@open-mercato/core 0.10.1-develop.7679.1.cb2c13f49e → 0.10.1-develop.7687.1.e1a6f9de51

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7679.1.cb2c13f49e",
+  "version": "0.10.1-develop.7687.1.e1a6f9de51",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -265,16 +265,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7679.1.cb2c13f49e",
-    "@open-mercato/shared": "0.10.1-develop.7679.1.cb2c13f49e",
-    "@open-mercato/ui": "0.10.1-develop.7679.1.cb2c13f49e",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7687.1.e1a6f9de51",
+    "@open-mercato/shared": "0.10.1-develop.7687.1.e1a6f9de51",
+    "@open-mercato/ui": "0.10.1-develop.7687.1.e1a6f9de51",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7679.1.cb2c13f49e",
-    "@open-mercato/shared": "0.10.1-develop.7679.1.cb2c13f49e",
-    "@open-mercato/ui": "0.10.1-develop.7679.1.cb2c13f49e",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7687.1.e1a6f9de51",
+    "@open-mercato/shared": "0.10.1-develop.7687.1.e1a6f9de51",
+    "@open-mercato/ui": "0.10.1-develop.7687.1.e1a6f9de51",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/auth/api/users/route.ts

@@ -415,7 +415,7 @@ export async function GET(req: Request) {
         { user: { $in: userIds as any }, deletedAt: null } as any,
         { populate: ['role'] },
         {
-          tenantId: effectiveTenantId ?? auth.tenantId ?? null,
+          tenantId: effectiveTenantId,
           organizationId: scopeOrganizationId,
         },
       )

package/src/modules/customer_accounts/api/magic-link/request.ts

@@ -16,6 +16,11 @@ import {
   customerMagicLinkIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerMagicLinkEmail } from '@open-mercato/core/modules/customer_accounts/lib/authLinkEmails'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+
+const logger = createLogger('customer_accounts').child({ component: 'magic-link-request' })
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -59,9 +64,17 @@ export async function POST(req: Request) {
 
   const user = await customerUserService.findByEmail(email, tenantId)
   if (user) {
-    await customerTokenService.createMagicLink(user.id, tenantId)
-    // Token is stored in DB; email delivery should be handled by a direct service call,
-    // NOT via the event bus — raw tokens must never travel through events.
+    const rawToken = await customerTokenService.createMagicLink(user.id, tenantId)
+    await sendCustomerMagicLinkEmail({
+      container,
+      tenantId,
+      organizationId: user.organizationId,
+      email: user.email,
+      rawToken,
+    }).catch((error) => {
+      logger.error('Magic link email failed', { err: error })
+      getTelemetryRuntime()?.reportError(error, { module: 'customer_accounts', code: 'customer_accounts.magic_link_email_failed' })
+    })
     void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>
       emitCustomerAccountsEvent('customer_accounts.magic_link.requested', {
         userId: user.id,

package/src/modules/customer_accounts/api/password/reset-request.ts

@@ -16,6 +16,11 @@ import {
   customerPasswordResetIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerPasswordResetEmail } from '@open-mercato/core/modules/customer_accounts/lib/authLinkEmails'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+
+const logger = createLogger('customer_accounts').child({ component: 'password-reset-request' })
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -60,9 +65,17 @@ export async function POST(req: Request) {
 
   const user = await customerUserService.findByEmail(email, tenantId)
   if (user) {
-    await customerTokenService.createPasswordReset(user.id, tenantId)
-    // Token is stored in DB; email delivery should be handled by a direct service call,
-    // NOT via the event bus — raw tokens must never travel through events.
+    const rawToken = await customerTokenService.createPasswordReset(user.id, tenantId)
+    await sendCustomerPasswordResetEmail({
+      container,
+      tenantId,
+      organizationId: user.organizationId,
+      email: user.email,
+      rawToken,
+    }).catch((error) => {
+      logger.error('Password reset email failed', { err: error })
+      getTelemetryRuntime()?.reportError(error, { module: 'customer_accounts', code: 'customer_accounts.password_reset_email_failed' })
+    })
     void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>
       emitCustomerAccountsEvent('customer_accounts.password_reset.requested', {
         userId: user.id,

package/src/modules/customer_accounts/emails/CustomerAuthLinkEmail.tsx

@@ -0,0 +1,45 @@
+import * as React from 'react'
+import { Html, Head, Preview, Body, Container, Text, Section, Link } from '@react-email/components'
+
+export type CustomerAuthLinkEmailCopy = {
+  preview: string
+  title: string
+  body: string
+  cta: string
+  hint: string
+}
+
+export type CustomerAuthLinkEmailProps = {
+  linkUrl: string
+  copy: CustomerAuthLinkEmailCopy
+}
+
+export function CustomerAuthLinkEmail({ linkUrl, copy }: CustomerAuthLinkEmailProps) {
+  return (
+    <Html>
+      <Head />
+      <Preview>{copy.preview}</Preview>
+      <Body style={body}>
+        <Container style={container}>
+          <Section>
+            <Text style={title}>{copy.title}</Text>
+            <Text style={paragraph}>{copy.body}</Text>
+            <Text>
+              <Link href={linkUrl} style={button}>{copy.cta}</Link>
+            </Text>
+            <Text style={hint}>{copy.hint}</Text>
+          </Section>
+        </Container>
+      </Body>
+    </Html>
+  )
+}
+
+const body: React.CSSProperties = { backgroundColor: '#f9fafb', margin: 0, padding: '24px 0' }
+const container: React.CSSProperties = { backgroundColor: '#ffffff', borderRadius: 12, padding: 24, margin: '0 auto', maxWidth: 520, boxShadow: '0 1px 4px rgba(0,0,0,0.06)' }
+const title: React.CSSProperties = { fontSize: 20, fontWeight: 600, color: '#111827', margin: '0 0 12px' }
+const paragraph: React.CSSProperties = { fontSize: 14, color: '#4b5563', lineHeight: '20px', margin: '0 0 16px' }
+const button: React.CSSProperties = { display: 'inline-block', backgroundColor: '#111827', color: '#ffffff', padding: '10px 14px', borderRadius: 8, textDecoration: 'none', fontSize: 14 }
+const hint: React.CSSProperties = { fontSize: 12, color: '#6b7280', marginTop: 16 }
+
+export default CustomerAuthLinkEmail

package/src/modules/customer_accounts/i18n/de.json

@@ -288,6 +288,12 @@
   "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
   "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
   "customer_accounts.invitation.email.title": "You have been invited",
+  "customer_accounts.magicLink.email.body": "Verwenden Sie diesen sicheren Link, um sich ohne Passwort bei Ihrem Portalkonto anzumelden.",
+  "customer_accounts.magicLink.email.cta": "Anmelden",
+  "customer_accounts.magicLink.email.hint": "Dieser Link ist 15 Minuten gültig und kann einmal verwendet werden. Wenn Sie ihn nicht angefordert haben, können Sie diese E-Mail ignorieren.",
+  "customer_accounts.magicLink.email.preview": "Verwenden Sie diesen Link, um sich im Kundenportal anzumelden.",
+  "customer_accounts.magicLink.email.subject": "Ihr Anmeldelink für das Portal",
+  "customer_accounts.magicLink.email.title": "Im Portal anmelden",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Rolle erstellen",
   "customer_accounts.nav.role_detail": "Rollendetails",
@@ -306,6 +312,12 @@
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",
   "customer_accounts.notifications.user.signup.title": "New customer signup",
+  "customer_accounts.passwordReset.email.body": "Wir haben eine Anfrage zum Zurücksetzen des Passworts für Ihr Portalkonto erhalten. Verwenden Sie diesen sicheren Link, um ein neues festzulegen.",
+  "customer_accounts.passwordReset.email.cta": "Passwort zurücksetzen",
+  "customer_accounts.passwordReset.email.hint": "Dieser Link ist 60 Minuten gültig und kann einmal verwendet werden. Wenn Sie kein Zurücksetzen angefordert haben, können Sie diese E-Mail ignorieren.",
+  "customer_accounts.passwordReset.email.preview": "Verwenden Sie diesen Link, um ein neues Portal-Passwort festzulegen.",
+  "customer_accounts.passwordReset.email.subject": "Setzen Sie Ihr Portal-Passwort zurück",
+  "customer_accounts.passwordReset.email.title": "Passwort zurücksetzen",
   "customer_accounts.portal_ai_assistant.sheet.composerPlaceholder": "Frage zu deinem Konto stellen...",
   "customer_accounts.portal_ai_assistant.sheet.description": "Read-only-Assistent für Portalkunden. Fragen zu deinem Konto und zur aktuellen Aktivität.",
   "customer_accounts.portal_ai_assistant.sheet.title": "Portal-AI-Assistent",

package/src/modules/customer_accounts/i18n/en.json

@@ -288,6 +288,12 @@
   "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
   "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
   "customer_accounts.invitation.email.title": "You have been invited",
+  "customer_accounts.magicLink.email.body": "Use this secure link to sign in to your portal account without a password.",
+  "customer_accounts.magicLink.email.cta": "Sign in",
+  "customer_accounts.magicLink.email.hint": "This link expires in 15 minutes and can be used once. If you did not request it, you can ignore this email.",
+  "customer_accounts.magicLink.email.preview": "Use this link to sign in to the customer portal.",
+  "customer_accounts.magicLink.email.subject": "Your portal sign-in link",
+  "customer_accounts.magicLink.email.title": "Sign in to the portal",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",
@@ -306,6 +312,12 @@
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",
   "customer_accounts.notifications.user.signup.title": "New customer signup",
+  "customer_accounts.passwordReset.email.body": "We received a request to reset the password for your portal account. Use this secure link to choose a new one.",
+  "customer_accounts.passwordReset.email.cta": "Reset password",
+  "customer_accounts.passwordReset.email.hint": "This link expires in 60 minutes and can be used once. If you did not request a password reset, you can ignore this email.",
+  "customer_accounts.passwordReset.email.preview": "Use this link to choose a new portal password.",
+  "customer_accounts.passwordReset.email.subject": "Reset your portal password",
+  "customer_accounts.passwordReset.email.title": "Reset your password",
   "customer_accounts.portal_ai_assistant.sheet.composerPlaceholder": "Ask about your account...",
   "customer_accounts.portal_ai_assistant.sheet.description": "Read-only assistant for portal customers. Ask about your account and recent activity.",
   "customer_accounts.portal_ai_assistant.sheet.title": "Portal AI assistant",

package/src/modules/customer_accounts/i18n/es.json

@@ -288,6 +288,12 @@
   "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
   "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
   "customer_accounts.invitation.email.title": "You have been invited",
+  "customer_accounts.magicLink.email.body": "Usa este enlace seguro para iniciar sesión en tu cuenta del portal sin contraseña.",
+  "customer_accounts.magicLink.email.cta": "Iniciar sesión",
+  "customer_accounts.magicLink.email.hint": "Este enlace caduca en 15 minutos y solo se puede usar una vez. Si no lo solicitaste, puedes ignorar este correo.",
+  "customer_accounts.magicLink.email.preview": "Usa este enlace para iniciar sesión en el portal de clientes.",
+  "customer_accounts.magicLink.email.subject": "Tu enlace de inicio de sesión del portal",
+  "customer_accounts.magicLink.email.title": "Inicia sesión en el portal",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",
@@ -306,6 +312,12 @@
   "customer_accounts.notifications.user.locked.title": "Customer account locked",
   "customer_accounts.notifications.user.signup.body": "A new customer account was created.",
   "customer_accounts.notifications.user.signup.title": "New customer signup",
+  "customer_accounts.passwordReset.email.body": "Recibimos una solicitud para restablecer la contraseña de tu cuenta del portal. Usa este enlace seguro para elegir una nueva.",
+  "customer_accounts.passwordReset.email.cta": "Restablecer contraseña",
+  "customer_accounts.passwordReset.email.hint": "Este enlace caduca en 60 minutos y solo se puede usar una vez. Si no solicitaste restablecer la contraseña, puedes ignorar este correo.",
+  "customer_accounts.passwordReset.email.preview": "Usa este enlace para elegir una nueva contraseña del portal.",
+  "customer_accounts.passwordReset.email.subject": "Restablece tu contraseña del portal",
+  "customer_accounts.passwordReset.email.title": "Restablece tu contraseña",
   "customer_accounts.portal_ai_assistant.sheet.composerPlaceholder": "Pregunta sobre tu cuenta...",
   "customer_accounts.portal_ai_assistant.sheet.description": "Asistente de solo lectura para clientes del portal. Pregunta sobre tu cuenta y actividad reciente.",
   "customer_accounts.portal_ai_assistant.sheet.title": "Asistente AI del portal",

package/src/modules/customer_accounts/i18n/ko.json

@@ -288,6 +288,12 @@
   "customer_accounts.invitation.email.preview": "포털 액세스 설정을 완료하려면 초대를 수락하세요.",
   "customer_accounts.invitation.email.subject": "고객 포털에 초대되었습니다",
   "customer_accounts.invitation.email.title": "귀하는 초대되었습니다",
+  "customer_accounts.magicLink.email.body": "이 보안 링크를 사용하여 비밀번호 없이 포털 계정에 로그인하세요.",
+  "customer_accounts.magicLink.email.cta": "로그인",
+  "customer_accounts.magicLink.email.hint": "이 링크는 15분 후에 만료되며 한 번만 사용할 수 있습니다. 요청하지 않았다면 이 이메일을 무시하셔도 됩니다.",
+  "customer_accounts.magicLink.email.preview": "이 링크를 사용하여 고객 포털에 로그인하세요.",
+  "customer_accounts.magicLink.email.subject": "포털 로그인 링크",
+  "customer_accounts.magicLink.email.title": "포털에 로그인",
   "customer_accounts.nav.group": "고객",
   "customer_accounts.nav.role_create": "역할 생성",
   "customer_accounts.nav.role_detail": "역할 상세 정보",
@@ -306,6 +312,12 @@
   "customer_accounts.notifications.user.locked.title": "고객 계정 잠김",
   "customer_accounts.notifications.user.signup.body": "새 고객 계정이 생성되었습니다.",
   "customer_accounts.notifications.user.signup.title": "새 고객 가입",
+  "customer_accounts.passwordReset.email.body": "포털 계정의 비밀번호 재설정 요청을 받았습니다. 이 보안 링크를 사용하여 새 비밀번호를 설정하세요.",
+  "customer_accounts.passwordReset.email.cta": "비밀번호 재설정",
+  "customer_accounts.passwordReset.email.hint": "이 링크는 60분 후에 만료되며 한 번만 사용할 수 있습니다. 비밀번호 재설정을 요청하지 않았다면 이 이메일을 무시하셔도 됩니다.",
+  "customer_accounts.passwordReset.email.preview": "이 링크를 사용하여 새 포털 비밀번호를 설정하세요.",
+  "customer_accounts.passwordReset.email.subject": "포털 비밀번호 재설정",
+  "customer_accounts.passwordReset.email.title": "비밀번호 재설정",
   "customer_accounts.portal_ai_assistant.sheet.composerPlaceholder": "계정에 대해 질문해 보세요...",
   "customer_accounts.portal_ai_assistant.sheet.description": "포털 고객을 위한 읽기 전용 어시스턴트입니다. 계정 및 최근 활동에 대해 질문하세요.",
   "customer_accounts.portal_ai_assistant.sheet.title": "포털 AI 어시스턴트",

package/src/modules/customer_accounts/i18n/pl.json

@@ -288,6 +288,12 @@
   "customer_accounts.invitation.email.preview": "Przyjmij zaproszenie, aby dokończyć konfigurację dostępu do portalu.",
   "customer_accounts.invitation.email.subject": "Masz zaproszenie do portalu klienta",
   "customer_accounts.invitation.email.title": "Masz zaproszenie",
+  "customer_accounts.magicLink.email.body": "Użyj tego bezpiecznego linku, aby zalogować się do konta w portalu bez hasła.",
+  "customer_accounts.magicLink.email.cta": "Zaloguj się",
+  "customer_accounts.magicLink.email.hint": "Ten link wygasa po 15 minutach i można go użyć tylko raz. Jeśli o niego nie prosiłeś, zignoruj tę wiadomość.",
+  "customer_accounts.magicLink.email.preview": "Użyj tego linku, aby zalogować się do portalu klienta.",
+  "customer_accounts.magicLink.email.subject": "Twój link do logowania w portalu",
+  "customer_accounts.magicLink.email.title": "Zaloguj się do portalu",
   "customer_accounts.nav.group": "Klienci",
   "customer_accounts.nav.role_create": "Utwórz rolę",
   "customer_accounts.nav.role_detail": "Szczegóły roli",
@@ -306,6 +312,12 @@
   "customer_accounts.notifications.user.locked.title": "Konto klienta zablokowane",
   "customer_accounts.notifications.user.signup.body": "Utworzono nowe konto klienta.",
   "customer_accounts.notifications.user.signup.title": "Nowa rejestracja klienta",
+  "customer_accounts.passwordReset.email.body": "Otrzymaliśmy prośbę o zresetowanie hasła do Twojego konta w portalu. Użyj tego bezpiecznego linku, aby ustawić nowe.",
+  "customer_accounts.passwordReset.email.cta": "Zresetuj hasło",
+  "customer_accounts.passwordReset.email.hint": "Ten link wygasa po 60 minutach i można go użyć tylko raz. Jeśli nie prosiłeś o reset hasła, zignoruj tę wiadomość.",
+  "customer_accounts.passwordReset.email.preview": "Użyj tego linku, aby ustawić nowe hasło do portalu.",
+  "customer_accounts.passwordReset.email.subject": "Zresetuj hasło do portalu",
+  "customer_accounts.passwordReset.email.title": "Zresetuj hasło",
   "customer_accounts.portal_ai_assistant.sheet.composerPlaceholder": "Zapytaj o swoje konto...",
   "customer_accounts.portal_ai_assistant.sheet.description": "Asystent tylko do odczytu dla klientów portalu. Zapytaj o swoje konto i ostatnią aktywność.",
   "customer_accounts.portal_ai_assistant.sheet.title": "Asystent AI portalu",

package/src/modules/customer_accounts/lib/authLinkEmails.ts

@@ -0,0 +1,77 @@
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { sendEmail } from '@open-mercato/shared/lib/email/send'
+import CustomerAuthLinkEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerAuthLinkEmail'
+import { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'
+
+export type CustomerAuthLinkEmailInput = {
+  container: AppContainer
+  tenantId: string
+  organizationId: string
+  email: string
+  rawToken: string
+}
+
+export async function sendCustomerPasswordResetEmail(input: CustomerAuthLinkEmailInput): Promise<void> {
+  const { translate } = await resolveTranslations()
+  const linkUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/reset-password?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container },
+  )
+
+  const subject = translate('customer_accounts.passwordReset.email.subject', 'Reset your portal password')
+  const copy = {
+    preview: translate('customer_accounts.passwordReset.email.preview', 'Use this link to choose a new portal password.'),
+    title: translate('customer_accounts.passwordReset.email.title', 'Reset your password'),
+    body: translate(
+      'customer_accounts.passwordReset.email.body',
+      'We received a request to reset the password for your portal account. Use this secure link to choose a new one.',
+    ),
+    cta: translate('customer_accounts.passwordReset.email.cta', 'Reset password'),
+    hint: translate(
+      'customer_accounts.passwordReset.email.hint',
+      'This link expires in 60 minutes and can be used once. If you did not request a password reset, you can ignore this email.',
+    ),
+  }
+
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerAuthLinkEmail({ linkUrl, copy }),
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+  })
+}
+
+export async function sendCustomerMagicLinkEmail(input: CustomerAuthLinkEmailInput): Promise<void> {
+  const { translate } = await resolveTranslations()
+  const linkUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/magic-link?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container },
+  )
+
+  const subject = translate('customer_accounts.magicLink.email.subject', 'Your portal sign-in link')
+  const copy = {
+    preview: translate('customer_accounts.magicLink.email.preview', 'Use this link to sign in to the customer portal.'),
+    title: translate('customer_accounts.magicLink.email.title', 'Sign in to the portal'),
+    body: translate(
+      'customer_accounts.magicLink.email.body',
+      'Use this secure link to sign in to your portal account without a password.',
+    ),
+    cta: translate('customer_accounts.magicLink.email.cta', 'Sign in'),
+    hint: translate(
+      'customer_accounts.magicLink.email.hint',
+      'This link expires in 15 minutes and can be used once. If you did not request it, you can ignore this email.',
+    ),
+  }
+
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerAuthLinkEmail({ linkUrl, copy }),
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
+  })
+}

package/src/modules/messages/commands/actions.ts

@@ -3,6 +3,9 @@ import { z } from 'zod'
 import { registerCommand, type CommandHandler } from '@open-mercato/shared/lib/commands'
 import { extractUndoPayload, type UndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Message, MessageObject, MessageRecipient } from '../data/entities'
 import { emitMessagesEvent } from '../events'
@@ -374,10 +377,14 @@ const executeActionCommand: CommandHandler<
         result = (commandResult.result as Record<string, unknown>) ?? {}
         operationLogEntry = commandResult.logEntry ?? null
       } catch (err) {
-        logger.error('executeActionCommand sub-command failed', { err })
         // The target command never completed — release the reservation so the
         // action stays retryable, matching the pre-claim failure semantics.
         await releaseTerminalClaim()
+        if (isCrudHttpError(err) || getCommandInterceptorHttpRejection(err)) {
+          throw err
+        }
+        logger.error('executeActionCommand sub-command failed', { err })
+        getTelemetryRuntime()?.reportError(err, { module: 'messages', code: 'messages.action_failed' })
         throw new Error('Action failed')
       }
     } else if (action.href) {

package/src/modules/payment_gateways/data/entities.ts

@@ -150,6 +150,10 @@ export class GatewayPaymentOperation {
   expression:
     'create index "gateway_session_initializations_prune_idx" on "gateway_session_initializations" ("tenant_id", "organization_id", "updated_at") where "gateway_transaction_id" is not null',
 })
+@Index({
+  name: 'gateway_session_initializations_retention_idx',
+  properties: ['tenantId', 'organizationId', 'updatedAt', 'id'],
+})
 export class GatewaySessionInitialization {
   [OptionalProps]?: 'claimToken' | 'claimedAt' | 'gatewayTransactionId' | 'createdAt' | 'updatedAt'
 

package/src/modules/payment_gateways/lib/session-idempotency.ts

@@ -150,6 +150,23 @@ export async function pruneCompletedPaymentSessionInitializations(
   em: EntityManager,
   scope: Scope,
   options: { now?: Date; batchSize?: number } = {},
+): Promise<number> {
+  return prunePaymentSessionInitializations(em, scope, options, false)
+}
+
+export async function pruneExpiredPaymentSessionInitializations(
+  em: EntityManager,
+  scope: Scope,
+  options: { now?: Date; batchSize?: number } = {},
+): Promise<number> {
+  return prunePaymentSessionInitializations(em, scope, options, true)
+}
+
+async function prunePaymentSessionInitializations(
+  em: EntityManager,
+  scope: Scope,
+  options: { now?: Date; batchSize?: number },
+  includeIncomplete: boolean,
 ): Promise<number> {
   const now = options.now ?? new Date()
   const batchSize = options.batchSize ?? PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE
@@ -157,21 +174,40 @@ export async function pruneCompletedPaymentSessionInitializations(
     throw new Error('[internal] Payment-session initialization prune batch size must be a positive integer')
   }
   const cutoff = new Date(now.getTime() - PAYMENT_SESSION_REPLAY_WINDOW_MS)
+  const eligibleState = includeIncomplete
+    ? `(gateway_transaction_id is not null or (
+        gateway_transaction_id is null and (
+          (claim_token is null and claimed_at is null)
+          or (claim_token is not null and claimed_at < ?)
+        )
+      ))`
+    : 'gateway_transaction_id is not null'
   const connection = em.getConnection()
   const result = await connection.execute(
     `
-    delete from gateway_session_initializations
-    where id in (
+    with expired_claims as materialized (
       select id from gateway_session_initializations
       where tenant_id = ?
         and organization_id = ?
-        and gateway_transaction_id is not null
         and updated_at < ?
-      order by updated_at asc
+        and ${eligibleState}
+      order by updated_at asc, id asc
       limit ?
+      for update skip locked
     )
+    delete from gateway_session_initializations
+    where tenant_id = ? and organization_id = ?
+      and id in (select id from expired_claims)
     `,
-    [scope.tenantId, scope.organizationId, cutoff, batchSize],
+    [
+      scope.tenantId,
+      scope.organizationId,
+      cutoff,
+      ...(includeIncomplete ? [cutoff] : []),
+      batchSize,
+      scope.tenantId,
+      scope.organizationId,
+    ],
     'run',
   ) as { affectedRows?: number; rowCount?: number } | undefined
   return result?.affectedRows ?? result?.rowCount ?? 0

package/src/modules/payment_gateways/migrations/.snapshot-open-mercato.json

@@ -558,6 +558,19 @@
           "keyName": "gateway_session_initializations_scope_operation_unique",
           "primary": false,
           "unique": true
+        },
+        {
+          "columnNames": [
+            "tenant_id",
+            "organization_id",
+            "updated_at",
+            "id"
+          ],
+          "composite": true,
+          "constraint": false,
+          "keyName": "gateway_session_initializations_retention_idx",
+          "primary": false,
+          "unique": false
         }
       ],
       "checks": [],
@@ -1171,4 +1184,4 @@
   ],
   "views": [],
   "nativeEnums": {}
-}
+}

package/src/modules/payment_gateways/migrations/Migration20261018180000_payment_gateways.ts

@@ -0,0 +1,18 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export class Migration20261018180000_payment_gateways extends Migration {
+  override isTransactional(): boolean {
+    return false
+  }
+
+  override up(): void | Promise<void> {
+    this.addSql('drop index concurrently if exists "gateway_session_initializations_retention_idx";')
+    this.addSql(
+      'create index concurrently "gateway_session_initializations_retention_idx" on "gateway_session_initializations" ("tenant_id", "organization_id", "updated_at", "id");',
+    )
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql('drop index concurrently if exists "gateway_session_initializations_retention_idx";')
+  }
+}

package/src/modules/payment_gateways/workers/session-initialization-prune.ts

@@ -4,7 +4,7 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 import {
   PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
   PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE,
-  pruneCompletedPaymentSessionInitializations,
+  pruneExpiredPaymentSessionInitializations,
 } from '../lib/session-idempotency'
 
 type PrunePayload = {
@@ -45,13 +45,13 @@ export default async function handle(
   }
 
   const em = ctx.resolve<EntityManager>('em').fork()
-  const deleted = await pruneCompletedPaymentSessionInitializations(
+  const deleted = await pruneExpiredPaymentSessionInitializations(
     em,
     { tenantId, organizationId },
     { batchSize: PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE },
   )
   if (deleted > 0) {
-    logger.info('Pruned completed payment-session initialization claims', {
+    logger.info('Pruned expired payment-session initialization claims', {
       deleted,
       tenantId,
       organizationId,

package/src/modules/portal/frontend/[orgSlug]/portal/magic-link/page.meta.ts

@@ -0,0 +1,9 @@
+import type { PageMetadata } from '@open-mercato/shared/modules/registry'
+
+export const metadata: PageMetadata = {
+  titleKey: 'portal.title',
+  title: 'Sign In',
+  navHidden: true,
+}
+
+export default metadata

package/src/modules/portal/frontend/[orgSlug]/portal/magic-link/page.tsx

@@ -0,0 +1,71 @@
+"use client"
+import { useCallback, useState } from 'react'
+import Link from 'next/link'
+import { useSearchParams } from 'next/navigation'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { replaceWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
+
+type Props = { params: { orgSlug: string } }
+
+export default function PortalMagicLinkPage({ params }: Props) {
+  const t = useT()
+  const orgSlug = params.orgSlug
+  const searchParams = useSearchParams()
+  const token = searchParams.get('token') ?? ''
+  const [submitting, setSubmitting] = useState(false)
+  const [error, setError] = useState<string | null>(
+    token ? null : t('portal.magicLink.error.missingToken', 'Sign-in link is invalid or incomplete.'),
+  )
+
+  const handleSignIn = useCallback(async () => {
+    if (!token) return
+    setSubmitting(true)
+    setError(null)
+    try {
+      const result = await apiCall<{ ok: boolean; error?: string }>('/api/customer_accounts/magic-link/verify', {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        credentials: 'include',
+        body: JSON.stringify({ token }),
+      })
+      if (result.ok && result.result?.ok) {
+        replaceWithPageReload(`/${orgSlug}/portal/dashboard`)
+        return
+      }
+      setError(t('portal.magicLink.error.invalidToken', 'This sign-in link is invalid or has expired. Request a new one.'))
+    } catch {
+      setError(t('portal.magicLink.error.generic', 'Sign-in failed. Please try again.'))
+    } finally {
+      setSubmitting(false)
+    }
+  }, [token, orgSlug, t])
+
+  return (
+    <div className="mx-auto flex w-full max-w-sm flex-col gap-4 py-12">
+      <div className="text-center">
+        <h1 className="text-2xl font-bold tracking-tight">{t('portal.magicLink.title', 'Sign in with a link')}</h1>
+        <p className="mt-1.5 text-sm text-muted-foreground">
+          {t('portal.magicLink.description', 'Continue to sign in to the portal with the link from your email.')}
+        </p>
+      </div>
+      {error ? (
+        <Alert status="error">
+          <AlertDescription>{error}</AlertDescription>
+        </Alert>
+      ) : null}
+      {token ? (
+        <Button type="button" onClick={() => void handleSignIn()} disabled={submitting} className="w-full rounded-lg">
+          {submitting ? <Spinner /> : null}
+          {t('portal.magicLink.submit', 'Sign in')}
+        </Button>
+      ) : null}
+      <Button asChild variant="outline" className="rounded-lg">
+        <Link href={`/${orgSlug}/portal/login`}>{t('portal.magicLink.backToLogin', 'Back to sign in')}</Link>
+      </Button>
+    </div>
+  )
+}