt instanceof Date ? (link.createdAt as Date) : new Date()
   const providerKey =
     typeof link.providerKey === 'string' ? (link.providerKey as string) : null
 
@@ -444,6 +460,33 @@ async function handleThreadingInheritance(
 
 // ── Helpers ───────────────────────────────────────────────────────────────
 
+/**
+ * When the linked email happened, for `CustomerInteraction.occurredAt` (#6095).
+ *
+ * Preference order:
+ *   1. `payload.providerTimestamp` — the provider's own receive/send time, put
+ *      on the hub event by ingest / delivery;
+ *   2. `MessageChannelLink.createdAt` — the ingest time, the only date this
+ *      handler knew before #6095, and the compatibility path for events that
+ *      were enqueued before the field existed;
+ *   3. now, for a link row with no usable `createdAt` (test stubs).
+ */
+function resolveOccurredAt(
+  payload: LinkChannelMessagePayload,
+  link: Record<string, unknown>,
+): Date {
+  const ingestedAt = link.createdAt instanceof Date ? link.createdAt : new Date()
+  const carried = payload.providerTimestamp
+  if (carried instanceof Date) {
+    return Number.isNaN(carried.getTime()) ? ingestedAt : carried
+  }
+  if (typeof carried === 'string' && carried) {
+    const parsed = new Date(carried)
+    if (!Number.isNaN(parsed.getTime())) return parsed
+  }
+  return ingestedAt
+}
+
 interface InteractionData {
   linkId: string
   tenantId: string

package/src/modules/messages/api/route.ts

@@ -470,12 +470,15 @@ export async function POST(req: Request) {
         sourceHint.data,
       )
     : undefined
-  // `inboundFromChannel` is likewise server-only (#6093): channel ingest sets
-  // it so an inbound message can be addressed to the conversation's assignee,
-  // and a request body must not be able to waive the recipients rule with it.
+  // `inboundFromChannel` and `sentAt` are likewise server-only (#6093, #6095):
+  // channel ingest sets them so an inbound message can be addressed to the
+  // conversation's assignee and stamped with the provider's receive time, but
+  // a request body must not be able to waive the recipients rule or backdate
+  // a message with them.
   const {
     sourceChannelType: _clientSuppliedChannelType,
     inboundFromChannel: _clientSuppliedInboundFlag,
+    sentAt: _clientSuppliedSentAt,
     ...clientBody
   } = (body ?? {}) as Record<string, unknown>
   const input = composeMessageSchema.parse({

package/src/modules/messages/commands/messages.ts

@@ -333,7 +333,9 @@ const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: str
         priority: input.priority,
         status: input.isDraft ? 'draft' : 'sent',
         isDraft: input.isDraft ?? false,
-        sentAt: input.isDraft ? null : new Date(),
+        // #6095: channel ingest passes the provider's timestamp so an imported
+        // mailbox sorts by when the mail was received, not when it was imported.
+        sentAt: input.isDraft ? null : input.sentAt ?? new Date(),
         actionData: input.actionData as MessageActionData | undefined,
         sendViaEmail,
         idempotencyKey: input.idempotencyKey ?? null,

package/src/modules/messages/data/validators.ts

@@ -138,12 +138,20 @@ const composeMessageBaseSchema = z.object({
   sendViaEmail: z.boolean().optional().default(false),
   parentMessageId: z.string().uuid().optional(),
   isDraft: z.boolean().optional().default(false),
+  /**
+   * When the message was actually sent, if the caller knows better than "now"
+   * (#6095). Channel ingest sets it to the provider's timestamp so an imported
+   * mailbox keeps its real chronology instead of collapsing onto the import
+   * minute. Server-only: the HTTP route strips any client-sent value, so a
+   * browser caller cannot backdate a message. Ignored for drafts.
+   */
+  sentAt: z.coerce.date().optional(),
 })
 
 type ComposeMessageRefinementValue = Omit<
   z.infer<typeof composeMessageBaseSchema>,
-  'sourceChannelType'
-> & { sourceChannelType?: string }
+  'sourceChannelType' | 'sentAt'
+> & { sourceChannelType?: string; sentAt?: Date }
 
 function refineComposeMessage(value: ComposeMessageRefinementValue, ctx: z.RefinementCtx): void {
   const isDraft = value.isDraft ?? false
@@ -213,23 +221,24 @@ function refineComposeMessage(value: ComposeMessageRefinementValue, ctx: z.Refin
 }
 
 /**
- * Full compose contract, including the server-resolved `sourceChannelType` and
- * the ingest-only `inboundFromChannel`. Used by the `messages.messages.compose`
- * command and by the HTTP route AFTER it has resolved the channel type itself.
+ * Full compose contract, including the server-resolved `sourceChannelType`,
+ * the ingest-only `inboundFromChannel`, and the server-supplied `sentAt`. Used
+ * by the `messages.messages.compose` command and by the HTTP route AFTER it
+ * has resolved the channel type itself.
  */
 export const composeMessageSchema = composeMessageBaseSchema.superRefine(refineComposeMessage)
 
 /**
  * Client-facing compose contract — the same rules minus the server-only fields:
- * `sourceChannelType` is never accepted from a request body (#4975) and neither
- * is `inboundFromChannel` (#6093). Published in OpenAPI so the documented
- * request shape matches what `POST /api/messages` actually reads: the route
- * discards any client-sent value for these, resolves the real channel type from
- * the referenced conversation or parent message, and only then validates
- * against {@link composeMessageSchema}.
+ * `sourceChannelType` is never accepted from a request body (#4975), neither is
+ * `inboundFromChannel` (#6093) nor `sentAt` (#6095). Published in OpenAPI so the
+ * documented request shape matches what `POST /api/messages` actually reads:
+ * the route discards any client-sent value for these, resolves the real
+ * channel type from the referenced conversation or parent message, and only
+ * then validates against {@link composeMessageSchema}.
  */
 export const composeMessageRequestSchema = composeMessageBaseSchema
-  .omit({ sourceChannelType: true, inboundFromChannel: true })
+  .omit({ sourceChannelType: true, inboundFromChannel: true, sentAt: true })
   .superRefine(refineComposeMessage)
 
 export const updateDraftSchema = z.object({

package/src/modules/wms/di.ts

@@ -1,6 +1,5 @@
 import { asValue } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
-import { availabilityProviderRegistry } from '@open-mercato/shared/lib/availability'
 import {
   InventoryBalance,
   InventoryLot,
@@ -11,7 +10,6 @@ import {
   WarehouseLocation,
   WarehouseZone,
 } from './data/entities'
-import { createWmsAvailabilityProvider } from './lib/availabilityProvider'
 
 export function register(container: AppContainer) {
   container.register({
@@ -24,8 +22,4 @@ export function register(container: AppContainer) {
     InventoryReservation: asValue(InventoryReservation),
     InventoryMovement: asValue(InventoryMovement),
   })
-
-  // Explicit, idempotent (replace-by-id) registration into the shared,
-  // dependency-free registry — never "same DI key, load order wins" (§3.1).
-  availabilityProviderRegistry.register(createWmsAvailabilityProvider(container))
 }

package/dist/generated/entities/availability_policy/index.js

@@ -1,41 +0,0 @@
-const id = "id";
-const organization_id = "organization_id";
-const tenant_id = "tenant_id";
-const store_id = "store_id";
-const product_id = "product_id";
-const variant_id = "variant_id";
-const is_stock_managed = "is_stock_managed";
-const allow_backorder = "allow_backorder";
-const backorder_lead_time_days = "backorder_lead_time_days";
-const preorder_release_at = "preorder_release_at";
-const low_stock_threshold = "low_stock_threshold";
-const min_order_quantity = "min_order_quantity";
-const max_order_quantity = "max_order_quantity";
-const quantity_increment = "quantity_increment";
-const hide_when_out_of_stock = "hide_when_out_of_stock";
-const is_active = "is_active";
-const created_at = "created_at";
-const updated_at = "updated_at";
-const deleted_at = "deleted_at";
-export {
-  allow_backorder,
-  backorder_lead_time_days,
-  created_at,
-  deleted_at,
-  hide_when_out_of_stock,
-  id,
-  is_active,
-  is_stock_managed,
-  low_stock_threshold,
-  max_order_quantity,
-  min_order_quantity,
-  organization_id,
-  preorder_release_at,
-  product_id,
-  quantity_increment,
-  store_id,
-  tenant_id,
-  updated_at,
-  variant_id
-};
-//# sourceMappingURL=index.js.map

package/dist/generated/entities/availability_policy/index.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../generated/entities/availability_policy/index.ts"],
-  "sourcesContent": ["export const id = \"id\";\nexport const organization_id = \"organization_id\";\nexport const tenant_id = \"tenant_id\";\nexport const store_id = \"store_id\";\nexport const product_id = \"product_id\";\nexport const variant_id = \"variant_id\";\nexport const is_stock_managed = \"is_stock_managed\";\nexport const allow_backorder = \"allow_backorder\";\nexport const backorder_lead_time_days = \"backorder_lead_time_days\";\nexport const preorder_release_at = \"preorder_release_at\";\nexport const low_stock_threshold = \"low_stock_threshold\";\nexport const min_order_quantity = \"min_order_quantity\";\nexport const max_order_quantity = \"max_order_quantity\";\nexport const quantity_increment = \"quantity_increment\";\nexport const hide_when_out_of_stock = \"hide_when_out_of_stock\";\nexport const is_active = \"is_active\";\nexport const created_at = \"created_at\";\nexport const updated_at = \"updated_at\";\nexport const deleted_at = \"deleted_at\";\n"],
-  "mappings": "AAAO,MAAM,KAAK;AACX,MAAM,kBAAkB;AACxB,MAAM,YAAY;AAClB,MAAM,WAAW;AACjB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,mBAAmB;AACzB,MAAM,kBAAkB;AACxB,MAAM,2BAA2B;AACjC,MAAM,sBAAsB;AAC5B,MAAM,sBAAsB;AAC5B,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,YAAY;AAClB,MAAM,aAAa;AACnB,MAAM,aAAa;AACnB,MAAM,aAAa;",
-  "names": []
-}

package/dist/modules/availability/acl.js

@@ -1,16 +0,0 @@
-const features = [
-  { id: "availability.policies.view", title: "View availability policies", module: "availability" },
-  {
-    id: "availability.policies.manage",
-    title: "Manage availability policies",
-    module: "availability",
-    dependsOn: ["availability.policies.view"]
-  },
-  { id: "availability.check", title: "Run availability checks", module: "availability" }
-];
-var acl_default = features;
-export {
-  acl_default as default,
-  features
-};
-//# sourceMappingURL=acl.js.map

package/dist/modules/availability/acl.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/modules/availability/acl.ts"],
-  "sourcesContent": ["export const features = [\n  { id: 'availability.policies.view', title: 'View availability policies', module: 'availability' },\n  {\n    id: 'availability.policies.manage',\n    title: 'Manage availability policies',\n    module: 'availability',\n    dependsOn: ['availability.policies.view'],\n  },\n  { id: 'availability.check', title: 'Run availability checks', module: 'availability' },\n]\n\nexport default features\n"],
-  "mappings": "AAAO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,8BAA8B,OAAO,8BAA8B,QAAQ,eAAe;AAAA,EAChG;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,4BAA4B;AAAA,EAC1C;AAAA,EACA,EAAE,IAAI,sBAAsB,OAAO,2BAA2B,QAAQ,eAAe;AACvF;AAEA,IAAO,cAAQ;",
-  "names": []
-}

package/dist/modules/availability/api/check/route.js

@@ -1,95 +0,0 @@
-import { NextResponse } from "next/server";
-import { z } from "zod";
-import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
-import { resolveActiveOrganizationId, organizationScopeRequiredResponse } from "@open-mercato/shared/lib/auth/organizationScope";
-import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import { resolveAvailability, availabilityItemKey } from "@open-mercato/shared/lib/availability";
-import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
-import { tryResolve } from "../../lib/tryResolve.js";
-const routeMetadata = {
-  POST: { requireAuth: true, requireFeatures: ["availability.check"] }
-};
-const metadata = routeMetadata;
-const openApi = {
-  tags: ["Availability"],
-  summary: "Reproduce the availability state and policy trace a buyer would see for one item.",
-  description: "Admin/debug tool. Mirrors resolveAvailability() and includes the per-field policySourceId trace."
-};
-const checkSchema = z.object({
-  productId: z.uuid(),
-  variantId: z.uuid().nullable().optional(),
-  quantity: z.coerce.number().int().min(1).default(1),
-  storeId: z.uuid().nullable().optional()
-});
-async function POST(req) {
-  const { translate } = await resolveTranslations();
-  const auth = await getAuthFromRequest(req);
-  if (!auth || !auth.tenantId) {
-    return NextResponse.json({ error: translate("availability.errors.unauthorized", "Unauthorized") }, { status: 401 });
-  }
-  const organizationId = resolveActiveOrganizationId(auth);
-  if (!organizationId) return organizationScopeRequiredResponse();
-  const body = await req.json().catch(() => ({}));
-  const parsed = checkSchema.safeParse(body);
-  if (!parsed.success) {
-    return NextResponse.json(
-      { error: translate("availability.errors.invalidCheckRequest", "Invalid request") },
-      { status: 400 }
-    );
-  }
-  const { productId, variantId, quantity, storeId } = parsed.data;
-  const tenantId = auth.tenantId;
-  const container = await createRequestContainer();
-  const em = container.resolve("em");
-  const CatalogProduct = tryResolve(container, "CatalogProduct");
-  if (CatalogProduct) {
-    const product = await em.findOne(CatalogProduct, { id: productId, organizationId, tenantId, deletedAt: null });
-    if (!product) {
-      return NextResponse.json(
-        { error: translate("availability.errors.productNotFound", "No such product") },
-        { status: 404 }
-      );
-    }
-    if (variantId) {
-      const CatalogProductVariant = tryResolve(container, "CatalogProductVariant");
-      if (CatalogProductVariant) {
-        const variant = await em.findOne(CatalogProductVariant, {
-          id: variantId,
-          organizationId,
-          tenantId,
-          deletedAt: null
-        });
-        if (!variant) {
-          return NextResponse.json(
-            { error: translate("availability.errors.variantNotFound", "No such variant") },
-            { status: 404 }
-          );
-        }
-      }
-    }
-  }
-  const query = {
-    tenantId,
-    organizationId,
-    storeId: storeId ?? null,
-    items: [{ catalogProductId: productId, catalogVariantId: variantId ?? null, quantity }]
-  };
-  const moduleConfig = tryResolve(container, "moduleConfigService");
-  const result = await resolveAvailability(query, moduleConfig ? { moduleConfig } : void 0);
-  const item = result.byItem[availabilityItemKey({ catalogProductId: productId, catalogVariantId: variantId ?? null })] ?? null;
-  const policyResolutionService = tryResolve(container, "policyResolutionService");
-  const policyTrace = policyResolutionService ? await policyResolutionService.resolve(em, {
-    tenantId,
-    organizationId,
-    storeId: storeId ?? null,
-    productId,
-    variantId: variantId ?? null
-  }) : null;
-  return NextResponse.json({ availability: item, policyTrace });
-}
-export {
-  POST,
-  metadata,
-  openApi
-};
-//# sourceMappingURL=route.js.map

package/dist/modules/availability/api/check/route.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../../src/modules/availability/api/check/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveActiveOrganizationId, organizationScopeRequiredResponse } from '@open-mercato/shared/lib/auth/organizationScope'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveAvailability, availabilityItemKey } from '@open-mercato/shared/lib/availability'\nimport type { AvailabilityModuleConfigReader, AvailabilityQuery } from '@open-mercato/shared/lib/availability'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { tryResolve } from '../../lib/tryResolve'\nimport type { PolicyResolutionService } from '../../lib/policyResolution'\n\n/**\n * `POST /api/availability/check` \u2014 admin/debug reproduction of what a buyer saw,\n * including the per-field `policySourceId` trace. No public storefront endpoints\n * ship in this module (\u00A78).\n */\nconst routeMetadata = {\n  POST: { requireAuth: true, requireFeatures: ['availability.check'] },\n}\n\nexport const metadata = routeMetadata\n\nexport const openApi = {\n  tags: ['Availability'],\n  summary: 'Reproduce the availability state and policy trace a buyer would see for one item.',\n  description: 'Admin/debug tool. Mirrors resolveAvailability() and includes the per-field policySourceId trace.',\n}\n\nconst checkSchema = z.object({\n  productId: z.uuid(),\n  variantId: z.uuid().nullable().optional(),\n  quantity: z.coerce.number().int().min(1).default(1),\n  storeId: z.uuid().nullable().optional(),\n})\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ error: translate('availability.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n\n  const organizationId = resolveActiveOrganizationId(auth)\n  if (!organizationId) return organizationScopeRequiredResponse()\n\n  const body = await req.json().catch(() => ({}))\n  const parsed = checkSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      { error: translate('availability.errors.invalidCheckRequest', 'Invalid request') },\n      { status: 400 },\n    )\n  }\n  const { productId, variantId, quantity, storeId } = parsed.data\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n\n  // Soft-resolved product/variant existence check \u2014 degrades gracefully when\n  // `catalog` is ejected (Phase 1 gate: coherent behaviour without it).\n  const CatalogProduct = tryResolve<new () => unknown>(container, 'CatalogProduct')\n  if (CatalogProduct) {\n    const product = await em.findOne(CatalogProduct as any, { id: productId, organizationId, tenantId, deletedAt: null })\n    if (!product) {\n      return NextResponse.json(\n        { error: translate('availability.errors.productNotFound', 'No such product') },\n        { status: 404 },\n      )\n    }\n    if (variantId) {\n      const CatalogProductVariant = tryResolve<new () => unknown>(container, 'CatalogProductVariant')\n      if (CatalogProductVariant) {\n        const variant = await em.findOne(CatalogProductVariant as any, {\n          id: variantId,\n          organizationId,\n          tenantId,\n          deletedAt: null,\n        })\n        if (!variant) {\n          return NextResponse.json(\n            { error: translate('availability.errors.variantNotFound', 'No such variant') },\n            { status: 404 },\n          )\n        }\n      }\n    }\n  }\n\n  const query: AvailabilityQuery = {\n    tenantId,\n    organizationId,\n    storeId: storeId ?? null,\n    items: [{ catalogProductId: productId, catalogVariantId: variantId ?? null, quantity }],\n  }\n\n  const moduleConfig = tryResolve<AvailabilityModuleConfigReader>(container, 'moduleConfigService')\n  const result = await resolveAvailability(query, moduleConfig ? { moduleConfig } : undefined)\n  const item = result.byItem[availabilityItemKey({ catalogProductId: productId, catalogVariantId: variantId ?? null })] ?? null\n\n  const policyResolutionService = tryResolve<PolicyResolutionService>(container, 'policyResolutionService')\n  const policyTrace = policyResolutionService\n    ? await policyResolutionService.resolve(em, {\n        tenantId,\n        organizationId,\n        storeId: storeId ?? null,\n        productId,\n        variantId: variantId ?? null,\n      })\n    : null\n\n  return NextResponse.json({ availability: item, policyTrace })\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,6BAA6B,yCAAyC;AAC/E,SAAS,8BAA8B;AACvC,SAAS,qBAAqB,2BAA2B;AAEzD,SAAS,2BAA2B;AACpC,SAAS,kBAAkB;AAQ3B,MAAM,gBAAgB;AAAA,EACpB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,oBAAoB,EAAE;AACrE;AAEO,MAAM,WAAW;AAEjB,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,cAAc;AAAA,EACrB,SAAS;AAAA,EACT,aAAa;AACf;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,WAAW,EAAE,KAAK;AAAA,EAClB,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAClD,SAAS,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AACxC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,oCAAoC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpH;AAEA,QAAM,iBAAiB,4BAA4B,IAAI;AACvD,MAAI,CAAC,eAAgB,QAAO,kCAAkC;AAE9D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,YAAY,UAAU,IAAI;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,UAAU,2CAA2C,iBAAiB,EAAE;AAAA,MACjF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,EAAE,WAAW,WAAW,UAAU,QAAQ,IAAI,OAAO;AAC3D,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AAIjC,QAAM,iBAAiB,WAA8B,WAAW,gBAAgB;AAChF,MAAI,gBAAgB;AAClB,UAAM,UAAU,MAAM,GAAG,QAAQ,gBAAuB,EAAE,IAAI,WAAW,gBAAgB,UAAU,WAAW,KAAK,CAAC;AACpH,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,uCAAuC,iBAAiB,EAAE;AAAA,QAC7E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,WAAW;AACb,YAAM,wBAAwB,WAA8B,WAAW,uBAAuB;AAC9F,UAAI,uBAAuB;AACzB,cAAM,UAAU,MAAM,GAAG,QAAQ,uBAA8B;AAAA,UAC7D,IAAI;AAAA,UACJ;AAAA,UACA;AAAA,UACA,WAAW;AAAA,QACb,CAAC;AACD,YAAI,CAAC,SAAS;AACZ,iBAAO,aAAa;AAAA,YAClB,EAAE,OAAO,UAAU,uCAAuC,iBAAiB,EAAE;AAAA,YAC7E,EAAE,QAAQ,IAAI;AAAA,UAChB;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,QAA2B;AAAA,IAC/B;AAAA,IACA;AAAA,IACA,SAAS,WAAW;AAAA,IACpB,OAAO,CAAC,EAAE,kBAAkB,WAAW,kBAAkB,aAAa,MAAM,SAAS,CAAC;AAAA,EACxF;AAEA,QAAM,eAAe,WAA2C,WAAW,qBAAqB;AAChG,QAAM,SAAS,MAAM,oBAAoB,OAAO,eAAe,EAAE,aAAa,IAAI,MAAS;AAC3F,QAAM,OAAO,OAAO,OAAO,oBAAoB,EAAE,kBAAkB,WAAW,kBAAkB,aAAa,KAAK,CAAC,CAAC,KAAK;AAEzH,QAAM,0BAA0B,WAAoC,WAAW,yBAAyB;AACxG,QAAM,cAAc,0BAChB,MAAM,wBAAwB,QAAQ,IAAI;AAAA,IACxC;AAAA,IACA;AAAA,IACA,SAAS,WAAW;AAAA,IACpB;AAAA,IACA,WAAW,aAAa;AAAA,EAC1B,CAAC,IACD;AAEJ,SAAO,aAAa,KAAK,EAAE,cAAc,MAAM,YAAY,CAAC;AAC9D;",
-  "names": []
-}

package/dist/modules/availability/api/openapi.js

@@ -1,27 +0,0 @@
-import {
-  createCrudOpenApiFactory,
-  createPagedListResponseSchema as createSharedPagedListResponseSchema,
-  defaultCreateResponseSchema as sharedDefaultCreateResponseSchema,
-  defaultOkResponseSchema as sharedDefaultOkResponseSchema
-} from "@open-mercato/shared/lib/openapi/crud";
-const defaultCreateResponseSchema = sharedDefaultCreateResponseSchema;
-const defaultOkResponseSchema = sharedDefaultOkResponseSchema;
-function createPagedListResponseSchema(itemSchema) {
-  return createSharedPagedListResponseSchema(itemSchema, { paginationMetaOptional: true });
-}
-const buildAvailabilityCrudOpenApi = createCrudOpenApiFactory({
-  defaultTag: "Availability",
-  defaultCreateResponseSchema,
-  defaultOkResponseSchema,
-  makeListDescription: ({ pluralLower }) => `Returns a paginated collection of ${pluralLower} scoped to the authenticated organization.`
-});
-function createAvailabilityCrudOpenApi(options) {
-  return buildAvailabilityCrudOpenApi(options);
-}
-export {
-  createAvailabilityCrudOpenApi,
-  createPagedListResponseSchema,
-  defaultCreateResponseSchema,
-  defaultOkResponseSchema
-};
-//# sourceMappingURL=openapi.js.map

package/dist/modules/availability/api/openapi.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/availability/api/openapi.ts"],
-  "sourcesContent": ["import { type ZodTypeAny } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  createCrudOpenApiFactory,\n  createPagedListResponseSchema as createSharedPagedListResponseSchema,\n  defaultCreateResponseSchema as sharedDefaultCreateResponseSchema,\n  defaultOkResponseSchema as sharedDefaultOkResponseSchema,\n  type CrudOpenApiOptions,\n} from '@open-mercato/shared/lib/openapi/crud'\n\nexport const defaultCreateResponseSchema = sharedDefaultCreateResponseSchema\nexport const defaultOkResponseSchema = sharedDefaultOkResponseSchema\n\nexport function createPagedListResponseSchema(itemSchema: ZodTypeAny) {\n  return createSharedPagedListResponseSchema(itemSchema, { paginationMetaOptional: true })\n}\n\nconst buildAvailabilityCrudOpenApi = createCrudOpenApiFactory({\n  defaultTag: 'Availability',\n  defaultCreateResponseSchema,\n  defaultOkResponseSchema,\n  makeListDescription: ({ pluralLower }) =>\n    `Returns a paginated collection of ${pluralLower} scoped to the authenticated organization.`,\n})\n\nexport function createAvailabilityCrudOpenApi(options: CrudOpenApiOptions): OpenApiRouteDoc {\n  return buildAvailabilityCrudOpenApi(options)\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA,iCAAiC;AAAA,EACjC,+BAA+B;AAAA,EAC/B,2BAA2B;AAAA,OAEtB;AAEA,MAAM,8BAA8B;AACpC,MAAM,0BAA0B;AAEhC,SAAS,8BAA8B,YAAwB;AACpE,SAAO,oCAAoC,YAAY,EAAE,wBAAwB,KAAK,CAAC;AACzF;AAEA,MAAM,+BAA+B,yBAAyB;AAAA,EAC5D,YAAY;AAAA,EACZ;AAAA,EACA;AAAA,EACA,qBAAqB,CAAC,EAAE,YAAY,MAClC,qCAAqC,WAAW;AACpD,CAAC;AAEM,SAAS,8BAA8B,SAA8C;AAC1F,SAAO,6BAA6B,OAAO;AAC7C;",
-  "names": []
-}