@open-mercato/shared 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6785.1.1dd7cfac55

package/src/lib/crud/__tests__/mutation-guard-registry.test.ts

@@ -1,5 +1,9 @@
 import { matchesEntity, runMutationGuards } from '../mutation-guard-registry'
 import type { MutationGuard, MutationGuardInput } from '../mutation-guard-registry'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '../../../modules/overrides'
 
 describe('matchesEntity', () => {
   it('matches wildcard "*" against any entity', () => {
@@ -24,6 +28,10 @@ describe('matchesEntity', () => {
 })
 
 describe('runMutationGuards', () => {
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+  })
+
   const baseInput: MutationGuardInput = {
     tenantId: 'tenant-1',
     organizationId: 'org-1',
@@ -159,6 +167,24 @@ describe('runMutationGuards', () => {
     expect(resultWithWildcard.errorBody).toEqual({ error: 'Blocked by wildcard', guardId: 'g1' })
   })
 
+  it('does not run a guard gated by a nulled ACL feature', async () => {
+    applyAclFeatureOverrides({ 'premium.locks': null })
+    const guard = makeGuard({
+      id: 'g1',
+      features: ['premium.locks'],
+      validate: jest.fn().mockResolvedValue({ ok: false }),
+    })
+
+    const result = await runMutationGuards(
+      [guard],
+      baseInput,
+      { userFeatures: ['*', 'premium.locks'] },
+    )
+
+    expect(result.ok).toBe(true)
+    expect(guard.validate).not.toHaveBeenCalled()
+  })
+
   it('uses custom error body when provided', async () => {
     const guard = makeGuard({
       id: 'g1',

package/src/lib/crud/enricher-runner.ts

@@ -15,6 +15,7 @@ import type {
 import { getEnrichersForEntity } from './enricher-registry'
 import { logEnricherTiming } from '../umes/enricher-timing'
 import { createLogger } from '../logger'
+import { authorizeFeatures } from '../../security/featurePolicy'
 
 const logger = createLogger('shared').child({ component: 'umes' })
 
@@ -35,17 +36,7 @@ function hasRequiredFeatures(
 ): boolean {
   if (!enricher.features || enricher.features.length === 0) return true
   if (!userFeatures) return false
-  const hasFeature = (required: string): boolean => {
-    for (const granted of userFeatures) {
-      if (granted === '*' || granted === required) return true
-      if (granted.endsWith('.*')) {
-        const prefix = granted.slice(0, -1)
-        if (required.startsWith(prefix)) return true
-      }
-    }
-    return false
-  }
-  return enricher.features.every((feature) => hasFeature(feature))
+  return authorizeFeatures(enricher.features, { grantedFeatures: userFeatures })
 }
 
 function filterByACLAndTenant(

package/src/lib/crud/factory.ts

@@ -2333,6 +2333,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
               organizationId: targetOrgId,
               tenantId: writeTenantId,
               values,
+              notify: false,
             })
           }
         }
@@ -2670,6 +2671,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
               organizationId: targetOrgId,
               tenantId: writeTenantId,
               values,
+              notify: false,
             })
           }
         }

package/src/lib/crud/interceptor-runner.ts

@@ -6,7 +6,7 @@ import type {
   InterceptorBeforeResult,
 } from './api-interceptor'
 import { getApiInterceptorsForRoute } from './interceptor-registry'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { logInterceptorActivity } from '../umes/interceptor-activity'
 
 const DEFAULT_TIMEOUT_MS = 5000
@@ -39,7 +39,7 @@ function sanitizeObject(input?: Record<string, unknown>): Record<string, unknown
 }
 
 function hasRequiredFeatures(features: string[] | undefined, userFeatures: string[] | undefined): boolean {
-  return hasAllFeatures(userFeatures, features)
+  return authorizeFeatures(features ?? [], { grantedFeatures: userFeatures ?? [] })
 }
 
 function timeoutPromise(ms: number, interceptorId: string): Promise<never> {

package/src/lib/crud/mutation-guard-registry.ts

@@ -1,5 +1,5 @@
 import type { AwilixContainer } from 'awilix'
-import { hasAllFeatures } from '../../security/features'
+import { authorizeFeatures } from '../../security/featurePolicy'
 import { resolveCrudMutationGuardService } from './mutation-guard-service'
 
 // ---------------------------------------------------------------------------
@@ -101,7 +101,7 @@ export async function runMutationGuards(
   const matching = guards
     .filter((g) => matchesEntity(g.targetEntity, input.resourceKind))
     .filter((g) => g.operations.includes(input.operation))
-    .filter((g) => hasAllFeatures(context.userFeatures, g.features))
+    .filter((g) => authorizeFeatures(g.features ?? [], { grantedFeatures: context.userFeatures }))
     .sort((a, b) => (a.priority ?? 50) - (b.priority ?? 50))
 
   let payload = input.mutationPayload

package/src/lib/crud/types.ts

@@ -1,5 +1,8 @@
 export type CrudEventAction = 'created' | 'updated' | 'deleted'
 
+/** Internal payload marker: the data engine owns this CRUD event's query-index decision. */
+export const CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY = '__omQueryIndexManaged' as const
+
 export type CrudEntityIdentifiers = {
   id: string
   organizationId: string | null

package/src/lib/data/__tests__/consistency.test.ts

@@ -0,0 +1,38 @@
+import {
+  __resetAlwaysConsistentCacheForTests,
+  isReadProjectionAlwaysConsistent,
+  parseAlwaysConsistentEnv,
+} from '../consistency'
+
+describe('read projection consistency flag', () => {
+  const originalEnv = process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT
+
+  afterEach(() => {
+    if (originalEnv === undefined) {
+      delete process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT
+    } else {
+      process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = originalEnv
+    }
+    __resetAlwaysConsistentCacheForTests()
+  })
+
+  it.each([undefined, null, '', ' ', 'off', 'false', '0', 'no', 'disabled', 'none', 'unexpected'])(
+    'parses %p as OFF',
+    (raw) => {
+      expect(parseAlwaysConsistentEnv(raw)).toBe(false)
+    },
+  )
+
+  it.each(['on', 'true', '1', 'yes', 'enabled'])('parses %p as ON', (raw) => {
+    expect(parseAlwaysConsistentEnv(raw)).toBe(true)
+  })
+
+  it('memoizes the env value until reset for tests', () => {
+    process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = 'on'
+    expect(isReadProjectionAlwaysConsistent()).toBe(true)
+    process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT = 'off'
+    expect(isReadProjectionAlwaysConsistent()).toBe(true)
+    __resetAlwaysConsistentCacheForTests()
+    expect(isReadProjectionAlwaysConsistent()).toBe(false)
+  })
+})

package/src/lib/data/__tests__/engine.bulk-suppress.test.ts

@@ -1,7 +1,11 @@
 import type { AwilixContainer } from 'awilix'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { DefaultDataEngine } from '../engine'
-import type { CrudEventsConfig, CrudIndexerConfig } from '../../crud/types'
+import {
+  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+  type CrudEventsConfig,
+  type CrudIndexerConfig,
+} from '../../crud/types'
 
 // The bulk-import deferral (`suppress`) must gate the two per-record side effects `emitOrmEntityEvent`
 // fans out — the `<module>.<entity>.<action>` domain event and the inline `query_index.upsert_one`
@@ -25,6 +29,15 @@ function buildEngine() {
   return { engine, emitEvent, emittedNames }
 }
 
+function expectManagedDomainPayload(emitEvent: jest.Mock, eventName: string): void {
+  const call = emitEvent.mock.calls.find(([name]) => name === eventName)
+  expect(call).toBeDefined()
+  const payload = call?.[1] as Record<string, unknown>
+  expect(payload[CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY]).toBe(true)
+  expect(Object.keys(payload)).not.toContain(CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY)
+  expect(JSON.stringify(payload)).not.toContain(CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY)
+}
+
 describe('DefaultDataEngine bulk-import suppression', () => {
   // The test events are intentionally not registered in the event registry; silence the
   // one-time "undeclared event" warning so it doesn't clutter the suite output.
@@ -33,9 +46,10 @@ describe('DefaultDataEngine bulk-import suppression', () => {
   afterAll(() => { warnSpy.mockRestore() })
 
   it('emits both the domain event and the reindex when unsuppressed', async () => {
-    const { engine, emittedNames } = buildEngine()
+    const { engine, emitEvent, emittedNames } = buildEngine()
     await engine.emitOrmEntityEvent({ action: 'created', entity: {}, events: EVENTS, indexer: INDEXER, identifiers: IDENTIFIERS })
     expect(emittedNames()).toEqual(expect.arrayContaining(['sales.order.created', 'query_index.upsert_one']))
+    expectManagedDomainPayload(emitEvent, 'sales.order.created')
   })
 
   it('skips the domain event but keeps the reindex with skipEvents', async () => {
@@ -47,11 +61,12 @@ describe('DefaultDataEngine bulk-import suppression', () => {
   })
 
   it('skips the reindex but keeps the domain event with skipReindex', async () => {
-    const { engine, emittedNames } = buildEngine()
+    const { engine, emitEvent, emittedNames } = buildEngine()
     await engine.emitOrmEntityEvent({ action: 'created', entity: {}, events: EVENTS, indexer: INDEXER, identifiers: IDENTIFIERS, suppress: { skipReindex: true } })
     const names = emittedNames()
     expect(names).toContain('sales.order.created')
     expect(names).not.toContain('query_index.upsert_one')
+    expectManagedDomainPayload(emitEvent, 'sales.order.created')
   })
 
   it('emits nothing when both are suppressed', async () => {

package/src/lib/data/consistency.ts

@@ -0,0 +1,17 @@
+import { parseBooleanWithDefault } from '../boolean'
+
+let alwaysConsistentFlag: boolean | null = null
+
+export function parseAlwaysConsistentEnv(raw: string | undefined | null): boolean {
+  return parseBooleanWithDefault(raw, false)
+}
+
+export function isReadProjectionAlwaysConsistent(): boolean {
+  if (alwaysConsistentFlag !== null) return alwaysConsistentFlag
+  alwaysConsistentFlag = parseAlwaysConsistentEnv(process.env.OM_CACHE_SAFETY_ALWAYS_CONSISTENT)
+  return alwaysConsistentFlag
+}
+
+export function __resetAlwaysConsistentCacheForTests(): void {
+  alwaysConsistentFlag = null
+}

package/src/lib/data/engine.ts

@@ -6,11 +6,12 @@ import { setRecordCustomFields } from '@open-mercato/core/modules/entities/lib/h
 import { validateCustomFieldValuesServer } from '@open-mercato/core/modules/entities/lib/validation'
 import { sanitizeCustomFieldHtmlRichTextValuesServer } from '@open-mercato/core/modules/entities/lib/htmlRichTextSanitizer'
 import type { EventBus } from '@open-mercato/events/types'
-import type {
-  CrudEventAction,
-  CrudEventsConfig,
-  CrudIndexerConfig,
-  CrudEntityIdentifiers,
+import {
+  CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+  type CrudEventAction,
+  type CrudEventsConfig,
+  type CrudIndexerConfig,
+  type CrudEntityIdentifiers,
 } from '../crud/types'
 import type { BulkImportSuppression } from '../commands/types'
 import { CrudHttpError } from '../crud/errors'
@@ -18,6 +19,7 @@ import { resolveRegisteredEntityTableName } from '../query/engine'
 import { getEntityIds } from '../encryption/entityIds'
 import { normalizeCustomFieldValues } from '../custom-fields/normalize'
 import { parseBooleanToken } from '../boolean'
+import { isReadProjectionAlwaysConsistent } from './consistency'
 import { isEventDeclared } from '../../modules/events'
 import { createLogger } from '../logger'
 
@@ -598,7 +600,7 @@ export class DefaultDataEngine implements DataEngine {
     if (events && !suppress?.skipEvents) {
       const eventName = `${events.module}.${events.entity}.${action}`
       warnIfUndeclaredEvent(eventName, 'emitOrmEntityEvent')
-      const payload = events.buildPayload
+      const builtPayload = events.buildPayload
         ? events.buildPayload(ctx)
         : {
             id: ctx.identifiers.id,
@@ -606,6 +608,20 @@ export class DefaultDataEngine implements DataEngine {
             tenantId: ctx.identifiers.tenantId,
             ...(ctx.syncOrigin ? { syncOrigin: ctx.syncOrigin } : {}),
           }
+      // A configured indexer means this data-engine call owns the query-index
+      // decision, including an explicit skipReindex suppression. Mark object
+      // payloads so the legacy domain-event bridge does not enqueue the same
+      // record a second time. Keep the marker non-enumerable so client broadcasts
+      // and persisted domain payloads retain their existing public shape.
+      // Primitive custom payloads cannot be bridged in any case because they do
+      // not expose the record id.
+      const payload = indexer && builtPayload && typeof builtPayload === 'object' && !Array.isArray(builtPayload)
+        ? Object.defineProperty(
+            { ...(builtPayload as Record<string, unknown>) },
+            CRUD_QUERY_INDEX_MANAGED_PAYLOAD_KEY,
+            { value: true, enumerable: false },
+          )
+        : builtPayload
       try {
         await bus.emitEvent(eventName, payload, {
           persistent: !!events.persistent,
@@ -618,6 +634,7 @@ export class DefaultDataEngine implements DataEngine {
     }
 
     if (indexer && !suppress?.skipReindex) {
+      const alwaysConsistent = isReadProjectionAlwaysConsistent()
       const resolveCoverageBaseDelta = (): number | undefined => {
         if (action === 'created') return 1
         if (action === 'deleted') return -1
@@ -643,9 +660,14 @@ export class DefaultDataEngine implements DataEngine {
         // returns. The subscriber removes the projection row + tokens synchronously and
         // defers the coverage recompute + fulltext delete, so this stays bounded.
         // Errors are logged, not thrown — index drift never fails the originating write.
-        await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
-          logger.error('query_index.delete_one emit failed', { err })
-        })
+        // Always-consistent mode rethrows so drift is loud and retryable.
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.delete_one', enrichedPayload, { rethrowHandlerErrors: true })
+        } else {
+          await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
+            logger.error('query_index.delete_one emit failed', { err })
+          })
+        }
       } else {
         const payload = indexer.buildUpsertPayload
           ? indexer.buildUpsertPayload(ctx)
@@ -663,18 +685,27 @@ export class DefaultDataEngine implements DataEngine {
         // (see delete_one above). The subscriber updates `entity_indexes` synchronously
         // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +
         // tokenize + DELETE + chunked INSERT) so write latency stays bounded.
-        await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
-          logger.error('query_index.upsert_one emit failed', { err })
-        })
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.upsert_one', enrichedPayload, { rethrowHandlerErrors: true })
+        } else {
+          await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
+            logger.error('query_index.upsert_one emit failed', { err })
+          })
+        }
       }
 
-      if (shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
-        void bus.emitEvent('query_index.coverage.refresh', {
+      if (alwaysConsistent || shouldTriggerCoverageRefresh(indexer.entityType, ctx.identifiers.tenantId ?? null)) {
+        const coveragePayload = {
           entityType: indexer.entityType,
           tenantId: ctx.identifiers.tenantId ?? null,
           organizationId: null,
           delayMs: 0,
-        }).catch(() => undefined)
+        }
+        if (alwaysConsistent) {
+          await bus.emitEvent('query_index.coverage.refresh', coveragePayload, { rethrowHandlerErrors: true })
+        } else {
+          void bus.emitEvent('query_index.coverage.refresh', coveragePayload).catch(() => undefined)
+        }
       }
     }
   }
@@ -739,7 +770,10 @@ export class DefaultDataEngine implements DataEngine {
           indexer: entry.indexer as CrudIndexerConfig<unknown>,
           suppress,
         })
-      } catch {
+      } catch (error) {
+        if (isReadProjectionAlwaysConsistent()) {
+          throw error
+        }
         // best-effort; continue with remaining side effects
       }
     }

package/src/modules/customer-auth.ts

@@ -20,6 +20,7 @@ export interface CustomerAuthContext {
   customerEntityId?: string | null
   personEntityId?: string | null
   resolvedFeatures: string[]
+  isPortalAdmin?: boolean
 }
 
 export type CustomerUser = {

package/src/modules/navigation/backendChrome.ts

@@ -44,6 +44,7 @@ export type BackendChromeBrand = {
   logo?: {
     src: string
     alt?: string
+    preserveAspectRatio?: boolean
   } | null
 }
 

package/src/security/__tests__/featurePolicy.test.ts

@@ -0,0 +1,166 @@
+import type { Module } from '../../modules/registry'
+import { getModules } from '../../lib/modules/registry'
+import {
+  applyAclFeatureOverrides,
+  resetModuleContractOverridesForTests,
+} from '../../modules/overrides'
+import {
+  authorizeFeatures,
+  getRemovedAclFeatureIds,
+  isAclFeatureRemoved,
+  resolveEffectiveFeatures,
+} from '../featurePolicy'
+
+jest.mock('../../lib/modules/registry', () => ({
+  getModules: jest.fn(),
+}))
+
+const mockGetModules = jest.mocked(getModules)
+
+const modules: Module[] = [
+  {
+    id: 'auth',
+    features: [
+      { id: 'auth.users.view', title: 'View users', module: 'auth' },
+      { id: 'auth.users.manage', title: 'Manage users', module: 'auth' },
+    ],
+  },
+  {
+    id: 'dashboards',
+    features: [
+      { id: 'analytics.view', title: 'View analytics', module: 'dashboards' },
+    ],
+  },
+  {
+    id: 'customer_accounts',
+    setup: {
+      defaultCustomerRoleFeatures: {
+        portal_admin: ['portal.*'],
+        buyer: ['portal.orders.view', 'portal.account.manage'],
+      },
+    },
+    frontendRoutes: [
+      {
+        Component: () => null,
+        requireCustomerFeatures: ['portal.quotes.view'],
+      },
+    ],
+  },
+]
+
+describe('featurePolicy', () => {
+  beforeEach(() => {
+    mockGetModules.mockReturnValue(modules)
+    resetModuleContractOverridesForTests()
+  })
+
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+    jest.resetAllMocks()
+  })
+
+  it('reports exact removals and lets a later replacement restore the feature', () => {
+    applyAclFeatureOverrides({
+      'auth.users.manage': null,
+      'legacy.feature': null,
+    })
+
+    expect(getRemovedAclFeatureIds()).toEqual(['auth.users.manage', 'legacy.feature'])
+    expect(isAclFeatureRemoved('auth.users.manage')).toBe(true)
+
+    applyAclFeatureOverrides({
+      'auth.users.manage': {
+        id: 'auth.users.manage',
+        title: 'Manage users',
+        module: 'auth',
+      },
+    })
+
+    expect(isAclFeatureRemoved('auth.users.manage')).toBe(false)
+    expect(getRemovedAclFeatureIds()).toEqual(['legacy.feature'])
+  })
+
+  it.each([
+    { grantedFeatures: ['auth.users.manage'], unrestricted: false, siblingAllowed: false },
+    { grantedFeatures: ['auth.*'], unrestricted: false, siblingAllowed: true },
+    { grantedFeatures: ['*'], unrestricted: false, siblingAllowed: true },
+    { grantedFeatures: [], unrestricted: true, siblingAllowed: true },
+  ])('denies a removed requirement before grants or unrestricted access', ({
+    siblingAllowed,
+    ...subject
+  }) => {
+    applyAclFeatureOverrides({ 'auth.users.manage': null })
+
+    expect(authorizeFeatures(['auth.users.manage'], subject)).toBe(false)
+    expect(authorizeFeatures(['auth.users.view'], subject)).toBe(siblingAllowed)
+  })
+
+  it('enforces invalid scope before unrestricted access', () => {
+    expect(authorizeFeatures(['auth.users.view'], {
+      grantedFeatures: ['*'],
+      unrestricted: true,
+      scopeAllowed: false,
+    })).toBe(false)
+  })
+
+  it('denies requirements owned by disabled modules', () => {
+    expect(authorizeFeatures(['search.global'], {
+      grantedFeatures: ['*'],
+      unrestricted: true,
+    })).toBe(false)
+  })
+
+  it('expands wildcards into a deterministic concrete set including portal sources', () => {
+    expect(resolveEffectiveFeatures(['*'])).toEqual([
+      'auth.users.view',
+      'auth.users.manage',
+      'analytics.view',
+      'portal.orders.view',
+      'portal.account.manage',
+      'portal.quotes.view',
+    ])
+    expect(resolveEffectiveFeatures(['portal.*'])).toEqual([
+      'portal.orders.view',
+      'portal.account.manage',
+      'portal.quotes.view',
+    ])
+  })
+
+  it('removes nulled features while preserving siblings and explicit custom grants', () => {
+    applyAclFeatureOverrides({
+      'auth.users.manage': null,
+      'auth.custom.audit': null,
+    })
+
+    expect(resolveEffectiveFeatures([
+      'auth.*',
+      'auth.custom.export',
+      'auth.custom.audit',
+    ])).toEqual([
+      'auth.users.view',
+      'auth.custom.export',
+    ])
+  })
+
+  it('uses declared ownership for off-convention features', () => {
+    expect(resolveEffectiveFeatures(['analytics.*'])).toEqual(['analytics.view'])
+    expect(authorizeFeatures(['analytics.view'], {
+      grantedFeatures: ['analytics.*'],
+    })).toBe(true)
+  })
+
+  it('fails closed for wildcards when the module registry is unavailable', () => {
+    mockGetModules.mockImplementation(() => {
+      throw new Error('registry unavailable')
+    })
+    applyAclFeatureOverrides({ 'legacy.removed': null })
+
+    expect(resolveEffectiveFeatures([
+      '*',
+      'legacy.*',
+      'legacy.explicit',
+      'legacy.removed',
+      'legacy.explicit',
+    ])).toEqual(['legacy.explicit'])
+  })
+})

package/src/security/enabledModulesRegistry.ts

@@ -31,6 +31,7 @@ type FeatureRegistry = {
   enabledModuleSet: Set<string>
   featureToModule: Map<string, string>
   prefixToModule: Map<string, string>
+  concreteFeatureIds: string[]
 }
 
 let cachedRegistry: FeatureRegistry | null = null
@@ -41,23 +42,63 @@ function buildRegistry(modules: readonly Module[]): FeatureRegistry {
   const enabledModuleSet = new Set(enabledModuleIds)
   const featureToModule = new Map<string, string>()
   const prefixToModule = new Map<string, string>()
+  const concreteFeatureIds: string[] = []
+  const concreteFeatureSet = new Set<string>()
+
+  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {
+    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId)
+      concreteFeatureIds.push(featureId)
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule)
+    }
+    const dot = featureId.indexOf('.')
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot)
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)
+    }
+  }
+
   for (const mod of modules) {
     const features = mod.features
-    if (!Array.isArray(features)) continue
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== 'string' || !feature.id) continue
-      const declared = typeof feature.module === 'string' && feature.module.length > 0
-        ? feature.module
-        : mod.id
-      featureToModule.set(feature.id, declared)
-      const dot = feature.id.indexOf('.')
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot)
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== 'string' || !feature.id) continue
+        const declared = typeof feature.module === 'string' && feature.module.length > 0
+          ? feature.module
+          : mod.id
+        addConcreteFeature(feature.id, declared, true)
+      }
+    }
+
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
       }
     }
+
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)
+        }
+      }
+    }
+  }
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds,
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }
 }
 
 function getRegistry(): FeatureRegistry | null {
@@ -93,6 +134,17 @@ export function getEnabledModuleIds(): string[] {
   return registry ? [...registry.enabledModuleIds] : []
 }
 
+/** @internal Infrastructure input for concrete feature-policy projection. */
+export function getConcreteFeatureIds(): string[] {
+  const registry = getRegistry()
+  return registry ? [...registry.concreteFeatureIds] : []
+}
+
+/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */
+export function hasEnabledModulesRegistry(): boolean {
+  return getRegistry() !== null
+}
+
 /**
  * Filters a raw granted-features list down to the grants whose owning
  * module is currently enabled. Expands `*` (superadmin) into one wildcard