create-mercato-app 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/template/.env.example

@@ -46,33 +46,6 @@ NEXTAUTH_SECRET=
 
 # Public URL used in emails and onboarding flows
 APP_URL=http://localhost:3000
-
-# Documents realtime collaboration (optional — run `yarn documents:collab`)
-# All collab vars are optional: leave NEXT_PUBLIC_DOCUMENTS_COLLAB_URL unset to
-# disable realtime collaboration; the document editor keeps working in
-# single-user mode. The URL is embedded at app build time; use a
-# browser-reachable wss:// URL in production. App and sidecar must share the
-# v2 secret. When DOCUMENTS_COLLAB_ALLOWED_ORIGINS is unset, the sidecar trusts
-# APP_URL / NEXT_PUBLIC_APP_URL.
-DOCUMENTS_COLLAB_PORT=4101
-DOCUMENTS_COLLAB_REDIS_URL=redis://localhost:6379
-# Required with collaboration Redis in production. Every sidecar replica in one
-# deployment must share this value, and deployments sharing Redis must use
-# different values. Allowed: letters, numbers, dot, underscore, colon, dash.
-DOCUMENTS_COLLAB_REDIS_PREFIX=open-mercato:documents:collab:local
-# Local development example: ws://localhost:4101. Production runtime ignores a
-# loopback value and falls back to single-user editing without failing the build.
-NEXT_PUBLIC_DOCUMENTS_COLLAB_URL=
-# Optional exact comma-separated browser origins; defaults to APP_URL.
-DOCUMENTS_COLLAB_ALLOWED_ORIGINS=
-# Required only when collaboration is enabled; generate a unique high-entropy
-# value containing at least 32 UTF-8 bytes. The sidecar fails closed when the
-# secret is missing or too short.
-DOCUMENTS_COLLAB_JWT_SECRET_V2=
-# Optional v1 rollout secret; when set it must differ from the v2 secret.
-# DOCUMENTS_COLLAB_JWT_SECRET=
-# Standalone sidecars set this to the app root (for example /app in Docker).
-DOCUMENTS_COLLAB_APP_ROOT=.
 # Additional trusted origins for app requests that must pass host validation.
 # APP_URL is required in production for security-sensitive email links.
 # In dev mode these values also govern the HMR WebSocket (/_next/webpack-hmr):
@@ -91,7 +64,11 @@ DOCUMENTS_COLLAB_APP_ROOT=.
 
 # Enable self-service onboarding (default: false)
 SELF_SERVICE_ONBOARDING_ENABLED=false
-# Enable Open Mercato demo widgets (default: false)
+# Enable Open Mercato demo widgets. The code default when this is unset is
+# `true` — scaffolds ship it off explicitly, so keep the line rather than
+# deleting it. To hide just the contact/feedback widget while keeping demo mode
+# on, set the `ff_om_hide_contact` key in the browser's localStorage:
+# https://docs.open-mercato.dev/architecture/configuration-decision-guide#ff-om-hide-contact
 DEMO_MODE=false
 
 # Hide the backend footer status bar (app version + terms/privacy links) (default: false)
@@ -135,10 +112,6 @@ OM_SECURITY_WEBAUTHN_RP_NAME=Open Mercato
 # Defaults to the hostname from APP_URL / NEXT_PUBLIC_APP_URL when left blank.
 OM_SECURITY_WEBAUTHN_RP_ID=
 OM_SECURITY_RECOVERY_CODE_COUNT=10
-# ⚠️  EMERGENCY BREAK-GLASS ONLY — when true, MFA enforcement is DISABLED platform-wide:
-# all MFA challenges and enrollment redirects are skipped and sudo step-up always falls back
-# to password. Keep false in normal operation; when enabled the app emits a warn-level
-# structured log at startup and on every bypassed challenge so the event is auditable.
 OM_SECURITY_MFA_EMERGENCY_BYPASS=false
 
 # Outgoing email sender priority:
@@ -276,11 +249,6 @@ OM_QUERY_INDEX_AUTO_REINDEX_DEBOUNCE_MS=30000
 # Skip immediate coverage recalculation on read (default: false)
 OPTIMIZE_INDEX_COVERAGE_STATS=false
 
-# Maximum reported list total (default: 10000). Counting stops after this many
-# matching rows; capped totals render as "10 000+" and responses carry
-# totalIsCapped: true. 0 disables capping and restores exact counts everywhere.
-OM_LIST_COUNT_CAP=10000
-
 # Continue serving results from entity indexes when coverage gaps are detected (default: true)
 FORCE_QUERY_INDEX_ON_PARTIAL_INDEXES=true
 
@@ -290,11 +258,6 @@ OM_SEARCH_MIN_LEN=3
 OM_SEARCH_ENABLE_PARTIAL=true
 OM_SEARCH_HASH_ALGO=sha256
 OM_SEARCH_STORE_RAW_TOKENS=false
-# Run like/ilike on PLAINTEXT base columns as exact SQL ILIKE instead of the approximate
-# search-token match (encrypted columns always keep the token path). Off by default: token
-# matching avoids the full scan an unanchored ILIKE may need, but it is approximate --
-# fragments shorter than OM_SEARCH_MIN_LEN vanish, so short document numbers over-match.
-OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS=false
 # Bound token fan-out per indexed record (0 disables an individual limit)
 OM_SEARCH_MAX_FIELD_CHARS=20000
 OM_SEARCH_MAX_TOKENS_PER_FIELD=5000
@@ -306,14 +269,6 @@ OM_SEARCH_MAX_TOKENS_PER_RECORD=20000
 # OM_SEARCH_FIELD_BLOCKLIST=body,customers:customer_interaction@notes
 # TTL for the process-level "does this entity have search tokens?" probe cache (ms, 0 disables).
 OM_SEARCH_TOKEN_PRESENCE_CACHE_MS=30000
-# Offer base `customers:customer_entity` rows as search results alongside the person/company
-# profiles. Off by default: a customer is found through their profile, which is what carries the
-# detail-page link, so the base row only adds a second, navigation-less copy of the same customer
-# to global search. Turn it on to restore the previous behavior -- both rows are returned and the
-# presenter enricher merges the pair back into one canonical result. Read-side only: the rows stay
-# in search_tokens either way, because the People/Companies list search and the query engines'
-# encrypted like/ilike rewrite resolve ids through them.
-OM_SEARCH_CUSTOMERS_INDEX_BASE_ENTITY=false
 
 # Search module debug logging (Meilisearch, vector search, reindex operations)
 OM_SEARCH_DEBUG=false
@@ -795,21 +750,6 @@ ACME_EMAIL=
 # OM_CHANNEL_IMAP_ALLOW_INTERNAL_HOSTS=false
 # OM_CHANNEL_IMAP_HARD_CAP_PER_POLL=200
 # OM_CHANNEL_IMAP_SOCKET_TIMEOUT_MS=60000
-# Discord bot channel. Normally connected interactively in /backend/integrations;
-# set the three credential vars only for deployment-managed bootstrap. They are
-# applied on tenant creation and can be re-applied with
-# `yarn mercato channel_discord configure-from-env --tenant <id> --org <id>`.
-# OM_CHANNEL_DISCORD_BOT_TOKEN=
-# OM_CHANNEL_DISCORD_APPLICATION_ID=
-# OM_CHANNEL_DISCORD_PUBLIC_KEY=
-# OM_CHANNEL_DISCORD_GUILD_ID=
-# OM_CHANNEL_DISCORD_DEFAULT_CHANNEL_ID=
-# Overwrite credentials that already exist for the tenant (default: keep them).
-# OM_CHANNEL_DISCORD_FORCE_PRECONFIGURE=false
-# Skip opening gateway WebSockets (CI / send-only deployments).
-# OM_CHANNEL_DISCORD_GATEWAY_DISABLED=false
-# Discord REST request timeout in milliseconds.
-# OM_CHANNEL_DISCORD_REQUEST_TIMEOUT_MS=15000
 
 # --- Logging (structured logging facade, @open-mercato/shared/lib/logger) ---
 # Docs: https://docs.openmercato.com/framework/runtime/logging

package/template/.yarnrc.yml.template

@@ -1,15 +1,11 @@
 nodeLinker: node-modules
 
 # Yarn refuses versions younger than `npmMinimalAgeGate` (default 1 day) with
-# "All versions satisfying ... are quarantined". Raised to 5 days to close the
-# supply-chain window where a compromised maintainer account pushes a malicious
-# patch before any advisory exists. For urgent patches use --no-time-gate.
-# This app pins the exact @open-mercato release it was scaffolded from, which
-# is usually minutes old, so the first-party scope opts out while every
-# third-party package keeps the cooldown. A per-scope `npmRegistryServer` entry
-# shadows a top-level `npmMinimalAgeGate: 0`, so the opt-out has to be
-# expressed as a preapproval.
-npmMinimalAgeGate: 5d
+# "All versions satisfying ... are quarantined". This app pins the exact
+# @open-mercato release it was scaffolded from, which is usually minutes old, so
+# the first-party scope opts out while every third-party package keeps the
+# cooldown. A per-scope `npmRegistryServer` entry shadows a top-level
+# `npmMinimalAgeGate: 0`, so the opt-out has to be expressed as a preapproval.
 npmPreapprovedPackages:
   - "@open-mercato/*"
 {{REGISTRY_CONFIG}}

package/template/AGENTS.md

@@ -12,7 +12,7 @@ Route first; never probe unmatched context.
 - Put entities in `src/modules/<id>/data/entities.ts`; API routes need per-method `metadata` + `openApi`.
 - Editable records expose `updated_at`/`updatedAt`; custom update/delete clients send the version and surface 409s.
 - Run `yarn db:generate`, review scoped SQL/snapshot, and ask before applying it.
-- Run `yarn generate` after discovery files/`src/modules.ts`/routes/pages/events/widgets/agents/tools/workflows change.
+- Run `yarn generate` after discovery files, `src/modules.ts`, routes, pages, events, widgets, agents, tools, or workflows change.
 - Contract-surface changes (route/schema/ID/export/seam/signature/event payload/CLI) MUST read `.ai/guides/upstream/BACKWARD_COMPATIBILITY.md`; tenant/org scope alone is not a contract.
 - Localize strings; use shared UI/tokens and cover loading/empty/error/conflict/keyboard/a11y.
 
@@ -23,8 +23,8 @@ Route first; never probe unmatched context.
 ## Never
 
 - Never leak tenants, trust payload scope, or treat missing scope as unrestricted.
-- Never edit `node_modules`/`.mercato/generated/**`/generated facts/shipped migrations.
-- Never use cross-module ORM relations; use IDs/snapshots/events/enrichers/extensions/optional DI.
+- Never edit `node_modules`, `.mercato/generated/**`, generated facts, or shipped migrations.
+- Never use cross-module ORM relations; use IDs/snapshots, events, enrichers, extensions, or optional DI.
 - Never use raw admin `fetch`/`<form>`, ad hoc crypto/cache/queues, role-name guards, or direct mutations when helpers exist.
 - Never hard-code user strings/status colors; expose secrets/transcripts; or guess answerable contracts.
 

package/template/Dockerfile

@@ -3,8 +3,6 @@ FROM node:24-alpine AS builder
 ENV NEXT_TELEMETRY_DISABLED=1 \
     PATH=/app/node_modules/.bin:$PATH
 ARG OPEN_MERCATO_DOCKER_REGISTRY_HOST=host.docker.internal
-ARG NEXT_PUBLIC_DOCUMENTS_COLLAB_URL
-ENV NEXT_PUBLIC_DOCUMENTS_COLLAB_URL=${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL}
 
 WORKDIR /app
 
@@ -60,31 +58,22 @@ COPY docker/scripts/init-or-migrate.sh /app/docker/scripts/init-or-migrate.sh
 RUN chmod +x /app/docker/scripts/dev-entrypoint.sh
 RUN chmod +x /app/docker/scripts/init-or-migrate.sh
 
-EXPOSE 3000 4101
+EXPOSE 3000
 CMD ["/bin/sh", "/app/docker/scripts/dev-entrypoint.sh"]
 
 FROM node:24-alpine AS runner
 
 ARG CONTAINER_PORT=3000
-ARG DOCUMENTS_COLLAB_PORT=4101
 ARG OPEN_MERCATO_DOCKER_REGISTRY_HOST=host.docker.internal
-# Chromium backs the Documents PDF export (puppeteer-core). Build with
-# --build-arg INSTALL_CHROMIUM=1 to include it; PDF export otherwise returns 503.
-ARG INSTALL_CHROMIUM=0
 
 ENV NODE_ENV=production \
     NEXT_TELEMETRY_DISABLED=1 \
     PATH=/app/node_modules/.bin:$PATH \
-    PORT=${CONTAINER_PORT} \
-    PUPPETEER_EXECUTABLE_PATH=/usr/bin/chromium
+    PORT=${CONTAINER_PORT}
 
 WORKDIR /app
 
-RUN if [ "$INSTALL_CHROMIUM" = "1" ]; then \
-      apk add --no-cache ca-certificates chromium openssl; \
-    else \
-      apk add --no-cache ca-certificates openssl; \
-    fi
+RUN apk add --no-cache ca-certificates openssl
 RUN corepack enable
 
 COPY package.json yarn.lock .yarnrc.yml ./
@@ -118,5 +107,5 @@ RUN adduser -D -u 1001 omuser \
 
 USER omuser
 
-EXPOSE ${CONTAINER_PORT} ${DOCUMENTS_COLLAB_PORT}
+EXPOSE ${CONTAINER_PORT}
 CMD ["yarn", "start"]

package/template/docker/scripts/init-or-migrate.sh

@@ -4,6 +4,7 @@ set -e
 MARKER_FILE="${INIT_MARKER_FILE:-/tmp/init-marker/.seeded}"
 INIT_COMMAND="${INIT_COMMAND:-yarn initialize}"
 MIGRATE_COMMAND="${MIGRATE_COMMAND:-yarn db:migrate}"
+SYNC_ROLE_ACLS_COMMAND="${SYNC_ROLE_ACLS_COMMAND:-yarn mercato auth sync-role-acls}"
 ALREADY_INITIALIZED_PATTERN='Initialization aborted: found [0-9][0-9]* existing user\(s\) in the database\.'
 CLI_NOT_FOUND_PATTERN='command not found: mercato'
 
@@ -11,12 +12,16 @@ run_command_with_cli_recovery() {
   COMMAND="$1"
   LOG_FILE="$2"
 
-  if sh -lc "${COMMAND}" >"${LOG_FILE}" 2>&1; then
+  # `STATUS=$?` after a failed `if ...; then ...; fi` reads the compound statement's own
+  # status, which POSIX defines as 0 — so every failure used to be reported as success and
+  # a broken migration silently fell through to `yarn start`. Capture the status directly.
+  STATUS=0
+  sh -lc "${COMMAND}" >"${LOG_FILE}" 2>&1 || STATUS=$?
+
+  if [ "${STATUS}" -eq 0 ]; then
     return 0
   fi
 
-  STATUS=$?
-
   if ! grep -Fq "${CLI_NOT_FOUND_PATTERN}" "${LOG_FILE}"; then
     return "${STATUS}"
   fi
@@ -26,6 +31,23 @@ run_command_with_cli_recovery() {
   sh -lc "${COMMAND}" >"${LOG_FILE}" 2>&1
 }
 
+# Modules enabled after the database was first seeded declare new `defaultRoleFeatures`
+# that existing tenants never received — `mercato init` applies them only at bootstrap.
+# The sync command is idempotent, so run it after every migration and keep it non-fatal:
+# a stale grant set must not block the container from starting.
+sync_role_acls() {
+  SYNC_LOG_FILE="$(mktemp)"
+
+  if run_command_with_cli_recovery "${SYNC_ROLE_ACLS_COMMAND}" "${SYNC_LOG_FILE}"; then
+    cat "${SYNC_LOG_FILE}"
+  else
+    echo "WARNING: role ACL sync failed; newly enabled modules may be inaccessible until it is run manually."
+    cat "${SYNC_LOG_FILE}"
+  fi
+
+  rm -f "${SYNC_LOG_FILE}"
+}
+
 if [ ! -f "${MARKER_FILE}" ]; then
   echo "First run: full initialization..."
   LOG_FILE="$(mktemp)"
@@ -48,6 +70,7 @@ if [ ! -f "${MARKER_FILE}" ]; then
       if run_command_with_cli_recovery "${MIGRATE_COMMAND}" "${RECOVERY_LOG_FILE}"; then
         cat "${RECOVERY_LOG_FILE}"
         rm -f "${RECOVERY_LOG_FILE}"
+        sync_role_acls
       else
         RECOVERY_STATUS=$?
         cat "${RECOVERY_LOG_FILE}"
@@ -70,6 +93,7 @@ LOG_FILE="$(mktemp)"
 if run_command_with_cli_recovery "${MIGRATE_COMMAND}" "${LOG_FILE}"; then
   cat "${LOG_FILE}"
   rm -f "${LOG_FILE}"
+  sync_role_acls
   exit 0
 fi
 

package/template/docker-compose.fullapp.dev.yml

@@ -40,8 +40,6 @@ services:
       APP_URL: ${APP_URL:-http://localhost:3000}
       # Additional trusted app/dev origins for the Open Mercato origin allowlist (resolveAllowedDevOrigins)
       APP_ALLOWED_ORIGINS: ${APP_ALLOWED_ORIGINS:-}
-      NEXT_PUBLIC_DOCUMENTS_COLLAB_URL: ${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL:-}
-      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-dev-only-documents-collab-v2-secret}
       CACHE_REDIS_URL: redis://redis:6379
       CACHE_STRATEGY: ${CACHE_STRATEGY:-redis}
       ENABLE_CRUD_API_CACHE: ${ENABLE_CRUD_API_CACHE:-true}
@@ -78,60 +76,6 @@ services:
     networks:
       - mercato-network-fullapp
 
-  documents-collab:
-    profiles:
-      - documents-collab
-    build:
-      context: .
-      target: dev
-      args:
-        - OPEN_MERCATO_DOCKER_REGISTRY_HOST=host.docker.internal
-      extra_hosts:
-        - "host.docker.internal:host-gateway"
-    command: ["yarn", "documents:collab"]
-    working_dir: /app
-    # Restart so a first boot that races the shared app build comes back up
-    # once its dependencies are present, instead of exiting and staying dead.
-    restart: unless-stopped
-    volumes:
-      - .:/app
-      - app_node_modules:/app/node_modules
-    ports:
-      - "${DOCUMENTS_COLLAB_PORT:-4101}:${DOCUMENTS_COLLAB_PORT:-4101}"
-    environment:
-      NODE_ENV: development
-      DATABASE_URL: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-open-mercato}
-      JWT_SECRET: ${JWT_SECRET:-JWT}
-      APP_URL: ${APP_URL:-http://localhost:3000}
-      NEXT_PUBLIC_APP_URL: ${APP_URL:-http://localhost:3000}
-      DOCUMENTS_COLLAB_PORT: ${DOCUMENTS_COLLAB_PORT:-4101}
-      DOCUMENTS_COLLAB_REDIS_URL: redis://redis:6379
-      DOCUMENTS_COLLAB_REDIS_PREFIX: ${DOCUMENTS_COLLAB_REDIS_PREFIX:-open-mercato:documents:collab:${DEPLOY_ENV:-local}}
-      # Same Redis as the app so multi-instance collaboration sync works out of the box
-      # (DOCUMENTS_COLLAB_REDIS_URL wins when both are set).
-      REDIS_URL: redis://redis:6379
-      DOCUMENTS_COLLAB_ALLOWED_ORIGINS: ${DOCUMENTS_COLLAB_ALLOWED_ORIGINS:-http://localhost:3000}
-      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-dev-only-documents-collab-v2-secret}
-      DOCUMENTS_COLLAB_JWT_SECRET: ${DOCUMENTS_COLLAB_JWT_SECRET:-}
-      DOCUMENTS_COLLAB_APP_ROOT: /app
-      # Mirror the app service's tenant-encryption configuration so the sidecar
-      # can decrypt the same data as the app.
-      TENANT_DATA_ENCRYPTION: ${TENANT_DATA_ENCRYPTION:-true}
-      TENANT_DATA_ENCRYPTION_DEBUG: ${TENANT_DATA_ENCRYPTION_DEBUG:-false}
-      TENANT_DATA_ENCRYPTION_FALLBACK_KEY: ${TENANT_DATA_ENCRYPTION_FALLBACK_KEY:-dev-tenant-encryption-fallback-key-32chars}
-      TENANT_DATA_ENCRYPTION_KEY: ${TENANT_DATA_ENCRYPTION_KEY:-}
-      CACHE_REDIS_URL: redis://redis:6379
-      CACHE_STRATEGY: ${CACHE_STRATEGY:-redis}
-    depends_on:
-      app:
-        condition: service_started
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    networks:
-      - mercato-network-fullapp
-
   postgres:
     image: pgvector/pgvector:pg17-trixie
     restart: unless-stopped

package/template/docker-compose.fullapp.yml

@@ -5,12 +5,6 @@ services:
       context: .
       args:
         - CONTAINER_PORT=${CONTAINER_PORT:-3000}
-        - INSTALL_CHROMIUM=${INSTALL_CHROMIUM:-0}
-        # Optional: browser-reachable ws(s):// endpoint baked in at build time.
-        # Leave unset to disable realtime document collaboration (the editor
-        # falls back to single-user editing). Invalid production values are
-        # ignored at runtime instead of failing the image build.
-        - NEXT_PUBLIC_DOCUMENTS_COLLAB_URL=${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL:-}
         - OPEN_MERCATO_DOCKER_REGISTRY_HOST=host.docker.internal
       extra_hosts:
         - "host.docker.internal:host-gateway"
@@ -59,13 +53,7 @@ services:
       JWT_LEGACY_CUTOVER_AT: "${JWT_LEGACY_CUTOVER_AT:-}"
       NEXTAUTH_SECRET: ${NEXTAUTH_SECRET:-}
       CONSENT_INTEGRITY_SECRET: ${CONSENT_INTEGRITY_SECRET:-}
-      # Set APP_URL to the public application origin in production deployments.
       APP_URL: ${APP_URL:-http://localhost:3000}
-      # Optional: unset disables realtime document collaboration (single-user editing keeps working).
-      NEXT_PUBLIC_DOCUMENTS_COLLAB_URL: ${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL:-}
-      # Required only when collaboration is enabled: a unique high-entropy shared secret
-      # (>= 32 UTF-8 bytes). The sidecar fails closed at runtime when it is missing or too short.
-      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-}
       # Additional trusted app/dev origins for the Open Mercato origin allowlist (resolveAllowedDevOrigins)
       APP_ALLOWED_ORIGINS: ${APP_ALLOWED_ORIGINS:-}
       REDIS_URL: ${REDIS_URL:-}
@@ -112,72 +100,6 @@ services:
     networks:
       - mercato-network-fullapp
 
-  documents-collab:
-    profiles:
-      - documents-collab
-    build:
-      context: .
-      args:
-        - CONTAINER_PORT=${CONTAINER_PORT:-3000}
-        - DOCUMENTS_COLLAB_PORT=${DOCUMENTS_COLLAB_PORT:-4101}
-        - INSTALL_CHROMIUM=${INSTALL_CHROMIUM:-0}
-        - NEXT_PUBLIC_DOCUMENTS_COLLAB_URL=${NEXT_PUBLIC_DOCUMENTS_COLLAB_URL:-}
-        - OPEN_MERCATO_DOCKER_REGISTRY_HOST=host.docker.internal
-      extra_hosts:
-        - "host.docker.internal:host-gateway"
-    command: ["yarn", "documents:collab"]
-    working_dir: /app
-    restart: unless-stopped
-    ports:
-      - "${DOCUMENTS_COLLAB_PORT:-4101}:${DOCUMENTS_COLLAB_PORT:-4101}"
-    # Liveness only: any HTTP reply (including 503 when collaboration is not
-    # configured) means the process is serving; a connection error means it is
-    # down. Readiness would false-negative on the optional collab feature.
-    healthcheck:
-      test: ["CMD-SHELL", "node -e \"require('http').get('http://127.0.0.1:'+(process.env.DOCUMENTS_COLLAB_PORT||4101)+'/healthz',r=>process.exit(0)).on('error',()=>process.exit(1))\""]
-      interval: 30s
-      timeout: 5s
-      retries: 3
-    environment:
-      NODE_ENV: production
-      DATABASE_URL: postgres://${POSTGRES_USER:-postgres}:${POSTGRES_PASSWORD:-postgres}@postgres:5432/${POSTGRES_DB:-open-mercato}
-      # Same required secret and bounded legacy-token window as the app service:
-      # the sidecar boots the app container and must never fall back to a
-      # published signing secret either.
-      JWT_SECRET: "${JWT_SECRET:?set JWT_SECRET in the .env file next to this compose file - generate one with: openssl rand -hex 32}"
-      JWT_LEGACY_GRACE_MINUTES: "${JWT_LEGACY_GRACE_MINUTES:-480}"
-      JWT_LEGACY_CUTOVER_AT: "${JWT_LEGACY_CUTOVER_AT:-}"
-      APP_URL: ${APP_URL:-http://localhost:3000}
-      NEXT_PUBLIC_APP_URL: ${APP_URL:-http://localhost:3000}
-      DOCUMENTS_COLLAB_PORT: ${DOCUMENTS_COLLAB_PORT:-4101}
-      DOCUMENTS_COLLAB_REDIS_URL: redis://redis:6379
-      DOCUMENTS_COLLAB_REDIS_PREFIX: ${DOCUMENTS_COLLAB_REDIS_PREFIX:-open-mercato:documents:collab:${DEPLOY_ENV:-local}}
-      # Same Redis as the app so multi-instance collaboration sync works out of the box
-      # (DOCUMENTS_COLLAB_REDIS_URL wins when both are set).
-      REDIS_URL: redis://redis:6379
-      DOCUMENTS_COLLAB_ALLOWED_ORIGINS: ${DOCUMENTS_COLLAB_ALLOWED_ORIGINS:-${APP_URL}}
-      # Required only when collaboration is enabled; the sidecar fails closed when missing/too short.
-      DOCUMENTS_COLLAB_JWT_SECRET_V2: ${DOCUMENTS_COLLAB_JWT_SECRET_V2:-}
-      DOCUMENTS_COLLAB_JWT_SECRET: ${DOCUMENTS_COLLAB_JWT_SECRET:-}
-      DOCUMENTS_COLLAB_APP_ROOT: /app
-      # Mirror the app service's tenant-encryption configuration so the sidecar
-      # can decrypt the same data as the app.
-      TENANT_DATA_ENCRYPTION: ${TENANT_DATA_ENCRYPTION:-true}
-      TENANT_DATA_ENCRYPTION_DEBUG: ${TENANT_DATA_ENCRYPTION_DEBUG:-false}
-      TENANT_DATA_ENCRYPTION_FALLBACK_KEY: ${TENANT_DATA_ENCRYPTION_FALLBACK_KEY:-dev-tenant-encryption-fallback-key-32chars}
-      TENANT_DATA_ENCRYPTION_KEY: ${TENANT_DATA_ENCRYPTION_KEY:-}
-      CACHE_REDIS_URL: redis://redis:6379
-      CACHE_STRATEGY: ${CACHE_STRATEGY:-redis}
-    depends_on:
-      app:
-        condition: service_started
-      postgres:
-        condition: service_healthy
-      redis:
-        condition: service_healthy
-    networks:
-      - mercato-network-fullapp
-
   postgres:
     image: pgvector/pgvector:pg17-trixie
     restart: unless-stopped

package/template/next.config.ts

@@ -59,9 +59,6 @@ const nextConfig: NextConfig & { agentRules?: boolean } = {
     'esbuild',
     '@esbuild/darwin-arm64',
     '@open-mercato/cli',
-    'puppeteer-core',
-    'jszip',
-    'yjs',
     // Telemetry: the OTEL SDK + instrumentations must run as real Node modules,
     // not be bundled — the auto-instrumentations (pg/undici) monkey-patch the
     // underlying drivers at runtime. The full list is owned by

package/template/package.json.template

@@ -16,7 +16,6 @@
     "dev:reset": "node ./scripts/dev-reset.mjs",
     "build": "yarn generate && cross-env NODE_ENV=production NODE_OPTIONS=--max-old-space-size=8192 next build",
     "start": "mercato server start",
-    "documents:collab": "node ./node_modules/@open-mercato/documents/dist/server/documents-collab-server.js",
     "lint": "eslint .",
     "ds:check": "node scripts/ds-check.mjs",
     "i18n:check-hardcoded": "node scripts/i18n-check-hardcoded.mjs",
@@ -53,7 +52,6 @@
     "@modelcontextprotocol/sdk": "^1.29.0",
     "@open-mercato/ai-assistant": "{{PACKAGE_VERSION}}",
     "@open-mercato/cache": "{{PACKAGE_VERSION}}",
-    "@open-mercato/channel-discord": "{{PACKAGE_VERSION}}",
     "@open-mercato/channel-gmail": "{{PACKAGE_VERSION}}",
     "@open-mercato/channel-imap": "{{PACKAGE_VERSION}}",
     "@open-mercato/channel-apns": "{{PACKAGE_VERSION}}",
@@ -63,7 +61,6 @@
     "@open-mercato/cli": "{{PACKAGE_VERSION}}",
     "@open-mercato/content": "{{PACKAGE_VERSION}}",
     "@open-mercato/core": "{{PACKAGE_VERSION}}",
-    "@open-mercato/documents": "{{PACKAGE_VERSION}}",
     "@open-mercato/events": "{{PACKAGE_VERSION}}",
     "@open-mercato/onboarding": "{{PACKAGE_VERSION}}",
     "@open-mercato/queue": "{{PACKAGE_VERSION}}",

package/template/src/components/DemoFeedbackWidget.tsx

@@ -14,6 +14,7 @@ import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { useAiDock } from '@open-mercato/ui/ai/AiDock'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { isContactWidgetHidden } from './demoFeedbackFlag'
 
 const SUPPRESS_COOKIE = 'om_feedback_suppress'
 const SHOWN_TODAY_COOKIE = 'om_feedback_shown'
@@ -48,6 +49,7 @@ export function DemoFeedbackWidget({ demoModeEnabled }: { demoModeEnabled: boole
   const [open, setOpen] = useState(false)
   const [captionIndex, setCaptionIndex] = useState(0)
   const [mounted, setMounted] = useState(false)
+  const [hiddenByFlag, setHiddenByFlag] = useState(false)
 
   // form state
   const [email, setEmail] = useState('')
@@ -63,7 +65,13 @@ export function DemoFeedbackWidget({ demoModeEnabled }: { demoModeEnabled: boole
   const autoShownRef = useRef(false)
   const [otherModalOpen, setOtherModalOpen] = useState(false)
 
-  useEffect(() => { setMounted(true) }, [])
+  // The `ff_om_hide_contact` localStorage flag lets a demo tenant hide the
+  // contact/feedback surface entirely (floating CTA and the inactivity popup).
+  // It is read after mount because localStorage is unavailable during SSR.
+  useEffect(() => {
+    setMounted(true)
+    setHiddenByFlag(isContactWidgetHidden())
+  }, [])
 
   // Track whether another Radix Dialog or native <dialog> modal is currently open.
   // The floating button + auto-popup must defer while the user is mid-task in another modal —
@@ -99,7 +107,7 @@ export function DemoFeedbackWidget({ demoModeEnabled }: { demoModeEnabled: boole
   // operator is mid-conversation with an assistant and a popup would be
   // disruptive on top of (or competing with) the dock surface.
   useEffect(() => {
-    if (!demoModeEnabled || !mounted) return
+    if (!demoModeEnabled || !mounted || hiddenByFlag) return
     if (aiDockActive) return
     if (getCookie(SUPPRESS_COOKIE) === '1') return
     if (getCookie(SHOWN_TODAY_COOKIE) === todayKey()) return
@@ -133,7 +141,7 @@ export function DemoFeedbackWidget({ demoModeEnabled }: { demoModeEnabled: boole
       events.forEach((ev) => window.removeEventListener(ev, resetTimer))
       if (inactivityTimer.current) clearTimeout(inactivityTimer.current)
     }
-  }, [demoModeEnabled, mounted, aiDockActive])
+  }, [demoModeEnabled, mounted, aiDockActive, hiddenByFlag])
 
   const handleSubmit = useCallback(async () => {
     setFieldErrors({})
@@ -205,7 +213,7 @@ export function DemoFeedbackWidget({ demoModeEnabled }: { demoModeEnabled: boole
     }
   }, [submitState, resetForm])
 
-  if (!mounted) return null
+  if (!mounted || hiddenByFlag) return null
 
   const caption = CAPTIONS[captionIndex]
   const currentCaption = t(caption.key, caption.fallback)

package/template/src/components/__tests__/DemoFeedbackWidget.test.tsx

@@ -0,0 +1,53 @@
+/**
+ * @jest-environment jsdom
+ */
+
+import '@testing-library/jest-dom'
+import { render, screen } from '@testing-library/react'
+import { DemoFeedbackWidget } from '../DemoFeedbackWidget'
+import { HIDE_CONTACT_FLAG_KEY } from '../demoFeedbackFlag'
+
+jest.mock('next/image', () => ({
+  __esModule: true,
+  default: ({ alt }: { alt: string }) => <span data-testid="logo">{alt}</span>,
+}))
+
+jest.mock('@open-mercato/shared/lib/i18n/context', () => ({
+  useT: () => (_key: string, fallback?: string) => fallback ?? '',
+}))
+
+jest.mock('@open-mercato/ui/ai/AiDock', () => ({
+  useAiDock: () => ({ state: {} }),
+}))
+
+jest.mock('@open-mercato/ui/backend/utils/apiCall', () => ({
+  apiCall: jest.fn(),
+}))
+
+describe('DemoFeedbackWidget', () => {
+  afterEach(() => {
+    window.localStorage.clear()
+  })
+
+  it('renders the floating contact button by default', () => {
+    render(<DemoFeedbackWidget demoModeEnabled={true} />)
+
+    expect(screen.getByRole('button', { name: 'Open feedback form' })).toBeInTheDocument()
+  })
+
+  it('hides the floating contact button when ff_om_hide_contact is set', () => {
+    window.localStorage.setItem(HIDE_CONTACT_FLAG_KEY, '1')
+
+    render(<DemoFeedbackWidget demoModeEnabled={true} />)
+
+    expect(screen.queryByRole('button', { name: 'Open feedback form' })).not.toBeInTheDocument()
+  })
+
+  it('keeps the button when the flag is explicitly disabled', () => {
+    window.localStorage.setItem(HIDE_CONTACT_FLAG_KEY, 'false')
+
+    render(<DemoFeedbackWidget demoModeEnabled={true} />)
+
+    expect(screen.getByRole('button', { name: 'Open feedback form' })).toBeInTheDocument()
+  })
+})

package/template/src/components/__tests__/demoFeedbackFlag.test.ts

@@ -0,0 +1,38 @@
+/**
+ * @jest-environment jsdom
+ */
+
+import { HIDE_CONTACT_FLAG_KEY, isContactWidgetHidden } from '../demoFeedbackFlag'
+
+describe('isContactWidgetHidden', () => {
+  afterEach(() => {
+    window.localStorage.clear()
+    jest.restoreAllMocks()
+  })
+
+  it('is false when the flag is absent', () => {
+    expect(isContactWidgetHidden()).toBe(false)
+  })
+
+  it('is true when the flag is present with an empty value', () => {
+    window.localStorage.setItem(HIDE_CONTACT_FLAG_KEY, '')
+    expect(isContactWidgetHidden()).toBe(true)
+  })
+
+  it.each(['1', 'true', 'yes', 'on', 'whatever'])('is true for value %s', (value) => {
+    window.localStorage.setItem(HIDE_CONTACT_FLAG_KEY, value)
+    expect(isContactWidgetHidden()).toBe(true)
+  })
+
+  it.each(['0', 'false', 'off', 'no'])('is false for explicit opt-out value %s', (value) => {
+    window.localStorage.setItem(HIDE_CONTACT_FLAG_KEY, value)
+    expect(isContactWidgetHidden()).toBe(false)
+  })
+
+  it('is false when localStorage access throws', () => {
+    jest.spyOn(Storage.prototype, 'getItem').mockImplementation(() => {
+      throw new Error('denied')
+    })
+    expect(isContactWidgetHidden()).toBe(false)
+  })
+})

package/template/src/components/demoFeedbackFlag.ts

@@ -0,0 +1,15 @@
+import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+
+export const HIDE_CONTACT_FLAG_KEY = 'ff_om_hide_contact'
+
+export function isContactWidgetHidden(): boolean {
+  if (typeof window === 'undefined') return false
+  let raw: string | null = null
+  try {
+    raw = window.localStorage.getItem(HIDE_CONTACT_FLAG_KEY)
+  } catch {
+    return false
+  }
+  if (raw === null) return false
+  return parseBooleanWithDefault(raw, true)
+}