@open-mercato/shared 0.7.1-develop.7153.1.7145d295e6 → 0.7.1-develop.7170.1.d95074d7ba

package/dist/lib/db/pg-errors.js

@@ -5,6 +5,42 @@ function isUniqueViolation(err) {
   const message = err.message;
   return typeof message === "string" && /duplicate key value|unique constraint/i.test(message);
 }
+const FOREIGN_KEY_VIOLATION_MESSAGE = /violates foreign key constraint(?: "([^"]+)")?/i;
+const MAX_ERROR_CHAIN_DEPTH = 4;
+function pgErrorCandidates(err) {
+  const found = [];
+  const seen = /* @__PURE__ */ new Set();
+  let layer = [err];
+  for (let depth = 0; depth < MAX_ERROR_CHAIN_DEPTH && layer.length > 0; depth += 1) {
+    const next = [];
+    for (const candidate of layer) {
+      if (!candidate || typeof candidate !== "object" || seen.has(candidate)) continue;
+      seen.add(candidate);
+      const record = candidate;
+      found.push(record);
+      next.push(record.cause, record.previous);
+    }
+    layer = next;
+  }
+  return found;
+}
+function isForeignKeyViolation(err) {
+  return pgErrorCandidates(err).some((candidate) => {
+    if (candidate.code === "23503") return true;
+    return typeof candidate.message === "string" && FOREIGN_KEY_VIOLATION_MESSAGE.test(candidate.message);
+  });
+}
+function getForeignKeyViolationConstraint(err) {
+  for (const candidate of pgErrorCandidates(err)) {
+    if (typeof candidate.constraint === "string" && candidate.constraint.length > 0) return candidate.constraint;
+  }
+  for (const candidate of pgErrorCandidates(err)) {
+    if (typeof candidate.message !== "string") continue;
+    const match = FOREIGN_KEY_VIOLATION_MESSAGE.exec(candidate.message);
+    if (match?.[1]) return match[1];
+  }
+  return null;
+}
 const TRANSIENT_CONNECTION_SQLSTATES = /* @__PURE__ */ new Set([
   "53300",
   // too_many_connections
@@ -47,6 +83,8 @@ function isTransientDbError(err) {
   return false;
 }
 export {
+  getForeignKeyViolationConstraint,
+  isForeignKeyViolation,
   isTransientDbError,
   isUniqueViolation
 };

package/dist/lib/db/pg-errors.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/db/pg-errors.ts"],
-  "sourcesContent": ["/**\n * Detect a Postgres unique-constraint violation (SQLSTATE 23505) regardless of\n * the ORM/driver layer that surfaces it. Shared across modules so duplicate-insert\n * handling stays consistent platform-wide.\n */\nexport function isUniqueViolation(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const code = (err as { code?: string }).code\n  if (code === '23505') return true // Postgres unique_violation\n  const message = (err as { message?: string }).message\n  return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)\n}\n\n/**\n * Postgres SQLSTATEs for transient connection / availability failures \u2014 the\n * database (or its connection pool) is temporarily unreachable and the request\n * can succeed on retry. Deliberately scoped to connection/availability codes;\n * query-level conflicts (deadlock 40P01, serialization 40001, lock_not_available\n * 55P03) are NOT included because they do not mean \"service unavailable\".\n */\nconst TRANSIENT_CONNECTION_SQLSTATES = new Set([\n  '53300', // too_many_connections\n  '53400', // configuration_limit_exceeded\n  '57P01', // admin_shutdown\n  '57P02', // crash_shutdown\n  '57P03', // cannot_connect_now (db starting up)\n  '08000', // connection_exception\n  '08001', // sqlclient_unable_to_establish_sqlconnection\n  '08003', // connection_does_not_exist\n  '08006', // connection_failure\n])\n\n/**\n * Postgres-driver / connection-pool messages that describe a transient DB\n * connection failure when the SQLSTATE is dropped by the ORM wrapper. These are\n * intentionally DB-specific phrases only. Bare socket codes (ECONNREFUSED,\n * ETIMEDOUT, \u2026) are deliberately NOT matched: they can originate from any\n * outbound socket (HTTP, cache, queue), so keying off them would falsely\n * attribute unrelated failures to the database.\n */\nconst TRANSIENT_DB_MESSAGE_PATTERNS = [\n  /too many clients already/i,\n  /unable to acquire a connection/i,\n  /timeout acquiring a connection/i,\n  /connection terminated/i,\n  /the database system is (starting up|shutting down|in recovery)/i,\n]\n\n/**\n * Detect a transient Postgres connection / availability failure (pool exhaustion,\n * `max_connections` reached, DB restarting) via its SQLSTATE or a DB-specific\n * driver message. Gates retryable 503 responses so callers do not report a\n * temporary infrastructure blip as an auth failure (401) or an unexpected server\n * error (500). Scoped to unambiguous DB signals so generic socket errors from\n * non-DB calls are never misclassified.\n */\nexport function isTransientDbError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') {\n    return false\n  }\n  const code = (err as { code?: string }).code\n  if (typeof code === 'string' && TRANSIENT_CONNECTION_SQLSTATES.has(code)) {\n    return true\n  }\n  const message = (err as { message?: string }).message\n  if (typeof message === 'string' && TRANSIENT_DB_MESSAGE_PATTERNS.some((pattern) => pattern.test(message))) {\n    return true\n  }\n  return false\n}\n"],
-  "mappings": "AAKO,SAAS,kBAAkB,KAAuB;AACvD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,OAAQ,IAA0B;AACxC,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,UAAW,IAA6B;AAC9C,SAAO,OAAO,YAAY,YAAY,yCAAyC,KAAK,OAAO;AAC7F;AASA,MAAM,iCAAiC,oBAAI,IAAI;AAAA,EAC7C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAUD,MAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,SAAS,mBAAmB,KAAuB;AACxD,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,IAA0B;AACxC,MAAI,OAAO,SAAS,YAAY,+BAA+B,IAAI,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AACA,QAAM,UAAW,IAA6B;AAC9C,MAAI,OAAO,YAAY,YAAY,8BAA8B,KAAK,CAAC,YAAY,QAAQ,KAAK,OAAO,CAAC,GAAG;AACzG,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
+  "sourcesContent": ["/**\n * Detect a Postgres unique-constraint violation (SQLSTATE 23505) regardless of\n * the ORM/driver layer that surfaces it. Shared across modules so duplicate-insert\n * handling stays consistent platform-wide.\n */\nexport function isUniqueViolation(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const code = (err as { code?: string }).code\n  if (code === '23505') return true // Postgres unique_violation\n  const message = (err as { message?: string }).message\n  return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)\n}\n\nconst FOREIGN_KEY_VIOLATION_MESSAGE = /violates foreign key constraint(?: \"([^\"]+)\")?/i\n\nconst MAX_ERROR_CHAIN_DEPTH = 4\n\n/**\n * MikroORM wraps driver errors and copies the pg fields onto the wrapper, but\n * the original error may also sit behind `cause` (Node) or `previous`\n * (MikroORM), possibly re-wrapped by a transaction helper. Walk that chain,\n * breadth-first with a small depth cap, so a check works on any layer.\n */\nfunction pgErrorCandidates(err: unknown): Array<Record<string, unknown>> {\n  const found: Array<Record<string, unknown>> = []\n  const seen = new Set<unknown>()\n  let layer: unknown[] = [err]\n  for (let depth = 0; depth < MAX_ERROR_CHAIN_DEPTH && layer.length > 0; depth += 1) {\n    const next: unknown[] = []\n    for (const candidate of layer) {\n      if (!candidate || typeof candidate !== 'object' || seen.has(candidate)) continue\n      seen.add(candidate)\n      const record = candidate as Record<string, unknown>\n      found.push(record)\n      next.push(record.cause, record.previous)\n    }\n    layer = next\n  }\n  return found\n}\n\n/**\n * Detect a Postgres foreign-key violation (SQLSTATE 23503): the row is still\n * referenced by a dependent table, or the payload references a parent that\n * does not exist. Looks through MikroORM's driver-error wrapping.\n */\nexport function isForeignKeyViolation(err: unknown): boolean {\n  return pgErrorCandidates(err).some((candidate) => {\n    if (candidate.code === '23503') return true // Postgres foreign_key_violation\n    return typeof candidate.message === 'string' && FOREIGN_KEY_VIOLATION_MESSAGE.test(candidate.message)\n  })\n}\n\n/**\n * Name of the constraint behind a foreign-key violation, read from the pg\n * `constraint` field on any layer of the wrapper chain, or parsed out of the\n * quoted constraint in the driver message when the field is missing.\n */\nexport function getForeignKeyViolationConstraint(err: unknown): string | null {\n  for (const candidate of pgErrorCandidates(err)) {\n    if (typeof candidate.constraint === 'string' && candidate.constraint.length > 0) return candidate.constraint\n  }\n  for (const candidate of pgErrorCandidates(err)) {\n    if (typeof candidate.message !== 'string') continue\n    const match = FOREIGN_KEY_VIOLATION_MESSAGE.exec(candidate.message)\n    if (match?.[1]) return match[1]\n  }\n  return null\n}\n\n/**\n * Postgres SQLSTATEs for transient connection / availability failures \u2014 the\n * database (or its connection pool) is temporarily unreachable and the request\n * can succeed on retry. Deliberately scoped to connection/availability codes;\n * query-level conflicts (deadlock 40P01, serialization 40001, lock_not_available\n * 55P03) are NOT included because they do not mean \"service unavailable\".\n */\nconst TRANSIENT_CONNECTION_SQLSTATES = new Set([\n  '53300', // too_many_connections\n  '53400', // configuration_limit_exceeded\n  '57P01', // admin_shutdown\n  '57P02', // crash_shutdown\n  '57P03', // cannot_connect_now (db starting up)\n  '08000', // connection_exception\n  '08001', // sqlclient_unable_to_establish_sqlconnection\n  '08003', // connection_does_not_exist\n  '08006', // connection_failure\n])\n\n/**\n * Postgres-driver / connection-pool messages that describe a transient DB\n * connection failure when the SQLSTATE is dropped by the ORM wrapper. These are\n * intentionally DB-specific phrases only. Bare socket codes (ECONNREFUSED,\n * ETIMEDOUT, \u2026) are deliberately NOT matched: they can originate from any\n * outbound socket (HTTP, cache, queue), so keying off them would falsely\n * attribute unrelated failures to the database.\n */\nconst TRANSIENT_DB_MESSAGE_PATTERNS = [\n  /too many clients already/i,\n  /unable to acquire a connection/i,\n  /timeout acquiring a connection/i,\n  /connection terminated/i,\n  /the database system is (starting up|shutting down|in recovery)/i,\n]\n\n/**\n * Detect a transient Postgres connection / availability failure (pool exhaustion,\n * `max_connections` reached, DB restarting) via its SQLSTATE or a DB-specific\n * driver message. Gates retryable 503 responses so callers do not report a\n * temporary infrastructure blip as an auth failure (401) or an unexpected server\n * error (500). Scoped to unambiguous DB signals so generic socket errors from\n * non-DB calls are never misclassified.\n */\nexport function isTransientDbError(err: unknown): boolean {\n  if (!err || typeof err !== 'object') {\n    return false\n  }\n  const code = (err as { code?: string }).code\n  if (typeof code === 'string' && TRANSIENT_CONNECTION_SQLSTATES.has(code)) {\n    return true\n  }\n  const message = (err as { message?: string }).message\n  if (typeof message === 'string' && TRANSIENT_DB_MESSAGE_PATTERNS.some((pattern) => pattern.test(message))) {\n    return true\n  }\n  return false\n}\n"],
+  "mappings": "AAKO,SAAS,kBAAkB,KAAuB;AACvD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,OAAQ,IAA0B;AACxC,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,UAAW,IAA6B;AAC9C,SAAO,OAAO,YAAY,YAAY,yCAAyC,KAAK,OAAO;AAC7F;AAEA,MAAM,gCAAgC;AAEtC,MAAM,wBAAwB;AAQ9B,SAAS,kBAAkB,KAA8C;AACvE,QAAM,QAAwC,CAAC;AAC/C,QAAM,OAAO,oBAAI,IAAa;AAC9B,MAAI,QAAmB,CAAC,GAAG;AAC3B,WAAS,QAAQ,GAAG,QAAQ,yBAAyB,MAAM,SAAS,GAAG,SAAS,GAAG;AACjF,UAAM,OAAkB,CAAC;AACzB,eAAW,aAAa,OAAO;AAC7B,UAAI,CAAC,aAAa,OAAO,cAAc,YAAY,KAAK,IAAI,SAAS,EAAG;AACxE,WAAK,IAAI,SAAS;AAClB,YAAM,SAAS;AACf,YAAM,KAAK,MAAM;AACjB,WAAK,KAAK,OAAO,OAAO,OAAO,QAAQ;AAAA,IACzC;AACA,YAAQ;AAAA,EACV;AACA,SAAO;AACT;AAOO,SAAS,sBAAsB,KAAuB;AAC3D,SAAO,kBAAkB,GAAG,EAAE,KAAK,CAAC,cAAc;AAChD,QAAI,UAAU,SAAS,QAAS,QAAO;AACvC,WAAO,OAAO,UAAU,YAAY,YAAY,8BAA8B,KAAK,UAAU,OAAO;AAAA,EACtG,CAAC;AACH;AAOO,SAAS,iCAAiC,KAA6B;AAC5E,aAAW,aAAa,kBAAkB,GAAG,GAAG;AAC9C,QAAI,OAAO,UAAU,eAAe,YAAY,UAAU,WAAW,SAAS,EAAG,QAAO,UAAU;AAAA,EACpG;AACA,aAAW,aAAa,kBAAkB,GAAG,GAAG;AAC9C,QAAI,OAAO,UAAU,YAAY,SAAU;AAC3C,UAAM,QAAQ,8BAA8B,KAAK,UAAU,OAAO;AAClE,QAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC;AAAA,EAChC;AACA,SAAO;AACT;AASA,MAAM,iCAAiC,oBAAI,IAAI;AAAA,EAC7C;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AAAA,EACA;AAAA;AACF,CAAC;AAUD,MAAM,gCAAgC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAUO,SAAS,mBAAmB,KAAuB;AACxD,MAAI,CAAC,OAAO,OAAO,QAAQ,UAAU;AACnC,WAAO;AAAA,EACT;AACA,QAAM,OAAQ,IAA0B;AACxC,MAAI,OAAO,SAAS,YAAY,+BAA+B,IAAI,IAAI,GAAG;AACxE,WAAO;AAAA,EACT;AACA,QAAM,UAAW,IAA6B;AAC9C,MAAI,OAAO,YAAY,YAAY,8BAA8B,KAAK,CAAC,YAAY,QAAQ,KAAK,OAAO,CAAC,GAAG;AACzG,WAAO;AAAA,EACT;AACA,SAAO;AACT;",
   "names": []
 }

package/dist/lib/number.js

@@ -1,3 +1,67 @@
+const DEFAULT_SEPARATORS = { group: ",", decimal: "." };
+const separatorCache = /* @__PURE__ */ new Map();
+const UNICODE_MINUS_SIGNS = /[−‒–—]/g;
+const GROUP_LIKE_CHARACTER = /[\s'’ʼ]/;
+const GROUP_LIKE_SEPARATOR_IN_POSITION = /(\d)[\s'’ʼ](?=\d{3}(?!\d))/g;
+const NORMALIZED_NUMBER = /^[+-]?(\d+(\.\d*)?|\.\d+)(e[+-]?\d+)?$/i;
+function resolveLocaleNumberSeparators(locale) {
+  const cacheKey = locale ?? "";
+  const cached = separatorCache.get(cacheKey);
+  if (cached) return cached;
+  let resolved = DEFAULT_SEPARATORS;
+  try {
+    const parts = new Intl.NumberFormat(locale, {
+      useGrouping: true,
+      minimumFractionDigits: 1
+    }).formatToParts(12345.6);
+    const group = parts.find((part) => part.type === "group")?.value ?? DEFAULT_SEPARATORS.group;
+    const decimal = parts.find((part) => part.type === "decimal")?.value ?? DEFAULT_SEPARATORS.decimal;
+    resolved = { group, decimal };
+  } catch {
+    resolved = DEFAULT_SEPARATORS;
+  }
+  separatorCache.set(cacheKey, resolved);
+  return resolved;
+}
+function isValidGrouping(integerPart, separator) {
+  const digits = integerPart.replace(/^[+-]/, "");
+  const segments = digits.split(separator);
+  if (segments.length < 2) return true;
+  const [first, ...rest] = segments;
+  if (!/^\d{1,3}$/.test(first)) return false;
+  return rest.every((segment) => /^\d{3}$/.test(segment));
+}
+function parseLocaleNumber(input, locale) {
+  if (input == null) return null;
+  const trimmed = input.trim();
+  if (!trimmed) return null;
+  const { group } = resolveLocaleNumberSeparators(locale);
+  let candidate = trimmed.replace(UNICODE_MINUS_SIGNS, "-");
+  if (group && group !== "," && group !== "." && !GROUP_LIKE_CHARACTER.test(group)) {
+    candidate = candidate.split(group).join(" ");
+  }
+  candidate = candidate.replace(GROUP_LIKE_SEPARATOR_IN_POSITION, "$1");
+  if (!candidate) return null;
+  const hasComma = candidate.includes(",");
+  const hasDot = candidate.includes(".");
+  let decimalSeparator = null;
+  if (hasComma && hasDot) {
+    decimalSeparator = candidate.lastIndexOf(",") > candidate.lastIndexOf(".") ? "," : ".";
+  } else if (hasComma || hasDot) {
+    const separator = hasComma ? "," : ".";
+    const segments = candidate.split(separator);
+    decimalSeparator = segments.length > 2 ? null : separator;
+  }
+  const groupSeparator = decimalSeparator ? decimalSeparator === "," ? "." : "," : hasComma ? "," : ".";
+  const [integerPart, ...fractionParts] = decimalSeparator ? candidate.split(decimalSeparator) : [candidate];
+  if (fractionParts.length > 1) return null;
+  if (!isValidGrouping(integerPart, groupSeparator)) return null;
+  if (fractionParts.length && fractionParts[0].includes(groupSeparator)) return null;
+  const normalized = `${integerPart.split(groupSeparator).join("")}${fractionParts.length ? `.${fractionParts[0]}` : ""}`;
+  if (!NORMALIZED_NUMBER.test(normalized)) return null;
+  const parsed = Number(normalized);
+  return Number.isFinite(parsed) ? parsed : null;
+}
 function parseNumberWithDefault(raw, fallback, options) {
   if (raw == null) return fallback;
   const trimmed = raw.trim();
@@ -9,6 +73,8 @@ function parseNumberWithDefault(raw, fallback, options) {
   return value;
 }
 export {
-  parseNumberWithDefault
+  parseLocaleNumber,
+  parseNumberWithDefault,
+  resolveLocaleNumberSeparators
 };
 //# sourceMappingURL=number.js.map

package/dist/lib/number.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/number.ts"],
-  "sourcesContent": ["export function parseNumberWithDefault(\n  raw: string | null | undefined,\n  fallback: number,\n  options?: { min?: number; integer?: boolean },\n): number {\n  if (raw == null) return fallback\n  const trimmed = raw.trim()\n  if (!trimmed) return fallback\n  const value = options?.integer ? Number.parseInt(trimmed, 10) : Number(trimmed)\n  if (!Number.isFinite(value)) return fallback\n  const min = options?.min ?? -Infinity\n  if (value < min) return fallback\n  return value\n}\n"],
-  "mappings": "AAAO,SAAS,uBACd,KACA,UACA,SACQ;AACR,MAAI,OAAO,KAAM,QAAO;AACxB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,EAAE,IAAI,OAAO,OAAO;AAC9E,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,QAAM,MAAM,SAAS,OAAO;AAC5B,MAAI,QAAQ,IAAK,QAAO;AACxB,SAAO;AACT;",
+  "sourcesContent": ["type LocaleNumberSeparators = { group: string; decimal: string }\n\nconst DEFAULT_SEPARATORS: LocaleNumberSeparators = { group: ',', decimal: '.' }\nconst separatorCache = new Map<string, LocaleNumberSeparators>()\n\nconst UNICODE_MINUS_SIGNS = /[\u2212\u2012\u2013\u2014]/g\nconst GROUP_LIKE_CHARACTER = /[\\s'\u2019\u02BC]/\nconst GROUP_LIKE_SEPARATOR_IN_POSITION = /(\\d)[\\s'\u2019\u02BC](?=\\d{3}(?!\\d))/g\nconst NORMALIZED_NUMBER = /^[+-]?(\\d+(\\.\\d*)?|\\.\\d+)(e[+-]?\\d+)?$/i\n\n/**\n * Group and decimal separators the given locale uses, derived from `Intl` rather than\n * assumed, so grouping characters such as the narrow no-break space (`fr-FR`) are covered.\n */\nexport function resolveLocaleNumberSeparators(locale?: string): LocaleNumberSeparators {\n  const cacheKey = locale ?? ''\n  const cached = separatorCache.get(cacheKey)\n  if (cached) return cached\n  let resolved = DEFAULT_SEPARATORS\n  try {\n    const parts = new Intl.NumberFormat(locale, {\n      useGrouping: true,\n      minimumFractionDigits: 1,\n    }).formatToParts(12345.6)\n    const group = parts.find((part) => part.type === 'group')?.value ?? DEFAULT_SEPARATORS.group\n    const decimal = parts.find((part) => part.type === 'decimal')?.value ?? DEFAULT_SEPARATORS.decimal\n    resolved = { group, decimal }\n  } catch {\n    resolved = DEFAULT_SEPARATORS\n  }\n  separatorCache.set(cacheKey, resolved)\n  return resolved\n}\n\nfunction isValidGrouping(integerPart: string, separator: string): boolean {\n  const digits = integerPart.replace(/^[+-]/, '')\n  const segments = digits.split(separator)\n  if (segments.length < 2) return true\n  const [first, ...rest] = segments\n  if (!/^\\d{1,3}$/.test(first)) return false\n  return rest.every((segment) => /^\\d{3}$/.test(segment))\n}\n\n/**\n * Parses a user-typed number written in the conventions of `locale` \u2014 `110,70` under `pl-PL`,\n * `1 234,56` under `fr-FR`, `1,234.56` under `en-US`. Returns `null` when the input is not a\n * number, never a silent `0`, so callers can tell \"unparseable\" apart from \"zero\".\n *\n * Both `,` and `.` are accepted as the decimal separator whichever way the locale runs, because\n * users type the shape their keyboard offers. A SINGLE `,` or `.` is therefore always the decimal\n * point, in every locale: `1.500` is 1.5 under `de-DE` just as it is under `en-US`. Reading a lone\n * separator as grouping instead would turn `1.500` into 1500 with no visible cue \u2014 a silent 1000\u00D7\n * on a money field, and three- and four-decimal unit prices are ordinary here. Grouping is\n * recognized only where it is unambiguous: at least two separators (`1.234.567`), or a whitespace\n * or apostrophe separator standing in a valid group-of-three position (`1 234,56`, `1\u2019234.5`).\n * Whitespace and apostrophes anywhere else are not absorbed \u2014 `1 2` is rejected rather than read\n * as 12 \u2014 so a mistyped or pasted value surfaces as an error instead of a different number.\n *\n * Use it only on strings a user typed. Values arriving from an API or the database are already\n * numbers and MUST NOT go through it.\n */\nexport function parseLocaleNumber(input: string | null | undefined, locale?: string): number | null {\n  if (input == null) return null\n  const trimmed = input.trim()\n  if (!trimmed) return null\n\n  const { group } = resolveLocaleNumberSeparators(locale)\n  let candidate = trimmed.replace(UNICODE_MINUS_SIGNS, '-')\n  if (group && group !== ',' && group !== '.' && !GROUP_LIKE_CHARACTER.test(group)) {\n    candidate = candidate.split(group).join(' ')\n  }\n  candidate = candidate.replace(GROUP_LIKE_SEPARATOR_IN_POSITION, '$1')\n  if (!candidate) return null\n\n  const hasComma = candidate.includes(',')\n  const hasDot = candidate.includes('.')\n  let decimalSeparator: string | null = null\n  if (hasComma && hasDot) {\n    decimalSeparator = candidate.lastIndexOf(',') > candidate.lastIndexOf('.') ? ',' : '.'\n  } else if (hasComma || hasDot) {\n    const separator = hasComma ? ',' : '.'\n    const segments = candidate.split(separator)\n    decimalSeparator = segments.length > 2 ? null : separator\n  }\n\n  const groupSeparator = decimalSeparator\n    ? decimalSeparator === ','\n      ? '.'\n      : ','\n    : hasComma\n      ? ','\n      : '.'\n  const [integerPart, ...fractionParts] = decimalSeparator ? candidate.split(decimalSeparator) : [candidate]\n  if (fractionParts.length > 1) return null\n  if (!isValidGrouping(integerPart, groupSeparator)) return null\n  if (fractionParts.length && fractionParts[0].includes(groupSeparator)) return null\n\n  const normalized = `${integerPart.split(groupSeparator).join('')}${fractionParts.length ? `.${fractionParts[0]}` : ''}`\n  if (!NORMALIZED_NUMBER.test(normalized)) return null\n  const parsed = Number(normalized)\n  return Number.isFinite(parsed) ? parsed : null\n}\n\nexport function parseNumberWithDefault(\n  raw: string | null | undefined,\n  fallback: number,\n  options?: { min?: number; integer?: boolean },\n): number {\n  if (raw == null) return fallback\n  const trimmed = raw.trim()\n  if (!trimmed) return fallback\n  const value = options?.integer ? Number.parseInt(trimmed, 10) : Number(trimmed)\n  if (!Number.isFinite(value)) return fallback\n  const min = options?.min ?? -Infinity\n  if (value < min) return fallback\n  return value\n}\n"],
+  "mappings": "AAEA,MAAM,qBAA6C,EAAE,OAAO,KAAK,SAAS,IAAI;AAC9E,MAAM,iBAAiB,oBAAI,IAAoC;AAE/D,MAAM,sBAAsB;AAC5B,MAAM,uBAAuB;AAC7B,MAAM,mCAAmC;AACzC,MAAM,oBAAoB;AAMnB,SAAS,8BAA8B,QAAyC;AACrF,QAAM,WAAW,UAAU;AAC3B,QAAM,SAAS,eAAe,IAAI,QAAQ;AAC1C,MAAI,OAAQ,QAAO;AACnB,MAAI,WAAW;AACf,MAAI;AACF,UAAM,QAAQ,IAAI,KAAK,aAAa,QAAQ;AAAA,MAC1C,aAAa;AAAA,MACb,uBAAuB;AAAA,IACzB,CAAC,EAAE,cAAc,OAAO;AACxB,UAAM,QAAQ,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,OAAO,GAAG,SAAS,mBAAmB;AACvF,UAAM,UAAU,MAAM,KAAK,CAAC,SAAS,KAAK,SAAS,SAAS,GAAG,SAAS,mBAAmB;AAC3F,eAAW,EAAE,OAAO,QAAQ;AAAA,EAC9B,QAAQ;AACN,eAAW;AAAA,EACb;AACA,iBAAe,IAAI,UAAU,QAAQ;AACrC,SAAO;AACT;AAEA,SAAS,gBAAgB,aAAqB,WAA4B;AACxE,QAAM,SAAS,YAAY,QAAQ,SAAS,EAAE;AAC9C,QAAM,WAAW,OAAO,MAAM,SAAS;AACvC,MAAI,SAAS,SAAS,EAAG,QAAO;AAChC,QAAM,CAAC,OAAO,GAAG,IAAI,IAAI;AACzB,MAAI,CAAC,YAAY,KAAK,KAAK,EAAG,QAAO;AACrC,SAAO,KAAK,MAAM,CAAC,YAAY,UAAU,KAAK,OAAO,CAAC;AACxD;AAoBO,SAAS,kBAAkB,OAAkC,QAAgC;AAClG,MAAI,SAAS,KAAM,QAAO;AAC1B,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,EAAE,MAAM,IAAI,8BAA8B,MAAM;AACtD,MAAI,YAAY,QAAQ,QAAQ,qBAAqB,GAAG;AACxD,MAAI,SAAS,UAAU,OAAO,UAAU,OAAO,CAAC,qBAAqB,KAAK,KAAK,GAAG;AAChF,gBAAY,UAAU,MAAM,KAAK,EAAE,KAAK,GAAG;AAAA,EAC7C;AACA,cAAY,UAAU,QAAQ,kCAAkC,IAAI;AACpE,MAAI,CAAC,UAAW,QAAO;AAEvB,QAAM,WAAW,UAAU,SAAS,GAAG;AACvC,QAAM,SAAS,UAAU,SAAS,GAAG;AACrC,MAAI,mBAAkC;AACtC,MAAI,YAAY,QAAQ;AACtB,uBAAmB,UAAU,YAAY,GAAG,IAAI,UAAU,YAAY,GAAG,IAAI,MAAM;AAAA,EACrF,WAAW,YAAY,QAAQ;AAC7B,UAAM,YAAY,WAAW,MAAM;AACnC,UAAM,WAAW,UAAU,MAAM,SAAS;AAC1C,uBAAmB,SAAS,SAAS,IAAI,OAAO;AAAA,EAClD;AAEA,QAAM,iBAAiB,mBACnB,qBAAqB,MACnB,MACA,MACF,WACE,MACA;AACN,QAAM,CAAC,aAAa,GAAG,aAAa,IAAI,mBAAmB,UAAU,MAAM,gBAAgB,IAAI,CAAC,SAAS;AACzG,MAAI,cAAc,SAAS,EAAG,QAAO;AACrC,MAAI,CAAC,gBAAgB,aAAa,cAAc,EAAG,QAAO;AAC1D,MAAI,cAAc,UAAU,cAAc,CAAC,EAAE,SAAS,cAAc,EAAG,QAAO;AAE9E,QAAM,aAAa,GAAG,YAAY,MAAM,cAAc,EAAE,KAAK,EAAE,CAAC,GAAG,cAAc,SAAS,IAAI,cAAc,CAAC,CAAC,KAAK,EAAE;AACrH,MAAI,CAAC,kBAAkB,KAAK,UAAU,EAAG,QAAO;AAChD,QAAM,SAAS,OAAO,UAAU;AAChC,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEO,SAAS,uBACd,KACA,UACA,SACQ;AACR,MAAI,OAAO,KAAM,QAAO;AACxB,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,QAAQ,SAAS,UAAU,OAAO,SAAS,SAAS,EAAE,IAAI,OAAO,OAAO;AAC9E,MAAI,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO;AACpC,QAAM,MAAM,SAAS,OAAO;AAC5B,MAAI,QAAQ,IAAK,QAAO;AACxB,SAAO;AACT;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.7.1-develop.7153.1.7145d295e6";
+const APP_VERSION = "0.7.1-develop.7170.1.d95074d7ba";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7153.1.7145d295e6';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7170.1.d95074d7ba';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.7.1-develop.7153.1.7145d295e6",
+  "version": "0.7.1-develop.7170.1.d95074d7ba",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -113,7 +113,7 @@
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/cache": "0.7.1-develop.7153.1.7145d295e6",
+    "@open-mercato/cache": "0.7.1-develop.7170.1.d95074d7ba",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/__tests__/number.test.ts

@@ -1,4 +1,4 @@
-import { parseNumberWithDefault } from '../number'
+import { parseLocaleNumber, parseNumberWithDefault, resolveLocaleNumberSeparators } from '../number'
 
 describe('parseNumberWithDefault', () => {
   it('returns the fallback when raw is missing or blank', () => {
@@ -31,3 +31,93 @@ describe('parseNumberWithDefault', () => {
     expect(parseNumberWithDefault('-5', 0)).toBe(-5)
   })
 })
+
+describe('resolveLocaleNumberSeparators', () => {
+  it('derives the separators from Intl rather than assuming a comma/dot pair', () => {
+    expect(resolveLocaleNumberSeparators('en-US')).toEqual({ group: ',', decimal: '.' })
+    expect(resolveLocaleNumberSeparators('de-DE')).toEqual({ group: '.', decimal: ',' })
+    expect(resolveLocaleNumberSeparators('pl-PL').decimal).toBe(',')
+    expect(resolveLocaleNumberSeparators('fr-FR').decimal).toBe(',')
+  })
+
+  it('reports a whitespace group separator for locales that group with spaces', () => {
+    expect(resolveLocaleNumberSeparators('fr-FR').group).toMatch(/^\s$/)
+    expect(resolveLocaleNumberSeparators('pl-PL').group).toMatch(/^\s$/)
+  })
+})
+
+describe('parseLocaleNumber', () => {
+  it('accepts the locale decimal separator the UI displays (issue #5552)', () => {
+    expect(parseLocaleNumber('110,70', 'pl-PL')).toBe(110.7)
+    expect(parseLocaleNumber('2,5', 'pl-PL')).toBe(2.5)
+    expect(parseLocaleNumber('110,70', 'de-DE')).toBe(110.7)
+    expect(parseLocaleNumber('110,70', 'fr-FR')).toBe(110.7)
+    expect(parseLocaleNumber('110.70', 'en-US')).toBe(110.7)
+  })
+
+  it('keeps accepting a dot under a comma-decimal locale, so the old input still works', () => {
+    expect(parseLocaleNumber('110.70', 'pl-PL')).toBe(110.7)
+    expect(parseLocaleNumber('2.5', 'de-DE')).toBe(2.5)
+    expect(parseLocaleNumber('0.01', 'fr-FR')).toBe(0.01)
+  })
+
+  it('parses grouped input, including whitespace and apostrophe group separators', () => {
+    expect(parseLocaleNumber('1\u00A0234,56', 'pl-PL')).toBe(1234.56)
+    expect(parseLocaleNumber('1\u202F234,56', 'pl-PL')).toBe(1234.56)
+    expect(parseLocaleNumber('1 234,56', 'fr-FR')).toBe(1234.56)
+    expect(parseLocaleNumber('1.234.567,89', 'de-DE')).toBe(1234567.89)
+    expect(parseLocaleNumber('1,234,567.89', 'en-US')).toBe(1234567.89)
+    expect(parseLocaleNumber('1’234.5', 'de-CH')).toBe(1234.5)
+  })
+
+  it('reads a lone separator as the decimal point, never as grouping', () => {
+    // A dot-grouping locale reading `1.500` as 1500 is a silent 1000x on a money field,
+    // and three- and four-decimal unit prices are ordinary here.
+    expect(parseLocaleNumber('1.500', 'de-DE')).toBe(1.5)
+    expect(parseLocaleNumber('2.500', 'es')).toBe(2.5)
+    expect(parseLocaleNumber('1.23', 'de-DE')).toBe(1.23)
+    expect(parseLocaleNumber('1,500', 'en-US')).toBe(1.5)
+    expect(parseLocaleNumber('1,23', 'en-US')).toBe(1.23)
+  })
+
+  it('recognizes grouping only where it is unambiguous', () => {
+    expect(parseLocaleNumber('1.234.567', 'de-DE')).toBe(1234567)
+    expect(parseLocaleNumber('1,234,567', 'en-US')).toBe(1234567)
+    expect(parseLocaleNumber('1 234', 'de-DE')).toBe(1234)
+    expect(parseLocaleNumber('1’234', 'de-CH')).toBe(1234)
+  })
+
+  it('does not absorb whitespace or apostrophes outside a valid grouping position', () => {
+    expect(parseLocaleNumber('1 2', 'en-US')).toBeNull()
+    expect(parseLocaleNumber("1'2", 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('1 2345', 'fr-FR')).toBeNull()
+  })
+
+  it('handles signs, blank fractions and exponent notation', () => {
+    expect(parseLocaleNumber('-110,70', 'pl-PL')).toBe(-110.7)
+    expect(parseLocaleNumber('−110,70', 'pl-PL')).toBe(-110.7)
+    expect(parseLocaleNumber('+7', 'pl-PL')).toBe(7)
+    expect(parseLocaleNumber('110,', 'pl-PL')).toBe(110)
+    expect(parseLocaleNumber(',5', 'pl-PL')).toBe(0.5)
+    expect(parseLocaleNumber('1e3', 'en-US')).toBe(1000)
+    expect(parseLocaleNumber('0', 'pl-PL')).toBe(0)
+  })
+
+  it('returns null instead of a silent zero for unparseable input', () => {
+    expect(parseLocaleNumber('', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('   ', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber(null, 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber(undefined, 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('abc', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('-', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('110,70,5', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('1.2.3', 'en-US')).toBeNull()
+    expect(parseLocaleNumber('12,34 PLN', 'pl-PL')).toBeNull()
+    expect(parseLocaleNumber('1,23,456', 'en-US')).toBeNull()
+  })
+
+  it('falls back to comma-group/dot-decimal when the locale tag is unusable', () => {
+    expect(parseLocaleNumber('1,234.5', 'not a locale')).toBe(1234.5)
+    expect(parseLocaleNumber('110.70', undefined)).toBe(110.7)
+  })
+})

package/src/lib/bootstrap/__tests__/dynamicLoader.appModuleOverrides.test.ts

@@ -0,0 +1,279 @@
+/**
+ * @jest-environment node
+ *
+ * Regression guard for #5582: the worker/CLI/scheduler bootstrap path (`bootstrapFromAppRoot`)
+ * must dispatch `entry.overrides` declared in the app's own `src/modules.ts` the same way the
+ * Next.js runtime does through `bootstrap-common.ts`'s `applyModuleOverridesFromEnabledModules`
+ * call. Without it, the override side-registry stays empty for every CLI/worker process, so
+ * `registerCliModules()` (called by `packages/cli/src/bin.ts` right after `bootstrapFromAppRoot`
+ * returns) applies no overrides — `seed-encryption` then seeds the base `defaultEncryptionMaps`
+ * instead of the app's `overrides.encryption.maps`.
+ *
+ * Like the #4327/#4491 guards next to it, this test authors both the `.ts` sources and fresh
+ * compiled `.mjs` siblings so `compileAndImport` takes its cache path and never invokes esbuild.
+ * The `.mjs` stubs use `module.exports` because Jest's CJS runtime handles the dynamic `import()`.
+ *
+ * That stubbing is a hard constraint of this tier, not a shortcut: letting esbuild compile a real
+ * `src/modules.ts` here emits genuine ESM, which Jest's CJS runtime then refuses to `import()`
+ * (`SyntaxError: Unexpected token 'export'`). So the esbuild compile path and the cross-module
+ * singleton it depends on are covered at the integration tier instead (#5855).
+ *
+ * `bootstrapFromAppRoot` reaches the factory through `import('./factory.js')`, and the `ai` override
+ * applier through `import('@open-mercato/ai-assistant/...')` — specifiers with no on-disk counterpart
+ * under Jest's CJS resolver, so both are mocked virtually.
+ */
+jest.mock('../../logger', () => {
+  const logger = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    child: () => logger,
+  }
+  return { createLogger: () => logger }
+})
+
+jest.mock(
+  '../factory.js',
+  () => ({
+    createBootstrap: () => () => {},
+    waitForAsyncRegistration: async () => {},
+  }),
+  { virtual: true },
+)
+
+const mockAiOverrideEntries: unknown[] = []
+
+jest.mock(
+  '@open-mercato/ai-assistant/modules/ai_assistant/lib/ai-overrides',
+  () => {
+    const { registerModuleOverrideApplier } = jest.requireActual('../../../modules/overrides')
+    registerModuleOverrideApplier('ai', (entries: unknown[]) => {
+      mockAiOverrideEntries.push(...entries)
+    })
+    return {}
+  },
+  { virtual: true },
+)
+
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { createLogger } from '../../logger'
+import { bootstrapFromAppRoot } from '../dynamicLoader'
+import { resetModuleContractOverridesForTests } from '../../../modules/overrides'
+import { registerCliModules, getCliModules, getDefaultEncryptionMaps } from '../../../modules/registry'
+import type { Module } from '../../../modules/registry'
+
+const mockedLogger = createLogger('shared') as unknown as {
+  debug: jest.Mock
+  error: jest.Mock
+}
+
+const BASE_ENCRYPTION_MAP = { entityId: 'test_module.widget', fields: [{ field: 'email' }] }
+const OVERRIDE_ENCRYPTION_MAP = {
+  entityId: 'test_module.widget',
+  fields: [{ field: 'email' }, { field: 'ssn' }],
+}
+
+const MODULES_CLI_GENERATED = {
+  ts: `export const modules = [{ id: 'test_module', defaultEncryptionMaps: [${JSON.stringify(BASE_ENCRYPTION_MAP)}] }]`,
+  compiled: `module.exports = { modules: [{ id: 'test_module', defaultEncryptionMaps: [${JSON.stringify(BASE_ENCRYPTION_MAP)}] }] }`,
+}
+
+const GENERATED_MODULES: Record<string, { ts: string; compiled: string }> = {
+  'entities.ids.generated': { ts: 'export const E = {}', compiled: 'module.exports = { E: {} }' },
+  'modules.cli.generated': MODULES_CLI_GENERATED,
+  'entities.generated': { ts: 'export const entities = []', compiled: 'module.exports = { entities: [] }' },
+  'di.generated': { ts: 'export const diRegistrars = []', compiled: 'module.exports = { diRegistrars: [] }' },
+}
+
+const APP_TSCONFIG = JSON.stringify({
+  compilerOptions: {
+    experimentalDecorators: true,
+    emitDecoratorMetadata: true,
+    useDefineForClassFields: false,
+    target: 'ES2022',
+  },
+})
+
+const APP_MODULES_TS_WITH_OVERRIDE = [
+  "export const enabledModules = [{",
+  "  id: 'test_module',",
+  '  overrides: {',
+  '    encryption: {',
+  `      maps: { 'test_module.widget': ${JSON.stringify(OVERRIDE_ENCRYPTION_MAP)} },`,
+  '    },',
+  '  },',
+  '}]',
+].join('\n')
+
+const APP_MODULES_COMPILED_WITH_OVERRIDE = `module.exports = { enabledModules: [{ id: 'test_module', overrides: { encryption: { maps: { 'test_module.widget': ${JSON.stringify(OVERRIDE_ENCRYPTION_MAP)} } } } }] }`
+
+const APP_MODULES_TS_WITHOUT_OVERRIDE = "export const enabledModules = [{ id: 'test_module' }]"
+const APP_MODULES_COMPILED_WITHOUT_OVERRIDE = "module.exports = { enabledModules: [{ id: 'test_module' }] }"
+
+const AI_AGENT_KEY = 'catalog.catalog_assistant'
+const APP_MODULES_TS_WITH_AI_OVERRIDE = `export const enabledModules = [{ id: 'test_module', overrides: { ai: { agents: { '${AI_AGENT_KEY}': null } } } }]`
+const APP_MODULES_COMPILED_WITH_AI_OVERRIDE = `module.exports = { enabledModules: [{ id: 'test_module', overrides: { ai: { agents: { '${AI_AGENT_KEY}': null } } } }] }`
+
+function hash(content: string): string {
+  return crypto.createHash('sha256').update(content).digest('hex')
+}
+
+function writeCompiledPair(
+  appRoot: string,
+  sourcePath: string,
+  compiledPath: string,
+  source: { ts: string; compiled: string },
+) {
+  fs.writeFileSync(sourcePath, source.ts)
+  fs.writeFileSync(compiledPath, source.compiled)
+  const sourceRelativePath = path.relative(appRoot, sourcePath).split(path.sep).join('/')
+  fs.writeFileSync(`${compiledPath}.cache.json`, JSON.stringify({
+    version: 4,
+    inputHash: hash(JSON.stringify({
+      version: 4,
+      sourceHash: hash(source.ts),
+      tsconfigHashes: {
+        'tsconfig.json': hash(APP_TSCONFIG),
+      },
+    })),
+    outputHash: hash(source.compiled),
+    dependencies: {
+      [sourceRelativePath]: hash(source.ts),
+    },
+  }))
+}
+
+const createdAppRoots: string[] = []
+
+function createAppRoot(appModules: { ts: string; compiled: string } | null): string {
+  const appRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'om-bootstrap-app-modules-'))
+  const generatedDir = path.join(appRoot, '.mercato', 'generated')
+  fs.mkdirSync(generatedDir, { recursive: true })
+  fs.writeFileSync(path.join(appRoot, 'tsconfig.json'), APP_TSCONFIG)
+
+  for (const [baseName, source] of Object.entries(GENERATED_MODULES)) {
+    writeCompiledPair(
+      appRoot,
+      path.join(generatedDir, `${baseName}.ts`),
+      path.join(generatedDir, `${baseName}.mjs`),
+      source,
+    )
+  }
+
+  if (appModules) {
+    fs.mkdirSync(path.join(appRoot, 'src'), { recursive: true })
+    writeCompiledPair(
+      appRoot,
+      path.join(appRoot, 'src', 'modules.ts'),
+      path.join(generatedDir, 'app-modules-overrides.compiled.mjs'),
+      appModules,
+    )
+  }
+
+  createdAppRoots.push(appRoot)
+  return appRoot
+}
+
+describe('bootstrapFromAppRoot — src/modules.ts entry.overrides reach CLI/worker processes', () => {
+  afterAll(() => {
+    for (const root of createdAppRoots) {
+      fs.rmSync(root, { recursive: true, force: true })
+    }
+  })
+
+  beforeEach(() => {
+    mockedLogger.debug.mockClear()
+    mockedLogger.error.mockClear()
+    mockAiOverrideEntries.length = 0
+    resetModuleContractOverridesForTests()
+  })
+
+  afterEach(() => {
+    resetModuleContractOverridesForTests()
+  })
+
+  it('dispatches overrides.encryption.maps so getDefaultEncryptionMaps reflects it after registerCliModules', async () => {
+    const appRoot = createAppRoot({ ts: APP_MODULES_TS_WITH_OVERRIDE, compiled: APP_MODULES_COMPILED_WITH_OVERRIDE })
+
+    const data = await bootstrapFromAppRoot(appRoot)
+    registerCliModules(data.modules as Module[])
+
+    const maps = getDefaultEncryptionMaps(getCliModules())
+    const widgetMap = maps.find((entry) => entry.entityId === 'test_module.widget')
+
+    expect(widgetMap).toBeDefined()
+    expect(widgetMap?.fields.map((field) => field.field)).toEqual(['email', 'ssn'])
+    expect(mockedLogger.error).not.toHaveBeenCalled()
+  })
+
+  it('keeps the base defaultEncryptionMaps when src/modules.ts declares no overrides', async () => {
+    const appRoot = createAppRoot({
+      ts: APP_MODULES_TS_WITHOUT_OVERRIDE,
+      compiled: APP_MODULES_COMPILED_WITHOUT_OVERRIDE,
+    })
+
+    const data = await bootstrapFromAppRoot(appRoot)
+    registerCliModules(data.modules as Module[])
+
+    const maps = getDefaultEncryptionMaps(getCliModules())
+    const widgetMap = maps.find((entry) => entry.entityId === 'test_module.widget')
+
+    expect(widgetMap).toBeDefined()
+    expect(widgetMap?.fields.map((field) => field.field)).toEqual(['email'])
+    expect(mockedLogger.error).not.toHaveBeenCalled()
+  })
+
+  it('refuses to bootstrap when a present src/modules.ts fails to load', async () => {
+    const appRoot = createAppRoot({
+      ts: APP_MODULES_TS_WITH_OVERRIDE,
+      compiled: "throw new Error('src/modules.ts is broken')",
+    })
+
+    // Degrading here is what #5582 looked like: seed-encryption would seed the base maps and
+    // still print success, so a present-but-unloadable modules file must stop the bootstrap.
+    await expect(bootstrapFromAppRoot(appRoot)).rejects.toThrow(
+      /Failed to load the app-level modules file[\s\S]*Refusing to bootstrap with a partial override set/,
+    )
+  })
+
+  it('refuses to bootstrap when src/modules.ts exports no enabledModules array', async () => {
+    const appRoot = createAppRoot({
+      ts: 'export const somethingElse = []',
+      compiled: 'module.exports = { somethingElse: [] }',
+    })
+
+    await expect(bootstrapFromAppRoot(appRoot)).rejects.toThrow(/exports no enabledModules array/)
+  })
+
+  it('skips the dispatch without error when the app has no src/modules.ts at all', async () => {
+    const appRoot = createAppRoot(null)
+
+    const data = await bootstrapFromAppRoot(appRoot)
+    registerCliModules(data.modules as Module[])
+
+    const maps = getDefaultEncryptionMaps(getCliModules())
+    expect(maps.find((entry) => entry.entityId === 'test_module.widget')?.fields).toHaveLength(1)
+    expect(mockedLogger.error).not.toHaveBeenCalled()
+  })
+
+  it('resolves the ai applier on demand so overrides.ai is not dropped in the CLI path', async () => {
+    const appRoot = createAppRoot({
+      ts: APP_MODULES_TS_WITH_AI_OVERRIDE,
+      compiled: APP_MODULES_COMPILED_WITH_AI_OVERRIDE,
+    })
+
+    await bootstrapFromAppRoot(appRoot)
+
+    // registerBuiltInModuleOverrideAppliers() does not register `ai`; without the on-demand
+    // import the dispatcher takes its unwired branch and discards the entry entirely.
+    expect(mockAiOverrideEntries).toEqual([
+      { moduleId: 'test_module', overrides: { agents: { [AI_AGENT_KEY]: null } } },
+    ])
+    expect(mockedLogger.error).not.toHaveBeenCalled()
+  })
+
+})