@open-mercato/shared 0.4.8-main-848cd3c22c → 0.4.8

package/dist/lib/auth/featureMatch.js

@@ -0,0 +1,31 @@
+function featureString(entry) {
+  return typeof entry === "string" ? entry : entry.id;
+}
+function featureScope(featureId) {
+  const dotIndex = featureId.indexOf(".");
+  return dotIndex === -1 ? featureId : featureId.slice(0, dotIndex);
+}
+function extractFeatureStrings(entries) {
+  return entries.map(featureString);
+}
+function matchFeature(required, granted) {
+  if (granted === "*") return true;
+  if (granted.endsWith(".*")) {
+    const prefix = granted.slice(0, -2);
+    return required === prefix || required.startsWith(prefix + ".");
+  }
+  return granted === required;
+}
+function hasAllFeatures(required, granted) {
+  if (!required.length) return true;
+  if (!granted.length) return false;
+  return required.every((req) => granted.some((g) => matchFeature(req, g)));
+}
+export {
+  extractFeatureStrings,
+  featureScope,
+  featureString,
+  hasAllFeatures,
+  matchFeature
+};
+//# sourceMappingURL=featureMatch.js.map

package/dist/lib/auth/featureMatch.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/auth/featureMatch.ts"],
+  "sourcesContent": ["export type FeatureEntry = { id: string; title?: string; module?: string }\n\nexport function featureString(entry: FeatureEntry | string): string {\n  return typeof entry === 'string' ? entry : entry.id\n}\n\nexport function featureScope(featureId: string): string {\n  const dotIndex = featureId.indexOf('.')\n  return dotIndex === -1 ? featureId : featureId.slice(0, dotIndex)\n}\n\nexport function extractFeatureStrings(entries: Array<FeatureEntry | string>): string[] {\n  return entries.map(featureString)\n}\n\n/**\n * Checks if a required feature is satisfied by a granted feature permission.\n *\n * Wildcard patterns:\n * - `*` (global wildcard): Grants access to all features\n * - `prefix.*` (module wildcard): Grants access to all features starting with `prefix.`\n *   and also the exact prefix itself\n * - Exact match: Feature must match exactly\n */\nexport function matchFeature(required: string, granted: string): boolean {\n  if (granted === '*') return true\n  if (granted.endsWith('.*')) {\n    const prefix = granted.slice(0, -2)\n    return required === prefix || required.startsWith(prefix + '.')\n  }\n  return granted === required\n}\n\n/**\n * Checks if all required features are satisfied by the granted feature set.\n */\nexport function hasAllFeatures(required: string[], granted: string[]): boolean {\n  if (!required.length) return true\n  if (!granted.length) return false\n  return required.every((req) => granted.some((g) => matchFeature(req, g)))\n}\n"],
+  "mappings": "AAEO,SAAS,cAAc,OAAsC;AAClE,SAAO,OAAO,UAAU,WAAW,QAAQ,MAAM;AACnD;AAEO,SAAS,aAAa,WAA2B;AACtD,QAAM,WAAW,UAAU,QAAQ,GAAG;AACtC,SAAO,aAAa,KAAK,YAAY,UAAU,MAAM,GAAG,QAAQ;AAClE;AAEO,SAAS,sBAAsB,SAAiD;AACrF,SAAO,QAAQ,IAAI,aAAa;AAClC;AAWO,SAAS,aAAa,UAAkB,SAA0B;AACvE,MAAI,YAAY,IAAK,QAAO;AAC5B,MAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,UAAM,SAAS,QAAQ,MAAM,GAAG,EAAE;AAClC,WAAO,aAAa,UAAU,SAAS,WAAW,SAAS,GAAG;AAAA,EAChE;AACA,SAAO,YAAY;AACrB;AAKO,SAAS,eAAe,UAAoB,SAA4B;AAC7E,MAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,SAAS,MAAM,CAAC,QAAQ,QAAQ,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC1E;",
+  "names": []
+}

package/dist/lib/auth/server.js

@@ -121,6 +121,7 @@ async function getAuthFromCookies() {
   try {
     const payload = verifyJwt(token);
     if (!payload) return null;
+    if (payload.type === "customer") return null;
     const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value;
     const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value;
     return applySuperAdminScope(payload, tenantCookie, orgCookie);
@@ -142,6 +143,7 @@ async function getAuthFromRequest(req) {
   if (token) {
     try {
       const payload = verifyJwt(token);
+      if (payload && payload.type === "customer") return null;
       if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie);
     } catch {
     }

package/dist/lib/auth/server.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/auth/server.ts"],
-  "sourcesContent": ["import { cookies } from 'next/headers'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  userId?: string\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: true, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: true, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as Record<string, unknown>).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth?.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role } = await import('@open-mercato/core/modules/auth/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) return null\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds } })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    try {\n      record.lastUsedAt = new Date()\n      await em.persistAndFlush(record)\n    } catch {\n      // best-effort update; ignore write failures\n    }\n\n    // For session keys, use sessionUserId; for regular keys, use createdBy\n    const actualUserId = record.sessionUserId ?? record.createdBy ?? null\n\n    return {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      keyId: record.id,\n      keyName: record.name,\n      ...(actualUserId ? { userId: actualUserId } : {}),\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return null\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return null\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return applySuperAdminScope(payload, tenantCookie, orgCookie)\n  } catch {\n    return null\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie)\n    } catch {\n      // fall back to API key detection\n    }\n  }\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) return null\n  const apiAuth = await resolveApiKeyAuth(apiKey)\n  if (!apiAuth) return null\n  return applySuperAdminScope(apiAuth, tenantCookie, orgCookie)\n}\n"],
-  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAE1B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAiBxB,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAiC,iBAAiB,KAAM,QAAO;AACpE,QAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACzD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe;AACvG;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAE7E,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC,IAC5C,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAE7H,QAAI;AACF,aAAO,aAAa,oBAAI,KAAK;AAC7B,YAAM,GAAG,gBAAgB,MAAM;AAAA,IACjC,QAAQ;AAAA,IAER;AAGA,UAAM,eAAe,OAAO,iBAAiB,OAAO,aAAa;AAEjE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,IACjD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAsB,qBAA2C;AAC/D,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,QAAS,QAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3E,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,MAAM,kBAAkB,MAAM;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,qBAAqB,SAAS,cAAc,SAAS;AAC9D;",
+  "sourcesContent": ["import { cookies } from 'next/headers'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { verifyJwt } from './jwt'\n\nconst TENANT_COOKIE_NAME = 'om_selected_tenant'\nconst ORGANIZATION_COOKIE_NAME = 'om_selected_org'\nconst ALL_ORGANIZATIONS_COOKIE_VALUE = '__all__'\nconst SUPERADMIN_ROLE = 'superadmin'\n\nexport type AuthContext = {\n  sub: string\n  tenantId: string | null\n  orgId: string | null\n  email?: string\n  roles?: string[]\n  isApiKey?: boolean\n  userId?: string\n  keyId?: string\n  keyName?: string\n  [k: string]: unknown\n} | null\n\ntype CookieOverride = { applied: boolean; value: string | null }\n\nfunction decodeCookieValue(raw: string | undefined): string | null {\n  if (raw === undefined) return null\n  try {\n    const decoded = decodeURIComponent(raw)\n    return decoded ?? null\n  } catch {\n    return raw ?? null\n  }\n}\n\nfunction readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nfunction resolveTenantOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded) return { applied: true, value: null }\n  const trimmed = decoded.trim()\n  if (!trimmed) return { applied: true, value: null }\n  return { applied: true, value: trimmed }\n}\n\nfunction resolveOrganizationOverride(raw: string | undefined): CookieOverride {\n  if (raw === undefined) return { applied: false, value: null }\n  const decoded = decodeCookieValue(raw)\n  if (!decoded || decoded === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  const trimmed = decoded.trim()\n  if (!trimmed || trimmed === ALL_ORGANIZATIONS_COOKIE_VALUE) {\n    return { applied: true, value: null }\n  }\n  return { applied: true, value: trimmed }\n}\n\nfunction isSuperAdminAuth(auth: AuthContext | null | undefined): boolean {\n  if (!auth) return false\n  if ((auth as Record<string, unknown>).isSuperAdmin === true) return true\n  const roles = Array.isArray(auth?.roles) ? auth.roles : []\n  return roles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)\n}\n\nfunction applySuperAdminScope(\n  auth: AuthContext,\n  tenantCookie: string | undefined,\n  orgCookie: string | undefined\n): AuthContext {\n  if (!auth || !isSuperAdminAuth(auth)) return auth\n\n  const tenantOverride = resolveTenantOverride(tenantCookie)\n  const orgOverride = resolveOrganizationOverride(orgCookie)\n  if (!tenantOverride.applied && !orgOverride.applied) return auth\n\n  type MutableAuthContext = Exclude<AuthContext, null> & {\n    actorTenantId?: string | null\n    actorOrgId?: string | null\n  }\n  const baseAuth = auth as Exclude<AuthContext, null>\n  const next: MutableAuthContext = { ...baseAuth }\n  if (tenantOverride.applied) {\n    if (!('actorTenantId' in next)) next.actorTenantId = auth?.tenantId ?? null\n    next.tenantId = tenantOverride.value\n  }\n  if (orgOverride.applied) {\n    if (!('actorOrgId' in next)) next.actorOrgId = auth?.orgId ?? null\n    next.orgId = orgOverride.value\n  }\n  next.isSuperAdmin = true\n  const existingRoles = Array.isArray(next.roles) ? next.roles : []\n  if (!existingRoles.some((role) => typeof role === 'string' && role.trim().toLowerCase() === SUPERADMIN_ROLE)) {\n    next.roles = [...existingRoles, 'superadmin']\n  }\n  return next\n}\n\nasync function resolveApiKeyAuth(secret: string): Promise<AuthContext> {\n  if (!secret) return null\n  try {\n    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const { findApiKeyBySecret } = await import('@open-mercato/core/modules/api_keys/services/apiKeyService')\n    const { Role } = await import('@open-mercato/core/modules/auth/data/entities')\n\n    const record = await findApiKeyBySecret(em, secret)\n    if (!record) return null\n\n    const roleIds = Array.isArray(record.rolesJson)\n      ? record.rolesJson.filter((value): value is string => typeof value === 'string' && value.length > 0)\n      : []\n    const roles = roleIds.length\n      ? await em.find(Role, { id: { $in: roleIds } })\n      : []\n    const roleNames = roles.map((role) => role.name).filter((name): name is string => typeof name === 'string' && name.length > 0)\n\n    try {\n      record.lastUsedAt = new Date()\n      await em.persistAndFlush(record)\n    } catch {\n      // best-effort update; ignore write failures\n    }\n\n    // For session keys, use sessionUserId; for regular keys, use createdBy\n    const actualUserId = record.sessionUserId ?? record.createdBy ?? null\n\n    return {\n      sub: `api_key:${record.id}`,\n      tenantId: record.tenantId ?? null,\n      orgId: record.organizationId ?? null,\n      roles: roleNames,\n      isApiKey: true,\n      keyId: record.id,\n      keyName: record.name,\n      ...(actualUserId ? { userId: actualUserId } : {}),\n    }\n  } catch {\n    return null\n  }\n}\n\nfunction extractApiKey(req: Request): string | null {\n  const header = (req.headers.get('x-api-key') || '').trim()\n  if (header) return header\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  if (authHeader.toLowerCase().startsWith('apikey ')) {\n    return authHeader.slice(7).trim()\n  }\n  return null\n}\n\nexport async function getAuthFromCookies(): Promise<AuthContext> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('auth_token')?.value\n  if (!token) return null\n  try {\n    const payload = verifyJwt(token) as AuthContext\n    if (!payload) return null\n    if ((payload as any).type === 'customer') return null\n    const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value\n    const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value\n    return applySuperAdminScope(payload, tenantCookie, orgCookie)\n  } catch {\n    return null\n  }\n}\n\nexport async function getAuthFromRequest(req: Request): Promise<AuthContext> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const tenantCookie = readCookieFromHeader(cookieHeader, TENANT_COOKIE_NAME)\n  const orgCookie = readCookieFromHeader(cookieHeader, ORGANIZATION_COOKIE_NAME)\n  const authHeader = (req.headers.get('authorization') || '').trim()\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) token = authHeader.slice(7).trim()\n  if (!token) {\n    const match = cookieHeader.match(/(?:^|;\\s*)auth_token=([^;]+)/)\n    if (match) token = decodeURIComponent(match[1])\n  }\n  if (token) {\n    try {\n      const payload = verifyJwt(token) as AuthContext\n      if (payload && (payload as any).type === 'customer') return null\n      if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie)\n    } catch {\n      // fall back to API key detection\n    }\n  }\n\n  const apiKey = extractApiKey(req)\n  if (!apiKey) return null\n  const apiAuth = await resolveApiKeyAuth(apiKey)\n  if (!apiAuth) return null\n  return applySuperAdminScope(apiAuth, tenantCookie, orgCookie)\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAExB,SAAS,iBAAiB;AAE1B,MAAM,qBAAqB;AAC3B,MAAM,2BAA2B;AACjC,MAAM,iCAAiC;AACvC,MAAM,kBAAkB;AAiBxB,SAAS,kBAAkB,KAAwC;AACjE,MAAI,QAAQ,OAAW,QAAO;AAC9B,MAAI;AACF,UAAM,UAAU,mBAAmB,GAAG;AACtC,WAAO,WAAW;AAAA,EACpB,QAAQ;AACN,WAAO,OAAO;AAAA,EAChB;AACF;AAEA,SAAS,qBAAqB,QAAmC,MAAkC;AACjG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,KAAyC;AACtE,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,QAAS,QAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAClD,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,4BAA4B,KAAyC;AAC5E,MAAI,QAAQ,OAAW,QAAO,EAAE,SAAS,OAAO,OAAO,KAAK;AAC5D,QAAM,UAAU,kBAAkB,GAAG;AACrC,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,QAAM,UAAU,QAAQ,KAAK;AAC7B,MAAI,CAAC,WAAW,YAAY,gCAAgC;AAC1D,WAAO,EAAE,SAAS,MAAM,OAAO,KAAK;AAAA,EACtC;AACA,SAAO,EAAE,SAAS,MAAM,OAAO,QAAQ;AACzC;AAEA,SAAS,iBAAiB,MAA+C;AACvE,MAAI,CAAC,KAAM,QAAO;AAClB,MAAK,KAAiC,iBAAiB,KAAM,QAAO;AACpE,QAAM,QAAQ,MAAM,QAAQ,MAAM,KAAK,IAAI,KAAK,QAAQ,CAAC;AACzD,SAAO,MAAM,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe;AACvG;AAEA,SAAS,qBACP,MACA,cACA,WACa;AACb,MAAI,CAAC,QAAQ,CAAC,iBAAiB,IAAI,EAAG,QAAO;AAE7C,QAAM,iBAAiB,sBAAsB,YAAY;AACzD,QAAM,cAAc,4BAA4B,SAAS;AACzD,MAAI,CAAC,eAAe,WAAW,CAAC,YAAY,QAAS,QAAO;AAM5D,QAAM,WAAW;AACjB,QAAM,OAA2B,EAAE,GAAG,SAAS;AAC/C,MAAI,eAAe,SAAS;AAC1B,QAAI,EAAE,mBAAmB,MAAO,MAAK,gBAAgB,MAAM,YAAY;AACvE,SAAK,WAAW,eAAe;AAAA,EACjC;AACA,MAAI,YAAY,SAAS;AACvB,QAAI,EAAE,gBAAgB,MAAO,MAAK,aAAa,MAAM,SAAS;AAC9D,SAAK,QAAQ,YAAY;AAAA,EAC3B;AACA,OAAK,eAAe;AACpB,QAAM,gBAAgB,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC;AAChE,MAAI,CAAC,cAAc,KAAK,CAAC,SAAS,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,YAAY,MAAM,eAAe,GAAG;AAC5G,SAAK,QAAQ,CAAC,GAAG,eAAe,YAAY;AAAA,EAC9C;AACA,SAAO;AACT;AAEA,eAAe,kBAAkB,QAAsC;AACrE,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,EAAE,uBAAuB,IAAI,MAAM,OAAO,uCAAuC;AACvF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,EAAE,mBAAmB,IAAI,MAAM,OAAO,4DAA4D;AACxG,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,+CAA+C;AAE7E,UAAM,SAAS,MAAM,mBAAmB,IAAI,MAAM;AAClD,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,UAAU,MAAM,QAAQ,OAAO,SAAS,IAC1C,OAAO,UAAU,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,IACjG,CAAC;AACL,UAAM,QAAQ,QAAQ,SAClB,MAAM,GAAG,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC,IAC5C,CAAC;AACL,UAAM,YAAY,MAAM,IAAI,CAAC,SAAS,KAAK,IAAI,EAAE,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,SAAS,CAAC;AAE7H,QAAI;AACF,aAAO,aAAa,oBAAI,KAAK;AAC7B,YAAM,GAAG,gBAAgB,MAAM;AAAA,IACjC,QAAQ;AAAA,IAER;AAGA,UAAM,eAAe,OAAO,iBAAiB,OAAO,aAAa;AAEjE,WAAO;AAAA,MACL,KAAK,WAAW,OAAO,EAAE;AAAA,MACzB,UAAU,OAAO,YAAY;AAAA,MAC7B,OAAO,OAAO,kBAAkB;AAAA,MAChC,OAAO;AAAA,MACP,UAAU;AAAA,MACV,OAAO,OAAO;AAAA,MACd,SAAS,OAAO;AAAA,MAChB,GAAI,eAAe,EAAE,QAAQ,aAAa,IAAI,CAAC;AAAA,IACjD;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,KAA6B;AAClD,QAAM,UAAU,IAAI,QAAQ,IAAI,WAAW,KAAK,IAAI,KAAK;AACzD,MAAI,OAAQ,QAAO;AACnB,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,WAAO,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EAClC;AACA,SAAO;AACT;AAEA,eAAsB,qBAA2C;AAC/D,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,YAAY,GAAG;AAC7C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,UAAU,UAAU,KAAK;AAC/B,QAAI,CAAC,QAAS,QAAO;AACrB,QAAK,QAAgB,SAAS,WAAY,QAAO;AACjD,UAAM,eAAe,YAAY,IAAI,kBAAkB,GAAG;AAC1D,UAAM,YAAY,YAAY,IAAI,wBAAwB,GAAG;AAC7D,WAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,EAC9D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,mBAAmB,KAAoC;AAC3E,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,eAAe,qBAAqB,cAAc,kBAAkB;AAC1E,QAAM,YAAY,qBAAqB,cAAc,wBAAwB;AAC7E,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AACjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,EAAG,SAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AACrF,MAAI,CAAC,OAAO;AACV,UAAM,QAAQ,aAAa,MAAM,8BAA8B;AAC/D,QAAI,MAAO,SAAQ,mBAAmB,MAAM,CAAC,CAAC;AAAA,EAChD;AACA,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU,UAAU,KAAK;AAC/B,UAAI,WAAY,QAAgB,SAAS,WAAY,QAAO;AAC5D,UAAI,QAAS,QAAO,qBAAqB,SAAS,cAAc,SAAS;AAAA,IAC3E,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,SAAS,cAAc,GAAG;AAChC,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,UAAU,MAAM,kBAAkB,MAAM;AAC9C,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,qBAAqB,SAAS,cAAc,SAAS;AAC9D;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.4.8-main-848cd3c22c";
+const APP_VERSION = "0.4.8";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.8-main-848cd3c22c'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.4.8'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/dist/modules/customer-auth.js

@@ -0,0 +1 @@
+//# sourceMappingURL=customer-auth.js.map

package/dist/modules/customer-auth.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [],
+  "mappings": "",
+  "names": []
+}

package/dist/modules/events/factory.js

@@ -33,6 +33,10 @@ function isBroadcastEvent(eventId) {
   const event = allDeclaredEvents.find((e) => e.id === eventId);
   return event?.clientBroadcast === true;
 }
+function isPortalBroadcastEvent(eventId) {
+  const event = allDeclaredEvents.find((e) => e.id === eventId);
+  return event?.portalBroadcast === true;
+}
 let _registeredEventConfigs = null;
 function registerEventModuleConfigs(configs) {
   if (_registeredEventConfigs !== null && process.env.NODE_ENV === "development") {
@@ -88,6 +92,7 @@ export {
   getGlobalEventBus,
   isBroadcastEvent,
   isEventDeclared,
+  isPortalBroadcastEvent,
   registerEventModuleConfigs,
   setGlobalEventBus
 };

package/dist/modules/events/factory.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/events/factory.ts"],
-  "sourcesContent": ["/**\n * Event Module Factory\n *\n * Provides factory functions for creating type-safe event configurations.\n */\n\nimport type {\n  EventDefinition,\n  EventModuleConfig,\n  EventPayload,\n  EmitOptions,\n  CreateModuleEventsOptions,\n  ModuleEventEmitter,\n} from './types'\n\n// =============================================================================\n// Global Event Bus Reference\n// =============================================================================\n\n/**\n * Type for the global event bus interface\n */\ninterface GlobalEventBus {\n  emit(event: string, payload: unknown, options?: EmitOptions): Promise<void>\n}\n\nconst GLOBAL_EVENT_BUS_KEY = '__openMercatoGlobalEventBus__'\n\n// Global event bus reference (set during bootstrap)\nlet globalEventBus: GlobalEventBus | null = null\n\n/**\n * Set the global event bus instance.\n * Called during app bootstrap to wire up event emission.\n */\nexport function setGlobalEventBus(bus: GlobalEventBus): void {\n  globalEventBus = bus\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_BUS_KEY] = bus\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\n/**\n * Get the global event bus instance.\n * Returns null if not yet bootstrapped.\n */\nexport function getGlobalEventBus(): GlobalEventBus | null {\n  try {\n    const sharedBus = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_BUS_KEY]\n    if (sharedBus && typeof sharedBus === 'object' && typeof (sharedBus as GlobalEventBus).emit === 'function') {\n      return sharedBus as GlobalEventBus\n    }\n  } catch {\n    // ignore global read failures\n  }\n  return globalEventBus\n}\n\n// =============================================================================\n// Event Registry for Validation\n// =============================================================================\n\n// Global set of all declared event IDs for runtime validation\nconst allDeclaredEventIds = new Set<string>()\n\n// Global registry of all declared events with their full definitions\nconst allDeclaredEvents: EventDefinition[] = []\n\n/**\n * Check if an event ID has been declared by any module.\n * Used for runtime validation to ensure only declared events are emitted.\n */\nexport function isEventDeclared(eventId: string): boolean {\n  return allDeclaredEventIds.has(eventId)\n}\n\n/**\n * Get all declared event IDs.\n * Useful for debugging and introspection.\n */\nexport function getAllDeclaredEventIds(): string[] {\n  return Array.from(allDeclaredEventIds)\n}\n\n/**\n * Get all declared events with their full definitions.\n * Used by the API to return available events for workflow triggers.\n */\nexport function getDeclaredEvents(): EventDefinition[] {\n  return [...allDeclaredEvents]\n}\n\n/**\n * Check if an event has clientBroadcast enabled.\n * Used by the SSE endpoint to filter events for the DOM Event Bridge.\n */\nexport function isBroadcastEvent(eventId: string): boolean {\n  const event = allDeclaredEvents.find(e => e.id === eventId)\n  return event?.clientBroadcast === true\n}\n\n// =============================================================================\n// Bootstrap Registration (similar to searchModuleConfigs pattern)\n// =============================================================================\n\nlet _registeredEventConfigs: EventModuleConfig[] | null = null\n\n/**\n * Register event module configurations globally.\n * Called during app bootstrap with configs from events.generated.ts.\n */\nexport function registerEventModuleConfigs(configs: EventModuleConfig[]): void {\n  if (_registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Event module configs re-registered (this may occur during HMR)')\n  }\n  _registeredEventConfigs = configs\n}\n\n/**\n * Get registered event module configurations.\n * Returns empty array if not registered.\n */\nexport function getEventModuleConfigs(): EventModuleConfig[] {\n  return _registeredEventConfigs ?? []\n}\n\n// =============================================================================\n// Factory Function\n// =============================================================================\n\n/**\n * Creates a type-safe event configuration for a module.\n *\n * Usage in module events.ts:\n * ```typescript\n * import { createModuleEvents } from '@open-mercato/shared/modules/events'\n *\n * const events = [\n *   { id: 'customers.people.created', label: 'Person Created', category: 'crud' },\n *   { id: 'customers.people.updated', label: 'Person Updated', category: 'crud' },\n * ] as const\n *\n * export const eventsConfig = createModuleEvents({\n *   moduleId: 'customers',\n *   events,\n * })\n *\n * // Export the typed emit function for use in commands\n * export const emitCustomersEvent = eventsConfig.emit\n *\n * // Export event IDs as a type for external use\n * export type CustomersEventId = typeof events[number]['id']\n *\n * export default eventsConfig\n * ```\n *\n * TypeScript will enforce that only declared event IDs can be emitted:\n * ```typescript\n * // \u2705 This compiles - event is declared\n * emitCustomersEvent('customers.people.created', { id: '123', tenantId: 'abc' })\n *\n * // \u274C TypeScript error - event not declared\n * emitCustomersEvent('customers.people.exploded', { id: '123' })\n * ```\n */\nexport function createModuleEvents<\n  const TEvents extends readonly { id: string }[],\n  TEventIds extends TEvents[number]['id'] = TEvents[number]['id']\n>(options: CreateModuleEventsOptions<TEventIds>): EventModuleConfig<TEventIds> {\n  const { moduleId, events, strict = false } = options\n\n  // Build set of valid event IDs for runtime validation\n  const validEventIds = new Set(events.map(e => e.id))\n\n  // Build full event definitions with module added\n  const fullEvents: EventDefinition[] = events.map(e => ({\n    ...e,\n    module: moduleId,\n  }))\n\n  // Register all event IDs and definitions in the global registry\n  for (const eventId of validEventIds) {\n    allDeclaredEventIds.add(eventId)\n  }\n  for (const event of fullEvents) {\n    // Avoid duplicates if createModuleEvents is called multiple times (e.g., HMR)\n    if (!allDeclaredEvents.find(e => e.id === event.id)) {\n      allDeclaredEvents.push(event)\n    }\n  }\n\n  /**\n   * The emit function - validates events and delegates to the global event bus\n   */\n  const emit = async (\n    eventId: TEventIds,\n    payload: EventPayload,\n    emitOptions?: EmitOptions\n  ): Promise<void> => {\n    // Runtime validation - event must be declared\n    if (!validEventIds.has(eventId)) {\n      const message =\n        `[events] Module \"${moduleId}\" tried to emit undeclared event \"${eventId}\". ` +\n        `Add it to the module's events.ts file first.`\n\n      if (strict) {\n        throw new Error(message)\n      } else {\n        console.error(message)\n        // In non-strict mode, still emit but with warning\n      }\n    }\n\n    // Get event bus from global reference\n    const eventBus = getGlobalEventBus()\n    if (!eventBus) {\n      console.warn(`[events] Event bus not available, cannot emit \"${eventId}\"`)\n      return\n    }\n\n    await eventBus.emit(eventId, payload, emitOptions)\n  }\n\n  return {\n    moduleId,\n    events: fullEvents,\n    emit: emit as unknown as ModuleEventEmitter<TEventIds>,\n  }\n}\n"],
-  "mappings": "AA0BA,MAAM,uBAAuB;AAG7B,IAAI,iBAAwC;AAMrC,SAAS,kBAAkB,KAA2B;AAC3D,mBAAiB;AACjB,MAAI;AACF;AAAC,IAAC,WAAuC,oBAAoB,IAAI;AAAA,EACnE,QAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAA2C;AACzD,MAAI;AACF,UAAM,YAAa,WAAuC,oBAAoB;AAC9E,QAAI,aAAa,OAAO,cAAc,YAAY,OAAQ,UAA6B,SAAS,YAAY;AAC1G,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAOA,MAAM,sBAAsB,oBAAI,IAAY;AAG5C,MAAM,oBAAuC,CAAC;AAMvC,SAAS,gBAAgB,SAA0B;AACxD,SAAO,oBAAoB,IAAI,OAAO;AACxC;AAMO,SAAS,yBAAmC;AACjD,SAAO,MAAM,KAAK,mBAAmB;AACvC;AAMO,SAAS,oBAAuC;AACrD,SAAO,CAAC,GAAG,iBAAiB;AAC9B;AAMO,SAAS,iBAAiB,SAA0B;AACzD,QAAM,QAAQ,kBAAkB,KAAK,OAAK,EAAE,OAAO,OAAO;AAC1D,SAAO,OAAO,oBAAoB;AACpC;AAMA,IAAI,0BAAsD;AAMnD,SAAS,2BAA2B,SAAoC;AAC7E,MAAI,4BAA4B,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC9E,YAAQ,MAAM,4EAA4E;AAAA,EAC5F;AACA,4BAA0B;AAC5B;AAMO,SAAS,wBAA6C;AAC3D,SAAO,2BAA2B,CAAC;AACrC;AAyCO,SAAS,mBAGd,SAA6E;AAC7E,QAAM,EAAE,UAAU,QAAQ,SAAS,MAAM,IAAI;AAG7C,QAAM,gBAAgB,IAAI,IAAI,OAAO,IAAI,OAAK,EAAE,EAAE,CAAC;AAGnD,QAAM,aAAgC,OAAO,IAAI,QAAM;AAAA,IACrD,GAAG;AAAA,IACH,QAAQ;AAAA,EACV,EAAE;AAGF,aAAW,WAAW,eAAe;AACnC,wBAAoB,IAAI,OAAO;AAAA,EACjC;AACA,aAAW,SAAS,YAAY;AAE9B,QAAI,CAAC,kBAAkB,KAAK,OAAK,EAAE,OAAO,MAAM,EAAE,GAAG;AACnD,wBAAkB,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,OAAO,OACX,SACA,SACA,gBACkB;AAElB,QAAI,CAAC,cAAc,IAAI,OAAO,GAAG;AAC/B,YAAM,UACJ,oBAAoB,QAAQ,qCAAqC,OAAO;AAG1E,UAAI,QAAQ;AACV,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB,OAAO;AACL,gBAAQ,MAAM,OAAO;AAAA,MAEvB;AAAA,IACF;AAGA,UAAM,WAAW,kBAAkB;AACnC,QAAI,CAAC,UAAU;AACb,cAAQ,KAAK,kDAAkD,OAAO,GAAG;AACzE;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,SAAS,SAAS,WAAW;AAAA,EACnD;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF;AACF;",
+  "sourcesContent": ["/**\n * Event Module Factory\n *\n * Provides factory functions for creating type-safe event configurations.\n */\n\nimport type {\n  EventDefinition,\n  EventModuleConfig,\n  EventPayload,\n  EmitOptions,\n  CreateModuleEventsOptions,\n  ModuleEventEmitter,\n} from './types'\n\n// =============================================================================\n// Global Event Bus Reference\n// =============================================================================\n\n/**\n * Type for the global event bus interface\n */\ninterface GlobalEventBus {\n  emit(event: string, payload: unknown, options?: EmitOptions): Promise<void>\n}\n\nconst GLOBAL_EVENT_BUS_KEY = '__openMercatoGlobalEventBus__'\n\n// Global event bus reference (set during bootstrap)\nlet globalEventBus: GlobalEventBus | null = null\n\n/**\n * Set the global event bus instance.\n * Called during app bootstrap to wire up event emission.\n */\nexport function setGlobalEventBus(bus: GlobalEventBus): void {\n  globalEventBus = bus\n  try {\n    ;(globalThis as Record<string, unknown>)[GLOBAL_EVENT_BUS_KEY] = bus\n  } catch {\n    // ignore global assignment failures\n  }\n}\n\n/**\n * Get the global event bus instance.\n * Returns null if not yet bootstrapped.\n */\nexport function getGlobalEventBus(): GlobalEventBus | null {\n  try {\n    const sharedBus = (globalThis as Record<string, unknown>)[GLOBAL_EVENT_BUS_KEY]\n    if (sharedBus && typeof sharedBus === 'object' && typeof (sharedBus as GlobalEventBus).emit === 'function') {\n      return sharedBus as GlobalEventBus\n    }\n  } catch {\n    // ignore global read failures\n  }\n  return globalEventBus\n}\n\n// =============================================================================\n// Event Registry for Validation\n// =============================================================================\n\n// Global set of all declared event IDs for runtime validation\nconst allDeclaredEventIds = new Set<string>()\n\n// Global registry of all declared events with their full definitions\nconst allDeclaredEvents: EventDefinition[] = []\n\n/**\n * Check if an event ID has been declared by any module.\n * Used for runtime validation to ensure only declared events are emitted.\n */\nexport function isEventDeclared(eventId: string): boolean {\n  return allDeclaredEventIds.has(eventId)\n}\n\n/**\n * Get all declared event IDs.\n * Useful for debugging and introspection.\n */\nexport function getAllDeclaredEventIds(): string[] {\n  return Array.from(allDeclaredEventIds)\n}\n\n/**\n * Get all declared events with their full definitions.\n * Used by the API to return available events for workflow triggers.\n */\nexport function getDeclaredEvents(): EventDefinition[] {\n  return [...allDeclaredEvents]\n}\n\n/**\n * Check if an event has clientBroadcast enabled.\n * Used by the SSE endpoint to filter events for the DOM Event Bridge.\n */\nexport function isBroadcastEvent(eventId: string): boolean {\n  const event = allDeclaredEvents.find(e => e.id === eventId)\n  return event?.clientBroadcast === true\n}\n\n/**\n * Check if an event has portalBroadcast enabled.\n * Used by the portal SSE endpoint to filter events for the Portal Event Bridge.\n */\nexport function isPortalBroadcastEvent(eventId: string): boolean {\n  const event = allDeclaredEvents.find(e => e.id === eventId)\n  return event?.portalBroadcast === true\n}\n\n// =============================================================================\n// Bootstrap Registration (similar to searchModuleConfigs pattern)\n// =============================================================================\n\nlet _registeredEventConfigs: EventModuleConfig[] | null = null\n\n/**\n * Register event module configurations globally.\n * Called during app bootstrap with configs from events.generated.ts.\n */\nexport function registerEventModuleConfigs(configs: EventModuleConfig[]): void {\n  if (_registeredEventConfigs !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] Event module configs re-registered (this may occur during HMR)')\n  }\n  _registeredEventConfigs = configs\n}\n\n/**\n * Get registered event module configurations.\n * Returns empty array if not registered.\n */\nexport function getEventModuleConfigs(): EventModuleConfig[] {\n  return _registeredEventConfigs ?? []\n}\n\n// =============================================================================\n// Factory Function\n// =============================================================================\n\n/**\n * Creates a type-safe event configuration for a module.\n *\n * Usage in module events.ts:\n * ```typescript\n * import { createModuleEvents } from '@open-mercato/shared/modules/events'\n *\n * const events = [\n *   { id: 'customers.people.created', label: 'Person Created', category: 'crud' },\n *   { id: 'customers.people.updated', label: 'Person Updated', category: 'crud' },\n * ] as const\n *\n * export const eventsConfig = createModuleEvents({\n *   moduleId: 'customers',\n *   events,\n * })\n *\n * // Export the typed emit function for use in commands\n * export const emitCustomersEvent = eventsConfig.emit\n *\n * // Export event IDs as a type for external use\n * export type CustomersEventId = typeof events[number]['id']\n *\n * export default eventsConfig\n * ```\n *\n * TypeScript will enforce that only declared event IDs can be emitted:\n * ```typescript\n * // \u2705 This compiles - event is declared\n * emitCustomersEvent('customers.people.created', { id: '123', tenantId: 'abc' })\n *\n * // \u274C TypeScript error - event not declared\n * emitCustomersEvent('customers.people.exploded', { id: '123' })\n * ```\n */\nexport function createModuleEvents<\n  const TEvents extends readonly { id: string }[],\n  TEventIds extends TEvents[number]['id'] = TEvents[number]['id']\n>(options: CreateModuleEventsOptions<TEventIds>): EventModuleConfig<TEventIds> {\n  const { moduleId, events, strict = false } = options\n\n  // Build set of valid event IDs for runtime validation\n  const validEventIds = new Set(events.map(e => e.id))\n\n  // Build full event definitions with module added\n  const fullEvents: EventDefinition[] = events.map(e => ({\n    ...e,\n    module: moduleId,\n  }))\n\n  // Register all event IDs and definitions in the global registry\n  for (const eventId of validEventIds) {\n    allDeclaredEventIds.add(eventId)\n  }\n  for (const event of fullEvents) {\n    // Avoid duplicates if createModuleEvents is called multiple times (e.g., HMR)\n    if (!allDeclaredEvents.find(e => e.id === event.id)) {\n      allDeclaredEvents.push(event)\n    }\n  }\n\n  /**\n   * The emit function - validates events and delegates to the global event bus\n   */\n  const emit = async (\n    eventId: TEventIds,\n    payload: EventPayload,\n    emitOptions?: EmitOptions\n  ): Promise<void> => {\n    // Runtime validation - event must be declared\n    if (!validEventIds.has(eventId)) {\n      const message =\n        `[events] Module \"${moduleId}\" tried to emit undeclared event \"${eventId}\". ` +\n        `Add it to the module's events.ts file first.`\n\n      if (strict) {\n        throw new Error(message)\n      } else {\n        console.error(message)\n        // In non-strict mode, still emit but with warning\n      }\n    }\n\n    // Get event bus from global reference\n    const eventBus = getGlobalEventBus()\n    if (!eventBus) {\n      console.warn(`[events] Event bus not available, cannot emit \"${eventId}\"`)\n      return\n    }\n\n    await eventBus.emit(eventId, payload, emitOptions)\n  }\n\n  return {\n    moduleId,\n    events: fullEvents,\n    emit: emit as unknown as ModuleEventEmitter<TEventIds>,\n  }\n}\n"],
+  "mappings": "AA0BA,MAAM,uBAAuB;AAG7B,IAAI,iBAAwC;AAMrC,SAAS,kBAAkB,KAA2B;AAC3D,mBAAiB;AACjB,MAAI;AACF;AAAC,IAAC,WAAuC,oBAAoB,IAAI;AAAA,EACnE,QAAQ;AAAA,EAER;AACF;AAMO,SAAS,oBAA2C;AACzD,MAAI;AACF,UAAM,YAAa,WAAuC,oBAAoB;AAC9E,QAAI,aAAa,OAAO,cAAc,YAAY,OAAQ,UAA6B,SAAS,YAAY;AAC1G,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;AAOA,MAAM,sBAAsB,oBAAI,IAAY;AAG5C,MAAM,oBAAuC,CAAC;AAMvC,SAAS,gBAAgB,SAA0B;AACxD,SAAO,oBAAoB,IAAI,OAAO;AACxC;AAMO,SAAS,yBAAmC;AACjD,SAAO,MAAM,KAAK,mBAAmB;AACvC;AAMO,SAAS,oBAAuC;AACrD,SAAO,CAAC,GAAG,iBAAiB;AAC9B;AAMO,SAAS,iBAAiB,SAA0B;AACzD,QAAM,QAAQ,kBAAkB,KAAK,OAAK,EAAE,OAAO,OAAO;AAC1D,SAAO,OAAO,oBAAoB;AACpC;AAMO,SAAS,uBAAuB,SAA0B;AAC/D,QAAM,QAAQ,kBAAkB,KAAK,OAAK,EAAE,OAAO,OAAO;AAC1D,SAAO,OAAO,oBAAoB;AACpC;AAMA,IAAI,0BAAsD;AAMnD,SAAS,2BAA2B,SAAoC;AAC7E,MAAI,4BAA4B,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAC9E,YAAQ,MAAM,4EAA4E;AAAA,EAC5F;AACA,4BAA0B;AAC5B;AAMO,SAAS,wBAA6C;AAC3D,SAAO,2BAA2B,CAAC;AACrC;AAyCO,SAAS,mBAGd,SAA6E;AAC7E,QAAM,EAAE,UAAU,QAAQ,SAAS,MAAM,IAAI;AAG7C,QAAM,gBAAgB,IAAI,IAAI,OAAO,IAAI,OAAK,EAAE,EAAE,CAAC;AAGnD,QAAM,aAAgC,OAAO,IAAI,QAAM;AAAA,IACrD,GAAG;AAAA,IACH,QAAQ;AAAA,EACV,EAAE;AAGF,aAAW,WAAW,eAAe;AACnC,wBAAoB,IAAI,OAAO;AAAA,EACjC;AACA,aAAW,SAAS,YAAY;AAE9B,QAAI,CAAC,kBAAkB,KAAK,OAAK,EAAE,OAAO,MAAM,EAAE,GAAG;AACnD,wBAAkB,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAKA,QAAM,OAAO,OACX,SACA,SACA,gBACkB;AAElB,QAAI,CAAC,cAAc,IAAI,OAAO,GAAG;AAC/B,YAAM,UACJ,oBAAoB,QAAQ,qCAAqC,OAAO;AAG1E,UAAI,QAAQ;AACV,cAAM,IAAI,MAAM,OAAO;AAAA,MACzB,OAAO;AACL,gBAAQ,MAAM,OAAO;AAAA,MAEvB;AAAA,IACF;AAGA,UAAM,WAAW,kBAAkB;AACnC,QAAI,CAAC,UAAU;AACb,cAAQ,KAAK,kDAAkD,OAAO,GAAG;AACzE;AAAA,IACF;AAEA,UAAM,SAAS,KAAK,SAAS,SAAS,WAAW;AAAA,EACnD;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/registry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/modules/registry.ts"],
-  "sourcesContent": ["import type { ReactNode } from 'react'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi/types'\nimport type { SyncCrudEventResult } from '../lib/crud/sync-event-types'\nimport type { DashboardWidgetModule } from './dashboard/widgets'\nimport type { InjectionAnyWidgetModule, ModuleInjectionTable } from './widgets/injection'\nimport type { IntegrationBundle, IntegrationDefinition } from './integrations/types'\n\n// Context passed to dynamic metadata guards\nexport type RouteVisibilityContext = { path?: string; auth?: any }\n\n// Metadata you can export from page.meta.ts or directly from a server page\nexport type PageMetadata = {\n  requireAuth?: boolean\n  requireRoles?: readonly string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: readonly string[]\n  // Titles and grouping (aliases supported)\n  title?: string\n  titleKey?: string\n  pageTitle?: string\n  pageTitleKey?: string\n  group?: string\n  groupKey?: string\n  pageGroup?: string\n  pageGroupKey?: string\n  // Ordering and visuals\n  order?: number\n  pageOrder?: number\n  icon?: ReactNode\n  navHidden?: boolean\n  // Dynamic flags\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  // Optional static breadcrumb trail for header\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  // Navigation context for tiered navigation:\n  // - 'main' (default): Main sidebar business operations\n  // - 'admin': Collapsible \"Settings & Admin\" section at bottom of sidebar\n  // - 'settings': Hidden from sidebar, only accessible via Settings hub page\n  // - 'profile': Profile dropdown items\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n\nexport type ApiHandler = (req: Request, ctx?: any) => Promise<Response> | Response\n\nexport type ModuleRoute = {\n  pattern?: string\n  path?: string\n  requireAuth?: boolean\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: string[]\n  title?: string\n  titleKey?: string\n  group?: string\n  groupKey?: string\n  icon?: ReactNode\n  order?: number\n  priority?: number\n  navHidden?: boolean\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n  Component: (props: any) => ReactNode | Promise<ReactNode>\n}\n\nexport type ModuleApiLegacy = {\n  method: HttpMethod\n  path: string\n  handler: ApiHandler\n  metadata?: Record<string, unknown>\n  docs?: OpenApiMethodDoc\n}\n\nexport type ModuleApiRouteFile = {\n  path: string\n  handlers: Partial<Record<HttpMethod, ApiHandler>>\n  requireAuth?: boolean\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements for the entire route file\n  // Note: per-method feature requirements should be expressed inside metadata\n  requireFeatures?: string[]\n  docs?: OpenApiRouteDoc\n  metadata?: Partial<Record<HttpMethod, unknown>>\n}\n\nexport type ModuleApi = ModuleApiLegacy | ModuleApiRouteFile\n\nexport type ModuleCli = {\n  command: string\n  run: (argv: string[]) => Promise<void> | void\n}\n\nexport type ModuleInfo = {\n  name?: string\n  title?: string\n  version?: string\n  description?: string\n  author?: string\n  license?: string\n  homepage?: string\n  copyright?: string\n  // Optional hard dependencies: module ids that must be enabled\n  requires?: string[]\n  // Whether this module can be ejected into the app's src/modules/ for customization\n  ejectable?: boolean\n}\n\nexport type ModuleDashboardWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<DashboardWidgetModule<any>>\n}\n\nexport type ModuleInjectionWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<InjectionAnyWidgetModule<any, any>>\n}\n\nexport type Module = {\n  id: string\n  info?: ModuleInfo\n  backendRoutes?: ModuleRoute[]\n  frontendRoutes?: ModuleRoute[]\n  apis?: ModuleApi[]\n  cli?: ModuleCli[]\n  translations?: Record<string, Record<string, string>>\n  // Optional: per-module feature declarations discovered from acl.ts (module root)\n  features?: Array<{ id: string; title: string; module: string }>\n  // Auto-discovered event subscribers\n  subscribers?: Array<{\n    id: string\n    event: string\n    persistent?: boolean\n    /** When true, subscriber runs synchronously inside the mutation pipeline */\n    sync?: boolean\n    /** Execution priority for sync subscribers (lower = earlier). Default: 50 */\n    priority?: number\n    // Imported function reference; will be registered into event bus\n    handler: (payload: any, ctx: any) => Promise<void | SyncCrudEventResult> | void | SyncCrudEventResult\n  }>\n  // Auto-discovered queue workers\n  workers?: Array<{\n    id: string\n    queue: string\n    concurrency: number\n    // Imported function reference; will be called by the queue worker\n    handler: (job: unknown, ctx: unknown) => Promise<void> | void\n  }>\n  // Optional: per-module declared entity extensions and custom fields (static)\n  // Extensions discovered from data/extensions.ts; Custom fields discovered from ce.ts (entities[].fields)\n  entityExtensions?: import('./entities').EntityExtension[]\n  customFieldSets?: import('./entities').CustomFieldSet[]\n  // Optional: per-module declared custom entities (virtual/logical entities)\n  // Discovered from ce.ts (module root). Each entry represents an entityId with optional label/description.\n  customEntities?: Array<{ id: string; label?: string; description?: string }>\n  dashboardWidgets?: ModuleDashboardWidgetEntry[]\n  injectionWidgets?: ModuleInjectionWidgetEntry[]\n  injectionTable?: ModuleInjectionTable\n  // Optional: per-module vector search configuration (discovered from vector.ts)\n  vector?: import('./vector').VectorModuleConfig\n  // Optional: module-specific tenant setup configuration (from setup.ts)\n  setup?: import('./setup').ModuleSetupConfig\n  // Optional: integration marketplace declarations discovered from integration.ts\n  integrations?: IntegrationDefinition[]\n  bundles?: IntegrationBundle[]\n}\n\nfunction normPath(s: string) {\n  return (s.startsWith('/') ? s : '/' + s).replace(/\\/+$/, '') || '/'\n}\n\nfunction matchPattern(pattern: string, pathname: string): Record<string, string | string[]> | undefined {\n  const p = normPath(pattern)\n  const u = normPath(pathname)\n  const pSegs = p.split('/').slice(1)\n  const uSegs = u.split('/').slice(1)\n  const params: Record<string, string | string[]> = {}\n  let i = 0\n  for (let j = 0; j < pSegs.length; j++, i++) {\n    const seg = pSegs[j]\n    const mCatchAll = seg.match(/^\\[\\.\\.\\.(.+)\\]$/)\n    const mOptCatch = seg.match(/^\\[\\[\\.\\.\\.(.+)\\]\\]$/)\n    const mDyn = seg.match(/^\\[(.+)\\]$/)\n    if (mCatchAll) {\n      const key = mCatchAll[1]\n      if (i >= uSegs.length) return undefined\n      params[key] = uSegs.slice(i)\n      i = uSegs.length\n      return i === uSegs.length ? params : undefined\n    } else if (mOptCatch) {\n      const key = mOptCatch[1]\n      params[key] = i < uSegs.length ? uSegs.slice(i) : []\n      i = uSegs.length\n      return params\n    } else if (mDyn) {\n      if (i >= uSegs.length) return undefined\n      params[mDyn[1]] = uSegs[i]\n    } else {\n      if (i >= uSegs.length || uSegs[i] !== seg) return undefined\n    }\n  }\n  if (i !== uSegs.length) return undefined\n  return params\n}\n\nfunction getPattern(r: ModuleRoute) {\n  return r.pattern ?? r.path ?? '/'\n}\n\nexport function findFrontendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.frontendRoutes ?? []\n    for (const r of routes) {\n      const params = matchPattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findBackendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.backendRoutes ?? []\n    for (const r of routes) {\n      const params = matchPattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findApi(modules: Module[], method: HttpMethod, pathname: string): { handler: ApiHandler; params: Record<string, string | string[]>; requireAuth?: boolean; requireRoles?: string[]; metadata?: any } | undefined {\n  for (const m of modules) {\n    const apis = m.apis ?? []\n    for (const a of apis) {\n      if ('handlers' in a) {\n        const params = matchPattern(a.path, pathname)\n        const handler = (a.handlers as any)[method]\n        if (params && handler) return { handler, params, requireAuth: a.requireAuth, requireRoles: (a as any).requireRoles, metadata: (a as any).metadata }\n      } else {\n        const al = a as ModuleApiLegacy\n        if (al.method !== method) continue\n        const params = matchPattern(al.path, pathname)\n        if (params) {\n          return { handler: al.handler, params, metadata: al.metadata }\n        }\n      }\n    }\n  }\n}\n\n// CLI modules registry - shared between CLI and module workers\nlet _cliModules: Module[] | null = null\n\nexport function registerCliModules(modules: Module[]) {\n  if (_cliModules !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] CLI modules re-registered (this may occur during HMR)')\n  }\n  _cliModules = modules\n}\n\nexport function getCliModules(): Module[] {\n  // Return empty array if not registered - allows generate command to work without bootstrap\n  return _cliModules ?? []\n}\n\nexport function hasCliModules(): boolean {\n  return _cliModules !== null && _cliModules.length > 0\n}\n"],
-  "mappings": "AA0LA,SAAS,SAAS,GAAW;AAC3B,UAAQ,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,GAAG,QAAQ,QAAQ,EAAE,KAAK;AAClE;AAEA,SAAS,aAAa,SAAiB,UAAiE;AACtG,QAAM,IAAI,SAAS,OAAO;AAC1B,QAAM,IAAI,SAAS,QAAQ;AAC3B,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,SAA4C,CAAC;AACnD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK;AAC1C,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,IAAI,MAAM,kBAAkB;AAC9C,UAAM,YAAY,IAAI,MAAM,sBAAsB;AAClD,UAAM,OAAO,IAAI,MAAM,YAAY;AACnC,QAAI,WAAW;AACb,YAAM,MAAM,UAAU,CAAC;AACvB,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,GAAG,IAAI,MAAM,MAAM,CAAC;AAC3B,UAAI,MAAM;AACV,aAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACvC,WAAW,WAAW;AACpB,YAAM,MAAM,UAAU,CAAC;AACvB,aAAO,GAAG,IAAI,IAAI,MAAM,SAAS,MAAM,MAAM,CAAC,IAAI,CAAC;AACnD,UAAI,MAAM;AACV,aAAO;AAAA,IACT,WAAW,MAAM;AACf,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC3B,OAAO;AACL,UAAI,KAAK,MAAM,UAAU,MAAM,CAAC,MAAM,IAAK,QAAO;AAAA,IACpD;AAAA,EACF;AACA,MAAI,MAAM,MAAM,OAAQ,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,WAAW,GAAgB;AAClC,SAAO,EAAE,WAAW,EAAE,QAAQ;AAChC;AAEO,SAAS,kBAAkB,SAAmB,UAAiG;AACpJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,kBAAkB,CAAC;AACpC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,aAAa,WAAW,CAAC,GAAG,QAAQ;AACnD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,SAAmB,UAAiG;AACnJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,iBAAiB,CAAC;AACnC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,aAAa,WAAW,CAAC,GAAG,QAAQ;AACnD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,QAAoB,UAAkK;AAC/N,aAAW,KAAK,SAAS;AACvB,UAAM,OAAO,EAAE,QAAQ,CAAC;AACxB,eAAW,KAAK,MAAM;AACpB,UAAI,cAAc,GAAG;AACnB,cAAM,SAAS,aAAa,EAAE,MAAM,QAAQ;AAC5C,cAAM,UAAW,EAAE,SAAiB,MAAM;AAC1C,YAAI,UAAU,QAAS,QAAO,EAAE,SAAS,QAAQ,aAAa,EAAE,aAAa,cAAe,EAAU,cAAc,UAAW,EAAU,SAAS;AAAA,MACpJ,OAAO;AACL,cAAM,KAAK;AACX,YAAI,GAAG,WAAW,OAAQ;AAC1B,cAAM,SAAS,aAAa,GAAG,MAAM,QAAQ;AAC7C,YAAI,QAAQ;AACV,iBAAO,EAAE,SAAS,GAAG,SAAS,QAAQ,UAAU,GAAG,SAAS;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,IAAI,cAA+B;AAE5B,SAAS,mBAAmB,SAAmB;AACpD,MAAI,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClE,YAAQ,MAAM,mEAAmE;AAAA,EACnF;AACA,gBAAc;AAChB;AAEO,SAAS,gBAA0B;AAExC,SAAO,eAAe,CAAC;AACzB;AAEO,SAAS,gBAAyB;AACvC,SAAO,gBAAgB,QAAQ,YAAY,SAAS;AACtD;",
+  "sourcesContent": ["import type { ReactNode } from 'react'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi/types'\nimport type { SyncCrudEventResult } from '../lib/crud/sync-event-types'\nimport type { DashboardWidgetModule } from './dashboard/widgets'\nimport type { InjectionAnyWidgetModule, ModuleInjectionTable } from './widgets/injection'\nimport type { IntegrationBundle, IntegrationDefinition } from './integrations/types'\n\n// Context passed to dynamic metadata guards\nexport type RouteVisibilityContext = { path?: string; auth?: any }\n\n// Metadata you can export from page.meta.ts or directly from a server page\nexport type PageMetadata = {\n  requireAuth?: boolean\n  requireRoles?: readonly string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: readonly string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: readonly string[]\n  // Titles and grouping (aliases supported)\n  title?: string\n  titleKey?: string\n  pageTitle?: string\n  pageTitleKey?: string\n  group?: string\n  groupKey?: string\n  pageGroup?: string\n  pageGroupKey?: string\n  // Ordering and visuals\n  order?: number\n  pageOrder?: number\n  icon?: ReactNode\n  navHidden?: boolean\n  // Dynamic flags\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  // Optional static breadcrumb trail for header\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  // Navigation context for tiered navigation:\n  // - 'main' (default): Main sidebar business operations\n  // - 'admin': Collapsible \"Settings & Admin\" section at bottom of sidebar\n  // - 'settings': Hidden from sidebar, only accessible via Settings hub page\n  // - 'profile': Profile dropdown items\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n\nexport type ApiHandler = (req: Request, ctx?: any) => Promise<Response> | Response\n\nexport type ModuleRoute = {\n  pattern?: string\n  path?: string\n  requireAuth?: boolean\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: string[]\n  title?: string\n  titleKey?: string\n  group?: string\n  groupKey?: string\n  icon?: ReactNode\n  order?: number\n  priority?: number\n  navHidden?: boolean\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n  Component: (props: any) => ReactNode | Promise<ReactNode>\n}\n\nexport type ModuleApiLegacy = {\n  method: HttpMethod\n  path: string\n  handler: ApiHandler\n  metadata?: Record<string, unknown>\n  docs?: OpenApiMethodDoc\n}\n\nexport type ModuleApiRouteFile = {\n  path: string\n  handlers: Partial<Record<HttpMethod, ApiHandler>>\n  requireAuth?: boolean\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements for the entire route file\n  // Note: per-method feature requirements should be expressed inside metadata\n  requireFeatures?: string[]\n  docs?: OpenApiRouteDoc\n  metadata?: Partial<Record<HttpMethod, unknown>>\n}\n\nexport type ModuleApi = ModuleApiLegacy | ModuleApiRouteFile\n\nexport type ModuleCli = {\n  command: string\n  run: (argv: string[]) => Promise<void> | void\n}\n\nexport type ModuleInfo = {\n  name?: string\n  title?: string\n  version?: string\n  description?: string\n  author?: string\n  license?: string\n  homepage?: string\n  copyright?: string\n  // Optional hard dependencies: module ids that must be enabled\n  requires?: string[]\n  // Whether this module can be ejected into the app's src/modules/ for customization\n  ejectable?: boolean\n}\n\nexport type ModuleDashboardWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<DashboardWidgetModule<any>>\n}\n\nexport type ModuleInjectionWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<InjectionAnyWidgetModule<any, any>>\n}\n\nexport type Module = {\n  id: string\n  info?: ModuleInfo\n  backendRoutes?: ModuleRoute[]\n  frontendRoutes?: ModuleRoute[]\n  apis?: ModuleApi[]\n  cli?: ModuleCli[]\n  translations?: Record<string, Record<string, string>>\n  // Optional: per-module feature declarations discovered from acl.ts (module root)\n  features?: Array<{ id: string; title: string; module: string }>\n  // Auto-discovered event subscribers\n  subscribers?: Array<{\n    id: string\n    event: string\n    persistent?: boolean\n    /** When true, subscriber runs synchronously inside the mutation pipeline */\n    sync?: boolean\n    /** Execution priority for sync subscribers (lower = earlier). Default: 50 */\n    priority?: number\n    // Imported function reference; will be registered into event bus\n    handler: (payload: any, ctx: any) => Promise<void | SyncCrudEventResult> | void | SyncCrudEventResult\n  }>\n  // Auto-discovered queue workers\n  workers?: Array<{\n    id: string\n    queue: string\n    concurrency: number\n    // Imported function reference; will be called by the queue worker\n    handler: (job: unknown, ctx: unknown) => Promise<void> | void\n  }>\n  // Optional: per-module declared entity extensions and custom fields (static)\n  // Extensions discovered from data/extensions.ts; Custom fields discovered from ce.ts (entities[].fields)\n  entityExtensions?: import('./entities').EntityExtension[]\n  customFieldSets?: import('./entities').CustomFieldSet[]\n  // Optional: per-module declared custom entities (virtual/logical entities)\n  // Discovered from ce.ts (module root). Each entry represents an entityId with optional label/description.\n  customEntities?: Array<{ id: string; label?: string; description?: string }>\n  dashboardWidgets?: ModuleDashboardWidgetEntry[]\n  injectionWidgets?: ModuleInjectionWidgetEntry[]\n  injectionTable?: ModuleInjectionTable\n  // Optional: per-module vector search configuration (discovered from vector.ts)\n  vector?: import('./vector').VectorModuleConfig\n  // Optional: module-specific tenant setup configuration (from setup.ts)\n  setup?: import('./setup').ModuleSetupConfig\n  // Optional: integration marketplace declarations discovered from integration.ts\n  integrations?: IntegrationDefinition[]\n  bundles?: IntegrationBundle[]\n}\n\nfunction normPath(s: string) {\n  return (s.startsWith('/') ? s : '/' + s).replace(/\\/+$/, '') || '/'\n}\n\nfunction matchPattern(pattern: string, pathname: string): Record<string, string | string[]> | undefined {\n  const p = normPath(pattern)\n  const u = normPath(pathname)\n  const pSegs = p.split('/').slice(1)\n  const uSegs = u.split('/').slice(1)\n  const params: Record<string, string | string[]> = {}\n  let i = 0\n  for (let j = 0; j < pSegs.length; j++, i++) {\n    const seg = pSegs[j]\n    const mCatchAll = seg.match(/^\\[\\.\\.\\.(.+)\\]$/)\n    const mOptCatch = seg.match(/^\\[\\[\\.\\.\\.(.+)\\]\\]$/)\n    const mDyn = seg.match(/^\\[(.+)\\]$/)\n    if (mCatchAll) {\n      const key = mCatchAll[1]\n      if (i >= uSegs.length) return undefined\n      params[key] = uSegs.slice(i)\n      i = uSegs.length\n      return i === uSegs.length ? params : undefined\n    } else if (mOptCatch) {\n      const key = mOptCatch[1]\n      params[key] = i < uSegs.length ? uSegs.slice(i) : []\n      i = uSegs.length\n      return params\n    } else if (mDyn) {\n      if (i >= uSegs.length) return undefined\n      params[mDyn[1]] = uSegs[i]\n    } else {\n      if (i >= uSegs.length || uSegs[i] !== seg) return undefined\n    }\n  }\n  if (i !== uSegs.length) return undefined\n  return params\n}\n\nfunction getPattern(r: ModuleRoute) {\n  return r.pattern ?? r.path ?? '/'\n}\n\nexport function findFrontendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.frontendRoutes ?? []\n    for (const r of routes) {\n      const params = matchPattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findBackendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.backendRoutes ?? []\n    for (const r of routes) {\n      const params = matchPattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findApi(modules: Module[], method: HttpMethod, pathname: string): { handler: ApiHandler; params: Record<string, string | string[]>; requireAuth?: boolean; requireRoles?: string[]; metadata?: any } | undefined {\n  for (const m of modules) {\n    const apis = m.apis ?? []\n    for (const a of apis) {\n      if ('handlers' in a) {\n        const params = matchPattern(a.path, pathname)\n        const handler = (a.handlers as any)[method]\n        if (params && handler) return { handler, params, requireAuth: a.requireAuth, requireRoles: (a as any).requireRoles, metadata: (a as any).metadata }\n      } else {\n        const al = a as ModuleApiLegacy\n        if (al.method !== method) continue\n        const params = matchPattern(al.path, pathname)\n        if (params) {\n          return { handler: al.handler, params, metadata: al.metadata }\n        }\n      }\n    }\n  }\n}\n\n// CLI modules registry - shared between CLI and module workers\nlet _cliModules: Module[] | null = null\n\nexport function registerCliModules(modules: Module[]) {\n  if (_cliModules !== null && process.env.NODE_ENV === 'development') {\n    console.debug('[Bootstrap] CLI modules re-registered (this may occur during HMR)')\n  }\n  _cliModules = modules\n}\n\nexport function getCliModules(): Module[] {\n  // Return empty array if not registered - allows generate command to work without bootstrap\n  return _cliModules ?? []\n}\n\nexport function hasCliModules(): boolean {\n  return _cliModules !== null && _cliModules.length > 0\n}\n"],
+  "mappings": "AAkMA,SAAS,SAAS,GAAW;AAC3B,UAAQ,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,GAAG,QAAQ,QAAQ,EAAE,KAAK;AAClE;AAEA,SAAS,aAAa,SAAiB,UAAiE;AACtG,QAAM,IAAI,SAAS,OAAO;AAC1B,QAAM,IAAI,SAAS,QAAQ;AAC3B,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,SAA4C,CAAC;AACnD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK;AAC1C,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,IAAI,MAAM,kBAAkB;AAC9C,UAAM,YAAY,IAAI,MAAM,sBAAsB;AAClD,UAAM,OAAO,IAAI,MAAM,YAAY;AACnC,QAAI,WAAW;AACb,YAAM,MAAM,UAAU,CAAC;AACvB,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,GAAG,IAAI,MAAM,MAAM,CAAC;AAC3B,UAAI,MAAM;AACV,aAAO,MAAM,MAAM,SAAS,SAAS;AAAA,IACvC,WAAW,WAAW;AACpB,YAAM,MAAM,UAAU,CAAC;AACvB,aAAO,GAAG,IAAI,IAAI,MAAM,SAAS,MAAM,MAAM,CAAC,IAAI,CAAC;AACnD,UAAI,MAAM;AACV,aAAO;AAAA,IACT,WAAW,MAAM;AACf,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC3B,OAAO;AACL,UAAI,KAAK,MAAM,UAAU,MAAM,CAAC,MAAM,IAAK,QAAO;AAAA,IACpD;AAAA,EACF;AACA,MAAI,MAAM,MAAM,OAAQ,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,WAAW,GAAgB;AAClC,SAAO,EAAE,WAAW,EAAE,QAAQ;AAChC;AAEO,SAAS,kBAAkB,SAAmB,UAAiG;AACpJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,kBAAkB,CAAC;AACpC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,aAAa,WAAW,CAAC,GAAG,QAAQ;AACnD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,SAAmB,UAAiG;AACnJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,iBAAiB,CAAC;AACnC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,aAAa,WAAW,CAAC,GAAG,QAAQ;AACnD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,QAAoB,UAAkK;AAC/N,aAAW,KAAK,SAAS;AACvB,UAAM,OAAO,EAAE,QAAQ,CAAC;AACxB,eAAW,KAAK,MAAM;AACpB,UAAI,cAAc,GAAG;AACnB,cAAM,SAAS,aAAa,EAAE,MAAM,QAAQ;AAC5C,cAAM,UAAW,EAAE,SAAiB,MAAM;AAC1C,YAAI,UAAU,QAAS,QAAO,EAAE,SAAS,QAAQ,aAAa,EAAE,aAAa,cAAe,EAAU,cAAc,UAAW,EAAU,SAAS;AAAA,MACpJ,OAAO;AACL,cAAM,KAAK;AACX,YAAI,GAAG,WAAW,OAAQ;AAC1B,cAAM,SAAS,aAAa,GAAG,MAAM,QAAQ;AAC7C,YAAI,QAAQ;AACV,iBAAO,EAAE,SAAS,GAAG,SAAS,QAAQ,UAAU,GAAG,SAAS;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAGA,IAAI,cAA+B;AAE5B,SAAS,mBAAmB,SAAmB;AACpD,MAAI,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClE,YAAQ,MAAM,mEAAmE;AAAA,EACnF;AACA,gBAAc;AAChB;AAEO,SAAS,gBAA0B;AAExC,SAAO,eAAe,CAAC;AACzB;AAEO,SAAS,gBAAyB;AACvC,SAAO,gBAAgB,QAAQ,YAAY,SAAS;AACtD;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.4.8-main-848cd3c22c",
+  "version": "0.4.8",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -86,6 +86,5 @@
   },
   "publishConfig": {
     "access": "public"
-  },
-  "stableVersion": "0.4.7"
+  }
 }

package/src/lib/auth/featureMatch.ts

@@ -0,0 +1,41 @@
+export type FeatureEntry = { id: string; title?: string; module?: string }
+
+export function featureString(entry: FeatureEntry | string): string {
+  return typeof entry === 'string' ? entry : entry.id
+}
+
+export function featureScope(featureId: string): string {
+  const dotIndex = featureId.indexOf('.')
+  return dotIndex === -1 ? featureId : featureId.slice(0, dotIndex)
+}
+
+export function extractFeatureStrings(entries: Array<FeatureEntry | string>): string[] {
+  return entries.map(featureString)
+}
+
+/**
+ * Checks if a required feature is satisfied by a granted feature permission.
+ *
+ * Wildcard patterns:
+ * - `*` (global wildcard): Grants access to all features
+ * - `prefix.*` (module wildcard): Grants access to all features starting with `prefix.`
+ *   and also the exact prefix itself
+ * - Exact match: Feature must match exactly
+ */
+export function matchFeature(required: string, granted: string): boolean {
+  if (granted === '*') return true
+  if (granted.endsWith('.*')) {
+    const prefix = granted.slice(0, -2)
+    return required === prefix || required.startsWith(prefix + '.')
+  }
+  return granted === required
+}
+
+/**
+ * Checks if all required features are satisfied by the granted feature set.
+ */
+export function hasAllFeatures(required: string[], granted: string[]): boolean {
+  if (!required.length) return true
+  if (!granted.length) return false
+  return required.every((req) => granted.some((g) => matchFeature(req, g)))
+}

package/src/lib/auth/server.ts

@@ -168,6 +168,7 @@ export async function getAuthFromCookies(): Promise<AuthContext> {
   try {
     const payload = verifyJwt(token) as AuthContext
     if (!payload) return null
+    if ((payload as any).type === 'customer') return null
     const tenantCookie = cookieStore.get(TENANT_COOKIE_NAME)?.value
     const orgCookie = cookieStore.get(ORGANIZATION_COOKIE_NAME)?.value
     return applySuperAdminScope(payload, tenantCookie, orgCookie)
@@ -190,6 +191,7 @@ export async function getAuthFromRequest(req: Request): Promise<AuthContext> {
   if (token) {
     try {
       const payload = verifyJwt(token) as AuthContext
+      if (payload && (payload as any).type === 'customer') return null
       if (payload) return applySuperAdminScope(payload, tenantCookie, orgCookie)
     } catch {
       // fall back to API key detection

package/src/modules/customer-auth.ts

@@ -0,0 +1,49 @@
+/**
+ * Customer Auth Types — Shared Type Definitions
+ *
+ * Re-exports customer authentication types for use by portal UI hooks
+ * and app modules that build customer-facing pages.
+ *
+ * The actual auth guard implementation lives in
+ * `@open-mercato/core/modules/customer_accounts/lib/customerAuth`
+ * — this module only provides the type contract.
+ */
+
+export interface CustomerAuthContext {
+  sub: string
+  type: 'customer'
+  tenantId: string
+  orgId: string
+  email: string
+  displayName: string
+  customerEntityId?: string | null
+  personEntityId?: string | null
+  resolvedFeatures: string[]
+}
+
+export type CustomerUser = {
+  id: string
+  email: string
+  displayName: string
+  emailVerified: boolean
+  customerEntityId: string | null
+  personEntityId: string | null
+  isActive: boolean
+  lastLoginAt: string | null
+  createdAt: string
+}
+
+export type CustomerRole = {
+  id: string
+  name: string
+  slug: string
+}
+
+export type CustomerAuthResult = {
+  user: CustomerUser | null
+  roles: CustomerRole[]
+  resolvedFeatures: string[]
+  isPortalAdmin: boolean
+  loading: boolean
+  error: string | null
+}

package/src/modules/events/factory.ts

@@ -101,6 +101,15 @@ export function isBroadcastEvent(eventId: string): boolean {
   return event?.clientBroadcast === true
 }
 
+/**
+ * Check if an event has portalBroadcast enabled.
+ * Used by the portal SSE endpoint to filter events for the Portal Event Bridge.
+ */
+export function isPortalBroadcastEvent(eventId: string): boolean {
+  const event = allDeclaredEvents.find(e => e.id === eventId)
+  return event?.portalBroadcast === true
+}
+
 // =============================================================================
 // Bootstrap Registration (similar to searchModuleConfigs pattern)
 // =============================================================================

package/src/modules/events/types.ts

@@ -34,6 +34,8 @@ export interface EventDefinition {
   excludeFromTriggers?: boolean
   /** When true, this event is bridged to the browser via SSE (DOM Event Bridge). Default: false */
   clientBroadcast?: boolean
+  /** When true, this event is bridged to the customer portal via SSE (Portal Event Bridge). Default: false */
+  portalBroadcast?: boolean
 }
 
 // =============================================================================

package/src/modules/registry.ts

@@ -14,6 +14,10 @@ export type PageMetadata = {
   requireRoles?: readonly string[]
   // Optional fine-grained feature requirements
   requireFeatures?: readonly string[]
+  // Portal: require customer (portal user) authentication instead of staff auth
+  requireCustomerAuth?: boolean
+  // Portal: require customer-specific features (checked against CustomerRbacService)
+  requireCustomerFeatures?: readonly string[]
   // Titles and grouping (aliases supported)
   title?: string
   titleKey?: string
@@ -58,6 +62,10 @@ export type ModuleRoute = {
   requireRoles?: string[]
   // Optional fine-grained feature requirements
   requireFeatures?: string[]
+  // Portal: require customer (portal user) authentication instead of staff auth
+  requireCustomerAuth?: boolean
+  // Portal: require customer-specific features (checked against CustomerRbacService)
+  requireCustomerFeatures?: string[]
   title?: string
   titleKey?: string
   group?: string

package/src/modules/setup.ts

@@ -20,6 +20,13 @@ export type DefaultRoleFeatures = {
   employee?: string[]
 }
 
+export type DefaultCustomerRoleFeatures = {
+  portal_admin?: string[]
+  buyer?: string[]
+  viewer?: string[]
+  [roleSlug: string]: string[] | undefined
+}
+
 export type ModuleSetupConfig = {
   /**
    * Called inside setupInitialTenant() right after the tenant/org is created.
@@ -49,4 +56,11 @@ export type ModuleSetupConfig = {
    * Merged into role ACLs during tenant setup.
    */
   defaultRoleFeatures?: DefaultRoleFeatures
+
+  /**
+   * Declarative default customer role-feature assignments.
+   * Merged into CustomerRoleAcl records during tenant setup.
+   * Keys are customer role slugs (portal_admin, buyer, viewer, or custom).
+   */
+  defaultCustomerRoleFeatures?: DefaultCustomerRoleFeatures
 }