celerp 2.1.0__tar.gz → 2.2.0__tar.gz

{celerp-2.1.0 → celerp-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: celerp
-Version: 2.1.0
+Version: 2.2.0
 Summary: Free, self-hosted ERP for small businesses
 License: Business Source License 1.1
         
@@ -185,18 +185,22 @@ Celerp is simple to use, flexible, customizable, and designed to transition your
 [![Tests](https://github.com/celerp/celerp/actions/workflows/ci.yml/badge.svg)](https://github.com/celerp/celerp/actions)
 [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE)
 
+<!-- PRESS_KIT:root-hero start -->
 ![Celerp manufacturing cost worksheet](docs/press-kit/screenshots/manufacturing-worksheet.png)
+<!-- PRESS_KIT:root-hero end -->
 
 ## Screenshots
 
 Real double-entry accounting, multi-location inventory, manufacturing, and a built-in REST API - one self-hosted app.
 
+<!-- PRESS_KIT:root-grid start -->
 | | |
 |---|---|
+| ![Dashboard with revenue trend, receivables aging, and inventory mix](docs/press-kit/screenshots/dashboard.png)<br>**Dashboard** - revenue trend, AR aging, inventory mix | ![Multi-location inventory with barcode scanning and valuation](docs/press-kit/screenshots/inventory.png)<br>**Inventory** - multi-location, barcode, valuation |
 | ![Double-entry trial balance that ties out to zero](docs/press-kit/screenshots/trial-balance.png)<br>**Trial balance** - ties out to zero | ![Balance sheet generated from the event-sourced ledger](docs/press-kit/screenshots/balance-sheet.png)<br>**Balance sheet** - live from the ledger |
-| ![General ledger with account drill-down](docs/press-kit/screenshots/general-ledger.png)<br>**General ledger** - full drill-down | ![Multi-location inventory with barcode scanning and valuation](docs/press-kit/screenshots/inventory.png)<br>**Inventory** - multi-location, barcode, valuation |
-| ![Production planning by status, priority, and due date](docs/press-kit/screenshots/production-planning.png)<br>**Production planning** - work orders, priorities, due dates | ![Built-in REST API for integrations](docs/press-kit/screenshots/rest-api.png)<br>**REST API** - integrate anything |
-| ![Dashboard with revenue trend, receivables aging, and inventory mix](docs/press-kit/screenshots/dashboard.png)<br>**Dashboard** - revenue trend, AR aging, inventory mix | |
+| ![Production planning by status, priority, and due date](docs/press-kit/screenshots/production-planning.png)<br>**Production planning** - work orders, priorities, due dates | ![International shipping document with commercial invoice and customs detail](docs/press-kit/screenshots/international-shipping-document.png)<br>**Shipping documents** - commercial invoice and customs |
+| ![Built-in REST API for integrations](docs/press-kit/screenshots/rest-api.png)<br>**REST API** - integrate anything | ![Customer statement of account showing receivables](docs/press-kit/screenshots/statement-of-account.png)<br>**Statement of account** - customer AR at a glance |
+<!-- PRESS_KIT:root-grid end -->
 
 More in the [press kit](docs/press-kit/).
 
@@ -206,9 +210,9 @@ More in the [press kit](docs/press-kit/).
 
 | Platform | Link |
 |----------|------|
-| Windows (.exe) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
-| Linux (.AppImage) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
-| macOS (.dmg) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
+| Windows (.exe) | [Download](https://celerp.com/download-thanks.html?dl=win) |
+| Linux (.deb) | [Download](https://celerp.com/download-thanks.html?dl=linux) |
+| macOS (.dmg) | [Download](https://celerp.com/download-thanks.html?dl=mac) |
 
 **Double-click. No account. No credit card. Your computer securely becomes the server for your office**
 
@@ -335,8 +339,7 @@ Celerp is open-core:
   self-hosting permitted, contributions welcome.
 - **An MIT-licensed module ecosystem** - the default business modules are MIT, so you can
   fork them, build your own modules, and ship them however you like. See [LICENSING.md](LICENSING.md).
-- **A proprietary application + cloud layer** (official UI, document/PDF output, and the cloud/AI
-  services) that powers the hosted experience.
+- **A source available application** (official UI, document/PDF output and AI & Connect services).
 
 See [LICENSING.md](LICENSING.md) for the full map and [TRADEMARK.md](legal/TRADEMARK.md) for use of the Celerp
 name. One restriction: don't resell Celerp itself as a competing product.

{celerp-2.1.0 → celerp-2.2.0}/README.md

@@ -12,18 +12,22 @@ Celerp is simple to use, flexible, customizable, and designed to transition your
 [![Tests](https://github.com/celerp/celerp/actions/workflows/ci.yml/badge.svg)](https://github.com/celerp/celerp/actions)
 [![License](https://img.shields.io/badge/license-BUSL--1.1-blue)](LICENSE)
 
+<!-- PRESS_KIT:root-hero start -->
 ![Celerp manufacturing cost worksheet](docs/press-kit/screenshots/manufacturing-worksheet.png)
+<!-- PRESS_KIT:root-hero end -->
 
 ## Screenshots
 
 Real double-entry accounting, multi-location inventory, manufacturing, and a built-in REST API - one self-hosted app.
 
+<!-- PRESS_KIT:root-grid start -->
 | | |
 |---|---|
+| ![Dashboard with revenue trend, receivables aging, and inventory mix](docs/press-kit/screenshots/dashboard.png)<br>**Dashboard** - revenue trend, AR aging, inventory mix | ![Multi-location inventory with barcode scanning and valuation](docs/press-kit/screenshots/inventory.png)<br>**Inventory** - multi-location, barcode, valuation |
 | ![Double-entry trial balance that ties out to zero](docs/press-kit/screenshots/trial-balance.png)<br>**Trial balance** - ties out to zero | ![Balance sheet generated from the event-sourced ledger](docs/press-kit/screenshots/balance-sheet.png)<br>**Balance sheet** - live from the ledger |
-| ![General ledger with account drill-down](docs/press-kit/screenshots/general-ledger.png)<br>**General ledger** - full drill-down | ![Multi-location inventory with barcode scanning and valuation](docs/press-kit/screenshots/inventory.png)<br>**Inventory** - multi-location, barcode, valuation |
-| ![Production planning by status, priority, and due date](docs/press-kit/screenshots/production-planning.png)<br>**Production planning** - work orders, priorities, due dates | ![Built-in REST API for integrations](docs/press-kit/screenshots/rest-api.png)<br>**REST API** - integrate anything |
-| ![Dashboard with revenue trend, receivables aging, and inventory mix](docs/press-kit/screenshots/dashboard.png)<br>**Dashboard** - revenue trend, AR aging, inventory mix | |
+| ![Production planning by status, priority, and due date](docs/press-kit/screenshots/production-planning.png)<br>**Production planning** - work orders, priorities, due dates | ![International shipping document with commercial invoice and customs detail](docs/press-kit/screenshots/international-shipping-document.png)<br>**Shipping documents** - commercial invoice and customs |
+| ![Built-in REST API for integrations](docs/press-kit/screenshots/rest-api.png)<br>**REST API** - integrate anything | ![Customer statement of account showing receivables](docs/press-kit/screenshots/statement-of-account.png)<br>**Statement of account** - customer AR at a glance |
+<!-- PRESS_KIT:root-grid end -->
 
 More in the [press kit](docs/press-kit/).
 
@@ -33,9 +37,9 @@ More in the [press kit](docs/press-kit/).
 
 | Platform | Link |
 |----------|------|
-| Windows (.exe) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
-| Linux (.AppImage) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
-| macOS (.dmg) | [Latest release](https://github.com/celerp/celerp/releases/latest) |
+| Windows (.exe) | [Download](https://celerp.com/download-thanks.html?dl=win) |
+| Linux (.deb) | [Download](https://celerp.com/download-thanks.html?dl=linux) |
+| macOS (.dmg) | [Download](https://celerp.com/download-thanks.html?dl=mac) |
 
 **Double-click. No account. No credit card. Your computer securely becomes the server for your office**
 
@@ -162,8 +166,7 @@ Celerp is open-core:
   self-hosting permitted, contributions welcome.
 - **An MIT-licensed module ecosystem** - the default business modules are MIT, so you can
   fork them, build your own modules, and ship them however you like. See [LICENSING.md](LICENSING.md).
-- **A proprietary application + cloud layer** (official UI, document/PDF output, and the cloud/AI
-  services) that powers the hosted experience.
+- **A source available application** (official UI, document/PDF output and AI & Connect services).
 
 See [LICENSING.md](LICENSING.md) for the full map and [TRADEMARK.md](legal/TRADEMARK.md) for use of the Celerp
 name. One restriction: don't resell Celerp itself as a competing product.

{celerp-2.1.0 → celerp-2.2.0}/celerp/config.py

@@ -25,6 +25,11 @@ class Settings(BaseSettings):
     idle_logout_minutes: int = 15
     # Set to "true" to allow the default JWT secret (CI only).
     allow_insecure_jwt: str = "false"
+    # Serve the OpenAPI schema (/openapi.json) and the grouped API reference.
+    # Default off: production does not publish the API shape. Enabled only by the
+    # press-kit capture harness (and CI) to render the reference. Never set true
+    # in production.
+    expose_openapi_schema: bool = False
     # Logging level for both API and UI processes. Override with LOG_LEVEL env var.
     # Accepted values: debug, info, warning, error, critical (case-insensitive).
     log_level: str = "INFO"

{celerp-2.1.0 → celerp-2.2.0}/celerp/events/schemas.py

@@ -61,6 +61,8 @@ class ItemPricingSet(BaseModel):
 
 class ItemStatusSet(BaseModel):
     new_status: str
+    # Set by revert-to-draft only.
+    reason: str | None = None
 
 
 class ItemTransferred(BaseModel):

{celerp-2.1.0 → celerp-2.2.0}/celerp/main.py

@@ -356,7 +356,47 @@ log = logging.getLogger(__name__)
 _storage_uri = settings.redis_url or "memory://"
 limiter = Limiter(key_func=get_remote_address, default_limits=["60/minute"], storage_uri=_storage_uri)
 
-app = FastAPI(title="Celerp", docs_url=None, redoc_url=None, lifespan=lifespan)
+_OPENAPI_TAGS = [
+    {"name": "auth", "description": "Sign in, sessions, and access tokens."},
+    {"name": "companies", "description": "Companies, members, and roles."},
+    {"name": "items", "description": "Inventory items, stock, and valuation."},
+    {"name": "docs", "description": "Invoices, purchase orders, quotations, and credit notes."},
+    {"name": "lists", "description": "Shipping documents and packing lists."},
+    {"name": "accounting", "description": "Chart of accounts and journal entries."},
+    {"name": "ledger", "description": "Event-sourced ledger and projections."},
+    {"name": "reports", "description": "Financial statements and aging reports."},
+    {"name": "manufacturing", "description": "Bills of materials and production orders."},
+    {"name": "labels", "description": "Label templates and barcode printing."},
+    {"name": "crm", "description": "Contacts, pipeline, and activity."},
+    {"name": "subscriptions", "description": "Recurring billing and auto-invoicing."},
+    {"name": "connectors", "description": "External integrations."},
+    {"name": "payments", "description": "Payment collection."},
+    {"name": "backup", "description": "Data export and import."},
+    {"name": "notifications", "description": "In-app notifications."},
+    {"name": "events", "description": "Server-sent event stream for live updates."},
+    {"name": "system", "description": "Health, status, and instance metadata."},
+]
+
+_OPENAPI_DESCRIPTION = "REST API for Celerp, the self-hosted business management platform."
+
+
+def _openapi_settings() -> dict:
+    """FastAPI OpenAPI kwargs for the current settings. Production keeps the schema
+    unserved (openapi_url=None); the press-kit capture harness turns
+    expose_openapi_schema on to publish it for the API reference shot, and that
+    non-default state is logged so it is never silent. Isolated so the exposure
+    boundary is unit-testable without reconstructing the whole app."""
+    expose = settings.expose_openapi_schema
+    if expose:
+        log.warning("expose_openapi_schema is on: serving the public OpenAPI schema at /openapi.json")
+    return {
+        "description": _OPENAPI_DESCRIPTION,
+        "openapi_tags": _OPENAPI_TAGS,
+        "openapi_url": "/openapi.json" if expose else None,
+    }
+
+
+app = FastAPI(title="Celerp", docs_url=None, redoc_url=None, lifespan=lifespan, **_openapi_settings())
 app.state.limiter = limiter
 app.add_exception_handler(RateLimitExceeded, _rate_limit_exceeded_handler)
 app.add_middleware(DrainMiddleware)

celerp-2.2.0/celerp/migrations/versions/b3c4d5e6f7a8_expand_role_permissions_to_role_grants.py

@@ -0,0 +1,175 @@
+# Copyright (c) 2026 Noah Severs
+# SPDX-License-Identifier: BUSL-1.1
+
+"""expand the role_permissions threshold overrides into explicit role_grants sets
+
+Revision ID: b3c4d5e6f7a8
+Revises: f8a9b0c1d2e3
+Create Date: 2026-08-09
+
+The data half of the per-role permissions change. Role overrides used to be a
+single minimum-role threshold per permission (Company.settings["role_permissions"]
+= {permission_key: minimum_role_key}); every role at or above that threshold was
+granted, so the roles moved as a block. They are now an explicit set of granted
+roles per permission (Company.settings["role_grants"] = {permission_key:
+[role_key, ...]}), each role granted independently. This migration rewrites every
+stored threshold into the exact set of roles it used to grant, so no company's
+effective permissions change, then drops the retired key.
+
+Deltas only: it materializes a grant set for the keys a company actually
+overrode, never the whole catalogue; unoverridden keys keep resolving to their
+registry default. Each threshold expands to every role at or above it, clamped up
+to the permission's floor (so a grandfathered sub-floor override lands on the
+floor exactly as the resolver reads it). A threshold on a permission that is no
+longer overridable, unknown to the catalogue, or naming a role that no longer
+exists never resolved to anything but the default, so it becomes no delta and is
+left absent.
+
+Signature-less (data only), so the develop-to-release reconcile replays it on
+every create_all/restore database. Idempotent: guarded on the presence of the
+retired key, so a second application is a no-op. The downgrade is the best-effort
+inverse: it collapses each grant set back to a single threshold at its lowest
+granted role and restores the retired key, so a rollback to the threshold-reading
+code keeps a company's effective permissions. This round-trips exactly for the
+contiguous sets the upgrade produces; a hand-authored non-contiguous set is
+documented lossy (it collapses to its lowest role, which the older resolver then
+re-expands as a block).
+
+The catalogue (floor role and overridability per permission) and the role levels
+are snapshotted here as literals, because a migration is immutable history: it
+must expand exactly as the rules stood when it was written, even after the
+registry in celerp.services.permissions later changes.
+"""
+
+from __future__ import annotations
+
+import json
+
+import sqlalchemy as sa
+from alembic import op
+
+revision = "b3c4d5e6f7a8"
+down_revision = "f8a9b0c1d2e3"
+branch_labels = None
+depends_on = None
+
+# Snapshot of auth.ROLE_LEVELS at this revision.
+_ROLE_LEVELS = {"viewer": 1, "operator": 2, "manager": 3, "admin": 4, "owner": 5}
+
+# Snapshot of the permission catalogue at this revision: key -> (floor_role,
+# grantable). default_role is irrelevant here because every key processed carries
+# an explicit override; only the floor (which clamps the expansion) and whether
+# the key is overridable at all matter.
+_CATALOGUE = {
+    "view_dashboards": ("viewer", True),
+    "view_documents": ("viewer", True),
+    "view_contacts": ("viewer", True),
+    "view_inventory": ("viewer", True),
+    "edit_documents": ("viewer", True),
+    "edit_contacts": ("viewer", True),
+    "edit_inventory": ("viewer", True),
+    "edit_inventory_amounts": ("viewer", True),
+    "finalize_documents": ("viewer", True),
+    "fulfill_documents": ("viewer", True),
+    "record_payments": ("viewer", True),
+    "manage_labels": ("viewer", True),
+    "manage_manufacturing": ("viewer", True),
+    "use_ai_assistant": ("viewer", True),
+    "run_backups": ("viewer", True),
+    "view_subscriptions": ("viewer", True),
+    "view_inventory_costs": ("viewer", True),
+    "set_inventory_prices": ("viewer", True),
+    "set_sales_doc_prices": ("viewer", True),
+    "delete_documents": ("viewer", True),
+    "adjust_inventory": ("viewer", True),
+    "import_export_data": ("viewer", True),
+    "view_payments": ("viewer", True),
+    "view_financial_reports": ("viewer", True),
+    "manage_accounting": ("viewer", True),
+    "manage_module_settings": ("viewer", True),
+    "manage_users": ("viewer", True),
+    "manage_company_settings": ("admin", True),
+    "manage_integrations": ("viewer", True),
+    "manage_permissions": ("owner", False),
+    "manage_company_lifecycle": ("owner", False),
+    "manage_billing": ("owner", False),
+}
+
+
+def _expand(stored_role: str, floor_role: str) -> list[str]:
+    """The role keys a threshold used to grant: every role at or above the
+    threshold, clamped up to the floor, ordered low to high."""
+    threshold = max(_ROLE_LEVELS[stored_role], _ROLE_LEVELS[floor_role])
+    return sorted(
+        (r for r, lvl in _ROLE_LEVELS.items() if lvl >= threshold),
+        key=lambda r: _ROLE_LEVELS[r],
+    )
+
+
+def _collapse(granted_roles: list[str]) -> str | None:
+    """Best-effort inverse of _expand: the threshold role at the lowest granted
+    level. Exact for a contiguous set (the shape upgrade produces); lossy for a
+    non-contiguous set, which no longer round-trips to the same set. None when no
+    granted role is known, leaving the permission absent (resolves to default)."""
+    levels = [_ROLE_LEVELS[r] for r in granted_roles if r in _ROLE_LEVELS]
+    if not levels:
+        return None
+    low = min(levels)
+    return next(r for r, lvl in _ROLE_LEVELS.items() if lvl == low)
+
+
+def upgrade() -> None:
+    conn = op.get_bind()
+    # Only companies that still carry the retired key; this is also the
+    # idempotency guard, so a replay after the key is stripped touches nothing.
+    rows = conn.execute(sa.text(
+        "SELECT id, settings FROM companies WHERE settings::jsonb ? 'role_permissions'"
+    )).fetchall()
+
+    for cid, settings in rows:
+        data = settings if isinstance(settings, dict) else json.loads(settings)
+        role_perms = data.get("role_permissions")
+        grants = dict(data.get("role_grants") or {})
+        if isinstance(role_perms, dict):
+            for key, stored_role in role_perms.items():
+                meta = _CATALOGUE.get(key)
+                if meta is None:
+                    continue  # unknown key: never resolved to an override
+                floor_role, grantable = meta
+                if not grantable:
+                    continue  # fixed permission: overrides were never honored
+                if stored_role not in _ROLE_LEVELS:
+                    continue  # stale role: resolved to the default, no delta
+                grants[key] = _expand(stored_role, floor_role)
+        if grants:
+            data["role_grants"] = grants
+        data.pop("role_permissions", None)
+        conn.execute(
+            sa.text("UPDATE companies SET settings = CAST(:s AS json) WHERE id = :id"),
+            {"s": json.dumps(data), "id": str(cid)},
+        )
+
+
+def downgrade() -> None:
+    conn = op.get_bind()
+    # Only companies that carry the new key; this is also the idempotency guard.
+    rows = conn.execute(sa.text(
+        "SELECT id, settings FROM companies WHERE settings::jsonb ? 'role_grants'"
+    )).fetchall()
+
+    for cid, settings in rows:
+        data = settings if isinstance(settings, dict) else json.loads(settings)
+        grants = data.get("role_grants")
+        role_perms = dict(data.get("role_permissions") or {})
+        if isinstance(grants, dict):
+            for key, roles in grants.items():
+                threshold = _collapse(roles if isinstance(roles, list) else [])
+                if threshold is not None:
+                    role_perms[key] = threshold
+        if role_perms:
+            data["role_permissions"] = role_perms
+        data.pop("role_grants", None)
+        conn.execute(
+            sa.text("UPDATE companies SET settings = CAST(:s AS json) WHERE id = :id"),
+            {"s": json.dumps(data), "id": str(cid)},
+        )

{celerp-2.1.0 → celerp-2.2.0}/celerp/routers/companies.py

@@ -22,6 +22,7 @@ from celerp.services.permissions import (
     ROLES,
     get_current_company_settings,
     require_permission,
+    resolved_grant_roles,
     role_has_permission,
 )
 from celerp.tax_regimes import get_regime, TAX_REGIMES
@@ -286,6 +287,16 @@ async def patch_me(payload: CompanyPatch, company_id=Depends(get_current_company
     # and category_schemas whenever a caller sent only one field (the UI happens
     # to pre-merge, but partial callers — and a name-only patch — must be safe).
     if payload.settings:
+        # Role grants are owner-only and may be written only through the dedicated
+        # PATCH /me/role-permissions endpoint (manage_permissions). This door is
+        # admin-gated (manage_company_settings), so accepting role_grants here would
+        # let an admin self-escalate around the owner gate. role_permissions is the
+        # retired storage key; reject it too so it can never be re-introduced.
+        if "role_grants" in payload.settings or "role_permissions" in payload.settings:
+            raise HTTPException(
+                status_code=422,
+                detail="Role permissions are set through the permissions matrix, not company settings",
+            )
         merged = {**(company.settings or {}), **payload.settings}
         # Price config must pass the same gate as the dedicated endpoints: the read
         # path trusts stored config, so no door may store what the validator rejects.
@@ -309,12 +320,12 @@ async def patch_role_permissions(
     _: None = require_permission("manage_permissions"),
     session: AsyncSession = Depends(get_session),
 ) -> dict:
-    """Set one permission's minimum role from a matrix checkbox toggle.
+    """Toggle one (permission, role) cell from the matrix.
 
     Owner-only (manage_permissions is a fixed owner row, so no owner can revoke
     their own ability to edit permissions). A toggle names a (permission, role)
-    cell and whether that role should now hold the permission; the stored
-    override is the resulting threshold role, and every higher role inherits it.
+    cell and whether that role should now hold the permission; only that role's
+    membership changes - every other role keeps the grant it already had.
     """
     perm = next((p for p in PERMISSIONS if p.key == payload.perm_key), None)
     if perm is None:
@@ -324,31 +335,29 @@ async def patch_role_permissions(
     if not perm.grantable:
         raise HTTPException(status_code=403, detail=f"The {perm.key} permission is fixed and cannot be reassigned")
 
-    # Checking a role's box lowers the threshold to that role; unchecking raises it
-    # to the next role up, since every role at or above the threshold inherits.
+    company = await session.get(Company, company_id)
+    if company is None:
+        raise HTTPException(status_code=404, detail="Not found")
+    settings = dict(company.settings or {})
+    grants = dict(settings.get("role_grants") or {})
+    # Seed from the currently RESOLVED set on first touch, so toggling one role
+    # leaves every other role's grant exactly as it is today.
+    roles = set(resolved_grant_roles(settings, perm.key))
     if payload.granted:
-        new_threshold = payload.role_key
+        roles.add(payload.role_key)
     else:
-        higher = sorted((r for r in ROLES if r.level > ROLE_LEVELS[payload.role_key]), key=lambda r: r.level)
-        # The owner column is always granted and never rendered as an unchecked box,
-        # so there is always a higher role to raise the threshold to here.
-        new_threshold = higher[0].key
-    if ROLE_LEVELS[new_threshold] < ROLE_LEVELS[perm.floor_role]:
+        roles.discard(payload.role_key)
+    # Floor guard: no override may drop the permission below its floor role.
+    if payload.granted and ROLE_LEVELS[payload.role_key] < ROLE_LEVELS[perm.floor_role]:
         raise HTTPException(
             status_code=422,
             detail=f"The {perm.key} permission cannot go below the {perm.floor_role} role",
         )
-
-    company = await session.get(Company, company_id)
-    if company is None:
-        raise HTTPException(status_code=404, detail="Not found")
-    settings = dict(company.settings or {})
-    overrides = dict(settings.get("role_permissions") or {})
-    overrides[perm.key] = new_threshold
-    settings["role_permissions"] = overrides
+    grants[perm.key] = sorted(roles, key=lambda r: ROLE_LEVELS[r])
+    settings["role_grants"] = grants
     company.settings = settings
     await session.commit()
-    return {"ok": True, "perm_key": perm.key, "threshold_role": new_threshold}
+    return {"ok": True, "perm_key": perm.key, "roles": grants[perm.key]}
 
 
 # ---------------------------------------------------------------------------
@@ -676,18 +685,16 @@ async def patch_user(
 # Item schema configuration
 # ---------------------------------------------------------------------------
 
+from celerp.services.field_schema import COST_SCHEMA_KEYS  # noqa: F401 re-export
 from celerp.services.field_schema import DEFAULT_ITEM_SCHEMA  # noqa: F401 re-export
 from celerp.services.field_schema import get_effective_field_schema  # noqa: F401 re-export
 
 
-_COST_SCHEMA_KEYS: frozenset[str] = frozenset({"cost_price", "cost_price_total"})
-
-
 @router.get("/me/item-schema")
 async def get_item_schema(company_id=Depends(get_current_company_id), role: str = Depends(get_current_role), settings: dict = Depends(get_current_company_settings), session: AsyncSession = Depends(get_session)) -> list[dict]:
     schema = await get_effective_field_schema(session, company_id)
     if not role_has_permission(settings, role, "view_inventory_costs"):
-        schema = [f for f in schema if f.get("key") not in _COST_SCHEMA_KEYS]
+        schema = [f for f in schema if f.get("key") not in COST_SCHEMA_KEYS]
     return schema
 
 

{celerp-2.1.0 → celerp-2.2.0}/celerp/routers/events.py

@@ -18,7 +18,7 @@ from celerp.notifications.sse import subscribe, unsubscribe
 
 log = logging.getLogger(__name__)
 
-router = APIRouter()
+router = APIRouter(tags=["events"])
 
 _TICK = object()  # sentinel: asyncio.TimeoutError path
 

{celerp-2.1.0 → celerp-2.2.0}/celerp/routers/health.py

@@ -171,16 +171,6 @@ async def backup_status() -> dict:
     }
 
 
-@router.get("/settings/email-status")
-async def email_status() -> dict:
-    """Return whether SMTP and/or gateway are configured for email sending."""
-    from celerp.config import settings
-    return {
-        "smtp_configured": bool(settings.smtp_host),
-        "gateway_connected": bool(settings.gateway_token),
-    }
-
-
 @router.post("/settings/cloud-disconnect", dependencies=[Depends(get_current_user)])
 async def cloud_disconnect() -> dict:
     """Stop the gateway WebSocket client and record a sticky Cloud disconnect.

{celerp-2.1.0 → celerp-2.2.0}/celerp/routers/stars.py

@@ -31,9 +31,9 @@ async def star_cta(
     session: AsyncSession = Depends(get_session),
 ) -> dict:
     """Return the relay-resolved CTA for ``medium`` (or the neutral link if the relay
-    is unreachable), plus the install-level dismissed flag. ``{}`` when disabled."""
+    is unreachable), plus the install-level dismissed flag. Neutral mode when disabled."""
     if not settings.star_cta_enabled:
-        return {}
+        return {"mode": "neutral"}
     cta = await get_star_cta(medium) or neutral_cta(medium)
     return {**cta, "dismissed": await star_prompt_dismissed(session)}
 

{celerp-2.1.0 → celerp-2.2.0}/celerp/services/auto_je.py

@@ -837,8 +837,9 @@ async def upsert_opening_inventory_je(
         )
     ).scalars().all()
 
-    # Inactive statuses: items no longer owned. Must match get_valuation()'s filter.
-    _INACTIVE = frozenset({"archived", "deleted", "void", "sold", "fulfilled", "merged", "expired"})
+    # Inactive statuses: items whose stock is not counted - no longer owned, or
+    # (draft) not yet committed. Must match get_valuation()'s filter.
+    _INACTIVE = frozenset({"archived", "deleted", "void", "sold", "fulfilled", "merged", "expired", "draft"})
 
     catalog_total = _Dec("0")
     for row in item_rows:

{celerp-2.1.0 → celerp-2.2.0}/celerp/services/cost_visibility.py

@@ -18,7 +18,8 @@ COST_ITEM_KEYS: frozenset[str] = frozenset({"cost_price", "cost_total"})
 
 
 def apply_field_visibility(
-    items: list[dict], role: str, field_schema: list[dict], can_see_costs: bool
+    items: list[dict], role: str, field_schema: list[dict], can_see_costs: bool,
+    can_author_drafts: bool = False,
 ) -> list[dict]:
     """Strip fields from item dicts that the caller is not allowed to see.
 
@@ -30,6 +31,11 @@ def apply_field_visibility(
     Cost keys are governed only by the permission, so the cost column's own
     visible_to_roles floor never double-gates them: a granted operator sees cost,
     an ungranted manager does not.
+
+    Draft carve-out: cost stripping attaches when an item is committed to
+    available, not at creation. When ``can_author_drafts`` (the caller holds
+    edit_inventory), a DRAFT item keeps its cost keys so its creator can finish
+    authoring it; every non-draft item is stripped as before.
     """
     caller_level = ROLE_LEVELS.get(role, 0)
     restricted = {
@@ -40,8 +46,15 @@ def apply_field_visibility(
         )
     }
     restricted -= COST_ITEM_KEYS
-    if not can_see_costs:
-        restricted |= COST_ITEM_KEYS
-    if not restricted:
+    cost_hidden = not can_see_costs
+    if not restricted and not cost_hidden:
         return items
-    return [{k: v for k, v in item.items() if k not in restricted} for item in items]
+    out = []
+    for item in items:
+        drop = set(restricted)
+        if cost_hidden and not (
+            can_author_drafts and str(item.get("status") or "").lower() == "draft"
+        ):
+            drop |= COST_ITEM_KEYS
+        out.append({k: v for k, v in item.items() if k not in drop} if drop else item)
+    return out

{celerp-2.1.0 → celerp-2.2.0}/celerp/services/field_schema.py

@@ -24,6 +24,18 @@ MIXED_VALUE = "Mixed"
 # COST_ITEM_KEYS precedent in celerp.services.cost_visibility.
 AMOUNT_ITEM_KEYS: frozenset[str] = frozenset({"quantity", "weight", "pieces", "gross_weight"})
 
+# Fields whose edit is gated by edit_inventory_amounts. Superset of the numeric
+# amount keys with sell_by added: changing the sell unit rewrites quantity, so it
+# carries the same authority as editing an amount directly. Kept distinct from
+# AMOUNT_ITEM_KEYS, which also drives the non-negative numeric validator on create
+# and import - sell_by is a unit string and must never reach that float() path.
+AMOUNT_EDIT_GATED_KEYS: frozenset[str] = AMOUNT_ITEM_KEYS | {"sell_by"}
+
+# Schema-field keys for the canonical cost price list, stripped from /me/item-schema
+# for callers without view_inventory_costs. Distinct from cost_visibility.COST_ITEM_KEYS,
+# which names the item-DATA keys (cost_total, not the virtual schema key cost_price_total).
+COST_SCHEMA_KEYS: frozenset[str] = frozenset({"cost_price", "cost_price_total"})
+
 # Default price lists (used when company has none configured)
 _DEFAULT_PRICE_LISTS: list[dict] = [
     {"name": "Wholesale"},
@@ -49,7 +61,9 @@ _BASE_FIELDS: list[dict] = [
     {"key": "pick_method",       "label": "Stock Cutting",     "type": "select", "editable": True,  "required": False, "options": ["default", "fifo", "fefo", "lifo"], "visible_to_roles": [],               "position": 4.6, "show_in_table": False, "tooltip_key": "field.tooltip.pick_method"},
     {"key": "location_name",     "label": "Location",          "type": "text",   "editable": False, "required": False, "options": [],                                            "visible_to_roles": [],               "position": 5,  "show_in_table": True,  "tooltip_key": "field.tooltip.location_name"},
     # Price columns are injected dynamically at position 6+ by _inject_price_columns()
-    {"key": "status",            "label": "Status",            "type": "status", "editable": True,  "required": False, "options": ["available", "reserved", "sold"], "visible_to_roles": [],               "position": 100, "show_in_table": True},
+    # Read-only: status changes only through dedicated actions (Make Available, Revert
+    # to Draft), never a free-form dropdown edit - same convention as document status.
+    {"key": "status",            "label": "Status",            "type": "status", "editable": False, "required": False, "options": [], "visible_to_roles": [],               "position": 100, "show_in_table": True},
     {"key": "short_description", "label": "Short Description", "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 101, "show_in_table": False},
     {"key": "description",       "label": "Description",       "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 102, "show_in_table": False},
     {"key": "notes",             "label": "Notes",             "type": "text",   "editable": True,  "required": False, "options": [],                                            "visible_to_roles": [],               "position": 103, "show_in_table": False},
@@ -112,6 +126,14 @@ def _inject_price_columns(base: list[dict], price_lists: list[dict]) -> list[dic
     return sorted(base + price_cols, key=lambda f: f.get("position", 999))
 
 
+def cost_columns(price_lists: list[dict]) -> list[dict]:
+    """The cost schema columns (cost_price and its virtual total) generated for the given
+    price lists, empty if none is a cost list. Used to re-inject the cost fields that the
+    company-scoped /me/item-schema strips, for a draft whose cost is item-visible - the
+    single source the schema endpoint would have produced, never a hand-built copy."""
+    return [f for f in _inject_price_columns([], price_lists) if f.get("key") in COST_SCHEMA_KEYS]
+
+
 # Backward-compatible constant: base fields + default price columns
 DEFAULT_ITEM_SCHEMA: list[dict] = _inject_price_columns(_BASE_FIELDS, _DEFAULT_PRICE_LISTS)
 
@@ -154,6 +176,13 @@ async def get_effective_field_schema(
         for f in base_schema
     ]
 
+    # Status is never a free-form dropdown, regardless of a stored schema round-trip
+    # captured before this became a hard rule.
+    base_schema = [
+        {**f, "editable": False, "options": []} if f["key"] == "status" else f
+        for f in base_schema
+    ]
+
     if category:
         cat_schemas: dict[str, list[dict]] = settings.get("category_schemas") or {}
         cat_fields: list[dict] = cat_schemas.get(category) or []