create-mercato-app 0.6.2-develop.3406.1.2b403f40da → 0.6.2-develop.3446.1.bd060c6017

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-mercato-app",
-  "version": "0.6.2-develop.3406.1.2b403f40da",
+  "version": "0.6.2-develop.3446.1.bd060c6017",
   "type": "module",
   "description": "Create a new Open Mercato application",
   "main": "./dist/index.js",

package/template/.env.example

@@ -88,6 +88,13 @@ NEXT_PUBLIC_UMES_DEVTOOLS=true
 # Enables checkout summary/help wrappers used by integration tests only.
 NEXT_PUBLIC_OM_EXAMPLE_CHECKOUT_TEST_INJECTIONS_ENABLED=false
 
+# Public date/time display format overrides (date-fns tokens).
+# Leave unset, or set to "system", to use the locale-derived default.
+# Examples: NEXT_PUBLIC_OM_DATE_FORMAT=dd.MM.yyyy
+#           NEXT_PUBLIC_OM_DATE_TIME_FORMAT=dd.MM.yyyy HH:mm
+# NEXT_PUBLIC_OM_DATE_FORMAT=
+# NEXT_PUBLIC_OM_DATE_TIME_FORMAT=
+
 # Mock payment gateway webhook secret used by the example mock provider.
 # Required for webhook verification in standalone integration and local test flows.
 # MOCK_GATEWAY_WEBHOOK_SECRET=open-mercato-mock-dev-webhook-secret

package/template/package.json.template

@@ -78,16 +78,18 @@
     "@uiw/react-markdown-preview": "^5.2.0",
     "@uiw/react-md-editor": "^4.1.0",
     "@xyflow/react": "^12.6.0",
-    "ai": "^6.0.168",
+    "ai": "^6.0.177",
     "awilix": "^12.0.5",
     "bcryptjs": "^3.0.3",
     "class-variance-authority": "^0.7.1",
     "clsx": "^2.1.1",
+    "date-fns": "4.1.0",
+    "date-fns-tz": "^3.2.0",
     "dotenv": "^17.4.2",
     "lucide-react": "^1.8.0",
     "mammoth": "^1.9.0",
     "newrelic": "^13.19.1",
-    "next": "16.2.4",
+    "next": "16.2.6",
     "pg": "8.20.0",
     "pdfjs-dist": "^5.4.149",
     "react": "19.2.5",
@@ -97,11 +99,11 @@
     "reflect-metadata": "^0.2.2",
     "remark-gfm": "^4.0.1",
     "resend": "^6.12.0",
-    "sanitize-html": "^2.17.2",
+    "sanitize-html": "^2.17.4",
     "semver": "^7.7.4",
     "tailwind-merge": "^3.5.0",
     "zod": "4.3.6",
-    "@stripe/react-stripe-js": "^6.2.0",
+    "@stripe/react-stripe-js": "^6.3.0",
     "@stripe/stripe-js": "^9.3.1",
     "@open-mercato/gateway-stripe": "{{PACKAGE_VERSION}}",
     "@open-mercato/sync-akeneo": "{{PACKAGE_VERSION}}"

package/template/scripts/dev-runtime.mjs

@@ -76,9 +76,9 @@ const {
   stripAnsi,
   wrapListLines,
 } = await import(resolveSplashHelpersImport())
-const { resolveSpawnCommand } = await import(resolveSpawnUtilsImport())
+const { resolveProjectBinary, resolveSpawnCommand } = await import(resolveSpawnUtilsImport())
 
-const command = process.platform === 'win32' ? 'mercato.cmd' : 'mercato'
+const command = resolveProjectBinary(process.platform === 'win32' ? 'mercato.cmd' : 'mercato')
 const classic = process.argv.includes('--classic') || isEnabledEnvFlag(process.env.OM_DEV_CLASSIC)
 const verbose = !classic && (process.argv.includes('--verbose') || process.env.MERCATO_DEV_OUTPUT === 'verbose')
 const rawPassthrough = classic || verbose
@@ -506,10 +506,10 @@ function spawnMercato(args) {
   return child
 }
 
-function waitForExit(child) {
+function waitForExit(child, label = 'Child process') {
   return new Promise((resolve) => {
     child.on('exit', (code, signal) => {
-      resolve({ code, signal })
+      resolve({ label, code, signal })
     })
   })
 }
@@ -535,6 +535,32 @@ function resolveChildExitCode(result, fallback = 1) {
   return fallback
 }
 
+function formatChildExitStatus(result) {
+  if (typeof result?.code === 'number') {
+    return `exit code ${result.code}`
+  }
+  if (result?.signal) {
+    return `signal ${result.signal}`
+  }
+  return 'an unknown status'
+}
+
+function resolveUnexpectedExitCode(result) {
+  const exitCode = resolveChildExitCode(result, 1)
+  return exitCode === 0 ? 1 : exitCode
+}
+
+function reportUnexpectedChildExit(result) {
+  const message = `❌ ${result?.label ?? 'Child process'} exited unexpectedly with ${formatChildExitStatus(result)}`
+  console.error(message)
+  rememberRawLog(message)
+  publishRuntimeFailure(message, {
+    progressCurrent: splashState.progressCurrent >= runtimeProgressCurrent ? splashState.progressCurrent : runtimeProgressCurrent,
+    progressLabel: splashState.progressLabel || startupProgress.label,
+    failureLines: [...collectRuntimeFailureLines(), message].slice(-10),
+  })
+}
+
 function joinBaseUrl(baseUrl, pathname) {
   return `${String(baseUrl ?? '').replace(/\/$/, '')}${pathname}`
 }
@@ -1660,15 +1686,16 @@ async function runClassicRuntime() {
 
   const watch = spawnMercato(['generate', 'watch', '--skip-initial'])
   const server = spawnMercato(['server', 'dev'])
-  const result = await Promise.race([waitForExit(watch), waitForExit(server)])
+  const result = await Promise.race([
+    waitForExit(watch, 'Generator watch'),
+    waitForExit(server, 'App runtime'),
+  ])
   if (isGracefulShutdownResult(result)) {
     return
   }
 
-  // Unexpected child exit MUST surface as non-zero even if the child reported
-  // code 0 — hiding a broken runtime as success masks failures from scripts/CI.
-  const childCode = resolveChildExitCode(result, 1)
-  shutdown(childCode === 0 ? 1 : childCode)
+  reportUnexpectedChildExit(result)
+  shutdown(resolveUnexpectedExitCode(result))
 }
 
 if (classic) {
@@ -1683,10 +1710,11 @@ printRuntimePackagesSummary()
 const watch = startFilteredChild(['generate', 'watch', '--skip-initial'], 'Generator watch', classifyWatchLine)
 const server = startFilteredChild(['server', 'dev'], 'App runtime', classifyServerLine)
 
-const result = await Promise.race([waitForExit(watch), waitForExit(server)])
+const result = await Promise.race([
+  waitForExit(watch, 'Generator watch'),
+  waitForExit(server, 'App runtime'),
+])
 if (!isGracefulShutdownResult(result)) {
-  // Unexpected child exit MUST surface as non-zero even if the child reported
-  // code 0 — hiding a broken runtime as success masks failures from scripts/CI.
-  const childCode = resolveChildExitCode(result, 1)
-  shutdown(childCode === 0 ? 1 : childCode)
+  reportUnexpectedChildExit(result)
+  shutdown(resolveUnexpectedExitCode(result))
 }

package/template/src/app/(backend)/backend/__tests__/layout-route-registry.test.tsx

@@ -9,11 +9,6 @@ const backendRoutes = [
 ]
 
 const mockRegisterBackendRouteManifests = jest.fn()
-const mockParseBooleanWithDefault = jest.fn(() => false)
-const mockCookies = jest.fn()
-const mockHeaders = jest.fn()
-const mockResolveTranslations = jest.fn()
-const mockGetAuthFromCookies = jest.fn()
 
 jest.mock('@/.mercato/generated/backend-routes.generated', () => ({
   backendRoutes,
@@ -25,12 +20,12 @@ jest.mock('@open-mercato/shared/modules/registry', () => ({
 }))
 
 jest.mock('next/headers', () => ({
-  cookies: (...args: unknown[]) => mockCookies(...args),
-  headers: (...args: unknown[]) => mockHeaders(...args),
+  cookies: jest.fn(),
+  headers: jest.fn(),
 }))
 
 jest.mock('@open-mercato/shared/lib/auth/server', () => ({
-  getAuthFromCookies: (...args: unknown[]) => mockGetAuthFromCookies(...args),
+  getAuthFromCookies: jest.fn(),
 }))
 
 jest.mock('@open-mercato/ui/backend/AppShell', () => ({
@@ -38,7 +33,7 @@ jest.mock('@open-mercato/ui/backend/AppShell', () => ({
 }))
 
 jest.mock('@open-mercato/shared/lib/i18n/server', () => ({
-  resolveTranslations: (...args: unknown[]) => mockResolveTranslations(...args),
+  resolveTranslations: jest.fn(),
 }))
 
 jest.mock('@open-mercato/shared/lib/i18n/context', () => ({
@@ -54,7 +49,7 @@ jest.mock('@open-mercato/shared/lib/version', () => ({
 }))
 
 jest.mock('@open-mercato/shared/lib/boolean', () => ({
-  parseBooleanWithDefault: (...args: unknown[]) => mockParseBooleanWithDefault(...args),
+  parseBooleanWithDefault: jest.fn(() => true),
 }))
 
 jest.mock('@open-mercato/ui/backend/injection/PageInjectionBoundary', () => ({
@@ -78,11 +73,6 @@ describe('Backend layout route registry', () => {
   beforeEach(() => {
     jest.resetModules()
     mockRegisterBackendRouteManifests.mockClear()
-    mockParseBooleanWithDefault.mockClear()
-    mockCookies.mockReset()
-    mockHeaders.mockReset()
-    mockResolveTranslations.mockReset()
-    mockGetAuthFromCookies.mockReset()
   })
 
   it('registers backend route manifests at module load', async () => {
@@ -92,35 +82,4 @@ describe('Backend layout route registry', () => {
 
     expect(mockRegisterBackendRouteManifests).toHaveBeenCalledWith(backendRoutes)
   })
-
-  it('defaults the demo mode flag to false when DEMO_MODE is unset', async () => {
-    const originalDemoMode = process.env.DEMO_MODE
-    delete process.env.DEMO_MODE
-    mockGetAuthFromCookies.mockResolvedValue(null)
-    mockCookies.mockResolvedValue({ get: () => undefined })
-    mockHeaders.mockResolvedValue({ get: () => null })
-    mockResolveTranslations.mockResolvedValue({
-      translate: (_key: string, fallback: string) => fallback,
-      locale: 'en',
-      dict: {},
-    })
-
-    try {
-      await jest.isolateModulesAsync(async () => {
-        const { default: BackendLayout } = await import('../layout')
-        await BackendLayout({
-          children: React.createElement('div'),
-          params: Promise.resolve({}),
-        })
-      })
-
-      expect(mockParseBooleanWithDefault).toHaveBeenCalledWith(undefined, false)
-    } finally {
-      if (originalDemoMode === undefined) {
-        delete process.env.DEMO_MODE
-      } else {
-        process.env.DEMO_MODE = originalDemoMode
-      }
-    }
-  })
 })

package/template/src/app/(backend)/backend/layout.tsx

@@ -80,7 +80,7 @@ export default async function BackendLayout({
 
   const collapsedCookie = cookieStore.get('om_sidebar_collapsed')?.value
   const initialCollapsed = collapsedCookie === '1'
-  const demoModeEnabled = parseBooleanWithDefault(process.env.DEMO_MODE, false)
+  const demoModeEnabled = parseBooleanWithDefault(process.env.DEMO_MODE, true)
   const deployEnv = process.env.DEPLOY_ENV
   const baseProductName = translate('appShell.productName', 'Open Mercato')
   const productName = deployEnv && deployEnv !== 'local'

package/template/src/app/__tests__/layout.test.tsx

@@ -97,18 +97,4 @@ describe('RootLayout', () => {
     expect(appProviders?.props.demoModeEnabled).toBe(false)
     expect(appProviders?.props.noticeBarsEnabled).toBe(true)
   })
-
-  it('defaults demo mode off when DEMO_MODE is unset', async () => {
-    delete process.env.DEMO_MODE
-    delete process.env.OM_INTEGRATION_TEST
-
-    const { default: RootLayout } = await import('../layout')
-    const { AppProviders } = await import('@/components/AppProviders')
-    const tree = await RootLayout({ children: 'child' })
-    const appProviders = findElementByType(tree, AppProviders)
-
-    expect(appProviders).not.toBeNull()
-    expect(appProviders?.props.demoModeEnabled).toBe(false)
-    expect(appProviders?.props.noticeBarsEnabled).toBe(true)
-  })
 })

package/template/src/app/globals.css

@@ -244,36 +244,47 @@ TODO: Fix that latter to have reference by the package names
   --sidebar-border: oklch(0.922 0 0);
   --sidebar-ring: oklch(0.708 0 0);
 
-  /* ═══ Design System: Semantic Status Tokens — Light Mode ═══ */
-  /* Error (hue ~25° — aligned with --destructive) */
-  --status-error-bg: oklch(0.965 0.015 25);
-  --status-error-text: oklch(0.365 0.120 25);
-  --status-error-border: oklch(0.830 0.060 25);
-  --status-error-icon: oklch(0.577 0.245 27.325);  /* = --destructive */
-
-  /* Success (hue ~160° — aligned with --chart-emerald) */
-  --status-success-bg: oklch(0.965 0.015 160);
-  --status-success-text: oklch(0.350 0.080 160);
-  --status-success-border: oklch(0.830 0.050 160);
-  --status-success-icon: oklch(0.596 0.145 163.225);  /* = --chart-emerald */
-
-  /* Warning (hue ~80° — aligned with --chart-amber) */
-  --status-warning-bg: oklch(0.970 0.020 80);
-  --status-warning-text: oklch(0.370 0.090 60);
-  --status-warning-border: oklch(0.830 0.070 80);
-  --status-warning-icon: oklch(0.700 0.160 70);
-
-  /* Info (hue ~277° — indigo, bridges to brand violet) */
-  --status-info-bg: oklch(0.962 0.018 272.314);    /* indigo-50 #EEF2FF */
-  --status-info-text: oklch(0.359 0.144 278.697);  /* indigo-800 #3730A3 */
-  --status-info-border: oklch(0.870 0.065 274.039);/* indigo-200 #C7D2FE */
-  --status-info-icon: oklch(0.511 0.262 276.966);  /* indigo-600 #4F46E5 = --chart-indigo */
-
-  /* Neutral (achromatic — aligned with --muted) */
-  --status-neutral-bg: oklch(0.965 0 0);
-  --status-neutral-text: oklch(0.445 0 0);
-  --status-neutral-border: oklch(0.850 0 0);
-  --status-neutral-icon: oklch(0.556 0 0);  /* = --muted-foreground */
+  /* ═══ Design System: Semantic Status Tokens — Light Mode ═══
+     Token values match the Tailwind v4 default palette so the
+     Alert / Notification / Toast primitive (Figma `169:2358`) is
+     pixel-perfect against the Figma `state/{x}/{base,light,lighter}`
+     variables (`#dc2626` / `#fecaca` / `#fef2f2` for error etc.).
+     Variable → token mapping:
+       state/{x}/base    → status-{x}-icon  (Tailwind 600)
+       state/{x}/light   → status-{x}-border (Tailwind 200)
+       state/{x}/lighter → status-{x}-bg    (Tailwind 50)
+     status-{x}-text uses Tailwind 900 for high contrast on the
+     light/lighter tints. */
+
+  /* Error — Tailwind red (Figma state/error/*) */
+  --status-error-bg: oklch(0.971 0.013 17.38);     /* red-50  #fef2f2 */
+  --status-error-text: oklch(0.396 0.141 25.723);  /* red-900 #7f1d1d */
+  --status-error-border: oklch(0.885 0.062 18.334);/* red-200 #fecaca */
+  --status-error-icon: oklch(0.577 0.245 27.325);  /* red-600 #dc2626 = --destructive */
+
+  /* Success — Tailwind green (Figma state/success/*) */
+  --status-success-bg: oklch(0.982 0.018 155.826);    /* green-50  #f0fdf4 */
+  --status-success-text: oklch(0.393 0.095 152.535);  /* green-900 #14532d */
+  --status-success-border: oklch(0.925 0.084 155.995);/* green-200 #bbf7d0 */
+  --status-success-icon: oklch(0.627 0.194 149.214);  /* green-600 #16a34a */
+
+  /* Warning — Tailwind amber (Figma state/warning/*) */
+  --status-warning-bg: oklch(0.987 0.022 95.277);    /* amber-50  #fffbeb */
+  --status-warning-text: oklch(0.414 0.112 45.904);  /* amber-900 #78350f */
+  --status-warning-border: oklch(0.924 0.12 95.746); /* amber-200 #fde68a */
+  --status-warning-icon: oklch(0.666 0.179 58.318);  /* amber-600 #d97706 */
+
+  /* Info — Tailwind indigo (Figma state/information/*) */
+  --status-info-bg: oklch(0.962 0.018 272.314);    /* indigo-50  #eef2ff */
+  --status-info-text: oklch(0.359 0.144 278.697);  /* indigo-900 #312e81 */
+  --status-info-border: oklch(0.870 0.065 274.039);/* indigo-200 #c7d2fe */
+  --status-info-icon: oklch(0.511 0.262 276.966);  /* indigo-600 #4f46e5 = --chart-indigo */
+
+  /* Neutral — Tailwind neutral (Figma state/faded/*) */
+  --status-neutral-bg: oklch(0.97 0 0);    /* neutral-100 #f5f5f5 */
+  --status-neutral-text: oklch(0.371 0 0); /* neutral-700 #404040 */
+  --status-neutral-border: oklch(0.922 0 0);/* neutral-200 #e5e5e5 (≈ Figma #ebebeb) */
+  --status-neutral-icon: oklch(0.556 0 0);  /* neutral-500 #737373 (≈ Figma #7b7b7b) */
 
   /* Pink (hue ~340° — Figma SPEC-048 ACCENT / PINK Stage badges; Tailwind pink-500/-200/-700/-50) */
   --status-pink-bg: oklch(0.965 0.020 340);   /* pink-50 #FDF2F8 */
@@ -358,36 +369,41 @@ TODO: Fix that latter to have reference by the package names
   --sidebar-border: oklch(1 0 0 / 10%);
   --sidebar-ring: oklch(0.556 0 0);
 
-  /* ═══ Design System: Semantic Status Tokens — Dark Mode ═══ */
-  /* Error */
-  --status-error-bg: oklch(0.220 0.025 25);
-  --status-error-text: oklch(0.850 0.090 25);
-  --status-error-border: oklch(0.400 0.060 25);
-  --status-error-icon: oklch(0.704 0.191 22.216);  /* = dark --destructive */
-
-  /* Success */
-  --status-success-bg: oklch(0.220 0.025 160);
-  --status-success-text: oklch(0.850 0.080 160);
-  --status-success-border: oklch(0.400 0.050 160);
-  --status-success-icon: oklch(0.696 0.170 162.480);  /* = dark --chart-emerald */
-
-  /* Warning */
-  --status-warning-bg: oklch(0.225 0.025 80);
-  --status-warning-text: oklch(0.870 0.080 80);
-  --status-warning-border: oklch(0.420 0.060 80);
-  --status-warning-icon: oklch(0.820 0.160 84.429);  /* = dark --chart-amber */
-
-  /* Info (indigo — bridges to brand violet in dark mode) */
-  --status-info-bg: oklch(0.220 0.040 276);
-  --status-info-text: oklch(0.785 0.115 274.713);  /* indigo-300 #A5B4FC */
-  --status-info-border: oklch(0.359 0.144 278.697);/* indigo-800 #3730A3 */
-  --status-info-icon: oklch(0.585 0.233 277.117); /* indigo-500 #6366F1 */
-
-  /* Neutral */
-  --status-neutral-bg: oklch(0.230 0 0);
-  --status-neutral-text: oklch(0.750 0 0);
-  --status-neutral-border: oklch(0.380 0 0);
-  --status-neutral-icon: oklch(0.708 0 0);  /* = dark --muted-foreground */
+  /* ═══ Design System: Semantic Status Tokens — Dark Mode ═══
+     Dark-mode counterparts mirror the Tailwind v4 dark palette
+     (`*-950` for bg, `*-300` for text, `*-800` for border, `*-500`
+     for icon) so the Alert primitive stays pixel-perfect against
+     the Figma dark variants. */
+
+  /* Error — Tailwind red (dark) */
+  --status-error-bg: oklch(0.258 0.092 26.042);    /* red-950 #450a0a */
+  --status-error-text: oklch(0.808 0.114 19.571); /* red-300 #fca5a5 */
+  --status-error-border: oklch(0.444 0.177 26.899);/* red-800 #991b1b */
+  --status-error-icon: oklch(0.637 0.237 25.331);  /* red-500 #ef4444 */
+
+  /* Success — Tailwind green (dark) */
+  --status-success-bg: oklch(0.266 0.065 152.934);    /* green-950 #052e16 */
+  --status-success-text: oklch(0.871 0.15 154.449);  /* green-300 #86efac */
+  --status-success-border: oklch(0.448 0.119 151.328);/* green-800 #166534 */
+  --status-success-icon: oklch(0.723 0.219 149.579);  /* green-500 #22c55e */
+
+  /* Warning — Tailwind amber (dark) */
+  --status-warning-bg: oklch(0.279 0.077 45.635);    /* amber-950 #451a03 */
+  --status-warning-text: oklch(0.879 0.169 91.605); /* amber-300 #fcd34d */
+  --status-warning-border: oklch(0.473 0.137 46.201);/* amber-800 #92400e */
+  --status-warning-icon: oklch(0.769 0.188 70.08);  /* amber-500 #f59e0b */
+
+  /* Info — Tailwind indigo (dark) */
+  --status-info-bg: oklch(0.257 0.09 281.288);    /* indigo-950 #1e1b4b */
+  --status-info-text: oklch(0.785 0.115 274.713);  /* indigo-300 #a5b4fc */
+  --status-info-border: oklch(0.398 0.195 277.366);/* indigo-800 #3730a3 */
+  --status-info-icon: oklch(0.585 0.233 277.117); /* indigo-500 #6366f1 */
+
+  /* Neutral — Tailwind neutral (dark) */
+  --status-neutral-bg: oklch(0.205 0 0);    /* neutral-900 #171717 */
+  --status-neutral-text: oklch(0.872 0 0);  /* neutral-300 #d4d4d4 */
+  --status-neutral-border: oklch(0.371 0 0);/* neutral-700 #404040 */
+  --status-neutral-icon: oklch(0.708 0 0);  /* neutral-400 #a3a3a3 = dark --muted-foreground */
 
   /* Pink (dark mode) — Figma SPEC-048 ACCENT / PINK Stage badges */
   --status-pink-bg: oklch(0.225 0.045 340);

package/template/src/app/layout.tsx

@@ -22,7 +22,7 @@ export default async function RootLayout({
 }>) {
   const locale = await detectLocale()
   const dict = await loadDictionary(locale)
-  const demoModeEnabled = process.env.DEMO_MODE === 'true'
+  const demoModeEnabled = process.env.DEMO_MODE !== 'false'
   const noticeBarsEnabled = process.env.OM_INTEGRATION_TEST !== 'true'
   return (
     <html lang={locale} suppressHydrationWarning>

package/template/src/components/AiAssistantShellIntegration.tsx

@@ -14,6 +14,8 @@ type AiAssistantShellIntegrationProps = {
   children: React.ReactNode
 }
 
+const AiAssistantIntegrationFallback: AiAssistantIntegrationComponent = ({ children }) => <>{children}</>
+
 export function AiAssistantShellIntegration({
   tenantId,
   organizationId,
@@ -23,10 +25,16 @@ export function AiAssistantShellIntegration({
 
   React.useEffect(() => {
     let cancelled = false
-    void import('@open-mercato/ai-assistant/frontend').then((module) => {
-      if (cancelled) return
-      setIntegrationComponent(() => module.AiAssistantIntegration)
-    })
+    void import('@open-mercato/ai-assistant/frontend')
+      .then((module) => {
+        if (cancelled) return
+        setIntegrationComponent(() => module.AiAssistantIntegration)
+      })
+      .catch((error) => {
+        if (cancelled) return
+        console.error('Failed to load AI assistant integration', error)
+        setIntegrationComponent(() => AiAssistantIntegrationFallback)
+      })
     return () => {
       cancelled = true
     }

package/template/src/modules/example/__integration__/TC-APP-001-metadata.spec.ts

@@ -14,7 +14,7 @@ async function setGermanLocale(page: Page) {
   ])
 }
 
-test.describe('TC-APP-001: Template metadata', () => {
+test.describe('TC-APP-001: App metadata', () => {
   test('home page exposes localized app metadata', async ({ page }) => {
     await setGermanLocale(page)
     await page.goto('/', { waitUntil: 'domcontentloaded' })

package/template/src/modules/example/backend/todos/[id]/edit/page.tsx

@@ -8,6 +8,7 @@ import { pushWithFlash } from '@open-mercato/ui/backend/utils/flash'
 import { SendObjectMessageDialog } from '@open-mercato/ui/backend/messages'
 import type { TodoListItem } from '../../../../types'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
 
 type TodoItem = TodoListItem
 type TodoCustomFieldValues = Record<`cf_${string}`, unknown>
@@ -80,13 +81,8 @@ export default function EditTodoPage({ params }: { params?: { id?: string } }) {
         const item = data?.items?.[0]
         if (!item) throw new Error(t('example.todos.form.error.notFound'))
         // Map to form initial values
-        const cfInit: Partial<TodoCustomFieldValues> = {}
         const extended = item as TodoItem & Record<string, unknown>
-        for (const [key, value] of Object.entries(extended)) {
-          if (key.startsWith('cf_')) {
-            cfInit[key as keyof TodoCustomFieldValues] = value
-          }
-        }
+        const cfInit = extractCustomFieldEntries(extended) as Partial<TodoCustomFieldValues>
         const init: TodoFormValues = {
           id: item.id,
           title: item.title,

package/template/src/modules/ratelimit_probe/__integration__/TC-INT-ratelimit-leakage.spec.ts

@@ -0,0 +1,60 @@
+import { expect, test } from '@playwright/test';
+
+const BASE_URL = process.env.BASE_URL || 'http://localhost:3000';
+
+/**
+ * Regression guard: `OM_INTEGRATION_TEST=true` must keep both the metadata-driven
+ * and the per-handler rate-limit paths bypassed.
+ *
+ * `readRateLimitConfig()` flips `RATE_LIMIT_ENABLED=false` whenever
+ * `OM_INTEGRATION_TEST=true`, which the integration runner exports via
+ * `packages/cli/src/lib/testing/integration.ts`. Without that bypass every
+ * Playwright run shares a single client IP across workers and burns through
+ * per-route point budgets — flakiness that scales with worker count.
+ *
+ * The metadata-path case depends on the dev-only `ratelimit_probe` module at
+ * `apps/mercato/src/modules/ratelimit_probe/`. That module ships only with
+ * the open-mercato monorepo and is intentionally absent from
+ * `create-mercato-app` scaffolds, so the metadata path self-skips when
+ * `/api/ratelimit_probe/ping` responds with 404.
+ */
+test.describe('per-route rate limits leak into OM_INTEGRATION_TEST runs', () => {
+  test('metadata.rateLimit path (apps/mercato root handler): 5 POSTs to /api/ratelimit_probe/ping all return 200 with points=3', async ({ request }) => {
+    const probe = await request.post(`${BASE_URL}/api/ratelimit_probe/ping`, {
+      headers: { 'Content-Type': 'application/json' },
+      data: {},
+    });
+    test.skip(
+      probe.status() === 404,
+      'ratelimit_probe module not registered (expected for create-mercato-app scaffolds)',
+    );
+
+    const statuses: number[] = [probe.status()];
+    for (let i = 0; i < 4; i += 1) {
+      const res = await request.post(`${BASE_URL}/api/ratelimit_probe/ping`, {
+        headers: { 'Content-Type': 'application/json' },
+        data: {},
+      });
+      statuses.push(res.status());
+    }
+    // With the OM_INTEGRATION_TEST bypass: all 5 calls return 200.
+    // Without it: rate limiter fires on the 4th call → [200, 200, 200, 429, 429].
+    expect(statuses, 'OM_INTEGRATION_TEST should bypass metadata.rateLimit').toEqual([200, 200, 200, 200, 200]);
+  });
+
+  test('manual checkRateLimit path (sales/quotes/accept): 11th POST 429s with points=10', async ({ request }) => {
+    // The rate limiter runs before token validation at sales/api/quotes/accept/route.ts:50-59,
+    // so an obviously invalid token still consumes points.
+    const statuses: number[] = [];
+    for (let i = 0; i < 12; i += 1) {
+      const res = await request.post(`${BASE_URL}/api/sales/quotes/fake-token-for-rate-limit-probe/accept`, {
+        headers: { 'Content-Type': 'application/json' },
+        data: {},
+      });
+      statuses.push(res.status());
+    }
+    // With the OM_INTEGRATION_TEST bypass: zero 429s (invalid token → 400/404, but never 429).
+    // Without it: 429 from the 11th call onward.
+    expect(statuses.filter((s) => s === 429), 'OM_INTEGRATION_TEST should bypass per-handler checkRateLimit').toEqual([]);
+  });
+});

package/template/src/modules.ts

@@ -68,6 +68,10 @@ if (enabledModules.some((entry) => entry.id === 'example')) {
   enabledModules.push({ id: 'example_customers_sync', from: '@app' })
 }
 
+if (parseBooleanWithDefault(process.env.OM_ENABLE_STORAGE_S3, false)) {
+  enabledModules.push({ id: 'storage_s3', from: '@open-mercato/storage-s3' })
+}
+
 const enterpriseModulesEnabled = parseBooleanWithDefault(process.env.OM_ENABLE_ENTERPRISE_MODULES, false)
 const enterpriseSsoEnabled = parseBooleanWithDefault(process.env.OM_ENABLE_ENTERPRISE_MODULES_SSO, false)
 const enterpriseSecurityEnabled = parseBooleanWithDefault(process.env.OM_ENABLE_ENTERPRISE_MODULES_SECURITY, false)