acumatica-cli 0.28.0__tar.gz → 0.29.0__tar.gz

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: acumatica-cli
-Version: 0.28.0
+Version: 0.29.0
 Summary: Acumatica ERP Config-as-Code: tenant provisioning, baseline config, and reference data
 Author: Konstantin Borovik
 Author-email: Konstantin Borovik <kb@lab5.ca>
@@ -196,7 +196,7 @@ There is no `--flavor`.
 | `config/bootstrap/` | virgin-tenant config: features, company, credit terms (no `project.xml`) |
 | `config/baseline/` | reference data: subaccounts, COA, ledger, UOMs |
 | `config/setup/` | one-time actions: financial year, master calendar, open periods |
-| `config/master/` | inventory/distribution masters: numbering (`05-…`) before prefs, warehouse, items, parties + Role/User (`90-roles` then `91-users`) |
+| `config/master/` | inventory/distribution masters: numbering (`05-…`) before prefs, warehouse, items, parties + Role/User (`90-roles` then `91-users` then `92-role-users`) |
 | `scenario/` | lifecycle txns for `acu run`: once capital, then buy, build, sell |
 | `config/views/` | observer views for `acu state` (`inquire:` / `entity:` / `gi:`; not SEED_DIRS) |
 | `state/` | committed derived-state observations (evidence, not seed; money/qty fixed-point) |

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/README.md

@@ -178,7 +178,7 @@ There is no `--flavor`.
 | `config/bootstrap/` | virgin-tenant config: features, company, credit terms (no `project.xml`) |
 | `config/baseline/` | reference data: subaccounts, COA, ledger, UOMs |
 | `config/setup/` | one-time actions: financial year, master calendar, open periods |
-| `config/master/` | inventory/distribution masters: numbering (`05-…`) before prefs, warehouse, items, parties + Role/User (`90-roles` then `91-users`) |
+| `config/master/` | inventory/distribution masters: numbering (`05-…`) before prefs, warehouse, items, parties + Role/User (`90-roles` then `91-users` then `92-role-users`) |
 | `scenario/` | lifecycle txns for `acu run`: once capital, then buy, build, sell |
 | `config/views/` | observer views for `acu state` (`inquire:` / `entity:` / `gi:`; not SEED_DIRS) |
 | `state/` | committed derived-state observations (evidence, not seed; money/qty fixed-point) |

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "acumatica-cli"
-version = "0.28.0"
+version = "0.29.0"
 description = "Acumatica ERP Config-as-Code: tenant provisioning, baseline config, and reference data"
 license = "PolyForm-Noncommercial-1.0.0"
 readme = "README.md"

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/pyproject.toml.orig

@@ -1,6 +1,6 @@
 [project]
 name = "acumatica-cli"
-version = "0.28.0"
+version = "0.29.0"
 description = "Acumatica ERP Config-as-Code: tenant provisioning, baseline config, and reference data"
 authors = [{ name = "Konstantin Borovik", email = "kb@lab5.ca" }]
 license = "PolyForm-Noncommercial-1.0.0"

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/bootstrap.py

@@ -9,7 +9,7 @@ cannot write CS100000 at all (T3 verdict) — and whose Bootstrap contract
 endpoint exposes the seeding surface (serialization verified T12).
 
 Bootstrap endpoint contract is package SoT (V2/V21/T178): always the
-packaged full company ``bootstrap_project.xml`` (``Bootstrap/1.7.0``).
+packaged full company ``bootstrap_project.xml`` (``Bootstrap/1.10.0``).
 Data-repo ``config/bootstrap/project.xml`` or ``bootstrap/project.xml`` is
 not a seed — present → hard error naming package SoT (no dual contract line).
 
@@ -68,7 +68,7 @@ def _bootstrap_file(root: Path, name: str) -> Path | None:
 
 
 def packaged_contract_xml() -> bytes:
-    """The CLI-shipped full company Bootstrap contract (``Bootstrap/1.7.0``)."""
+    """The CLI-shipped full company Bootstrap contract (``Bootstrap/1.10.0``)."""
     return (resources.files("acumatica_cli") / "bootstrap_project.xml").read_bytes()
 
 

acumatica_cli-0.29.0/src/acumatica_cli/bootstrap_plugin.cs

@@ -0,0 +1,147 @@
+// acu bootstrap CustomizationPlugin (SPEC T11).
+//
+// Runs in-process on customization publish - the one write path to
+// FeaturesSet that works: the contract API cannot persist features no
+// matter what endpoint fronts CS100000 (T3 verdict, docs/rest-api.md).
+//
+// Deliberately writes through PXDatabase, not FeaturesMaint: the graph
+// save collides with the publish pipeline's concurrent plugin invocations
+// ("Another process has added the 'FeaturesSet' record" - observed live,
+// 26.101.0225) and nothing persists. A keyed row write is deterministic
+// and idempotent: update the existing row, insert when absent. All 205
+// NOT NULL bit columns are filled reflectively (only ~136 carry DB
+// defaults); Status = 0 means Validated (PXIntList, verified vs live).
+//
+// The Enabled set is NOT authored here (SPEC V2: feature flags are config
+// "what", never tool source - B6): package_zip() substitutes the
+// ACU_FEATURES sentinel below with the data repo's bootstrap/features.yaml
+// list (built-in six when the file is absent) at package-build time.
+using System;
+using System.Collections;
+using System.Collections.Generic;
+using System.Reflection;
+using PX.Data;
+using PX.Objects.CS;
+using PX.SM;
+
+namespace AcuBootstrap
+{
+    public class AcuBootstrapPlugin : Customization.CustomizationPlugin
+    {
+        private static readonly HashSet<string> Enabled = new HashSet<string>
+        {
+            /*ACU_FEATURES*/
+        };
+
+        public override void UpdateDatabase()
+        {
+            var flags = new List<PXDataFieldAssign>();
+            var known = new HashSet<string>();
+            foreach (PropertyInfo prop in typeof(FeaturesSet).GetProperties())
+            {
+                if (prop.PropertyType == typeof(bool?))
+                {
+                    known.Add(prop.Name);
+                    flags.Add(new PXDataFieldAssign(
+                        prop.Name, PXDbType.Bit, Enabled.Contains(prop.Name)));
+                }
+            }
+            foreach (string name in Enabled)
+            {
+                if (!known.Contains(name))
+                {
+                    // silent-typo guard (T24): a misspelled features.yaml
+                    // entry enables nothing - say so in the publish log
+                    WriteLog("AcuBootstrap: unknown feature name '" + name
+                        + "' - no FeaturesSet property, nothing enabled");
+                }
+            }
+            flags.Add(new PXDataFieldAssign("Status", PXDbType.Int, 0)); // Validated
+
+            using (var tx = new PXTransactionScope())
+            {
+                bool updated = PXDatabase.Update<FeaturesSet>(flags.ToArray());
+                if (!updated)
+                {
+                    PXDatabase.Insert<FeaturesSet>(flags.ToArray());
+                    WriteLog("AcuBootstrap: FeaturesSet row inserted (features enabled)");
+                }
+                else
+                {
+                    WriteLog("AcuBootstrap: FeaturesSet row updated (features enabled)");
+                }
+                tx.Complete();
+            }
+        }
+
+        // V53/B33: mapped Role.Users / User.Roles PUT never writes
+        // UsersInRoles. Persist is a keyed PXDatabase write (same
+        // FeaturesSet idiom): ApplicationName='/' (ASP.NET membership).
+        public static void AssignUserToRole(string username, string rolename)
+        {
+            if (string.IsNullOrEmpty(username) || string.IsNullOrEmpty(rolename))
+            {
+                throw new PXException(
+                    "AssignUser requires Username and Rolename");
+            }
+            Guid userId = PXAccess.GetUserID();
+            DateTime now = DateTime.Now;
+            var update = new List<PXDataFieldParam>
+            {
+                new PXDataFieldRestrict("Username", PXDbType.NVarChar, username),
+                new PXDataFieldRestrict("Rolename", PXDbType.NVarChar, rolename),
+                new PXDataFieldRestrict("ApplicationName", PXDbType.VarChar, "/"),
+                new PXDataFieldAssign("LastModifiedByID", PXDbType.UniqueIdentifier, userId),
+                new PXDataFieldAssign("LastModifiedByScreenID", PXDbType.Char, "SM201005"),
+                new PXDataFieldAssign("LastModifiedDateTime", PXDbType.DateTime, now),
+            };
+            bool updated = PXDatabase.Update<UsersInRoles>(update.ToArray());
+            if (!updated)
+            {
+                var insert = new List<PXDataFieldAssign>
+                {
+                    new PXDataFieldAssign("Username", PXDbType.NVarChar, username),
+                    new PXDataFieldAssign("Rolename", PXDbType.NVarChar, rolename),
+                    new PXDataFieldAssign("ApplicationName", PXDbType.VarChar, "/"),
+                    new PXDataFieldAssign("CreatedByID", PXDbType.UniqueIdentifier, userId),
+                    new PXDataFieldAssign("CreatedByScreenID", PXDbType.Char, "SM201005"),
+                    new PXDataFieldAssign("CreatedDateTime", PXDbType.DateTime, now),
+                    new PXDataFieldAssign("LastModifiedByID", PXDbType.UniqueIdentifier, userId),
+                    new PXDataFieldAssign("LastModifiedByScreenID", PXDbType.Char, "SM201005"),
+                    new PXDataFieldAssign("LastModifiedDateTime", PXDbType.DateTime, now),
+                };
+                PXDatabase.Insert<UsersInRoles>(insert.ToArray());
+            }
+        }
+    }
+
+    public class AssignUserFilter : PXBqlTable, IBqlTable
+    {
+        [PXString(256, IsUnicode = true, InputMask = "")]
+        [PXUIField(DisplayName = "Username")]
+        public virtual string Username { get; set; }
+        public abstract class username : PX.Data.BQL.BqlString.Field<username> { }
+    }
+
+    // Action lives on RoleAccess so Base.Roles.Current is the SM201005 header.
+    public class AcuRoleAccessExt : PXGraphExtension<RoleAccess>
+    {
+        public static bool IsActive() => true;
+
+        public PXFilter<AssignUserFilter> AssignUserParams;
+
+        public PXAction<Roles> assignUser;
+
+        [PXButton(CommitChanges = true)]
+        [PXUIField(DisplayName = "Assign User", Visible = false)]
+        protected virtual IEnumerable AssignUser(PXAdapter adapter)
+        {
+            string username = AssignUserParams.Current != null
+                ? AssignUserParams.Current.Username : null;
+            Roles role = Base.Roles.Current;
+            string rolename = role != null ? role.Rolename : null;
+            AcuBootstrapPlugin.AssignUserToRole(username, rolename);
+            return adapter.Get();
+        }
+    }
+}

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/bootstrap_project.xml

@@ -8,7 +8,12 @@
   T204 bumps 1.4.0 -> 1.5.0 for SegmentedKey, gh #30 / V50;
   T207 bumps 1.5.0 -> 1.6.0 for SegmentedKey Detail view (B28);
   gh #34 bumps 1.6.0 -> 1.7.0 for Company DecPlQty + WeightUOM/VolumeUOM
-  (CS101500 commonsetup; kit BOM milligram-scale KG needs qty precision 3).
+  (CS101500 commonsetup; kit BOM milligram-scale KG needs qty precision 3);
+  gh #35 bumps 1.7.0 -> 1.8.0 for User.Roles -> RolesByUser (UsersInRoles)
+  and drops Selected (AllowedRoles was EPLoginTypeAllowsRole / EP202500);
+  T228 bumps 1.8.0 -> 1.9.0 for Role.Users -> UsersByRole (SM201005
+  Users tab; mapped-detail PUT is a no-op — B33) and 1.9.0 -> 1.10.0
+  for Role AssignUser action (PXDatabase UsersInRoles persist).
 
   package_zip() (bootstrap.py) prefers data-repo bootstrap/project.xml when
   present; otherwise this packaged template is the fallback so config init,
@@ -48,9 +53,13 @@
     Username; identity FirstName/LastName/Email + IsApproved +
     PasswordNeverExpires + PasswordChangeOnNextLogin; Password write-only
     (extract/diff policy = V39/T147).
-  - membership = User detail Roles -> AllowedRoles (UsersInRoles/Roles
-    projection): Rolename + Selected (assign when true). Apply order
-    Role then User (V22 prefixes; T148).
+  - User detail Roles -> RolesByUser (GET/diff shape; PUT never
+    writes UsersInRoles — B31/B32/B33). Persist = Role action
+    AssignUser -> PXDatabase UsersInRoles (ApplicationName='/').
+    Role.Users -> UsersByRole is the mapped-detail fixture (silent
+    200). Apply order Role then User then Role.Users
+    (V22 prefixes 90/91/92). Never AllowedRoles
+    (EPLoginTypeAllowsRole / EP202500 allow-list; gh #35 / V53).
 
   T150 NumberingSequence (gh #25) - Default endpoint has no numbering
   surface; CS201010 Numbering Sequences (NumberingMaint — NOT the
@@ -112,7 +121,7 @@
 -->
 <Customization level="" description="acu bootstrap: CustomizationPlugin enables features on publish; Bootstrap endpoint exposes full company surface (company + credit terms + financial currency + GL chain + module preferences + vendor class + statement cycle + warehouse + order type + cash account + role + user + membership + numbering sequence + segmented key)" product-version="26.101">
   <EntityEndpoint>
-    <Endpoint xmlns="http://www.acumatica.com/entity/maintenance/5.31" name="Bootstrap" version="1.7.0" systemContractVersion="4">
+    <Endpoint xmlns="http://www.acumatica.com/entity/maintenance/5.31" name="Bootstrap" version="1.10.0" systemContractVersion="4">
       <TopLevelEntity name="Company" screen="CS101500">
         <Fields>
           <Field name="AcctCD" type="StringValue" />
@@ -1019,6 +1028,7 @@
         <Fields>
           <Field name="Rolename" type="StringValue" />
           <Field name="Descr" type="StringValue" />
+          <Field name="Users" type="RoleUser[]" />
         </Fields>
         <Mappings>
           <Mapping field="Rolename">
@@ -1027,8 +1037,33 @@
           <Mapping field="Descr">
             <To object="Roles" field="Descr" />
           </Mapping>
+          <Mapping field="Users">
+            <To object="UsersByRole" field="" />
+          </Mapping>
         </Mappings>
+        <Actions>
+          <Action name="AssignUser" mappedTo="assignUser" isDefault="false">
+            <Fields>
+              <Field name="Username" type="StringValue" />
+            </Fields>
+            <Mappings>
+              <Mapping field="Username">
+                <To object="AssignUserParams" field="Username" />
+              </Mapping>
+            </Mappings>
+          </Action>
+        </Actions>
       </TopLevelEntity>
+      <Detail name="RoleUser">
+        <Fields>
+          <Field name="Username" type="StringValue" />
+        </Fields>
+        <Mappings>
+          <Mapping field="Username">
+            <To object="UsersByRole" field="Username" />
+          </Mapping>
+        </Mappings>
+      </Detail>
       <TopLevelEntity name="User" screen="SM201010">
         <Fields>
           <Field name="Username" type="StringValue" />
@@ -1067,21 +1102,17 @@
             <To object="UserList" field="Password" />
           </Mapping>
           <Mapping field="Roles">
-            <To object="AllowedRoles" field="" />
+            <To object="RolesByUser" field="" />
           </Mapping>
         </Mappings>
       </TopLevelEntity>
       <Detail name="UserRole">
         <Fields>
           <Field name="Rolename" type="StringValue" />
-          <Field name="Selected" type="BooleanValue" />
         </Fields>
         <Mappings>
           <Mapping field="Rolename">
-            <To object="AllowedRoles" field="Rolename" />
-          </Mapping>
-          <Mapping field="Selected">
-            <To object="AllowedRoles" field="Selected" />
+            <To object="RolesByUser" field="Rolename" />
           </Mapping>
         </Mappings>
       </Detail>

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/config.py

@@ -70,6 +70,10 @@ INIT_TEMPLATES = (
         "config/baseline/60-ledger-company.yaml",
     ),
     ("config/baseline/90-uoms.yaml", "config/baseline/90-uoms.yaml"),
+    (
+        "config/baseline/91-company-packaging.yaml",
+        "config/baseline/91-company-packaging.yaml",
+    ),
     ("config/setup/10-financial-year.yaml", "config/setup/10-financial-year.yaml"),
     ("config/setup/20-master-calendar.yaml", "config/setup/20-master-calendar.yaml"),
     ("config/setup/30-open-periods.yaml", "config/setup/30-open-periods.yaml"),
@@ -128,6 +132,7 @@ INIT_TEMPLATES = (
     ),
     ("config/master/90-roles.yaml", "config/master/90-roles.yaml"),
     ("config/master/91-users.yaml", "config/master/91-users.yaml"),
+    ("config/master/92-role-users.yaml", "config/master/92-role-users.yaml"),
     (
         "config/views/10-trial-balance.yaml",
         "config/views/10-trial-balance.yaml",

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/extract.py

@@ -590,6 +590,13 @@ class _Extraction:
             if not live:
                 self._skip(target, "no records")
                 continue
+            # V53: Role.Users GET may stay empty; do not emit identity-only
+            # 92-role-users.yaml that would drop authored AssignUser rows.
+            if spec.include == ["Users"] and not any(
+                isinstance(r.get("Users"), list) and r["Users"] for r in records
+            ):
+                self._skip(target, "Users GET empty")
+                continue
             self._emit(target, _render(spec, records), len(records))
             produced.add(spec.file)
         return produced

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/seed.py

@@ -397,6 +397,10 @@ def apply(
     records in the same file. Returns ``(ok_count, error_messages)`` —
     never silent partial; caller exits 1 when any errors remain. Exit 2
     stays drift (``diff`` only).
+
+    Role.Users mapped-detail PUT is a no-op (V53/B33). After the Role PUT,
+    apply invokes contract action ``AssignUser`` per Username so persist
+    is PXDatabase UsersInRoles, not the mapped detail.
     """
     if isinstance(baseline, ActionFile):
         return _apply_action(client, baseline, dry_run)
@@ -406,14 +410,23 @@ def apply(
         label = ", ".join(str(record[k]) for k in baseline.keys)
         if dry_run:
             output.data(f"  would PUT {baseline.entity} [{label}]")
-            ok += 1
+            try:
+                _assign_role_users(client, baseline, record, dry_run=True)
+                ok += 1
+            except RuntimeError as err:
+                msg = f"{baseline.entity} [{label}]: {err}"
+                output.error(msg)
+                errors.append(msg)
             continue
         try:
             body = _put_body(client, baseline, record)
+            if baseline.entity == "Role":
+                body.pop("Users", None)
             _put(client, baseline.entity, body, baseline.endpoint)
             if baseline.entity == "Company":
                 client.refresh_after_company()
             output.data(f"  PUT {baseline.entity} [{label}]")
+            _assign_role_users(client, baseline, record, dry_run=False)
             ok += 1
         except RuntimeError as err:
             msg = f"{baseline.entity} [{label}]: {err}"
@@ -422,6 +435,51 @@ def apply(
     return ok, errors
 
 
+def _assign_role_users(
+    client: AcumaticaClient,
+    baseline: BaselineFile,
+    record: dict[str, Any],
+    *,
+    dry_run: bool,
+) -> None:
+    """V53/B33: persist Role.Users via AssignUser, not mapped-detail PUT.
+
+    Additive-only: ``delete: true`` merge rows are skipped. Mapped GET of
+    Users may be empty, so extra live members are not a persist delete.
+    Role PUT strips ``Users`` so additive-only does not depend on B33.
+    """
+    if baseline.entity != "Role":
+        return
+    users = record.get("Users")
+    if not isinstance(users, list):
+        return
+    rolename = record.get("Rolename")
+    if not isinstance(rolename, str) or not rolename:
+        return
+    to_assign: list[str] = []
+    for i, row in enumerate(users):
+        if isinstance(row, dict) and row.get("delete") is True:
+            continue
+        if not isinstance(row, dict):
+            raise RuntimeError(f"Users[{i}] is not a mapping")
+        username = row.get("Username")
+        if not isinstance(username, str) or not username:
+            raise RuntimeError(f"Users[{i}] missing Username")
+        to_assign.append(username)
+    for username in to_assign:
+        if dry_run:
+            output.data(f"  would invoke AssignUser [{rolename}/{username}]")
+            continue
+        client.invoke(
+            "Role",
+            "AssignUser",
+            {"Rolename": rolename},
+            {"Username": username},
+            baseline.endpoint,
+        )
+        output.data(f"  invoke AssignUser [{rolename}/{username}]")
+
+
 def _put(
     client: AcumaticaClient,
     entity: str,

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/seed_catalog.yaml

@@ -6,7 +6,7 @@
 #   entity    contract entity name (the GET source and the emitted `entity:`)
 #   endpoint  omitted = the instance Default endpoint; the symbolic name
 #             `bootstrap` stays symbolic in emitted files and resolves to
-#             the packaged full company Bootstrap/1.7.0 at HTTP/load time
+#             the packaged full company Bootstrap/1.10.0 at HTTP/load time
 #             (package SoT - V20/V21/T178; data-repo project.xml forbidden)
 #   keys      key fields: the emitted `key:`, the record sort order, and
 #             the B9 fallback's $select projection; the tuple must
@@ -44,10 +44,9 @@ entities:
 
 # config/bootstrap/ - the virgin-tenant phase via the custom Bootstrap
 # endpoint: built-in endpoints cannot create the first organization (C).
-# Company packaging: DecPlQty + WeightUOM/VolumeUOM on CS101500 commonsetup
-# (gh #34). WeightUOM/VolumeUOM required to persist CommonSetup when
-# DistributionModule is on. B26 dropped unmapped packaging claims; mapped
-# fields that GET returns stay in include.
+# Company identity first (bootstrap). Packaging qty/UOMs are a second
+# Company PUT after 90-uoms.yaml (see that row). StockItem WeightUOM
+# /VolumeUOM stay GET-omit (B26).
 
 - entity: Company
   endpoint: bootstrap
@@ -58,9 +57,6 @@ entities:
   - OrganizationType
   - BaseCuryID
   - CountryID
-  - DecPlQty
-  - WeightUOM
-  - VolumeUOM
 
 - entity: CreditTerms
   endpoint: bootstrap
@@ -167,6 +163,20 @@ entities:
   - Description
   - L3Code
 
+# Company packaging (gh #34 / V52): second PUT after UOMs so KG/LITER
+# exist for CommonSetup_RowPersisting when DistributionModule is on.
+# Include-partition of the same live Company row (warehouse-phase idiom).
+# Mapped fields GET-return stay in include.
+
+- entity: Company
+  endpoint: bootstrap
+  keys: [AcctCD]
+  file: config/baseline/91-company-packaging.yaml
+  include:
+  - DecPlQty
+  - WeightUOM
+  - VolumeUOM
+
 # config/master/ - full packaged seed (T117). Multi-file Warehouse uses
 # include field-partition (same live warehouse row, three apply phases).
 # Multi-file StockItem uses OData filter-split on ItemClass.
@@ -522,10 +532,12 @@ entities:
   - Active
   - StockComponents
 
-# config/master/ Role then User (V22 prefixes; T145/T146/T148). Bootstrap
-# only — Default has no Role/User surface. Membership = User detail Roles
-# (UserRole/AllowedRoles). Package 90-roles = full pre-build CompanyID=1
-# Roles dump (system + module roles; live 26.x); 91-users demo soadmin.
+# config/master/ Role then User then Role.Users (V22 prefixes 90/91/92;
+# T145/T146/T148/T228). Bootstrap only — Default has no Role/User surface.
+# Persist = Role action AssignUser (PXDatabase UsersInRoles; T228/B33).
+# User detail Roles is GET/diff shape (PUT never writes UsersInRoles —
+# B31/B32/B33). Package 90-roles = full pre-build CompanyID=1
+# Roles dump; 91-users demo soadmin identity; 92-role-users membership.
 # Password is write-only on apply (V39/T147): include omits Password so
 # extract never emits hashes (b64__Password also out of include).
 
@@ -551,6 +563,19 @@ entities:
   - PasswordChangeOnNextLogin
   - Roles
 
+# Persist membership (T228/V53): apply Role.Users invokes AssignUser.
+# Filter-split from 90-roles (Descr-only identity dump). Mapped-detail
+# PUT never writes UsersInRoles (B31/B32/B33).
+- entity: Role
+  endpoint: bootstrap
+  keys: [Rolename]
+  file: config/master/92-role-users.yaml
+  filter: Rolename eq 'SO Admin'
+  detail_keys:
+    Users: Username
+  include:
+  - Users
+
 # config/setup/ - the GL action chain (T36/T37): financial-year setup,
 # then calendar generation, then period activation; numbered prefixes
 # mirror the verified apply order.

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/templates/README.md

@@ -48,7 +48,7 @@ Bare `acu apply` / `acu diff` also prefer `config/` when those trees exist.
 | `config/bootstrap/` | Company, features, credit terms (Bootstrap contract is package SoT — never scaffolded) |
 | `config/baseline/` | GL foundation (COA, ledger, subaccounts, UOMs) |
 | `config/setup/` | Financial year, master calendar, open periods |
-| `config/master/` | Numbering (`05-numbering-sequences`) before module prefs; inventory, warehouse, items, vendors, customers; roles/users (`90-roles` then `91-users`) |
+| `config/master/` | Numbering (`05-numbering-sequences`) before module prefs; inventory, warehouse, items, vendors, customers; roles/users (`90-roles` then `91-users` then `92-role-users`) |
 | `scenario/10-seed-capital.yaml` | Once-class owner capital JE (skip-if-present when present); Period = `${current_period}` |
 | `scenario/20-buy.yaml` | Additive component PO → receipt → bill → AP pay |
 | `scenario/30-build.yaml` | Additive kit assembly |

acumatica_cli-0.29.0/src/acumatica_cli/templates/config/baseline/91-company-packaging.yaml

@@ -0,0 +1,8 @@
+entity: Company
+key: AcctCD
+endpoint: bootstrap
+records:
+- AcctCD: LAB5
+  DecPlQty: 3
+  WeightUOM: KG
+  VolumeUOM: LITER

{acumatica_cli-0.28.0 → acumatica_cli-0.29.0}/src/acumatica_cli/templates/config/master/91-users.yaml

@@ -13,4 +13,3 @@ records:
   PasswordChangeOnNextLogin: false
   Roles:
   - Rolename: SO Admin
-    Selected: true

acumatica_cli-0.29.0/src/acumatica_cli/templates/config/master/92-role-users.yaml

@@ -0,0 +1,9 @@
+entity: Role
+key: Rolename
+endpoint: bootstrap
+detail_keys:
+  Users: Username
+records:
+- Rolename: SO Admin
+  Users:
+  - Username: soadmin

acumatica_cli-0.28.0/src/acumatica_cli/bootstrap_plugin.cs

@@ -1,74 +0,0 @@
-// acu bootstrap CustomizationPlugin (SPEC T11).
-//
-// Runs in-process on customization publish - the one write path to
-// FeaturesSet that works: the contract API cannot persist features no
-// matter what endpoint fronts CS100000 (T3 verdict, docs/rest-api.md).
-//
-// Deliberately writes through PXDatabase, not FeaturesMaint: the graph
-// save collides with the publish pipeline's concurrent plugin invocations
-// ("Another process has added the 'FeaturesSet' record" - observed live,
-// 26.101.0225) and nothing persists. A keyed row write is deterministic
-// and idempotent: update the existing row, insert when absent. All 205
-// NOT NULL bit columns are filled reflectively (only ~136 carry DB
-// defaults); Status = 0 means Validated (PXIntList, verified vs live).
-//
-// The Enabled set is NOT authored here (SPEC V2: feature flags are config
-// "what", never tool source - B6): package_zip() substitutes the
-// ACU_FEATURES sentinel below with the data repo's bootstrap/features.yaml
-// list (built-in six when the file is absent) at package-build time.
-using System.Collections.Generic;
-using System.Reflection;
-using PX.Data;
-using PX.Objects.CS;
-
-namespace AcuBootstrap
-{
-    public class AcuBootstrapPlugin : Customization.CustomizationPlugin
-    {
-        private static readonly HashSet<string> Enabled = new HashSet<string>
-        {
-            /*ACU_FEATURES*/
-        };
-
-        public override void UpdateDatabase()
-        {
-            var flags = new List<PXDataFieldAssign>();
-            var known = new HashSet<string>();
-            foreach (PropertyInfo prop in typeof(FeaturesSet).GetProperties())
-            {
-                if (prop.PropertyType == typeof(bool?))
-                {
-                    known.Add(prop.Name);
-                    flags.Add(new PXDataFieldAssign(
-                        prop.Name, PXDbType.Bit, Enabled.Contains(prop.Name)));
-                }
-            }
-            foreach (string name in Enabled)
-            {
-                if (!known.Contains(name))
-                {
-                    // silent-typo guard (T24): a misspelled features.yaml
-                    // entry enables nothing - say so in the publish log
-                    WriteLog("AcuBootstrap: unknown feature name '" + name
-                        + "' - no FeaturesSet property, nothing enabled");
-                }
-            }
-            flags.Add(new PXDataFieldAssign("Status", PXDbType.Int, 0)); // Validated
-
-            using (var tx = new PXTransactionScope())
-            {
-                bool updated = PXDatabase.Update<FeaturesSet>(flags.ToArray());
-                if (!updated)
-                {
-                    PXDatabase.Insert<FeaturesSet>(flags.ToArray());
-                    WriteLog("AcuBootstrap: FeaturesSet row inserted (features enabled)");
-                }
-                else
-                {
-                    WriteLog("AcuBootstrap: FeaturesSet row updated (features enabled)");
-                }
-                tx.Complete();
-            }
-        }
-    }
-}