@open-mercato/shared 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/dist/modules/registry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/modules/registry.ts"],
-  "sourcesContent": ["import type { ReactNode } from 'react'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi/types'\nimport type { SyncCrudEventResult } from '../lib/crud/sync-event-types'\nimport type { DashboardWidgetModule } from './dashboard/widgets'\nimport type { InjectionAnyWidgetModule, ModuleInjectionTable } from './widgets/injection'\nimport type { IntegrationBundle, IntegrationDefinition } from './integrations/types'\nimport { createLogger } from '../lib/logger'\nimport {\n  applyApiOverridesToManifests,\n  applyModuleOverridesToModules,\n  applyPageOverridesToManifests,\n  composeApiRouteOverrides,\n  composePageRouteOverrides,\n} from './overrides'\n\nconst logger = createLogger('shared').child({ component: 'cli-registry' })\n\n// Context passed to dynamic metadata guards\nexport type RouteVisibilityContext = { path?: string; auth?: any }\n\n/**\n * Portal sidebar navigation hint. When declared on a portal page's metadata,\n * the page is auto-listed in the portal sidebar (subject to RBAC) by the\n * `/api/customer_accounts/portal/nav` endpoint.\n *\n * Absence of `nav` means the page is routable but not auto-listed (useful for\n * detail pages, create forms, etc.).\n */\nexport type PortalNavMetadata = {\n  label: string\n  labelKey?: string\n  group?: 'main' | 'account'\n  order?: number\n  icon?: string\n}\n\n// Metadata you can export from page.meta.ts or directly from a server page\nexport type PageMetadata = {\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: readonly string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: readonly string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: readonly string[]\n  // Portal: optional sidebar presentation hint (auto-listed by portal nav endpoint)\n  nav?: PortalNavMetadata\n  // Titles and grouping (aliases supported)\n  title?: string\n  titleKey?: string\n  pageTitle?: string\n  pageTitleKey?: string\n  group?: string\n  groupKey?: string\n  pageGroup?: string\n  pageGroupKey?: string\n  // Ordering and visuals\n  order?: number\n  pageOrder?: number\n  priority?: number\n  pagePriority?: number\n  icon?: ReactNode\n  navHidden?: boolean\n  // Dynamic flags\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  // Optional static breadcrumb trail for header\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  // Navigation context for tiered navigation:\n  // - 'main' (default): Main sidebar business operations\n  // - 'admin': Collapsible \"Settings & Admin\" section at bottom of sidebar\n  // - 'settings': Hidden from sidebar, only accessible via Settings hub page\n  // - 'profile': Profile dropdown items\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n\nexport type ApiHandler = (req: Request, ctx?: any) => Promise<Response> | Response\n\nexport type ModuleSubscriberHandler = (\n  payload: any,\n  ctx: any\n) => Promise<void | SyncCrudEventResult> | void | SyncCrudEventResult\n\nexport type ModuleWorkerHandler = (job: unknown, ctx: unknown) => Promise<void> | void\n\nexport type ModuleRoute = {\n  pattern?: string\n  path?: string\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: string[]\n  // Portal: optional sidebar presentation hint (auto-listed by portal nav endpoint)\n  nav?: PortalNavMetadata\n  title?: string\n  titleKey?: string\n  group?: string\n  groupKey?: string\n  icon?: ReactNode\n  order?: number\n  priority?: number\n  navHidden?: boolean\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n  Component: (props: any) => ReactNode | Promise<ReactNode>\n}\n\nexport type ModuleRouteMetadata = Omit<ModuleRoute, 'Component'>\n\nexport type ModuleApiLegacy = {\n  method: HttpMethod\n  path: string\n  handler: ApiHandler\n  metadata?: Record<string, unknown>\n  docs?: OpenApiMethodDoc\n}\n\nexport type ModuleApiRouteFile = {\n  path: string\n  handlers: Partial<Record<HttpMethod, ApiHandler>>\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements for the entire route file\n  // Note: per-method feature requirements should be expressed inside metadata\n  requireFeatures?: string[]\n  docs?: OpenApiRouteDoc\n  metadata?: Partial<Record<HttpMethod, unknown>>\n}\n\nexport type ModuleApi = ModuleApiLegacy | ModuleApiRouteFile\n\nexport type RouteMatchParams = Record<string, string | string[]>\n\nexport type FrontendRouteManifestEntry = Omit<ModuleRoute, 'Component'> & {\n  moduleId: string\n  load: () => Promise<ModuleRoute['Component']>\n}\n\nexport type BackendRouteManifestEntry = Omit<ModuleRoute, 'Component'> & {\n  moduleId: string\n  load: () => Promise<ModuleRoute['Component']>\n}\n\nexport type ApiRouteManifestEntry = {\n  moduleId: string\n  kind: 'route-file' | 'legacy'\n  path: string\n  methods: HttpMethod[]\n  method?: HttpMethod\n  load: () => Promise<Record<string, unknown>>\n}\n\nexport type ModuleCli = {\n  command: string\n  run: (argv: string[]) => Promise<void> | void\n}\n\nexport type ModuleSubscriber = {\n  id: string\n  moduleId?: string\n  event: string\n  persistent?: boolean\n  sync?: boolean\n  priority?: number\n  handler: ModuleSubscriberHandler\n}\n\nexport type ModuleWorker = {\n  id: string\n  moduleId?: string\n  queue: string\n  concurrency: number\n  handler: ModuleWorkerHandler\n}\n\nexport type ModuleInfo = {\n  name?: string\n  title?: string\n  version?: string\n  description?: string\n  author?: string\n  license?: string\n  homepage?: string\n  copyright?: string\n  // Optional hard dependencies: module ids that must be enabled\n  requires?: string[]\n  // Whether this module can be ejected into the app's src/modules/ for customization\n  ejectable?: boolean\n}\n\nexport type ModuleDashboardWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<DashboardWidgetModule<any>>\n}\n\nexport type ModuleInjectionWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  widgetId?: string\n  loader: () => Promise<InjectionAnyWidgetModule<any, any>>\n}\n\nexport type Module = {\n  id: string\n  info?: ModuleInfo\n  backendRoutes?: ModuleRoute[]\n  frontendRoutes?: ModuleRoute[]\n  apis?: ModuleApi[]\n  cli?: ModuleCli[]\n  translations?: Record<string, Record<string, string>>\n  // Optional: per-module feature declarations discovered from acl.ts (module root)\n  features?: Array<{ id: string; title: string; module: string }>\n  // Auto-discovered event subscribers\n  subscribers?: ModuleSubscriber[]\n  // Auto-discovered queue workers\n  workers?: ModuleWorker[]\n  // Optional: per-module declared entity extensions and custom fields (static)\n  // Extensions discovered from data/extensions.ts; Custom fields discovered from ce.ts (entities[].fields)\n  entityExtensions?: import('./entities').EntityExtension[]\n  customFieldSets?: import('./entities').CustomFieldSet[]\n  // Optional: per-module declared custom entities (virtual/logical entities)\n  // Discovered from ce.ts (module root). Each entry represents an entityId with optional label/description.\n  customEntities?: Array<{ id: string; label?: string; description?: string }>\n  dashboardWidgets?: ModuleDashboardWidgetEntry[]\n  injectionWidgets?: ModuleInjectionWidgetEntry[]\n  injectionTable?: ModuleInjectionTable\n  // Optional: per-module vector search configuration (discovered from vector.ts)\n  vector?: import('./vector').VectorModuleConfig\n  // Optional: module-specific tenant setup configuration (from setup.ts)\n  setup?: import('./setup').ModuleSetupConfig\n  // Optional: default encryption maps owned by the module (from encryption.ts)\n  defaultEncryptionMaps?: import('./encryption').ModuleEncryptionMap[]\n  // Optional: integration marketplace declarations discovered from integration.ts\n  integrations?: IntegrationDefinition[]\n  bundles?: IntegrationBundle[]\n}\n\nfunction normPath(s: string) {\n  return (s.startsWith('/') ? s : '/' + s).replace(/\\/+$/, '') || '/'\n}\n\n// 0 = literal (most specific), 1 = dynamic [param], 2 = catch-all [...param] or [[...param]]\nfunction segmentSpecificity(seg: string): 0 | 1 | 2 {\n  if (seg.startsWith('[[...') || seg.startsWith('[...')) return 2\n  if (seg.startsWith('[')) return 1\n  return 0\n}\n\nfunction compareRouteSpecificity(aPattern: string, bPattern: string): number {\n  const aSegs = aPattern.split('/')\n  const bSegs = bPattern.split('/')\n  const len = Math.max(aSegs.length, bSegs.length)\n  for (let i = 0; i < len; i++) {\n    const av = i < aSegs.length ? segmentSpecificity(aSegs[i]) : -1\n    const bv = i < bSegs.length ? segmentSpecificity(bSegs[i]) : -1\n    if (av !== bv) return av - bv\n  }\n  return 0\n}\n\nexport function sortRoutesBySpecificity<T extends { pattern?: string; path?: string }>(routes: T[]): T[] {\n  return [...routes].sort((a, b) =>\n    compareRouteSpecificity(a.pattern ?? a.path ?? '/', b.pattern ?? b.path ?? '/'),\n  )\n}\n\n// Memoized per-array sorted view, so direct callers (e.g., the Next.js catch-all\n// routes that import generated `frontendRoutes`/`backendRoutes`/`apiRoutes`\n// arrays) match against a specificity-sorted view even if they never call\n// `register*RouteManifests`. Keyed by array reference; generated arrays are\n// module-level constants so this caches once per process.\nconst sortedRoutesCache = new WeakMap<object, readonly unknown[]>()\n\nfunction ensureSortedRoutes<T extends { pattern?: string; path?: string }>(routes: readonly T[]): readonly T[] {\n  const cached = sortedRoutesCache.get(routes) as readonly T[] | undefined\n  if (cached) return cached\n  const sorted = sortRoutesBySpecificity([...routes])\n  sortedRoutesCache.set(routes, sorted)\n  return sorted\n}\n\nexport function matchRoutePattern(pattern: string, pathname: string): RouteMatchParams | undefined {\n  const p = normPath(pattern)\n  const u = normPath(pathname)\n  const pSegs = p.split('/').slice(1)\n  const uSegs = u.split('/').slice(1)\n  const params: Record<string, string | string[]> = {}\n  let i = 0\n  for (let j = 0; j < pSegs.length; j++, i++) {\n    const seg = pSegs[j]\n    const mCatchAll = seg.match(/^\\[\\.\\.\\.(.+)\\]$/)\n    const mOptCatch = seg.match(/^\\[\\[\\.\\.\\.(.+)\\]\\]$/)\n    const mDyn = seg.match(/^\\[(.+)\\]$/)\n    if (mCatchAll) {\n      const key = mCatchAll[1]\n      if (i >= uSegs.length) return undefined\n      params[key] = uSegs.slice(i)\n      return params\n    } else if (mOptCatch) {\n      const key = mOptCatch[1]\n      params[key] = i < uSegs.length ? uSegs.slice(i) : []\n      return params\n    } else if (mDyn) {\n      if (i >= uSegs.length) return undefined\n      params[mDyn[1]] = uSegs[i]\n    } else {\n      if (i >= uSegs.length || uSegs[i].toLowerCase() !== seg.toLowerCase()) return undefined\n    }\n  }\n  if (i !== uSegs.length) return undefined\n  return params\n}\n\nfunction getPattern(r: ModuleRoute) {\n  return r.pattern ?? r.path ?? '/'\n}\n\nexport function findFrontendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.frontendRoutes ?? []\n    for (const r of routes) {\n      const params = matchRoutePattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findBackendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.backendRoutes ?? []\n    for (const r of routes) {\n      const params = matchRoutePattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findApi(modules: Module[], method: HttpMethod, pathname: string): { handler: ApiHandler; params: Record<string, string | string[]>; requireAuth?: boolean; requireRoles?: string[]; metadata?: any } | undefined {\n  for (const m of modules) {\n    const apis = m.apis ?? []\n    for (const a of apis) {\n      if ('handlers' in a) {\n        const params = matchRoutePattern(a.path, pathname)\n        const handler = (a.handlers as any)[method]\n        if (params && handler) return { handler, params, requireAuth: a.requireAuth, requireRoles: (a as any).requireRoles, metadata: (a as any).metadata }\n      } else {\n        const al = a as ModuleApiLegacy\n        if (al.method !== method) continue\n        const params = matchRoutePattern(al.path, pathname)\n        if (params) {\n          return { handler: al.handler, params, metadata: al.metadata }\n        }\n      }\n    }\n  }\n}\n\nexport function findRouteManifestMatch<T extends { pattern?: string; path?: string }>(\n  routes: T[],\n  pathname: string\n): { route: T; params: RouteMatchParams } | undefined {\n  for (const route of ensureSortedRoutes(routes)) {\n    const params = matchRoutePattern(route.pattern ?? route.path ?? '/', pathname)\n    if (params) {\n      return { route, params }\n    }\n  }\n}\n\nexport function findApiRouteManifestMatch<T extends { path: string; methods: HttpMethod[] }>(\n  routes: T[],\n  method: HttpMethod,\n  pathname: string\n): { route: T; params: RouteMatchParams } | undefined {\n  for (const route of ensureSortedRoutes(routes)) {\n    if (!route.methods.includes(method)) continue\n    const params = matchRoutePattern(route.path, pathname)\n    if (params) {\n      return { route, params }\n    }\n  }\n}\n\nexport function resolvePageRouteMetadata(pattern: string, metadata: PageMetadata | null | undefined): ModuleRouteMetadata {\n  return {\n    pattern: pattern || '/',\n    requireAuth: metadata?.requireAuth,\n    requireRoles: metadata?.requireRoles ? [...metadata.requireRoles] : undefined,\n    requireFeatures: metadata?.requireFeatures ? [...metadata.requireFeatures] : undefined,\n    requireCustomerAuth: metadata?.requireCustomerAuth,\n    requireCustomerFeatures: metadata?.requireCustomerFeatures ? [...metadata.requireCustomerFeatures] : undefined,\n    nav: metadata?.nav,\n    title: metadata?.pageTitle ?? metadata?.title,\n    titleKey: metadata?.pageTitleKey ?? metadata?.titleKey,\n    group: metadata?.pageGroup ?? metadata?.group,\n    groupKey: metadata?.pageGroupKey ?? metadata?.groupKey,\n    icon: metadata?.icon,\n    order: metadata?.pageOrder ?? metadata?.order,\n    priority: metadata?.pagePriority ?? metadata?.priority,\n    navHidden: metadata?.navHidden,\n    visible: metadata?.visible,\n    enabled: metadata?.enabled,\n    breadcrumb: metadata?.breadcrumb,\n    pageContext: metadata?.pageContext,\n    placement: metadata?.placement,\n  }\n}\n\nlet _backendRouteManifests: BackendRouteManifestEntry[] | null = null\n\nexport function registerBackendRouteManifests(routes: BackendRouteManifestEntry[]) {\n  const pageOverrides = composePageRouteOverrides()\n  const finalRoutes = Object.keys(pageOverrides).length === 0\n    ? routes\n    : applyPageOverridesToManifests(routes, pageOverrides, 'backend')\n  _backendRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getBackendRouteManifests(): BackendRouteManifestEntry[] {\n  return _backendRouteManifests ?? []\n}\n\nlet _frontendRouteManifests: FrontendRouteManifestEntry[] | null = null\n\nexport function registerFrontendRouteManifests(routes: FrontendRouteManifestEntry[]) {\n  const pageOverrides = composePageRouteOverrides()\n  const finalRoutes = Object.keys(pageOverrides).length === 0\n    ? routes\n    : applyPageOverridesToManifests(routes, pageOverrides, 'frontend')\n  _frontendRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getFrontendRouteManifests(): FrontendRouteManifestEntry[] {\n  return _frontendRouteManifests ?? []\n}\n\nlet _apiRouteManifests: ApiRouteManifestEntry[] | null = null\n\nexport function registerApiRouteManifests(routes: ApiRouteManifestEntry[]) {\n  // Apply any `entry.overrides.routes.api` overrides registered through the\n  // unified `modules.ts` dispatcher or programmatic API before storing the\n  // manifest. The composer is cheap and returns an empty object when no\n  // overrides exist, so this is a no-op for apps that do not opt in.\n  const routeOverrides = composeApiRouteOverrides()\n  const finalRoutes = Object.keys(routeOverrides).length === 0\n    ? routes\n    : applyApiOverridesToManifests(routes, routeOverrides)\n  _apiRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getApiRouteManifests(): ApiRouteManifestEntry[] {\n  return _apiRouteManifests ?? []\n}\n\n// CLI modules registry - shared between CLI and module workers\nlet _cliModules: Module[] | null = null\n\nexport function registerCliModules(modules: Module[]) {\n  if (_cliModules !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('CLI modules re-registered (this may occur during HMR)')\n  }\n  _cliModules = applyModuleOverridesToModules(modules)\n}\n\nexport function getCliModules(): Module[] {\n  // Return empty array if not registered - allows generate command to work without bootstrap\n  return _cliModules ?? []\n}\n\nexport function hasCliModules(): boolean {\n  return _cliModules !== null && _cliModules.length > 0\n}\n\nexport function getDefaultEncryptionMaps(modules: Module[]): import('./encryption').ModuleEncryptionMap[] {\n  const byEntityId = new Map<string, { moduleId: string; map: import('./encryption').ModuleEncryptionMap }>()\n\n  for (const mod of modules) {\n    for (const entry of mod.defaultEncryptionMaps ?? []) {\n      const previous = byEntityId.get(entry.entityId)\n      if (previous) {\n        throw new Error(\n          `[registry] Duplicate default encryption map for \"${entry.entityId}\" declared by \"${previous.moduleId}\" and \"${mod.id}\"`\n        )\n      }\n      byEntityId.set(entry.entityId, {\n        moduleId: mod.id,\n        map: {\n          entityId: entry.entityId,\n          fields: entry.fields.map((field) => ({\n            field: field.field,\n            hashField: field.hashField ?? null,\n          })),\n        },\n      })\n    }\n  }\n\n  return Array.from(byEntityId.values(), ({ map }) => map)\n}\n\nfunction ensureLazyHandler<T extends (...args: any[]) => any>(\n  loaded: unknown,\n  kind: 'subscriber' | 'worker',\n  id: string\n): T {\n  const handler = typeof loaded === 'function'\n    ? loaded\n    : loaded && typeof loaded === 'object' && 'default' in loaded\n      ? (loaded as Record<string, unknown>).default\n      : null\n  if (typeof handler !== 'function') {\n    throw new Error(`[registry] Invalid ${kind} module \"${id}\" (missing default export handler)`)\n  }\n  return handler as T\n}\n\nexport function createLazyModuleSubscriber(\n  loadModule: () => Promise<unknown>,\n  id: string\n): ModuleSubscriberHandler {\n  let handlerPromise: Promise<ModuleSubscriberHandler> | null = null\n  return async (payload, ctx) => {\n    handlerPromise ??= loadModule().then((loaded) =>\n      ensureLazyHandler<ModuleSubscriberHandler>(loaded, 'subscriber', id)\n    )\n    const handler = await handlerPromise\n    return handler(payload, ctx)\n  }\n}\n\nexport function createLazyModuleWorker(\n  loadModule: () => Promise<unknown>,\n  id: string\n): ModuleWorkerHandler {\n  let handlerPromise: Promise<ModuleWorkerHandler> | null = null\n  return async (job, ctx) => {\n    handlerPromise ??= loadModule().then((loaded) =>\n      ensureLazyHandler<ModuleWorkerHandler>(loaded, 'worker', id)\n    )\n    const handler = await handlerPromise\n    return handler(job, ctx)\n  }\n}\n"],
-  "mappings": "AAMA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAyPzE,SAAS,SAAS,GAAW;AAC3B,UAAQ,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,GAAG,QAAQ,QAAQ,EAAE,KAAK;AAClE;AAGA,SAAS,mBAAmB,KAAwB;AAClD,MAAI,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,MAAM,EAAG,QAAO;AAC9D,MAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB,UAA0B;AAC3E,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAM,MAAM,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM;AAC/C,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,KAAK,IAAI,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAC7D,UAAM,KAAK,IAAI,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAC7D,QAAI,OAAO,GAAI,QAAO,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,wBAAuE,QAAkB;AACvG,SAAO,CAAC,GAAG,MAAM,EAAE;AAAA,IAAK,CAAC,GAAG,MAC1B,wBAAwB,EAAE,WAAW,EAAE,QAAQ,KAAK,EAAE,WAAW,EAAE,QAAQ,GAAG;AAAA,EAChF;AACF;AAOA,MAAM,oBAAoB,oBAAI,QAAoC;AAElE,SAAS,mBAAkE,QAAoC;AAC7G,QAAM,SAAS,kBAAkB,IAAI,MAAM;AAC3C,MAAI,OAAQ,QAAO;AACnB,QAAM,SAAS,wBAAwB,CAAC,GAAG,MAAM,CAAC;AAClD,oBAAkB,IAAI,QAAQ,MAAM;AACpC,SAAO;AACT;AAEO,SAAS,kBAAkB,SAAiB,UAAgD;AACjG,QAAM,IAAI,SAAS,OAAO;AAC1B,QAAM,IAAI,SAAS,QAAQ;AAC3B,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,SAA4C,CAAC;AACnD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK;AAC1C,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,IAAI,MAAM,kBAAkB;AAC9C,UAAM,YAAY,IAAI,MAAM,sBAAsB;AAClD,UAAM,OAAO,IAAI,MAAM,YAAY;AACnC,QAAI,WAAW;AACb,YAAM,MAAM,UAAU,CAAC;AACvB,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,GAAG,IAAI,MAAM,MAAM,CAAC;AAC3B,aAAO;AAAA,IACT,WAAW,WAAW;AACpB,YAAM,MAAM,UAAU,CAAC;AACvB,aAAO,GAAG,IAAI,IAAI,MAAM,SAAS,MAAM,MAAM,CAAC,IAAI,CAAC;AACnD,aAAO;AAAA,IACT,WAAW,MAAM;AACf,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC3B,OAAO;AACL,UAAI,KAAK,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,IAAI,YAAY,EAAG,QAAO;AAAA,IAChF;AAAA,EACF;AACA,MAAI,MAAM,MAAM,OAAQ,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,WAAW,GAAgB;AAClC,SAAO,EAAE,WAAW,EAAE,QAAQ;AAChC;AAEO,SAAS,kBAAkB,SAAmB,UAAiG;AACpJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,kBAAkB,CAAC;AACpC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,QAAQ;AACxD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,SAAmB,UAAiG;AACnJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,iBAAiB,CAAC;AACnC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,QAAQ;AACxD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,QAAoB,UAAkK;AAC/N,aAAW,KAAK,SAAS;AACvB,UAAM,OAAO,EAAE,QAAQ,CAAC;AACxB,eAAW,KAAK,MAAM;AACpB,UAAI,cAAc,GAAG;AACnB,cAAM,SAAS,kBAAkB,EAAE,MAAM,QAAQ;AACjD,cAAM,UAAW,EAAE,SAAiB,MAAM;AAC1C,YAAI,UAAU,QAAS,QAAO,EAAE,SAAS,QAAQ,aAAa,EAAE,aAAa,cAAe,EAAU,cAAc,UAAW,EAAU,SAAS;AAAA,MACpJ,OAAO;AACL,cAAM,KAAK;AACX,YAAI,GAAG,WAAW,OAAQ;AAC1B,cAAM,SAAS,kBAAkB,GAAG,MAAM,QAAQ;AAClD,YAAI,QAAQ;AACV,iBAAO,EAAE,SAAS,GAAG,SAAS,QAAQ,UAAU,GAAG,SAAS;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,uBACd,QACA,UACoD;AACpD,aAAW,SAAS,mBAAmB,MAAM,GAAG;AAC9C,UAAM,SAAS,kBAAkB,MAAM,WAAW,MAAM,QAAQ,KAAK,QAAQ;AAC7E,QAAI,QAAQ;AACV,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,0BACd,QACA,QACA,UACoD;AACpD,aAAW,SAAS,mBAAmB,MAAM,GAAG;AAC9C,QAAI,CAAC,MAAM,QAAQ,SAAS,MAAM,EAAG;AACrC,UAAM,SAAS,kBAAkB,MAAM,MAAM,QAAQ;AACrD,QAAI,QAAQ;AACV,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,yBAAyB,SAAiB,UAAgE;AACxH,SAAO;AAAA,IACL,SAAS,WAAW;AAAA,IACpB,aAAa,UAAU;AAAA,IACvB,cAAc,UAAU,eAAe,CAAC,GAAG,SAAS,YAAY,IAAI;AAAA,IACpE,iBAAiB,UAAU,kBAAkB,CAAC,GAAG,SAAS,eAAe,IAAI;AAAA,IAC7E,qBAAqB,UAAU;AAAA,IAC/B,yBAAyB,UAAU,0BAA0B,CAAC,GAAG,SAAS,uBAAuB,IAAI;AAAA,IACrG,KAAK,UAAU;AAAA,IACf,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,MAAM,UAAU;AAAA,IAChB,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,WAAW,UAAU;AAAA,IACrB,SAAS,UAAU;AAAA,IACnB,SAAS,UAAU;AAAA,IACnB,YAAY,UAAU;AAAA,IACtB,aAAa,UAAU;AAAA,IACvB,WAAW,UAAU;AAAA,EACvB;AACF;AAEA,IAAI,yBAA6D;AAE1D,SAAS,8BAA8B,QAAqC;AACjF,QAAM,gBAAgB,0BAA0B;AAChD,QAAM,cAAc,OAAO,KAAK,aAAa,EAAE,WAAW,IACtD,SACA,8BAA8B,QAAQ,eAAe,SAAS;AAClE,2BAAyB,wBAAwB,WAAW;AAC9D;AAEO,SAAS,2BAAwD;AACtE,SAAO,0BAA0B,CAAC;AACpC;AAEA,IAAI,0BAA+D;AAE5D,SAAS,+BAA+B,QAAsC;AACnF,QAAM,gBAAgB,0BAA0B;AAChD,QAAM,cAAc,OAAO,KAAK,aAAa,EAAE,WAAW,IACtD,SACA,8BAA8B,QAAQ,eAAe,UAAU;AACnE,4BAA0B,wBAAwB,WAAW;AAC/D;AAEO,SAAS,4BAA0D;AACxE,SAAO,2BAA2B,CAAC;AACrC;AAEA,IAAI,qBAAqD;AAElD,SAAS,0BAA0B,QAAiC;AAKzE,QAAM,iBAAiB,yBAAyB;AAChD,QAAM,cAAc,OAAO,KAAK,cAAc,EAAE,WAAW,IACvD,SACA,6BAA6B,QAAQ,cAAc;AACvD,uBAAqB,wBAAwB,WAAW;AAC1D;AAEO,SAAS,uBAAgD;AAC9D,SAAO,sBAAsB,CAAC;AAChC;AAGA,IAAI,cAA+B;AAE5B,SAAS,mBAAmB,SAAmB;AACpD,MAAI,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClE,WAAO,MAAM,uDAAuD;AAAA,EACtE;AACA,gBAAc,8BAA8B,OAAO;AACrD;AAEO,SAAS,gBAA0B;AAExC,SAAO,eAAe,CAAC;AACzB;AAEO,SAAS,gBAAyB;AACvC,SAAO,gBAAgB,QAAQ,YAAY,SAAS;AACtD;AAEO,SAAS,yBAAyB,SAAiE;AACxG,QAAM,aAAa,oBAAI,IAAmF;AAE1G,aAAW,OAAO,SAAS;AACzB,eAAW,SAAS,IAAI,yBAAyB,CAAC,GAAG;AACnD,YAAM,WAAW,WAAW,IAAI,MAAM,QAAQ;AAC9C,UAAI,UAAU;AACZ,cAAM,IAAI;AAAA,UACR,oDAAoD,MAAM,QAAQ,kBAAkB,SAAS,QAAQ,UAAU,IAAI,EAAE;AAAA,QACvH;AAAA,MACF;AACA,iBAAW,IAAI,MAAM,UAAU;AAAA,QAC7B,UAAU,IAAI;AAAA,QACd,KAAK;AAAA,UACH,UAAU,MAAM;AAAA,UAChB,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,YACnC,OAAO,MAAM;AAAA,YACb,WAAW,MAAM,aAAa;AAAA,UAChC,EAAE;AAAA,QACJ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,WAAW,OAAO,GAAG,CAAC,EAAE,IAAI,MAAM,GAAG;AACzD;AAEA,SAAS,kBACP,QACA,MACA,IACG;AACH,QAAM,UAAU,OAAO,WAAW,aAC9B,SACA,UAAU,OAAO,WAAW,YAAY,aAAa,SAClD,OAAmC,UACpC;AACN,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI,MAAM,sBAAsB,IAAI,YAAY,EAAE,oCAAoC;AAAA,EAC9F;AACA,SAAO;AACT;AAEO,SAAS,2BACd,YACA,IACyB;AACzB,MAAI,iBAA0D;AAC9D,SAAO,OAAO,SAAS,QAAQ;AAC7B,uBAAmB,WAAW,EAAE;AAAA,MAAK,CAAC,WACpC,kBAA2C,QAAQ,cAAc,EAAE;AAAA,IACrE;AACA,UAAM,UAAU,MAAM;AACtB,WAAO,QAAQ,SAAS,GAAG;AAAA,EAC7B;AACF;AAEO,SAAS,uBACd,YACA,IACqB;AACrB,MAAI,iBAAsD;AAC1D,SAAO,OAAO,KAAK,QAAQ;AACzB,uBAAmB,WAAW,EAAE;AAAA,MAAK,CAAC,WACpC,kBAAuC,QAAQ,UAAU,EAAE;AAAA,IAC7D;AACA,UAAM,UAAU,MAAM;AACtB,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;",
+  "sourcesContent": ["import type { ReactNode } from 'react'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi/types'\nimport type { SyncCrudEventResult } from '../lib/crud/sync-event-types'\nimport type { DashboardWidgetModule } from './dashboard/widgets'\nimport type { InjectionAnyWidgetModule, ModuleInjectionTable } from './widgets/injection'\nimport type { IntegrationBundle, IntegrationDefinition } from './integrations/types'\nimport { createLogger } from '../lib/logger'\nimport {\n  applyApiOverridesToManifests,\n  applyModuleOverridesToModules,\n  applyPageOverridesToManifests,\n  composeApiRouteOverrides,\n  composePageRouteOverrides,\n} from './overrides'\n\nconst logger = createLogger('shared').child({ component: 'cli-registry' })\n\n// Context passed to dynamic metadata guards\nexport type RouteVisibilityContext = { path?: string; auth?: any }\n\n/**\n * Portal sidebar navigation hint. When declared on a portal page's metadata,\n * the page is auto-listed in the portal sidebar (subject to RBAC) by the\n * `/api/customer_accounts/portal/nav` endpoint.\n *\n * Absence of `nav` means the page is routable but not auto-listed (useful for\n * detail pages, create forms, etc.).\n */\nexport type PortalNavMetadata = {\n  label: string\n  labelKey?: string\n  group?: 'main' | 'account'\n  order?: number\n  icon?: string\n}\n\n// Metadata you can export from page.meta.ts or directly from a server page\nexport type PageMetadata = {\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: readonly string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: readonly string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: readonly string[]\n  // Portal: optional sidebar presentation hint (auto-listed by portal nav endpoint)\n  nav?: PortalNavMetadata\n  // Titles and grouping (aliases supported)\n  title?: string\n  titleKey?: string\n  pageTitle?: string\n  pageTitleKey?: string\n  group?: string\n  groupKey?: string\n  pageGroup?: string\n  pageGroupKey?: string\n  // Ordering and visuals\n  order?: number\n  pageOrder?: number\n  priority?: number\n  pagePriority?: number\n  icon?: ReactNode\n  navHidden?: boolean\n  // Dynamic flags\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  // Optional static breadcrumb trail for header\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  // Navigation context for tiered navigation:\n  // - 'main' (default): Main sidebar business operations\n  // - 'admin': Collapsible \"Settings & Admin\" section at bottom of sidebar\n  // - 'settings': Hidden from sidebar, only accessible via Settings hub page\n  // - 'profile': Profile dropdown items\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n}\n\nexport type HttpMethod = 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n\nexport type ApiHandler = (req: Request, ctx?: any) => Promise<Response> | Response\n\nexport type ModuleSubscriberHandler = (\n  payload: any,\n  ctx: any\n) => Promise<void | SyncCrudEventResult> | void | SyncCrudEventResult\n\nexport type ModuleWorkerHandler = (job: unknown, ctx: unknown) => Promise<void> | void\n\nexport type ModuleRoute = {\n  pattern?: string\n  path?: string\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements\n  requireFeatures?: string[]\n  // Portal: require customer (portal user) authentication instead of staff auth\n  requireCustomerAuth?: boolean\n  // Portal: require customer-specific features (checked against CustomerRbacService)\n  requireCustomerFeatures?: string[]\n  // Portal: optional sidebar presentation hint (auto-listed by portal nav endpoint)\n  nav?: PortalNavMetadata\n  title?: string\n  titleKey?: string\n  group?: string\n  groupKey?: string\n  icon?: ReactNode\n  order?: number\n  priority?: number\n  navHidden?: boolean\n  visible?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  enabled?: (ctx: RouteVisibilityContext) => boolean | Promise<boolean>\n  breadcrumb?: Array<{ label: string; labelKey?: string; href?: string }>\n  pageContext?: 'main' | 'admin' | 'settings' | 'profile'\n  placement?: {\n    section: string\n    sectionLabel?: string\n    sectionLabelKey?: string\n    order?: number\n  }\n  Component: (props: any) => ReactNode | Promise<ReactNode>\n}\n\nexport type ModuleRouteMetadata = Omit<ModuleRoute, 'Component'>\n\nexport type ModuleApiLegacy = {\n  method: HttpMethod\n  path: string\n  handler: ApiHandler\n  metadata?: Record<string, unknown>\n  docs?: OpenApiMethodDoc\n}\n\nexport type ModuleApiRouteFile = {\n  path: string\n  handlers: Partial<Record<HttpMethod, ApiHandler>>\n  requireAuth?: boolean\n  /** @deprecated Use `requireFeatures` instead \u2014 role names are mutable and can be spoofed */\n  requireRoles?: string[]\n  // Optional fine-grained feature requirements for the entire route file\n  // Note: per-method feature requirements should be expressed inside metadata\n  requireFeatures?: string[]\n  docs?: OpenApiRouteDoc\n  metadata?: Partial<Record<HttpMethod, unknown>>\n}\n\nexport type ModuleApi = ModuleApiLegacy | ModuleApiRouteFile\n\nexport type RouteMatchParams = Record<string, string | string[]>\n\nexport type FrontendRouteManifestEntry = Omit<ModuleRoute, 'Component'> & {\n  moduleId: string\n  load: () => Promise<ModuleRoute['Component']>\n}\n\nexport type BackendRouteManifestEntry = Omit<ModuleRoute, 'Component'> & {\n  moduleId: string\n  load: () => Promise<ModuleRoute['Component']>\n}\n\nexport type ApiRouteManifestEntry = {\n  moduleId: string\n  kind: 'route-file' | 'legacy'\n  path: string\n  methods: HttpMethod[]\n  method?: HttpMethod\n  load: () => Promise<Record<string, unknown>>\n}\n\nexport type ModuleCli = {\n  command: string\n  run: (argv: string[]) => Promise<void> | void\n}\n\nexport type ModuleSubscriber = {\n  id: string\n  moduleId?: string\n  event: string\n  persistent?: boolean\n  sync?: boolean\n  priority?: number\n  handler: ModuleSubscriberHandler\n}\n\nexport type ModuleWorker = {\n  id: string\n  moduleId?: string\n  queue: string\n  concurrency: number\n  lockDuration?: number\n  maxStalledCount?: number\n  handler: ModuleWorkerHandler\n}\n\nexport type ModuleInfo = {\n  name?: string\n  title?: string\n  version?: string\n  description?: string\n  author?: string\n  license?: string\n  homepage?: string\n  copyright?: string\n  // Optional hard dependencies: module ids that must be enabled\n  requires?: string[]\n  // Whether this module can be ejected into the app's src/modules/ for customization\n  ejectable?: boolean\n}\n\nexport type ModuleDashboardWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  loader: () => Promise<DashboardWidgetModule<any>>\n}\n\nexport type ModuleInjectionWidgetEntry = {\n  moduleId: string\n  key: string\n  source: 'app' | 'package'\n  widgetId?: string\n  loader: () => Promise<InjectionAnyWidgetModule<any, any>>\n}\n\nexport type Module = {\n  id: string\n  info?: ModuleInfo\n  backendRoutes?: ModuleRoute[]\n  frontendRoutes?: ModuleRoute[]\n  apis?: ModuleApi[]\n  cli?: ModuleCli[]\n  translations?: Record<string, Record<string, string>>\n  // Optional: per-module feature declarations discovered from acl.ts (module root)\n  features?: Array<{ id: string; title: string; module: string }>\n  // Auto-discovered event subscribers\n  subscribers?: ModuleSubscriber[]\n  // Auto-discovered queue workers\n  workers?: ModuleWorker[]\n  // Optional: per-module declared entity extensions and custom fields (static)\n  // Extensions discovered from data/extensions.ts; Custom fields discovered from ce.ts (entities[].fields)\n  entityExtensions?: import('./entities').EntityExtension[]\n  customFieldSets?: import('./entities').CustomFieldSet[]\n  // Optional: per-module declared custom entities (virtual/logical entities)\n  // Discovered from ce.ts (module root). Each entry represents an entityId with optional label/description.\n  customEntities?: Array<{ id: string; label?: string; description?: string }>\n  dashboardWidgets?: ModuleDashboardWidgetEntry[]\n  injectionWidgets?: ModuleInjectionWidgetEntry[]\n  injectionTable?: ModuleInjectionTable\n  // Optional: per-module vector search configuration (discovered from vector.ts)\n  vector?: import('./vector').VectorModuleConfig\n  // Optional: module-specific tenant setup configuration (from setup.ts)\n  setup?: import('./setup').ModuleSetupConfig\n  // Optional: default encryption maps owned by the module (from encryption.ts)\n  defaultEncryptionMaps?: import('./encryption').ModuleEncryptionMap[]\n  // Optional: integration marketplace declarations discovered from integration.ts\n  integrations?: IntegrationDefinition[]\n  bundles?: IntegrationBundle[]\n}\n\nfunction normPath(s: string) {\n  return (s.startsWith('/') ? s : '/' + s).replace(/\\/+$/, '') || '/'\n}\n\n// 0 = literal (most specific), 1 = dynamic [param], 2 = catch-all [...param] or [[...param]]\nfunction segmentSpecificity(seg: string): 0 | 1 | 2 {\n  if (seg.startsWith('[[...') || seg.startsWith('[...')) return 2\n  if (seg.startsWith('[')) return 1\n  return 0\n}\n\nfunction compareRouteSpecificity(aPattern: string, bPattern: string): number {\n  const aSegs = aPattern.split('/')\n  const bSegs = bPattern.split('/')\n  const len = Math.max(aSegs.length, bSegs.length)\n  for (let i = 0; i < len; i++) {\n    const av = i < aSegs.length ? segmentSpecificity(aSegs[i]) : -1\n    const bv = i < bSegs.length ? segmentSpecificity(bSegs[i]) : -1\n    if (av !== bv) return av - bv\n  }\n  return 0\n}\n\nexport function sortRoutesBySpecificity<T extends { pattern?: string; path?: string }>(routes: T[]): T[] {\n  return [...routes].sort((a, b) =>\n    compareRouteSpecificity(a.pattern ?? a.path ?? '/', b.pattern ?? b.path ?? '/'),\n  )\n}\n\n// Memoized per-array sorted view, so direct callers (e.g., the Next.js catch-all\n// routes that import generated `frontendRoutes`/`backendRoutes`/`apiRoutes`\n// arrays) match against a specificity-sorted view even if they never call\n// `register*RouteManifests`. Keyed by array reference; generated arrays are\n// module-level constants so this caches once per process.\nconst sortedRoutesCache = new WeakMap<object, readonly unknown[]>()\n\nfunction ensureSortedRoutes<T extends { pattern?: string; path?: string }>(routes: readonly T[]): readonly T[] {\n  const cached = sortedRoutesCache.get(routes) as readonly T[] | undefined\n  if (cached) return cached\n  const sorted = sortRoutesBySpecificity([...routes])\n  sortedRoutesCache.set(routes, sorted)\n  return sorted\n}\n\nexport function matchRoutePattern(pattern: string, pathname: string): RouteMatchParams | undefined {\n  const p = normPath(pattern)\n  const u = normPath(pathname)\n  const pSegs = p.split('/').slice(1)\n  const uSegs = u.split('/').slice(1)\n  const params: Record<string, string | string[]> = {}\n  let i = 0\n  for (let j = 0; j < pSegs.length; j++, i++) {\n    const seg = pSegs[j]\n    const mCatchAll = seg.match(/^\\[\\.\\.\\.(.+)\\]$/)\n    const mOptCatch = seg.match(/^\\[\\[\\.\\.\\.(.+)\\]\\]$/)\n    const mDyn = seg.match(/^\\[(.+)\\]$/)\n    if (mCatchAll) {\n      const key = mCatchAll[1]\n      if (i >= uSegs.length) return undefined\n      params[key] = uSegs.slice(i)\n      return params\n    } else if (mOptCatch) {\n      const key = mOptCatch[1]\n      params[key] = i < uSegs.length ? uSegs.slice(i) : []\n      return params\n    } else if (mDyn) {\n      if (i >= uSegs.length) return undefined\n      params[mDyn[1]] = uSegs[i]\n    } else {\n      if (i >= uSegs.length || uSegs[i].toLowerCase() !== seg.toLowerCase()) return undefined\n    }\n  }\n  if (i !== uSegs.length) return undefined\n  return params\n}\n\nfunction getPattern(r: ModuleRoute) {\n  return r.pattern ?? r.path ?? '/'\n}\n\nexport function findFrontendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.frontendRoutes ?? []\n    for (const r of routes) {\n      const params = matchRoutePattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findBackendMatch(modules: Module[], pathname: string): { route: ModuleRoute; params: Record<string, string | string[]> } | undefined {\n  for (const m of modules) {\n    const routes = m.backendRoutes ?? []\n    for (const r of routes) {\n      const params = matchRoutePattern(getPattern(r), pathname)\n      if (params) return { route: r, params }\n    }\n  }\n}\n\nexport function findApi(modules: Module[], method: HttpMethod, pathname: string): { handler: ApiHandler; params: Record<string, string | string[]>; requireAuth?: boolean; requireRoles?: string[]; metadata?: any } | undefined {\n  for (const m of modules) {\n    const apis = m.apis ?? []\n    for (const a of apis) {\n      if ('handlers' in a) {\n        const params = matchRoutePattern(a.path, pathname)\n        const handler = (a.handlers as any)[method]\n        if (params && handler) return { handler, params, requireAuth: a.requireAuth, requireRoles: (a as any).requireRoles, metadata: (a as any).metadata }\n      } else {\n        const al = a as ModuleApiLegacy\n        if (al.method !== method) continue\n        const params = matchRoutePattern(al.path, pathname)\n        if (params) {\n          return { handler: al.handler, params, metadata: al.metadata }\n        }\n      }\n    }\n  }\n}\n\nexport function findRouteManifestMatch<T extends { pattern?: string; path?: string }>(\n  routes: T[],\n  pathname: string\n): { route: T; params: RouteMatchParams } | undefined {\n  for (const route of ensureSortedRoutes(routes)) {\n    const params = matchRoutePattern(route.pattern ?? route.path ?? '/', pathname)\n    if (params) {\n      return { route, params }\n    }\n  }\n}\n\nexport function findApiRouteManifestMatch<T extends { path: string; methods: HttpMethod[] }>(\n  routes: T[],\n  method: HttpMethod,\n  pathname: string\n): { route: T; params: RouteMatchParams } | undefined {\n  for (const route of ensureSortedRoutes(routes)) {\n    if (!route.methods.includes(method)) continue\n    const params = matchRoutePattern(route.path, pathname)\n    if (params) {\n      return { route, params }\n    }\n  }\n}\n\nexport function resolvePageRouteMetadata(pattern: string, metadata: PageMetadata | null | undefined): ModuleRouteMetadata {\n  return {\n    pattern: pattern || '/',\n    requireAuth: metadata?.requireAuth,\n    requireRoles: metadata?.requireRoles ? [...metadata.requireRoles] : undefined,\n    requireFeatures: metadata?.requireFeatures ? [...metadata.requireFeatures] : undefined,\n    requireCustomerAuth: metadata?.requireCustomerAuth,\n    requireCustomerFeatures: metadata?.requireCustomerFeatures ? [...metadata.requireCustomerFeatures] : undefined,\n    nav: metadata?.nav,\n    title: metadata?.pageTitle ?? metadata?.title,\n    titleKey: metadata?.pageTitleKey ?? metadata?.titleKey,\n    group: metadata?.pageGroup ?? metadata?.group,\n    groupKey: metadata?.pageGroupKey ?? metadata?.groupKey,\n    icon: metadata?.icon,\n    order: metadata?.pageOrder ?? metadata?.order,\n    priority: metadata?.pagePriority ?? metadata?.priority,\n    navHidden: metadata?.navHidden,\n    visible: metadata?.visible,\n    enabled: metadata?.enabled,\n    breadcrumb: metadata?.breadcrumb,\n    pageContext: metadata?.pageContext,\n    placement: metadata?.placement,\n  }\n}\n\nlet _backendRouteManifests: BackendRouteManifestEntry[] | null = null\n\nexport function registerBackendRouteManifests(routes: BackendRouteManifestEntry[]) {\n  const pageOverrides = composePageRouteOverrides()\n  const finalRoutes = Object.keys(pageOverrides).length === 0\n    ? routes\n    : applyPageOverridesToManifests(routes, pageOverrides, 'backend')\n  _backendRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getBackendRouteManifests(): BackendRouteManifestEntry[] {\n  return _backendRouteManifests ?? []\n}\n\nlet _frontendRouteManifests: FrontendRouteManifestEntry[] | null = null\n\nexport function registerFrontendRouteManifests(routes: FrontendRouteManifestEntry[]) {\n  const pageOverrides = composePageRouteOverrides()\n  const finalRoutes = Object.keys(pageOverrides).length === 0\n    ? routes\n    : applyPageOverridesToManifests(routes, pageOverrides, 'frontend')\n  _frontendRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getFrontendRouteManifests(): FrontendRouteManifestEntry[] {\n  return _frontendRouteManifests ?? []\n}\n\nlet _apiRouteManifests: ApiRouteManifestEntry[] | null = null\n\nexport function registerApiRouteManifests(routes: ApiRouteManifestEntry[]) {\n  // Apply any `entry.overrides.routes.api` overrides registered through the\n  // unified `modules.ts` dispatcher or programmatic API before storing the\n  // manifest. The composer is cheap and returns an empty object when no\n  // overrides exist, so this is a no-op for apps that do not opt in.\n  const routeOverrides = composeApiRouteOverrides()\n  const finalRoutes = Object.keys(routeOverrides).length === 0\n    ? routes\n    : applyApiOverridesToManifests(routes, routeOverrides)\n  _apiRouteManifests = sortRoutesBySpecificity(finalRoutes)\n}\n\nexport function getApiRouteManifests(): ApiRouteManifestEntry[] {\n  return _apiRouteManifests ?? []\n}\n\n// CLI modules registry - shared between CLI and module workers\nlet _cliModules: Module[] | null = null\n\nexport function registerCliModules(modules: Module[]) {\n  if (_cliModules !== null && process.env.NODE_ENV === 'development') {\n    logger.debug('CLI modules re-registered (this may occur during HMR)')\n  }\n  _cliModules = applyModuleOverridesToModules(modules)\n}\n\nexport function getCliModules(): Module[] {\n  // Return empty array if not registered - allows generate command to work without bootstrap\n  return _cliModules ?? []\n}\n\nexport function hasCliModules(): boolean {\n  return _cliModules !== null && _cliModules.length > 0\n}\n\nexport function getDefaultEncryptionMaps(modules: Module[]): import('./encryption').ModuleEncryptionMap[] {\n  const byEntityId = new Map<string, { moduleId: string; map: import('./encryption').ModuleEncryptionMap }>()\n\n  for (const mod of modules) {\n    for (const entry of mod.defaultEncryptionMaps ?? []) {\n      const previous = byEntityId.get(entry.entityId)\n      if (previous) {\n        throw new Error(\n          `[registry] Duplicate default encryption map for \"${entry.entityId}\" declared by \"${previous.moduleId}\" and \"${mod.id}\"`\n        )\n      }\n      byEntityId.set(entry.entityId, {\n        moduleId: mod.id,\n        map: {\n          entityId: entry.entityId,\n          ...(entry.keyScope ? { keyScope: entry.keyScope } : {}),\n          fields: entry.fields.map((field) => ({\n            field: field.field,\n            hashField: field.hashField ?? null,\n          })),\n        },\n      })\n    }\n  }\n\n  return Array.from(byEntityId.values(), ({ map }) => map)\n}\n\nfunction ensureLazyHandler<T extends (...args: any[]) => any>(\n  loaded: unknown,\n  kind: 'subscriber' | 'worker',\n  id: string\n): T {\n  const handler = typeof loaded === 'function'\n    ? loaded\n    : loaded && typeof loaded === 'object' && 'default' in loaded\n      ? (loaded as Record<string, unknown>).default\n      : null\n  if (typeof handler !== 'function') {\n    throw new Error(`[registry] Invalid ${kind} module \"${id}\" (missing default export handler)`)\n  }\n  return handler as T\n}\n\nexport function createLazyModuleSubscriber(\n  loadModule: () => Promise<unknown>,\n  id: string\n): ModuleSubscriberHandler {\n  let handlerPromise: Promise<ModuleSubscriberHandler> | null = null\n  return async (payload, ctx) => {\n    handlerPromise ??= loadModule().then((loaded) =>\n      ensureLazyHandler<ModuleSubscriberHandler>(loaded, 'subscriber', id)\n    )\n    const handler = await handlerPromise\n    return handler(payload, ctx)\n  }\n}\n\nexport function createLazyModuleWorker(\n  loadModule: () => Promise<unknown>,\n  id: string\n): ModuleWorkerHandler {\n  let handlerPromise: Promise<ModuleWorkerHandler> | null = null\n  return async (job, ctx) => {\n    handlerPromise ??= loadModule().then((loaded) =>\n      ensureLazyHandler<ModuleWorkerHandler>(loaded, 'worker', id)\n    )\n    const handler = await handlerPromise\n    return handler(job, ctx)\n  }\n}\n"],
+  "mappings": "AAMA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,QAAQ,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AA2PzE,SAAS,SAAS,GAAW;AAC3B,UAAQ,EAAE,WAAW,GAAG,IAAI,IAAI,MAAM,GAAG,QAAQ,QAAQ,EAAE,KAAK;AAClE;AAGA,SAAS,mBAAmB,KAAwB;AAClD,MAAI,IAAI,WAAW,OAAO,KAAK,IAAI,WAAW,MAAM,EAAG,QAAO;AAC9D,MAAI,IAAI,WAAW,GAAG,EAAG,QAAO;AAChC,SAAO;AACT;AAEA,SAAS,wBAAwB,UAAkB,UAA0B;AAC3E,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAM,QAAQ,SAAS,MAAM,GAAG;AAChC,QAAM,MAAM,KAAK,IAAI,MAAM,QAAQ,MAAM,MAAM;AAC/C,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,KAAK,IAAI,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAC7D,UAAM,KAAK,IAAI,MAAM,SAAS,mBAAmB,MAAM,CAAC,CAAC,IAAI;AAC7D,QAAI,OAAO,GAAI,QAAO,KAAK;AAAA,EAC7B;AACA,SAAO;AACT;AAEO,SAAS,wBAAuE,QAAkB;AACvG,SAAO,CAAC,GAAG,MAAM,EAAE;AAAA,IAAK,CAAC,GAAG,MAC1B,wBAAwB,EAAE,WAAW,EAAE,QAAQ,KAAK,EAAE,WAAW,EAAE,QAAQ,GAAG;AAAA,EAChF;AACF;AAOA,MAAM,oBAAoB,oBAAI,QAAoC;AAElE,SAAS,mBAAkE,QAAoC;AAC7G,QAAM,SAAS,kBAAkB,IAAI,MAAM;AAC3C,MAAI,OAAQ,QAAO;AACnB,QAAM,SAAS,wBAAwB,CAAC,GAAG,MAAM,CAAC;AAClD,oBAAkB,IAAI,QAAQ,MAAM;AACpC,SAAO;AACT;AAEO,SAAS,kBAAkB,SAAiB,UAAgD;AACjG,QAAM,IAAI,SAAS,OAAO;AAC1B,QAAM,IAAI,SAAS,QAAQ;AAC3B,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,QAAQ,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClC,QAAM,SAA4C,CAAC;AACnD,MAAI,IAAI;AACR,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,KAAK;AAC1C,UAAM,MAAM,MAAM,CAAC;AACnB,UAAM,YAAY,IAAI,MAAM,kBAAkB;AAC9C,UAAM,YAAY,IAAI,MAAM,sBAAsB;AAClD,UAAM,OAAO,IAAI,MAAM,YAAY;AACnC,QAAI,WAAW;AACb,YAAM,MAAM,UAAU,CAAC;AACvB,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,GAAG,IAAI,MAAM,MAAM,CAAC;AAC3B,aAAO;AAAA,IACT,WAAW,WAAW;AACpB,YAAM,MAAM,UAAU,CAAC;AACvB,aAAO,GAAG,IAAI,IAAI,MAAM,SAAS,MAAM,MAAM,CAAC,IAAI,CAAC;AACnD,aAAO;AAAA,IACT,WAAW,MAAM;AACf,UAAI,KAAK,MAAM,OAAQ,QAAO;AAC9B,aAAO,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC;AAAA,IAC3B,OAAO;AACL,UAAI,KAAK,MAAM,UAAU,MAAM,CAAC,EAAE,YAAY,MAAM,IAAI,YAAY,EAAG,QAAO;AAAA,IAChF;AAAA,EACF;AACA,MAAI,MAAM,MAAM,OAAQ,QAAO;AAC/B,SAAO;AACT;AAEA,SAAS,WAAW,GAAgB;AAClC,SAAO,EAAE,WAAW,EAAE,QAAQ;AAChC;AAEO,SAAS,kBAAkB,SAAmB,UAAiG;AACpJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,kBAAkB,CAAC;AACpC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,QAAQ;AACxD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,iBAAiB,SAAmB,UAAiG;AACnJ,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,EAAE,iBAAiB,CAAC;AACnC,eAAW,KAAK,QAAQ;AACtB,YAAM,SAAS,kBAAkB,WAAW,CAAC,GAAG,QAAQ;AACxD,UAAI,OAAQ,QAAO,EAAE,OAAO,GAAG,OAAO;AAAA,IACxC;AAAA,EACF;AACF;AAEO,SAAS,QAAQ,SAAmB,QAAoB,UAAkK;AAC/N,aAAW,KAAK,SAAS;AACvB,UAAM,OAAO,EAAE,QAAQ,CAAC;AACxB,eAAW,KAAK,MAAM;AACpB,UAAI,cAAc,GAAG;AACnB,cAAM,SAAS,kBAAkB,EAAE,MAAM,QAAQ;AACjD,cAAM,UAAW,EAAE,SAAiB,MAAM;AAC1C,YAAI,UAAU,QAAS,QAAO,EAAE,SAAS,QAAQ,aAAa,EAAE,aAAa,cAAe,EAAU,cAAc,UAAW,EAAU,SAAS;AAAA,MACpJ,OAAO;AACL,cAAM,KAAK;AACX,YAAI,GAAG,WAAW,OAAQ;AAC1B,cAAM,SAAS,kBAAkB,GAAG,MAAM,QAAQ;AAClD,YAAI,QAAQ;AACV,iBAAO,EAAE,SAAS,GAAG,SAAS,QAAQ,UAAU,GAAG,SAAS;AAAA,QAC9D;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,uBACd,QACA,UACoD;AACpD,aAAW,SAAS,mBAAmB,MAAM,GAAG;AAC9C,UAAM,SAAS,kBAAkB,MAAM,WAAW,MAAM,QAAQ,KAAK,QAAQ;AAC7E,QAAI,QAAQ;AACV,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,0BACd,QACA,QACA,UACoD;AACpD,aAAW,SAAS,mBAAmB,MAAM,GAAG;AAC9C,QAAI,CAAC,MAAM,QAAQ,SAAS,MAAM,EAAG;AACrC,UAAM,SAAS,kBAAkB,MAAM,MAAM,QAAQ;AACrD,QAAI,QAAQ;AACV,aAAO,EAAE,OAAO,OAAO;AAAA,IACzB;AAAA,EACF;AACF;AAEO,SAAS,yBAAyB,SAAiB,UAAgE;AACxH,SAAO;AAAA,IACL,SAAS,WAAW;AAAA,IACpB,aAAa,UAAU;AAAA,IACvB,cAAc,UAAU,eAAe,CAAC,GAAG,SAAS,YAAY,IAAI;AAAA,IACpE,iBAAiB,UAAU,kBAAkB,CAAC,GAAG,SAAS,eAAe,IAAI;AAAA,IAC7E,qBAAqB,UAAU;AAAA,IAC/B,yBAAyB,UAAU,0BAA0B,CAAC,GAAG,SAAS,uBAAuB,IAAI;AAAA,IACrG,KAAK,UAAU;AAAA,IACf,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,MAAM,UAAU;AAAA,IAChB,OAAO,UAAU,aAAa,UAAU;AAAA,IACxC,UAAU,UAAU,gBAAgB,UAAU;AAAA,IAC9C,WAAW,UAAU;AAAA,IACrB,SAAS,UAAU;AAAA,IACnB,SAAS,UAAU;AAAA,IACnB,YAAY,UAAU;AAAA,IACtB,aAAa,UAAU;AAAA,IACvB,WAAW,UAAU;AAAA,EACvB;AACF;AAEA,IAAI,yBAA6D;AAE1D,SAAS,8BAA8B,QAAqC;AACjF,QAAM,gBAAgB,0BAA0B;AAChD,QAAM,cAAc,OAAO,KAAK,aAAa,EAAE,WAAW,IACtD,SACA,8BAA8B,QAAQ,eAAe,SAAS;AAClE,2BAAyB,wBAAwB,WAAW;AAC9D;AAEO,SAAS,2BAAwD;AACtE,SAAO,0BAA0B,CAAC;AACpC;AAEA,IAAI,0BAA+D;AAE5D,SAAS,+BAA+B,QAAsC;AACnF,QAAM,gBAAgB,0BAA0B;AAChD,QAAM,cAAc,OAAO,KAAK,aAAa,EAAE,WAAW,IACtD,SACA,8BAA8B,QAAQ,eAAe,UAAU;AACnE,4BAA0B,wBAAwB,WAAW;AAC/D;AAEO,SAAS,4BAA0D;AACxE,SAAO,2BAA2B,CAAC;AACrC;AAEA,IAAI,qBAAqD;AAElD,SAAS,0BAA0B,QAAiC;AAKzE,QAAM,iBAAiB,yBAAyB;AAChD,QAAM,cAAc,OAAO,KAAK,cAAc,EAAE,WAAW,IACvD,SACA,6BAA6B,QAAQ,cAAc;AACvD,uBAAqB,wBAAwB,WAAW;AAC1D;AAEO,SAAS,uBAAgD;AAC9D,SAAO,sBAAsB,CAAC;AAChC;AAGA,IAAI,cAA+B;AAE5B,SAAS,mBAAmB,SAAmB;AACpD,MAAI,gBAAgB,QAAQ,QAAQ,IAAI,aAAa,eAAe;AAClE,WAAO,MAAM,uDAAuD;AAAA,EACtE;AACA,gBAAc,8BAA8B,OAAO;AACrD;AAEO,SAAS,gBAA0B;AAExC,SAAO,eAAe,CAAC;AACzB;AAEO,SAAS,gBAAyB;AACvC,SAAO,gBAAgB,QAAQ,YAAY,SAAS;AACtD;AAEO,SAAS,yBAAyB,SAAiE;AACxG,QAAM,aAAa,oBAAI,IAAmF;AAE1G,aAAW,OAAO,SAAS;AACzB,eAAW,SAAS,IAAI,yBAAyB,CAAC,GAAG;AACnD,YAAM,WAAW,WAAW,IAAI,MAAM,QAAQ;AAC9C,UAAI,UAAU;AACZ,cAAM,IAAI;AAAA,UACR,oDAAoD,MAAM,QAAQ,kBAAkB,SAAS,QAAQ,UAAU,IAAI,EAAE;AAAA,QACvH;AAAA,MACF;AACA,iBAAW,IAAI,MAAM,UAAU;AAAA,QAC7B,UAAU,IAAI;AAAA,QACd,KAAK;AAAA,UACH,UAAU,MAAM;AAAA,UAChB,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,UACrD,QAAQ,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,YACnC,OAAO,MAAM;AAAA,YACb,WAAW,MAAM,aAAa;AAAA,UAChC,EAAE;AAAA,QACJ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,WAAW,OAAO,GAAG,CAAC,EAAE,IAAI,MAAM,GAAG;AACzD;AAEA,SAAS,kBACP,QACA,MACA,IACG;AACH,QAAM,UAAU,OAAO,WAAW,aAC9B,SACA,UAAU,OAAO,WAAW,YAAY,aAAa,SAClD,OAAmC,UACpC;AACN,MAAI,OAAO,YAAY,YAAY;AACjC,UAAM,IAAI,MAAM,sBAAsB,IAAI,YAAY,EAAE,oCAAoC;AAAA,EAC9F;AACA,SAAO;AACT;AAEO,SAAS,2BACd,YACA,IACyB;AACzB,MAAI,iBAA0D;AAC9D,SAAO,OAAO,SAAS,QAAQ;AAC7B,uBAAmB,WAAW,EAAE;AAAA,MAAK,CAAC,WACpC,kBAA2C,QAAQ,cAAc,EAAE;AAAA,IACrE;AACA,UAAM,UAAU,MAAM;AACtB,WAAO,QAAQ,SAAS,GAAG;AAAA,EAC7B;AACF;AAEO,SAAS,uBACd,YACA,IACqB;AACrB,MAAI,iBAAsD;AAC1D,SAAO,OAAO,KAAK,QAAQ;AACzB,uBAAmB,WAAW,EAAE;AAAA,MAAK,CAAC,WACpC,kBAAuC,QAAQ,UAAU,EAAE;AAAA,IAC7D;AACA,UAAM,UAAU,MAAM;AACtB,WAAO,QAAQ,KAAK,GAAG;AAAA,EACzB;AACF;",
   "names": []
 }

package/dist/modules/widgets/extension-points.js

@@ -0,0 +1,96 @@
+function defineModuleExtensionPoints(declaration) {
+  return Object.freeze({
+    ...declaration,
+    hosts: Object.freeze({ ...declaration.hosts })
+  });
+}
+function injectionExtensionHost(declaration) {
+  const hasExactId = typeof declaration.spotId === "string" && declaration.spotId.length > 0;
+  const hasPattern = typeof declaration.pattern === "string" && declaration.pattern.length > 0;
+  if (hasExactId === hasPattern) {
+    throw new Error("[internal] injection extension hosts require exactly one of spotId or pattern");
+  }
+  if (hasPattern && (!declaration.parameters || Object.keys(declaration.parameters).length === 0)) {
+    throw new Error("[internal] patterned injection extension hosts require named parameters");
+  }
+  return Object.freeze({ ...declaration });
+}
+function dataTableExtensionHost(declaration) {
+  return Object.freeze({ family: "data-table", ...declaration });
+}
+function crudFormExtensionHost(declaration) {
+  return Object.freeze({ family: "crud-form", ...declaration });
+}
+function componentExtensionHost(declaration) {
+  return Object.freeze({ family: "component-handle", ...declaration });
+}
+const DATA_TABLE_EXTENSION_SURFACES = [
+  { key: "header", suffix: "header", capabilities: ["render-widget"], bound: true },
+  { key: "footer", suffix: "footer", capabilities: ["render-widget"], bound: true },
+  { key: "toolbar", suffix: "toolbar", capabilities: ["toolbar-widget"], bound: true },
+  { key: "searchTrailing", suffix: "search-trailing", capabilities: ["render-widget"], bound: true },
+  { key: "columns", suffix: "columns", capabilities: ["column-widget"], bound: true },
+  { key: "rowActions", suffix: "row-actions", capabilities: ["row-action"], bound: true },
+  { key: "bulkActions", suffix: "bulk-actions", capabilities: ["bulk-action"], bound: true },
+  { key: "filters", suffix: "filters", capabilities: ["filter-widget"], bound: true },
+  { key: "replacement", suffix: null, capabilities: ["component-replacement"], bound: true },
+  { key: "emptyState", suffix: "empty-state", capabilities: ["render-widget"], bound: false }
+];
+const CRUD_FORM_EXTENSION_SURFACES = [
+  { key: "base", suffix: null, capabilities: ["render-widget", "lifecycle-handler"], bound: true },
+  { key: "header", suffix: "header", capabilities: ["render-widget"], bound: true },
+  { key: "fields", suffix: "fields", capabilities: ["field-widget"], bound: true },
+  { key: "replacement", suffix: null, capabilities: ["component-replacement"], bound: true },
+  { key: "beforeFields", suffix: "before-fields", capabilities: ["render-widget"], bound: false },
+  { key: "afterFields", suffix: "after-fields", capabilities: ["render-widget"], bound: false },
+  { key: "footer", suffix: "footer", capabilities: ["render-widget"], bound: false },
+  { key: "sidebar", suffix: "sidebar", capabilities: ["render-widget"], bound: false },
+  { key: "group", suffix: "group:{groupId}", capabilities: ["render-widget"], bound: false },
+  { key: "fieldBefore", suffix: "field:{fieldId}:before", capabilities: ["render-widget"], bound: false },
+  { key: "fieldAfter", suffix: "field:{fieldId}:after", capabilities: ["render-widget"], bound: false }
+];
+const CRUD_FORM_LIFECYCLE_PHASES = [
+  "transformValidation",
+  "transformDisplayData",
+  "onBeforeNavigate",
+  "onAppEvent",
+  "onVisibilityChange",
+  "onBeforeDelete",
+  "onDelete",
+  "onAfterDelete",
+  "onDeleteError",
+  "onFieldChange",
+  "transformFormData",
+  "onBeforeSave",
+  "onSave",
+  "onAfterSave"
+];
+const CRUD_FORM_OPERATIONS = ["create", "update", "delete"];
+function dataTableExtensionSpotId(tableId, suffix) {
+  return suffix ? `data-table:${tableId}:${suffix}` : `data-table:${tableId}`;
+}
+function crudFormExtensionSpotId(entityId, suffix) {
+  return suffix ? `crud-form:${entityId}:${suffix}` : `crud-form:${entityId}`;
+}
+function extensionSpotChildId(spotId, suffix) {
+  return `${spotId}:${suffix}`;
+}
+function resolveExtensionPointPattern(pattern, parameters) {
+  return pattern.replace(/\{([^}]+)\}/g, (token, parameterName) => parameters[parameterName] ?? token);
+}
+export {
+  CRUD_FORM_EXTENSION_SURFACES,
+  CRUD_FORM_LIFECYCLE_PHASES,
+  CRUD_FORM_OPERATIONS,
+  DATA_TABLE_EXTENSION_SURFACES,
+  componentExtensionHost,
+  crudFormExtensionHost,
+  crudFormExtensionSpotId,
+  dataTableExtensionHost,
+  dataTableExtensionSpotId,
+  defineModuleExtensionPoints,
+  extensionSpotChildId,
+  injectionExtensionHost,
+  resolveExtensionPointPattern
+};
+//# sourceMappingURL=extension-points.js.map

package/dist/modules/widgets/extension-points.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/widgets/extension-points.ts"],
+  "sourcesContent": ["export type ExtensionHostFamily =\n  | 'generic'\n  | 'menu'\n  | 'data-table'\n  | 'crud-form'\n  | 'detail'\n  | 'portal-page'\n  | 'component-handle'\n  | 'entity'\n  | 'api-route'\n  | 'command'\n  | 'event'\n  | 'query-lifecycle'\n  | 'dashboard'\n  | 'notification'\n  | 'integration'\n  | 'specialized-registry'\n  | 'module-override'\n\nexport type ExtensionHostCapability =\n  | 'render-widget'\n  | 'headless-widget'\n  | 'menu-item'\n  | 'column-widget'\n  | 'row-action'\n  | 'bulk-action'\n  | 'filter-widget'\n  | 'toolbar-widget'\n  | 'field-widget'\n  | 'lifecycle-handler'\n  | 'component-replacement'\n  | 'response-enricher'\n  | 'query-enricher'\n  | 'api-interceptor'\n  | 'command-interceptor'\n  | 'mutation-guard'\n  | 'entity-extension'\n  | 'async-subscriber'\n  | 'sync-subscriber'\n  | 'browser-client'\n  | 'browser-portal'\n  | 'registry-contribution'\n  | 'module-override'\n\nexport type ExtensionHostActivation = 'always' | 'host-opt-in' | 'caller-opt-in' | 'feature-gated'\n\nexport type ExtensionPointPatternParameter = {\n  source: string\n  pattern?: string\n}\n\ntype ExtensionHostDeclarationBase = {\n  source: string\n  contextContract?: string\n  dataContract?: string\n  scopeContract?: string\n  runtimeContract?: string\n  activation?: ExtensionHostActivation\n  aliases?: readonly string[]\n  fallbacks?: readonly string[]\n}\n\ntype InjectionExtensionHostDeclarationBase = ExtensionHostDeclarationBase & {\n  family: Exclude<ExtensionHostFamily, 'data-table' | 'crud-form' | 'component-handle'>\n  supported: readonly ExtensionHostCapability[]\n}\n\nexport type InjectionExtensionHostDeclaration = InjectionExtensionHostDeclarationBase & (\n  | {\n      spotId: string\n      pattern?: never\n      parameters?: never\n    }\n  | {\n      spotId?: never\n      pattern: string\n      parameters: Readonly<Record<string, ExtensionPointPatternParameter>>\n    }\n)\n\nexport type DataTableExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'data-table'\n  tableId: string\n  baseSpotId?: string\n}\n\nexport type CrudFormExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'crud-form'\n  entityId: string\n  spotId?: string\n}\n\nexport type ComponentExtensionHostDeclaration = ExtensionHostDeclarationBase & {\n  family: 'component-handle'\n  componentId: string\n  propsContract?: string\n}\n\nexport type ModuleExtensionHostDeclaration =\n  | InjectionExtensionHostDeclaration\n  | DataTableExtensionHostDeclaration\n  | CrudFormExtensionHostDeclaration\n  | ComponentExtensionHostDeclaration\n\nexport type ModuleExtensionPoints<\n  TModuleId extends string = string,\n  THosts extends Readonly<Record<string, ModuleExtensionHostDeclaration>> = Readonly<Record<string, ModuleExtensionHostDeclaration>>,\n> = {\n  moduleId: TModuleId\n  hosts: THosts\n}\n\nexport function defineModuleExtensionPoints<\n  const TModuleId extends string,\n  const THosts extends Readonly<Record<string, ModuleExtensionHostDeclaration>>,\n>(declaration: ModuleExtensionPoints<TModuleId, THosts>): ModuleExtensionPoints<TModuleId, THosts> {\n  return Object.freeze({\n    ...declaration,\n    hosts: Object.freeze({ ...declaration.hosts }),\n  })\n}\n\nexport function injectionExtensionHost<const TDeclaration extends InjectionExtensionHostDeclaration>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration> {\n  const hasExactId = typeof declaration.spotId === 'string' && declaration.spotId.length > 0\n  const hasPattern = typeof declaration.pattern === 'string' && declaration.pattern.length > 0\n  if (hasExactId === hasPattern) {\n    throw new Error('[internal] injection extension hosts require exactly one of spotId or pattern')\n  }\n  if (hasPattern && (!declaration.parameters || Object.keys(declaration.parameters).length === 0)) {\n    throw new Error('[internal] patterned injection extension hosts require named parameters')\n  }\n  return Object.freeze({ ...declaration })\n}\n\nexport function dataTableExtensionHost<\n  const TDeclaration extends Omit<DataTableExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'data-table' }> {\n  return Object.freeze({ family: 'data-table', ...declaration })\n}\n\nexport function crudFormExtensionHost<\n  const TDeclaration extends Omit<CrudFormExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'crud-form' }> {\n  return Object.freeze({ family: 'crud-form', ...declaration })\n}\n\nexport function componentExtensionHost<\n  const TDeclaration extends Omit<ComponentExtensionHostDeclaration, 'family'>,\n>(\n  declaration: TDeclaration,\n): Readonly<TDeclaration & { family: 'component-handle' }> {\n  return Object.freeze({ family: 'component-handle', ...declaration })\n}\n\nexport type BoundExtensionSurface = {\n  key: string\n  suffix: string | null\n  capabilities: readonly ExtensionHostCapability[]\n  bound: boolean\n  phases?: readonly string[]\n  operations?: readonly string[]\n}\n\nexport const DATA_TABLE_EXTENSION_SURFACES = [\n  { key: 'header', suffix: 'header', capabilities: ['render-widget'], bound: true },\n  { key: 'footer', suffix: 'footer', capabilities: ['render-widget'], bound: true },\n  { key: 'toolbar', suffix: 'toolbar', capabilities: ['toolbar-widget'], bound: true },\n  { key: 'searchTrailing', suffix: 'search-trailing', capabilities: ['render-widget'], bound: true },\n  { key: 'columns', suffix: 'columns', capabilities: ['column-widget'], bound: true },\n  { key: 'rowActions', suffix: 'row-actions', capabilities: ['row-action'], bound: true },\n  { key: 'bulkActions', suffix: 'bulk-actions', capabilities: ['bulk-action'], bound: true },\n  { key: 'filters', suffix: 'filters', capabilities: ['filter-widget'], bound: true },\n  { key: 'replacement', suffix: null, capabilities: ['component-replacement'], bound: true },\n  { key: 'emptyState', suffix: 'empty-state', capabilities: ['render-widget'], bound: false },\n] as const satisfies readonly BoundExtensionSurface[]\n\nexport const CRUD_FORM_EXTENSION_SURFACES = [\n  { key: 'base', suffix: null, capabilities: ['render-widget', 'lifecycle-handler'], bound: true },\n  { key: 'header', suffix: 'header', capabilities: ['render-widget'], bound: true },\n  { key: 'fields', suffix: 'fields', capabilities: ['field-widget'], bound: true },\n  { key: 'replacement', suffix: null, capabilities: ['component-replacement'], bound: true },\n  { key: 'beforeFields', suffix: 'before-fields', capabilities: ['render-widget'], bound: false },\n  { key: 'afterFields', suffix: 'after-fields', capabilities: ['render-widget'], bound: false },\n  { key: 'footer', suffix: 'footer', capabilities: ['render-widget'], bound: false },\n  { key: 'sidebar', suffix: 'sidebar', capabilities: ['render-widget'], bound: false },\n  { key: 'group', suffix: 'group:{groupId}', capabilities: ['render-widget'], bound: false },\n  { key: 'fieldBefore', suffix: 'field:{fieldId}:before', capabilities: ['render-widget'], bound: false },\n  { key: 'fieldAfter', suffix: 'field:{fieldId}:after', capabilities: ['render-widget'], bound: false },\n] as const satisfies readonly BoundExtensionSurface[]\n\nexport const CRUD_FORM_LIFECYCLE_PHASES = [\n  'transformValidation',\n  'transformDisplayData',\n  'onBeforeNavigate',\n  'onAppEvent',\n  'onVisibilityChange',\n  'onBeforeDelete',\n  'onDelete',\n  'onAfterDelete',\n  'onDeleteError',\n  'onFieldChange',\n  'transformFormData',\n  'onBeforeSave',\n  'onSave',\n  'onAfterSave',\n] as const\n\nexport const CRUD_FORM_OPERATIONS = ['create', 'update', 'delete'] as const\n\nexport function dataTableExtensionSpotId(tableId: string, suffix?: string): string {\n  return suffix ? `data-table:${tableId}:${suffix}` : `data-table:${tableId}`\n}\n\nexport function crudFormExtensionSpotId(entityId: string, suffix?: string): string {\n  return suffix ? `crud-form:${entityId}:${suffix}` : `crud-form:${entityId}`\n}\n\nexport function extensionSpotChildId(spotId: string, suffix: string): string {\n  return `${spotId}:${suffix}`\n}\n\nexport function resolveExtensionPointPattern(\n  pattern: string,\n  parameters: Readonly<Record<string, string>>,\n): string {\n  return pattern.replace(/\\{([^}]+)\\}/g, (token, parameterName: string) => parameters[parameterName] ?? token)\n}\n\n/**\n * Portable, structural copy of the CLI provenance source reference\n * (`ModuleFactSourceRef` in `packages/cli/.../module-facts.ts`). Redefined here\n * \u2014 rather than imported \u2014 so `@open-mercato/shared` keeps zero dependency on\n * `@open-mercato/cli`. Field names are kept byte-identical so the two are\n * assignable across the package boundary.\n */\nexport type ModuleFactSourceRef = {\n  sourcePath: string\n  exportName?: string\n  line?: number\n}\n\n/** Portable, structural copy of the CLI provenance fact reference. */\nexport type ModuleFactRef = {\n  factSection: string\n  factKey: string\n}\n\nexport type ModuleExtensionContributionKind = ModuleExtensionContributionFact['kind']\n\nexport type ModuleExtensionActivationKind =\n  | 'crud-response-enricher'\n  | 'query-enricher'\n  | 'mutation-guard'\n  | 'api-interceptor-bridge'\n  | 'command-interceptor-bridge'\n  | 'widget-injection-consumer'\n  | 'component-extension-consumer'\n  | 'dashboard-host-consumer'\n\nexport type ModuleExtensionTargetRef = {\n  kind:\n    | 'module'\n    | 'entity'\n    | 'api-route'\n    | 'command'\n    | 'widget-spot'\n    | 'component'\n    | 'event'\n    | 'notification'\n    | 'wildcard'\n  id: string\n  moduleId?: string\n  method?: 'GET' | 'POST' | 'PUT' | 'PATCH' | 'DELETE'\n}\n\nexport type ModuleExtensionActivation = {\n  id: string\n  kind: ModuleExtensionActivationKind\n  host: ModuleExtensionTargetRef\n  contributionKinds: ModuleExtensionContributionKind[]\n  phases?: string[]\n  /**\n   * Mutation operations the call site guards, when statically declared. A\n   * contribution declaring only other operations is not bound by this activation.\n   */\n  operations?: string[]\n  source: ModuleFactSourceRef\n  bridge?: ModuleFactRef\n}\n\nexport type ModuleExtensionResolution =\n  | 'bound'\n  | 'capability-only'\n  | 'optional-target-missing'\n  | 'wildcard'\n  | 'unresolved'\n\nexport type ModuleIncomingExtensionRef = {\n  contributionId: string\n  contributionKind: ModuleExtensionContributionKind\n  contributorModuleId: string\n  target: ModuleExtensionTargetRef\n  activationId?: string\n  resolution: ModuleExtensionResolution\n  source: ModuleFactSourceRef\n}\n\nexport type ModuleContributionResolution = {\n  contributionId: string\n  target: ModuleExtensionTargetRef\n  resolution: ModuleExtensionResolution\n  activationIds: string[]\n}\n\n/**\n * Additive, optional bidirectional-topology fields layered on top of the\n * existing extension-surface facts. Every field is optional so legacy consumers\n * and pre-existing generated output remain byte-compatible.\n */\nexport type ModuleExtensionSurfaceFactsAdditions = {\n  activations?: ModuleExtensionActivation[]\n  incoming?: ModuleIncomingExtensionRef[]\n  contributionResolutions?: ModuleContributionResolution[]\n}\n\nexport type ModuleExtensionSurfaceFacts = {\n  hosts: ModuleExtensionHostFact[]\n  contributions: ModuleExtensionContributionFact[]\n  unresolved: ModuleExtensionUnresolvedFact[]\n} & ModuleExtensionSurfaceFactsAdditions\n\nexport type ModuleExtensionHostFact = {\n  key: string\n  id: string\n  resolution: 'exact' | 'pattern' | 'framework' | 'fact-ref'\n  family: ExtensionHostFamily\n  ownerModule: string\n  capabilities: ExtensionHostCapability[]\n  phases?: string[]\n  operations?: string[]\n  contextContract?: string\n  dataContract?: string\n  scopeContract?: string\n  runtimeContract?: string\n  activation?: ExtensionHostActivation\n  bound: boolean\n  stability: 'frozen' | 'stable'\n  source:\n    | { kind: 'declaration'; path: string; symbol: string }\n    | { kind: 'fact-ref'; factSection: string; factKey: string }\n    | { kind: 'framework'; path: string; symbol: string }\n  aliases?: string[]\n  patternParameters?: Record<string, ExtensionPointPatternParameter>\n  fallbacks?: string[]\n}\n\nexport type ModuleExtensionTargetFact = {\n  id: string\n  resolution: 'exact' | 'pattern' | 'framework' | 'fact-ref' | 'optional-external' | 'unresolved'\n  factRef?: { factSection: string; factKey: string }\n  optionalOwnerPackage?: string\n}\n\nexport type ModuleExtensionContributionBase = {\n  id: string\n  targets: ModuleExtensionTargetFact[]\n  phases?: string[]\n  operations?: string[]\n  features?: string[]\n  scopeContract: string\n  activation?: ExtensionHostActivation\n  placement?: { relativeTo?: string; position?: 'first' | 'last' | 'before' | 'after'; priority?: number }\n  roundTripId?: string\n  override?: { domain: string; key: string; mode: 'disable-replace' | 'replace' | 'additive' }\n  source: { path: string; symbol?: string }\n}\n\nexport type ModuleExtensionContributionFact = ModuleExtensionContributionBase & (\n  | {\n      kind: 'widget'\n      details: {\n        payload: 'render' | 'headless' | 'menu' | 'dashboard' | 'notification' | 'integration'\n        registryKey: string\n        itemIds?: string[]\n        labelKeys?: string[]\n        contextContract?: string\n        dataContract?: string\n        executionGuard: 'host' | 'contribution' | 'both'\n      }\n    }\n  | {\n      kind: 'data-table'\n      details: {\n        payload: 'column' | 'row-action' | 'bulk-action' | 'filter' | 'toolbar' | 'render'\n        tableId: string\n        executionGuard: 'host' | 'contribution' | 'both'\n      }\n    }\n  | {\n      kind: 'crud-form'\n      details: {\n        payload: 'render' | 'field' | 'lifecycle-handler'\n        entityId: string\n        fieldIds?: string[]\n        groupIds?: string[]\n        requestHeaderCapability: boolean\n      }\n    }\n  | {\n      kind: 'component-override'\n      details: { handle: string; mode: 'replace' | 'wrapper' | 'props'; propsContract: string }\n    }\n  | {\n      kind: 'response-enricher'\n      details: {\n        targetEntity: string\n        surfaces: Array<'list' | 'detail'>\n        timeoutMs: number\n        fallback: 'none' | 'configured'\n        critical: boolean\n        cachePosture: 'record-pure' | 'rerun-on-list-cache-hit'\n        queryEngine?: {\n          engines: string[]\n          applyOn: Array<'list' | 'detail'>\n          activation: 'caller-opt-in'\n        }\n      }\n    }\n  | {\n      kind: 'api-interceptor'\n      details: {\n        route: string\n        methods: string[]\n        phases: Array<'before' | 'after'>\n        activation: 'crud-pipeline' | 'custom-route-bridge'\n        timeoutMs: number\n        failurePosture: 'fail-closed' | 'fallback'\n      }\n    }\n  | {\n      kind: 'command-interceptor'\n      details: {\n        targetCommand: string\n        phases: Array<'before-execute' | 'after-execute' | 'before-undo' | 'after-undo'>\n      }\n    }\n  | {\n      kind: 'mutation-guard'\n      details: {\n        entityId: string\n        operations: Array<'create' | 'update' | 'delete'>\n        capabilities: Array<'block' | 'rewrite' | 'after-success'>\n        optimisticLock: 'preserved'\n      }\n    }\n  | {\n      kind: 'entity-extension'\n      details: {\n        hostEntityId: string\n        extensionEntityId: string\n        linkId: string\n        scopeContract: string\n        orphanContract: string\n      }\n    }\n  | {\n      kind: 'subscriber'\n      details: {\n        event: string\n        subscriberId: string\n        persistent: boolean\n        sync: boolean\n        priority?: number\n      }\n    }\n  | {\n      kind: 'browser-reaction'\n      details: {\n        transports: Array<'client' | 'portal' | 'notification-effect'>\n        hooks: string[]\n        audienceScopeContract: string\n        maxPayloadBytes?: number\n        dedupWindowMs?: number\n        /**\n         * Statically declared handler id. Runtime keys `notifications.handlers`\n         * overrides by it, so it is absent when the module declares no id (such a\n         * handler cannot be overridden).\n         */\n        overrideKey?: string\n      }\n    }\n  | {\n      kind: 'specialized-registry'\n      details: {\n        registry: 'notification' | 'integration' | 'search' | 'vector' | 'ai' | 'payment' | 'shipping' | 'currency' | 'workflow'\n        registryId: string\n        specialistRoute: string\n      }\n    }\n  | {\n      kind: 'module-override'\n      details: {\n        domain: string\n        key: string\n        mode: 'disable-replace' | 'replace' | 'additive'\n      }\n    }\n)\n\nexport type ModuleExtensionUnresolvedFact = {\n  key: string\n  source: { path: string; symbol?: string }\n  reason:\n    | 'unclassified-binding'\n    | 'unbound-declaration'\n    | 'dynamic-without-pattern'\n    | 'unresolved-first-party-target'\n}\n"],
+  "mappings": "AAgHO,SAAS,4BAGd,aAAiG;AACjG,SAAO,OAAO,OAAO;AAAA,IACnB,GAAG;AAAA,IACH,OAAO,OAAO,OAAO,EAAE,GAAG,YAAY,MAAM,CAAC;AAAA,EAC/C,CAAC;AACH;AAEO,SAAS,uBACd,aACwB;AACxB,QAAM,aAAa,OAAO,YAAY,WAAW,YAAY,YAAY,OAAO,SAAS;AACzF,QAAM,aAAa,OAAO,YAAY,YAAY,YAAY,YAAY,QAAQ,SAAS;AAC3F,MAAI,eAAe,YAAY;AAC7B,UAAM,IAAI,MAAM,+EAA+E;AAAA,EACjG;AACA,MAAI,eAAe,CAAC,YAAY,cAAc,OAAO,KAAK,YAAY,UAAU,EAAE,WAAW,IAAI;AAC/F,UAAM,IAAI,MAAM,yEAAyE;AAAA,EAC3F;AACA,SAAO,OAAO,OAAO,EAAE,GAAG,YAAY,CAAC;AACzC;AAEO,SAAS,uBAGd,aACmD;AACnD,SAAO,OAAO,OAAO,EAAE,QAAQ,cAAc,GAAG,YAAY,CAAC;AAC/D;AAEO,SAAS,sBAGd,aACkD;AAClD,SAAO,OAAO,OAAO,EAAE,QAAQ,aAAa,GAAG,YAAY,CAAC;AAC9D;AAEO,SAAS,uBAGd,aACyD;AACzD,SAAO,OAAO,OAAO,EAAE,QAAQ,oBAAoB,GAAG,YAAY,CAAC;AACrE;AAWO,MAAM,gCAAgC;AAAA,EAC3C,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,gBAAgB,GAAG,OAAO,KAAK;AAAA,EACnF,EAAE,KAAK,kBAAkB,QAAQ,mBAAmB,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EACjG,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAClF,EAAE,KAAK,cAAc,QAAQ,eAAe,cAAc,CAAC,YAAY,GAAG,OAAO,KAAK;AAAA,EACtF,EAAE,KAAK,eAAe,QAAQ,gBAAgB,cAAc,CAAC,aAAa,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAClF,EAAE,KAAK,eAAe,QAAQ,MAAM,cAAc,CAAC,uBAAuB,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,cAAc,QAAQ,eAAe,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAC5F;AAEO,MAAM,+BAA+B;AAAA,EAC1C,EAAE,KAAK,QAAQ,QAAQ,MAAM,cAAc,CAAC,iBAAiB,mBAAmB,GAAG,OAAO,KAAK;AAAA,EAC/F,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,KAAK;AAAA,EAChF,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,cAAc,GAAG,OAAO,KAAK;AAAA,EAC/E,EAAE,KAAK,eAAe,QAAQ,MAAM,cAAc,CAAC,uBAAuB,GAAG,OAAO,KAAK;AAAA,EACzF,EAAE,KAAK,gBAAgB,QAAQ,iBAAiB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EAC9F,EAAE,KAAK,eAAe,QAAQ,gBAAgB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EAC5F,EAAE,KAAK,UAAU,QAAQ,UAAU,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACjF,EAAE,KAAK,WAAW,QAAQ,WAAW,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACnF,EAAE,KAAK,SAAS,QAAQ,mBAAmB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACzF,EAAE,KAAK,eAAe,QAAQ,0BAA0B,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AAAA,EACtG,EAAE,KAAK,cAAc,QAAQ,yBAAyB,cAAc,CAAC,eAAe,GAAG,OAAO,MAAM;AACtG;AAEO,MAAM,6BAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEO,MAAM,uBAAuB,CAAC,UAAU,UAAU,QAAQ;AAE1D,SAAS,yBAAyB,SAAiB,QAAyB;AACjF,SAAO,SAAS,cAAc,OAAO,IAAI,MAAM,KAAK,cAAc,OAAO;AAC3E;AAEO,SAAS,wBAAwB,UAAkB,QAAyB;AACjF,SAAO,SAAS,aAAa,QAAQ,IAAI,MAAM,KAAK,aAAa,QAAQ;AAC3E;AAEO,SAAS,qBAAqB,QAAgB,QAAwB;AAC3E,SAAO,GAAG,MAAM,IAAI,MAAM;AAC5B;AAEO,SAAS,6BACd,SACA,YACQ;AACR,SAAO,QAAQ,QAAQ,gBAAgB,CAAC,OAAO,kBAA0B,WAAW,aAAa,KAAK,KAAK;AAC7G;",
+  "names": []
+}

package/dist/security/enabledModulesRegistry.js

@@ -6,21 +6,57 @@ function buildRegistry(modules) {
   const enabledModuleSet = new Set(enabledModuleIds);
   const featureToModule = /* @__PURE__ */ new Map();
   const prefixToModule = /* @__PURE__ */ new Map();
+  const concreteFeatureIds = [];
+  const concreteFeatureSet = /* @__PURE__ */ new Set();
+  const addConcreteFeature = (featureId, owningModule, authoritative) => {
+    if (!featureId || featureId === "*" || featureId.endsWith(".*")) return;
+    if (!concreteFeatureSet.has(featureId)) {
+      concreteFeatureSet.add(featureId);
+      concreteFeatureIds.push(featureId);
+    }
+    if (authoritative || !featureToModule.has(featureId)) {
+      featureToModule.set(featureId, owningModule);
+    }
+    const dot = featureId.indexOf(".");
+    if (dot > 0) {
+      const prefix = featureId.slice(0, dot);
+      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule);
+    }
+  };
   for (const mod of modules) {
     const features = mod.features;
-    if (!Array.isArray(features)) continue;
-    for (const feature of features) {
-      if (!feature || typeof feature.id !== "string" || !feature.id) continue;
-      const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
-      featureToModule.set(feature.id, declared);
-      const dot = feature.id.indexOf(".");
-      if (dot > 0) {
-        const prefix = feature.id.slice(0, dot);
-        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared);
+    if (Array.isArray(features)) {
+      for (const feature of features) {
+        if (!feature || typeof feature.id !== "string" || !feature.id) continue;
+        const declared = typeof feature.module === "string" && feature.module.length > 0 ? feature.module : mod.id;
+        addConcreteFeature(feature.id, declared, true);
+      }
+    }
+    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures;
+    if (customerDefaults) {
+      for (const roleFeatures of Object.values(customerDefaults)) {
+        if (!Array.isArray(roleFeatures)) continue;
+        for (const featureId of roleFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
+      }
+    }
+    if (Array.isArray(mod.frontendRoutes)) {
+      for (const route of mod.frontendRoutes) {
+        if (!Array.isArray(route.requireCustomerFeatures)) continue;
+        for (const featureId of route.requireCustomerFeatures) {
+          if (typeof featureId === "string") addConcreteFeature(featureId, mod.id, false);
+        }
       }
     }
   }
-  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule };
+  return {
+    enabledModuleIds,
+    enabledModuleSet,
+    featureToModule,
+    prefixToModule,
+    concreteFeatureIds
+  };
 }
 function getRegistry() {
   try {
@@ -52,6 +88,13 @@ function getEnabledModuleIds() {
   const registry = getRegistry();
   return registry ? [...registry.enabledModuleIds] : [];
 }
+function getConcreteFeatureIds() {
+  const registry = getRegistry();
+  return registry ? [...registry.concreteFeatureIds] : [];
+}
+function hasEnabledModulesRegistry() {
+  return getRegistry() !== null;
+}
 function filterGrantsByEnabledModules(granted) {
   const registry = getRegistry();
   if (!registry) return [...granted];
@@ -73,7 +116,9 @@ function filterGrantsByEnabledModules(granted) {
 }
 export {
   filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
   getEnabledModuleIds,
-  getOwningModuleId
+  getOwningModuleId,
+  hasEnabledModulesRegistry
 };
 //# sourceMappingURL=enabledModulesRegistry.js.map

package/dist/security/enabledModulesRegistry.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/security/enabledModulesRegistry.ts"],
-  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  for (const mod of modules) {\n    const features = mod.features\n    if (!Array.isArray(features)) continue\n    for (const feature of features) {\n      if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n      const declared = typeof feature.module === 'string' && feature.module.length > 0\n        ? feature.module\n        : mod.id\n      featureToModule.set(feature.id, declared)\n      const dot = feature.id.indexOf('.')\n      if (dot > 0) {\n        const prefix = feature.id.slice(0, dot)\n        if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, declared)\n      }\n    }\n  }\n  return { enabledModuleIds, enabledModuleSet, featureToModule, prefixToModule }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
-  "mappings": "AAyBA,SAAS,kBAAkB;AAU3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,CAAC,MAAM,QAAQ,QAAQ,EAAG;AAC9B,eAAW,WAAW,UAAU;AAC9B,UAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,YAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,sBAAgB,IAAI,QAAQ,IAAI,QAAQ;AACxC,YAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG;AAClC,UAAI,MAAM,GAAG;AACX,cAAM,SAAS,QAAQ,GAAG,MAAM,GAAG,GAAG;AACtC,YAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,QAAQ;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,kBAAkB,kBAAkB,iBAAiB,eAAe;AAC/E;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Module-aware grant filtering.\n *\n * Features live under `<module>.<action>` (see AGENTS.md naming convention).\n * When a module is disabled in `modules.ts`, its routes/UI are absent but\n * roles may still carry the feature string. Anywhere we turn raw ACL\n * grants into \"what the user can currently act on\", we must drop grants\n * whose owning module is not enabled \u2014 otherwise stale grants re-open the\n * 404-class bug PR #1567 only partially fixed.\n *\n * Owning-module resolution:\n * - Most features follow the convention so `id.split('.')[0]` matches the\n *   module id. For those, the prefix is correct.\n * - A few features (e.g. `analytics.view`) deliberately use a different\n *   namespace from their owning module. For those, the registry's declared\n *   `module` field on the `Module.features` entry is authoritative. We\n *   consult it first and fall back to the prefix only when the feature is\n *   unknown to the registry.\n *\n * This helper is server-only: it reads the enabled module set from the\n * bootstrapped module registry. The browser never imports it; instead,\n * server code pre-filters `BackendChromePayload.grantedFeatures` so\n * client-side `hasFeature` can stay a pure grant check.\n */\n\nimport { getModules } from '../lib/modules/registry'\nimport type { Module } from '../modules/registry'\n\ntype FeatureRegistry = {\n  enabledModuleIds: string[]\n  enabledModuleSet: Set<string>\n  featureToModule: Map<string, string>\n  prefixToModule: Map<string, string>\n  concreteFeatureIds: string[]\n}\n\nlet cachedRegistry: FeatureRegistry | null = null\nlet cachedModulesRef: readonly Module[] | null = null\n\nfunction buildRegistry(modules: readonly Module[]): FeatureRegistry {\n  const enabledModuleIds = modules.map((mod) => mod.id)\n  const enabledModuleSet = new Set(enabledModuleIds)\n  const featureToModule = new Map<string, string>()\n  const prefixToModule = new Map<string, string>()\n  const concreteFeatureIds: string[] = []\n  const concreteFeatureSet = new Set<string>()\n\n  const addConcreteFeature = (featureId: string, owningModule: string, authoritative: boolean) => {\n    if (!featureId || featureId === '*' || featureId.endsWith('.*')) return\n    if (!concreteFeatureSet.has(featureId)) {\n      concreteFeatureSet.add(featureId)\n      concreteFeatureIds.push(featureId)\n    }\n    if (authoritative || !featureToModule.has(featureId)) {\n      featureToModule.set(featureId, owningModule)\n    }\n    const dot = featureId.indexOf('.')\n    if (dot > 0) {\n      const prefix = featureId.slice(0, dot)\n      if (!prefixToModule.has(prefix)) prefixToModule.set(prefix, owningModule)\n    }\n  }\n\n  for (const mod of modules) {\n    const features = mod.features\n    if (Array.isArray(features)) {\n      for (const feature of features) {\n        if (!feature || typeof feature.id !== 'string' || !feature.id) continue\n        const declared = typeof feature.module === 'string' && feature.module.length > 0\n          ? feature.module\n          : mod.id\n        addConcreteFeature(feature.id, declared, true)\n      }\n    }\n\n    const customerDefaults = mod.setup?.defaultCustomerRoleFeatures\n    if (customerDefaults) {\n      for (const roleFeatures of Object.values(customerDefaults)) {\n        if (!Array.isArray(roleFeatures)) continue\n        for (const featureId of roleFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n\n    if (Array.isArray(mod.frontendRoutes)) {\n      for (const route of mod.frontendRoutes) {\n        if (!Array.isArray(route.requireCustomerFeatures)) continue\n        for (const featureId of route.requireCustomerFeatures) {\n          if (typeof featureId === 'string') addConcreteFeature(featureId, mod.id, false)\n        }\n      }\n    }\n  }\n  return {\n    enabledModuleIds,\n    enabledModuleSet,\n    featureToModule,\n    prefixToModule,\n    concreteFeatureIds,\n  }\n}\n\nfunction getRegistry(): FeatureRegistry | null {\n  try {\n    const modules = getModules() as readonly Module[]\n    if (cachedRegistry && cachedModulesRef === modules) return cachedRegistry\n    cachedModulesRef = modules\n    cachedRegistry = buildRegistry(modules)\n    return cachedRegistry\n  } catch {\n    return null\n  }\n}\n\nexport function getOwningModuleId(featureId: string): string {\n  const registry = getRegistry()\n  if (registry) {\n    const direct = registry.featureToModule.get(featureId)\n    if (direct) return direct\n    if (featureId.endsWith('.*')) {\n      const prefix = featureId.slice(0, -2)\n      const fromPrefix = registry.prefixToModule.get(prefix)\n      if (fromPrefix) return fromPrefix\n      return prefix\n    }\n  }\n  const dot = featureId.indexOf('.')\n  return dot === -1 ? featureId : featureId.slice(0, dot)\n}\n\nexport function getEnabledModuleIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.enabledModuleIds] : []\n}\n\n/** @internal Infrastructure input for concrete feature-policy projection. */\nexport function getConcreteFeatureIds(): string[] {\n  const registry = getRegistry()\n  return registry ? [...registry.concreteFeatureIds] : []\n}\n\n/** @internal Distinguishes an empty registry from an unavailable bootstrap registry. */\nexport function hasEnabledModulesRegistry(): boolean {\n  return getRegistry() !== null\n}\n\n/**\n * Filters a raw granted-features list down to the grants whose owning\n * module is currently enabled. Expands `*` (superadmin) into one wildcard\n * per enabled module so the result is still safe to feed into a pure\n * `matchFeature` check, plus one wildcard per off-convention feature\n * prefix (e.g. `analytics.*`) whose declared owning module is enabled.\n * If the module registry is not populated (tests, CLI), returns the input\n * unchanged \u2014 preserves legacy behavior.\n */\nexport function filterGrantsByEnabledModules(granted: readonly string[]): string[] {\n  const registry = getRegistry()\n  if (!registry) return [...granted]\n  const { enabledModuleIds, enabledModuleSet, prefixToModule } = registry\n  const result: string[] = []\n  for (const grant of granted) {\n    if (grant === '*') {\n      for (const id of enabledModuleIds) result.push(`${id}.*`)\n      for (const [prefix, owningModule] of prefixToModule) {\n        if (!enabledModuleSet.has(prefix) && enabledModuleSet.has(owningModule)) {\n          result.push(`${prefix}.*`)\n        }\n      }\n      continue\n    }\n    if (enabledModuleSet.has(getOwningModuleId(grant))) result.push(grant)\n  }\n  return result\n}\n"],
+  "mappings": "AAyBA,SAAS,kBAAkB;AAW3B,IAAI,iBAAyC;AAC7C,IAAI,mBAA6C;AAEjD,SAAS,cAAc,SAA6C;AAClE,QAAM,mBAAmB,QAAQ,IAAI,CAAC,QAAQ,IAAI,EAAE;AACpD,QAAM,mBAAmB,IAAI,IAAI,gBAAgB;AACjD,QAAM,kBAAkB,oBAAI,IAAoB;AAChD,QAAM,iBAAiB,oBAAI,IAAoB;AAC/C,QAAM,qBAA+B,CAAC;AACtC,QAAM,qBAAqB,oBAAI,IAAY;AAE3C,QAAM,qBAAqB,CAAC,WAAmB,cAAsB,kBAA2B;AAC9F,QAAI,CAAC,aAAa,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACjE,QAAI,CAAC,mBAAmB,IAAI,SAAS,GAAG;AACtC,yBAAmB,IAAI,SAAS;AAChC,yBAAmB,KAAK,SAAS;AAAA,IACnC;AACA,QAAI,iBAAiB,CAAC,gBAAgB,IAAI,SAAS,GAAG;AACpD,sBAAgB,IAAI,WAAW,YAAY;AAAA,IAC7C;AACA,UAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,QAAI,MAAM,GAAG;AACX,YAAM,SAAS,UAAU,MAAM,GAAG,GAAG;AACrC,UAAI,CAAC,eAAe,IAAI,MAAM,EAAG,gBAAe,IAAI,QAAQ,YAAY;AAAA,IAC1E;AAAA,EACF;AAEA,aAAW,OAAO,SAAS;AACzB,UAAM,WAAW,IAAI;AACrB,QAAI,MAAM,QAAQ,QAAQ,GAAG;AAC3B,iBAAW,WAAW,UAAU;AAC9B,YAAI,CAAC,WAAW,OAAO,QAAQ,OAAO,YAAY,CAAC,QAAQ,GAAI;AAC/D,cAAM,WAAW,OAAO,QAAQ,WAAW,YAAY,QAAQ,OAAO,SAAS,IAC3E,QAAQ,SACR,IAAI;AACR,2BAAmB,QAAQ,IAAI,UAAU,IAAI;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,mBAAmB,IAAI,OAAO;AACpC,QAAI,kBAAkB;AACpB,iBAAW,gBAAgB,OAAO,OAAO,gBAAgB,GAAG;AAC1D,YAAI,CAAC,MAAM,QAAQ,YAAY,EAAG;AAClC,mBAAW,aAAa,cAAc;AACpC,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,MAAM,QAAQ,IAAI,cAAc,GAAG;AACrC,iBAAW,SAAS,IAAI,gBAAgB;AACtC,YAAI,CAAC,MAAM,QAAQ,MAAM,uBAAuB,EAAG;AACnD,mBAAW,aAAa,MAAM,yBAAyB;AACrD,cAAI,OAAO,cAAc,SAAU,oBAAmB,WAAW,IAAI,IAAI,KAAK;AAAA,QAChF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,cAAsC;AAC7C,MAAI;AACF,UAAM,UAAU,WAAW;AAC3B,QAAI,kBAAkB,qBAAqB,QAAS,QAAO;AAC3D,uBAAmB;AACnB,qBAAiB,cAAc,OAAO;AACtC,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,kBAAkB,WAA2B;AAC3D,QAAM,WAAW,YAAY;AAC7B,MAAI,UAAU;AACZ,UAAM,SAAS,SAAS,gBAAgB,IAAI,SAAS;AACrD,QAAI,OAAQ,QAAO;AACnB,QAAI,UAAU,SAAS,IAAI,GAAG;AAC5B,YAAM,SAAS,UAAU,MAAM,GAAG,EAAE;AACpC,YAAM,aAAa,SAAS,eAAe,IAAI,MAAM;AACrD,UAAI,WAAY,QAAO;AACvB,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,MAAM,UAAU,QAAQ,GAAG;AACjC,SAAO,QAAQ,KAAK,YAAY,UAAU,MAAM,GAAG,GAAG;AACxD;AAEO,SAAS,sBAAgC;AAC9C,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,gBAAgB,IAAI,CAAC;AACtD;AAGO,SAAS,wBAAkC;AAChD,QAAM,WAAW,YAAY;AAC7B,SAAO,WAAW,CAAC,GAAG,SAAS,kBAAkB,IAAI,CAAC;AACxD;AAGO,SAAS,4BAAqC;AACnD,SAAO,YAAY,MAAM;AAC3B;AAWO,SAAS,6BAA6B,SAAsC;AACjF,QAAM,WAAW,YAAY;AAC7B,MAAI,CAAC,SAAU,QAAO,CAAC,GAAG,OAAO;AACjC,QAAM,EAAE,kBAAkB,kBAAkB,eAAe,IAAI;AAC/D,QAAM,SAAmB,CAAC;AAC1B,aAAW,SAAS,SAAS;AAC3B,QAAI,UAAU,KAAK;AACjB,iBAAW,MAAM,iBAAkB,QAAO,KAAK,GAAG,EAAE,IAAI;AACxD,iBAAW,CAAC,QAAQ,YAAY,KAAK,gBAAgB;AACnD,YAAI,CAAC,iBAAiB,IAAI,MAAM,KAAK,iBAAiB,IAAI,YAAY,GAAG;AACvE,iBAAO,KAAK,GAAG,MAAM,IAAI;AAAA,QAC3B;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,iBAAiB,IAAI,kBAAkB,KAAK,CAAC,EAAG,QAAO,KAAK,KAAK;AAAA,EACvE;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/security/featurePolicy.js

@@ -0,0 +1,62 @@
+import { hasAllFeatures as matchesAllFeatures } from "./features.js";
+import {
+  filterGrantsByEnabledModules,
+  getConcreteFeatureIds,
+  getEnabledModuleIds,
+  getOwningModuleId,
+  hasEnabledModulesRegistry
+} from "./enabledModulesRegistry.js";
+import { composeAclFeatureOverrides } from "../modules/overrides.js";
+function getRemovedAclFeatureIds() {
+  return Object.entries(composeAclFeatureOverrides()).filter(([, override]) => override === null).map(([featureId]) => featureId);
+}
+function isAclFeatureRemoved(featureId) {
+  return composeAclFeatureOverrides()[featureId] === null;
+}
+function isFeatureEnabled(featureId) {
+  if (!hasEnabledModulesRegistry()) return true;
+  const enabledModuleIds = getEnabledModuleIds();
+  return enabledModuleIds.includes(getOwningModuleId(featureId));
+}
+function authorizeFeatures(required, subject) {
+  if (required.length === 0) return true;
+  if (subject.scopeAllowed === false) return false;
+  if (required.some((featureId) => isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId))) {
+    return false;
+  }
+  if (subject.unrestricted === true) return true;
+  return matchesAllFeatures(
+    filterGrantsByEnabledModules(subject.grantedFeatures),
+    required
+  );
+}
+function resolveEffectiveFeatures(grantedFeatures) {
+  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures).filter((featureId) => !isAclFeatureRemoved(featureId));
+  if (!hasEnabledModulesRegistry()) {
+    return filteredGrants.filter((featureId, index, features) => featureId !== "*" && !featureId.endsWith(".*") && features.indexOf(featureId) === index);
+  }
+  const result = [];
+  const seen = /* @__PURE__ */ new Set();
+  const addFeature = (featureId) => {
+    if (seen.has(featureId) || isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)) {
+      return;
+    }
+    seen.add(featureId);
+    result.push(featureId);
+  };
+  for (const featureId of getConcreteFeatureIds()) {
+    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId);
+  }
+  for (const featureId of filteredGrants) {
+    if (featureId === "*" || featureId.endsWith(".*")) continue;
+    addFeature(featureId);
+  }
+  return result;
+}
+export {
+  authorizeFeatures,
+  getRemovedAclFeatureIds,
+  isAclFeatureRemoved,
+  resolveEffectiveFeatures
+};
+//# sourceMappingURL=featurePolicy.js.map

package/dist/security/featurePolicy.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/security/featurePolicy.ts"],
+  "sourcesContent": ["import { hasAllFeatures as matchesAllFeatures } from './features'\nimport {\n  filterGrantsByEnabledModules,\n  getConcreteFeatureIds,\n  getEnabledModuleIds,\n  getOwningModuleId,\n  hasEnabledModulesRegistry,\n} from './enabledModulesRegistry'\nimport { composeAclFeatureOverrides } from '../modules/overrides'\n\nexport type FeaturePolicySubject = {\n  grantedFeatures: readonly string[]\n  unrestricted?: boolean\n  scopeAllowed?: boolean\n}\n\nexport function getRemovedAclFeatureIds(): string[] {\n  return Object.entries(composeAclFeatureOverrides())\n    .filter(([, override]) => override === null)\n    .map(([featureId]) => featureId)\n}\n\nexport function isAclFeatureRemoved(featureId: string): boolean {\n  return composeAclFeatureOverrides()[featureId] === null\n}\n\nfunction isFeatureEnabled(featureId: string): boolean {\n  if (!hasEnabledModulesRegistry()) return true\n  const enabledModuleIds = getEnabledModuleIds()\n  return enabledModuleIds.includes(getOwningModuleId(featureId))\n}\n\nexport function authorizeFeatures(\n  required: readonly string[],\n  subject: FeaturePolicySubject,\n): boolean {\n  if (required.length === 0) return true\n  if (subject.scopeAllowed === false) return false\n  if (required.some((featureId) => (\n    isAclFeatureRemoved(featureId) || !isFeatureEnabled(featureId)\n  ))) {\n    return false\n  }\n  if (subject.unrestricted === true) return true\n  return matchesAllFeatures(\n    filterGrantsByEnabledModules(subject.grantedFeatures),\n    required,\n  )\n}\n\nexport function resolveEffectiveFeatures(\n  grantedFeatures: readonly string[],\n): string[] {\n  const filteredGrants = filterGrantsByEnabledModules(grantedFeatures)\n    .filter((featureId) => !isAclFeatureRemoved(featureId))\n\n  if (!hasEnabledModulesRegistry()) {\n    return filteredGrants.filter((featureId, index, features) => (\n      featureId !== '*'\n      && !featureId.endsWith('.*')\n      && features.indexOf(featureId) === index\n    ))\n  }\n\n  const result: string[] = []\n  const seen = new Set<string>()\n  const addFeature = (featureId: string) => {\n    if (\n      seen.has(featureId)\n      || isAclFeatureRemoved(featureId)\n      || !isFeatureEnabled(featureId)\n    ) {\n      return\n    }\n    seen.add(featureId)\n    result.push(featureId)\n  }\n\n  for (const featureId of getConcreteFeatureIds()) {\n    if (matchesAllFeatures(filteredGrants, [featureId])) addFeature(featureId)\n  }\n\n  for (const featureId of filteredGrants) {\n    if (featureId === '*' || featureId.endsWith('.*')) continue\n    addFeature(featureId)\n  }\n\n  return result\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB,0BAA0B;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAQpC,SAAS,0BAAoC;AAClD,SAAO,OAAO,QAAQ,2BAA2B,CAAC,EAC/C,OAAO,CAAC,CAAC,EAAE,QAAQ,MAAM,aAAa,IAAI,EAC1C,IAAI,CAAC,CAAC,SAAS,MAAM,SAAS;AACnC;AAEO,SAAS,oBAAoB,WAA4B;AAC9D,SAAO,2BAA2B,EAAE,SAAS,MAAM;AACrD;AAEA,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,0BAA0B,EAAG,QAAO;AACzC,QAAM,mBAAmB,oBAAoB;AAC7C,SAAO,iBAAiB,SAAS,kBAAkB,SAAS,CAAC;AAC/D;AAEO,SAAS,kBACd,UACA,SACS;AACT,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,MAAI,QAAQ,iBAAiB,MAAO,QAAO;AAC3C,MAAI,SAAS,KAAK,CAAC,cACjB,oBAAoB,SAAS,KAAK,CAAC,iBAAiB,SAAS,CAC9D,GAAG;AACF,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,iBAAiB,KAAM,QAAO;AAC1C,SAAO;AAAA,IACL,6BAA6B,QAAQ,eAAe;AAAA,IACpD;AAAA,EACF;AACF;AAEO,SAAS,yBACd,iBACU;AACV,QAAM,iBAAiB,6BAA6B,eAAe,EAChE,OAAO,CAAC,cAAc,CAAC,oBAAoB,SAAS,CAAC;AAExD,MAAI,CAAC,0BAA0B,GAAG;AAChC,WAAO,eAAe,OAAO,CAAC,WAAW,OAAO,aAC9C,cAAc,OACX,CAAC,UAAU,SAAS,IAAI,KACxB,SAAS,QAAQ,SAAS,MAAM,KACpC;AAAA,EACH;AAEA,QAAM,SAAmB,CAAC;AAC1B,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,aAAa,CAAC,cAAsB;AACxC,QACE,KAAK,IAAI,SAAS,KACf,oBAAoB,SAAS,KAC7B,CAAC,iBAAiB,SAAS,GAC9B;AACA;AAAA,IACF;AACA,SAAK,IAAI,SAAS;AAClB,WAAO,KAAK,SAAS;AAAA,EACvB;AAEA,aAAW,aAAa,sBAAsB,GAAG;AAC/C,QAAI,mBAAmB,gBAAgB,CAAC,SAAS,CAAC,EAAG,YAAW,SAAS;AAAA,EAC3E;AAEA,aAAW,aAAa,gBAAgB;AACtC,QAAI,cAAc,OAAO,UAAU,SAAS,IAAI,EAAG;AACnD,eAAW,SAAS;AAAA,EACtB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/jest.config.cjs

@@ -12,7 +12,8 @@ module.exports = {
     '^@open-mercato/core/(.*)$': '<rootDir>/../core/src/$1',
   },
   transform: {
-    '^.+\\.(t|j)sx?$': [
+    // `.cjs` is included so the build-time source emitters under scripts/ are testable.
+    '^.+\\.(cjs|(t|j)sx?)$': [
       '<rootDir>/../../scripts/jest-mikroorm-transformer.cjs',
       {
         tsconfig: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7",
+  "version": "0.6.8-develop.6874.1.982d6097d8",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -48,10 +48,18 @@
       "types": "./src/lib/events/patterns.ts",
       "default": "./dist/lib/events/patterns.js"
     },
+    "./lib/data/consistency": {
+      "types": "./src/lib/data/consistency.ts",
+      "default": "./dist/lib/data/consistency.js"
+    },
     "./lib/logger": {
       "types": "./src/lib/logger/index.ts",
       "default": "./dist/lib/logger/index.js"
     },
+    "./lib/search/tokenLookup": {
+      "types": "./src/lib/search/tokenLookup.ts",
+      "default": "./dist/lib/search/tokenLookup.js"
+    },
     "./modules/generators": {
       "types": "./src/modules/generators/index.ts",
       "default": "./dist/modules/generators/index.js"
@@ -94,23 +102,24 @@
     }
   },
   "dependencies": {
-    "@mikro-orm/core": "^7.1.5",
-    "@mikro-orm/decorators": "^7.1.5",
-    "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7",
+    "@mikro-orm/core": "^7.1.8",
+    "@mikro-orm/decorators": "^7.1.8",
+    "@mikro-orm/postgresql": "^7.1.8",
+    "@open-mercato/cache": "0.6.8-develop.6874.1.982d6097d8",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",
     "rate-limiter-flexible": "^11.2.0",
     "re2js": "2.8.6",
     "reflect-metadata": "^0.2.2",
-    "sanitize-html": "^2.17.5",
-    "undici": "^8.7.0"
+    "sanitize-html": "2.17.5",
+    "undici": "^8.9.0"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
-    "ts-jest": "^29.4.11",
+    "ts-jest": "^29.4.12",
+    "ts-morph": "^28.0.0",
     "typescript": "7.0.2"
   },
   "publishConfig": {
@@ -120,5 +129,6 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/shared"
-  }
+  },
+  "stableVersion": "0.6.7"
 }