@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/src/modules/customers/api/people/[id]/route.ts

@@ -12,6 +12,8 @@ import {
   CustomerActivity,
   CustomerTagAssignment,
   CustomerTag,
+  CustomerLabelAssignment,
+  CustomerLabel,
   CustomerDealPersonLink,
   CustomerDeal,
   CustomerTodoLink,
@@ -33,8 +35,9 @@ import { hydrateCanonicalInteractions } from '../../../lib/interactionReadModel'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { parseBooleanFromUnknown, parseBooleanToken } from '@open-mercato/shared/lib/boolean'
+import { loadPersonCompanyLinks, summarizePersonCompanies } from '../../../lib/personCompanies'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },
@@ -396,6 +399,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   const includeDeals = includeTokens.has('deals')
   const includeInteractions = includeTokens.has('interactions')
   const includeTodos = includeTokens.has('todos') || includeTokens.has('tasks')
+  const plannedPreviewLimit = 5
 
   let statusCode = 500
   let profileMeta: Record<string, unknown> | undefined
@@ -410,6 +414,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   let customFields: Record<string, unknown> = {}
   let viewerUserId: string | null = null
   let profile: CustomerPersonProfile | null = null
+  let companies: Array<{ linkId: string | null; companyId: string; displayName: string; isPrimary: boolean; synthetic?: boolean }> = []
 
   try {
     const parse = paramsSchema.safeParse({ id: ctx.params?.id })
@@ -446,7 +451,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     })
     const em = (container.resolve('em') as EntityManager)
 
-    const person = await em.findOne(CustomerEntity, { id: parse.data.id, kind: 'person', deletedAt: null })
+    const person = await findOneWithDecryption(em, CustomerEntity, { id: parse.data.id, kind: 'person', deletedAt: null }, {}, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
     profiler.mark('person_loaded', { found: !!person })
     if (!person) {
       statusCode = 404
@@ -469,11 +474,12 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       return forbidden('Access denied')
     }
 
-    profile = await em.findOne(CustomerPersonProfile, { entity: person }, { populate: ['company'] })
+    profile = await findOneWithDecryption(em, CustomerPersonProfile, { entity: person }, { populate: ['company'] }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
     profiler.mark('profile_loaded', { found: !!profile })
+    companies = summarizePersonCompanies(profile, await loadPersonCompanyLinks(em, person))
 
     if (includeAddresses) {
-      addresses = await em.find(CustomerAddress, { entity: person.id }, { orderBy: { isPrimary: 'desc', createdAt: 'desc' } })
+      addresses = await findWithDecryption(em, CustomerAddress, { entity: person.id }, { orderBy: { isPrimary: 'desc', createdAt: 'desc' } }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
       profiler.mark('addresses_loaded', { count: addresses.length })
     }
 
@@ -486,19 +492,30 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     )
     profiler.mark('tags_loaded', { count: tagAssignments.length })
 
+    const labelAssignments = await findWithDecryption(
+      em,
+      CustomerLabelAssignment,
+      { entity: person.id },
+      { populate: ['label'] },
+      { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null },
+    )
+    profiler.mark('labels_loaded', { count: labelAssignments.length })
+
     if (includeComments) {
-      comments = await em.find(CustomerComment, { entity: person.id }, { orderBy: { createdAt: 'desc' }, limit: 50 })
+      comments = await findWithDecryption(em, CustomerComment, { entity: person.id }, { orderBy: { createdAt: 'desc' }, limit: 50 }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
       profiler.mark('comments_loaded', { count: comments.length })
     }
 
     const shouldLoadCanonicalInteractions = includeInteractions || includeActivities || includeTodos
     const canonicalInteractionRows = shouldLoadCanonicalInteractions
-      ? await em.find(
+      ? await findWithDecryption(
+          em,
           CustomerInteraction,
           interactionFlags.unified
             ? { entity: person.id, deletedAt: null }
             : { entity: person.id },
           { orderBy: { scheduledAt: 'asc', createdAt: 'desc' }, limit: 100 },
+          { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null },
         )
       : []
     profiler.mark('canonical_interactions_loaded', { count: canonicalInteractionRows.length })
@@ -515,8 +532,42 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       : []
     profiler.mark('canonical_interactions_hydrated', { count: canonicalInteractions.length })
 
+    const plannedPreviewInteractions = shouldLoadCanonicalInteractions
+      ? (() => {
+          const sorted = [...canonicalInteractions]
+            .filter((interaction) => interaction.status === 'planned' && interaction.interactionType !== 'task')
+            .sort((left, right) => {
+              const leftTime = new Date(left.scheduledAt ?? left.createdAt).getTime()
+              const rightTime = new Date(right.scheduledAt ?? right.createdAt).getTime()
+              if (leftTime === rightTime) return left.id.localeCompare(right.id)
+              return leftTime - rightTime
+            })
+          return sorted.slice(0, plannedPreviewLimit)
+        })()
+      : await hydrateCanonicalInteractions({
+          em,
+          container,
+          auth,
+          selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+          interactions: await findWithDecryption(
+            em,
+            CustomerInteraction,
+            {
+              entity: person.id,
+              organizationId: person.organizationId,
+              tenantId: person.tenantId,
+              deletedAt: null,
+              status: 'planned',
+              interactionType: { $ne: 'task' },
+            },
+            { orderBy: { scheduledAt: 'ASC', createdAt: 'ASC' }, limit: plannedPreviewLimit },
+            { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null },
+          ),
+          enrich: true,
+        })
+
     if (includeActivities && !interactionFlags.unified) {
-      activities = await em.find(CustomerActivity, { entity: person.id }, { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: 50 })
+      activities = await findWithDecryption(em, CustomerActivity, { entity: person.id }, { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: 50 }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
       profiler.mark('activities_loaded', { count: activities.length })
     }
 
@@ -525,7 +576,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     }
 
     if (includeTodos && !interactionFlags.unified) {
-      todoLinks = await em.find(CustomerTodoLink, { entity: person.id }, { orderBy: { createdAt: 'desc' }, limit: 50 })
+      todoLinks = await findWithDecryption(em, CustomerTodoLink, { entity: person.id }, { orderBy: { createdAt: 'desc' }, limit: 50 }, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
       profiler.mark('todo_links_loaded', { count: todoLinks.length })
       if (todoLinks.length) {
         const queryEngine = (container.resolve('queryEngine') as QueryEngine)
@@ -575,7 +626,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     if (viewerUserId) authorIds.add(viewerUserId)
 
     if (authorIds.size) {
-      const users = await em.find(User, { id: { $in: Array.from(authorIds) } })
+      const users = await findWithDecryption(em, User, { id: { $in: Array.from(authorIds) } }, {}, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
       userMap = new Map(
         users.map((user) => [
           user.id,
@@ -640,6 +691,56 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     profiler.mark('custom_fields_merged', { keys: Object.keys(customFields).length })
 
     const viewerUserIdFinal = viewerUserId
+    const counts = {
+      tags: tagAssignments.length + labelAssignments.length,
+      comments: includeComments
+        ? comments.length
+        : await em.count(CustomerComment, {
+            entity: person.id,
+            organizationId: person.organizationId,
+            tenantId: person.tenantId,
+          }),
+      activities: await em.count(CustomerInteraction, {
+        entity: person.id,
+        organizationId: person.organizationId,
+        tenantId: person.tenantId,
+        deletedAt: null,
+        interactionType: { $ne: 'task' },
+      }),
+      interactions: await em.count(CustomerInteraction, {
+        entity: person.id,
+        organizationId: person.organizationId,
+        tenantId: person.tenantId,
+        deletedAt: null,
+      }),
+      todos: interactionFlags.unified
+        ? await em.count(CustomerInteraction, {
+            entity: person.id,
+            organizationId: person.organizationId,
+            tenantId: person.tenantId,
+            deletedAt: null,
+            interactionType: 'task',
+          })
+        : await em.count(CustomerTodoLink, {
+            entity: person.id,
+            organizationId: person.organizationId,
+            tenantId: person.tenantId,
+          }),
+      addresses: includeAddresses
+        ? addresses.length
+        : await em.count(CustomerAddress, {
+            entity: person.id,
+            organizationId: person.organizationId,
+            tenantId: person.tenantId,
+          }),
+      deals: includeDeals
+        ? deals.length
+        : await em.count(CustomerDealPersonLink, {
+            person: person.id,
+          }),
+      companies: companies.length,
+    }
+
     const response = NextResponse.json({
       interactionMode,
       person: {
@@ -652,6 +753,8 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         status: person.status,
         lifecycleStage: person.lifecycleStage,
         source: person.source,
+        temperature: person.temperature,
+        renewalQuarter: person.renewalQuarter,
         nextInteractionAt: person.nextInteractionAt ? person.nextInteractionAt.toISOString() : null,
         nextInteractionName: person.nextInteractionName,
         nextInteractionRefId: person.nextInteractionRefId,
@@ -680,7 +783,16 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
           }
         : null,
       customFields,
-      tags: serializeTags(tagAssignments),
+      tags: [
+        ...serializeTags(tagAssignments),
+        ...labelAssignments
+          .map((a) => {
+            const label = a.label as CustomerLabel | string | null
+            if (!label || typeof label === 'string') return null
+            return { id: label.id, label: label.label, color: null }
+          })
+          .filter((t): t is { id: string; label: string; color: null } => t !== null),
+      ],
       addresses: includeAddresses
         ? addresses.map((address) => ({
             id: address.id,
@@ -762,12 +874,17 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
             title: deal.title,
             status: deal.status,
             pipelineStage: deal.pipelineStage,
+            pipelineId: deal.pipelineId ?? null,
+            pipelineStageId: deal.pipelineStageId ?? null,
             valueAmount: deal.valueAmount,
             valueCurrency: deal.valueCurrency,
             probability: deal.probability,
             expectedCloseAt: deal.expectedCloseAt ? deal.expectedCloseAt.toISOString() : null,
             ownerUserId: deal.ownerUserId,
             source: deal.source,
+            closureOutcome: deal.closureOutcome ?? null,
+            lossReasonId: deal.lossReasonId ?? null,
+            lossNotes: deal.lossNotes ?? null,
             createdAt: deal.createdAt.toISOString(),
             updatedAt: deal.updatedAt.toISOString(),
           }))
@@ -815,9 +932,20 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
                 }).slice(0, 50)
           )
         : [],
-      company: profile?.company && typeof profile.company !== 'string'
-        ? { id: profile.company.id, displayName: profile.company.displayName }
-        : null,
+      isPrimary: companies.some((entry) => entry.isPrimary),
+      companies: companies.map((entry) => ({
+        id: entry.companyId,
+        displayName: entry.displayName,
+        isPrimary: entry.isPrimary,
+      })),
+      company: (() => {
+        const primaryCompany = companies.find((entry) => entry.isPrimary) ?? companies[0] ?? null
+        return primaryCompany
+          ? { id: primaryCompany.companyId, displayName: primaryCompany.displayName }
+          : null
+      })(),
+      plannedActivitiesPreview: plannedPreviewInteractions,
+      counts,
       viewer: {
         userId: viewerUserIdFinal,
         name: viewerUserIdFinal ? userMap.get(viewerUserIdFinal)?.name ?? null : null,
@@ -828,19 +956,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     profileMeta = {
       include: Array.from(includeTokens),
       interactionMode,
-      counts: {
-        tags: tagAssignments.length,
-        comments: comments.length,
-        activities: includeActivities
-          ? (interactionFlags.unified ? canonicalActivityItems.length : activities.length + canonicalActivityItems.length)
-          : 0,
-        interactions: canonicalInteractions.length,
-        todos: includeTodos
-          ? (interactionFlags.unified ? canonicalTodoItems.length : todoLinks.length + canonicalTodoItems.length)
-          : 0,
-        addresses: addresses.length,
-        deals: deals.length,
-      },
+      counts,
     }
     profiler.mark('response_ready', { status: statusCode })
     return response
@@ -995,6 +1111,9 @@ const personDetailResponseSchema = z.object({
       expectedCloseAt: z.string().nullable().optional(),
       ownerUserId: z.string().uuid().nullable().optional(),
       source: z.string().nullable().optional(),
+      closureOutcome: z.string().nullable().optional(),
+      lossReasonId: z.string().uuid().nullable().optional(),
+      lossNotes: z.string().nullable().optional(),
       createdAt: z.string(),
       updatedAt: z.string(),
     }),
@@ -1016,6 +1135,14 @@ const personDetailResponseSchema = z.object({
       customValues: z.record(z.string(), z.unknown()).nullable().optional(),
     }),
   ),
+  isPrimary: z.boolean(),
+  companies: z.array(
+    z.object({
+      id: z.string().uuid(),
+      displayName: z.string(),
+      isPrimary: z.boolean(),
+    }),
+  ),
   viewer: z.object({
     userId: z.string().uuid().nullable(),
     name: z.string().nullable(),

package/src/modules/customers/api/people/route.ts

@@ -1,12 +1,18 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { CustomerEntity, CustomerPersonProfile } from '../../data/entities'
+import {
+  CustomerDealPersonLink,
+  CustomerEntity,
+  CustomerPersonCompanyLink,
+  CustomerPersonProfile,
+} from '../../data/entities'
 import { E } from '#generated/entities.ids.generated'
 import { personCreateSchema, personUpdateSchema } from '../../data/validators'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
+  applyEntityIdExclusion,
   applyEntityIdRestriction,
   consumeAdvancedFilterState,
   findMatchingEntityIdsWithQueryEngine,
@@ -23,6 +29,7 @@ import {
   createPagedListResponseSchema,
   defaultOkResponseSchema,
 } from '../openapi'
+import { withActiveCustomerPersonCompanyLinkFilter } from '../../lib/personCompanyLinkTable'
 import { normalizeProfilePayload } from './payload'
 
 const rawBodySchema = z.object({}).passthrough()
@@ -48,6 +55,9 @@ const listSchema = z
     id: z.string().uuid().optional(),
     tagIds: z.string().optional(),
     tagIdsEmpty: z.string().optional(),
+    excludeIds: z.string().optional(),
+    excludeLinkedCompanyId: z.string().uuid().optional(),
+    excludeLinkedDealId: z.string().uuid().optional(),
   })
   .passthrough()
 
@@ -98,10 +108,10 @@ const crud = makeCrudRoute({
       createdAt: 'created_at',
       updatedAt: 'updated_at',
     },
-    buildFilters: async (query: any, ctx) => {
+    buildFilters: async (query, ctx) => {
       const advancedQuery = { ...query }
       const advancedFilterState = consumeAdvancedFilterState(query)
-      const filters: Record<string, any> = { kind: { $eq: 'person' } }
+      const filters: Record<string, unknown> = { kind: { $eq: 'person' } }
       if (query.id) filters.id = { $eq: query.id }
       if (query.search) {
         const matchingIds = ctx
@@ -192,6 +202,65 @@ const crud = makeCrudRoute({
       } else if (tagIds.length > 0) {
         filters['tag_assignments.tag_id'] = { $in: tagIds }
       }
+      const excludedIds = new Set<string>()
+      const excludeIdsRaw = typeof query.excludeIds === 'string' ? query.excludeIds : ''
+      excludeIdsRaw
+        .split(',')
+        .map((value: string) => value.trim())
+        .filter((value: string) => value.length > 0)
+        .forEach((value: string) => excludedIds.add(value))
+      if (ctx && query.excludeLinkedCompanyId) {
+        try {
+          const em = ctx.container.resolve('em') as EntityManager
+          const decryptionScope = {
+            tenantId: ctx.auth?.tenantId ?? null,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
+          }
+          const linkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+            em,
+            { company: query.excludeLinkedCompanyId },
+            'customers.people.GET',
+          )
+          const links = await findWithDecryption(
+            em,
+            CustomerPersonCompanyLink,
+            linkWhere,
+            { populate: ['person'] },
+            decryptionScope,
+          )
+          links.forEach((link) => {
+            const personId = link.person?.id
+            if (typeof personId === 'string' && personId.length > 0) excludedIds.add(personId)
+          })
+        } catch (err) {
+          console.warn('[customers.people.list] exclusion lookup failed; falling back to base result set', err)
+        }
+      }
+      if (ctx && query.excludeLinkedDealId) {
+        try {
+          const em = ctx.container.resolve('em') as EntityManager
+          const decryptionScope = {
+            tenantId: ctx.auth?.tenantId ?? null,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
+          }
+          const links = await findWithDecryption(
+            em,
+            CustomerDealPersonLink,
+            {
+              deal: query.excludeLinkedDealId,
+            },
+            { populate: ['person'] },
+            decryptionScope,
+          )
+          links.forEach((link) => {
+            const personId = link.person?.id
+            if (typeof personId === 'string' && personId.length > 0) excludedIds.add(personId)
+          })
+        } catch (err) {
+          console.warn('[customers.people.list] exclusion lookup failed; falling back to base result set', err)
+        }
+      }
+      applyEntityIdExclusion(filters, Array.from(excludedIds))
       const hasEmail = parseBooleanToken(query.hasEmail)
       if (!email && !emailStartsWith && !emailContains && hasEmail !== null) {
         filters.primary_email = { $exists: hasEmail }
@@ -218,7 +287,7 @@ const crud = makeCrudRoute({
       }
       if (ctx) {
         try {
-          const em = ctx.container.resolve('em') as any
+          const em = ctx.container.resolve('em') as EntityManager
           const cfFilters = await buildCustomFieldFiltersFromQuery({
             entityIds: [E.customers.customer_entity, E.customers.customer_person_profile],
             query,
@@ -226,8 +295,8 @@ const crud = makeCrudRoute({
             tenantId: ctx.auth?.tenantId ?? null,
           })
           Object.assign(filters, cfFilters)
-        } catch {
-          // ignore custom field filter errors; fall back to base filters
+        } catch (err) {
+          console.warn('[customers.people.list] custom field filter resolution failed; falling back to base filters', err)
         }
       }
       if (ctx && advancedFilterState) {
@@ -280,11 +349,12 @@ const crud = makeCrudRoute({
         type: 'left',
       },
     ],
-    transformItem: (item: any) => {
-      if (!item) return item
-      const normalized = { ...item }
+    transformItem: (item) => {
+      if (!item || typeof item !== 'object') return item
+      const record = item as Record<string, unknown>
+      const normalized: Record<string, unknown> = { ...record }
       delete normalized.kind
-      const cfEntries = extractAllCustomFieldEntries(item)
+      const cfEntries = extractAllCustomFieldEntries(record)
       for (const key of Object.keys(normalized)) {
         if (key.startsWith('cf:')) {
           delete normalized[key]
@@ -351,6 +421,27 @@ const crud = makeCrudRoute({
         .filter((id: string | null): id is string => typeof id === 'string' && id.length > 0)
       if (!ids.length) return
 
+      const em = ctx.container.resolve('em') as EntityManager
+      const decryptionScope = {
+        tenantId: ctx.auth?.tenantId ?? null,
+        organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
+      }
+      const entities = await findWithDecryption(
+        em,
+        CustomerEntity,
+        {
+          id: { $in: ids },
+          deletedAt: null,
+          kind: 'person',
+        } as FilterQuery<CustomerEntity>,
+        undefined,
+        decryptionScope,
+      )
+      const entitiesById = new Map<string, CustomerEntity>()
+      for (const entity of entities) {
+        entitiesById.set(entity.id, entity)
+      }
+
       const where: Record<string, unknown> = {
         entity: { $in: ids },
         tenantId: ctx.auth?.tenantId ?? null,
@@ -360,42 +451,54 @@ const crud = makeCrudRoute({
       }
 
       const profiles = await findWithDecryption(
-        ctx.container.resolve('em') as any,
+        em,
         CustomerPersonProfile,
-        where as any,
-        { populate: ['entity', 'company'] } as any,
-        {
-          tenantId: ctx.auth?.tenantId ?? null,
-          organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
-        },
+        where as FilterQuery<CustomerPersonProfile>,
+        { populate: ['entity', 'company'] },
+        decryptionScope,
       )
 
       const profilesByEntityId = new Map<string, CustomerPersonProfile>()
       for (const profile of profiles) {
-        const entityId = typeof (profile as any)?.entity?.id === 'string' ? (profile as any).entity.id : null
+        const profileEntity = (profile as { entity?: { id?: unknown } }).entity
+        const entityId = typeof profileEntity?.id === 'string' ? profileEntity.id : null
         if (entityId) profilesByEntityId.set(entityId, profile)
       }
 
       payload.items = items.map((item: unknown) => {
         if (!item || typeof item !== 'object') return item
         const record = item as Record<string, unknown>
+        const entity = typeof record.id === 'string' ? entitiesById.get(record.id) : undefined
         const profile = typeof record.id === 'string' ? profilesByEntityId.get(record.id) : undefined
-        if (!profile) return item
+        if (!entity && !profile) return item
         return {
           ...record,
-          first_name: profile.firstName ?? null,
-          last_name: profile.lastName ?? null,
-          preferred_name: profile.preferredName ?? null,
-          job_title: profile.jobTitle ?? null,
-          department: profile.department ?? null,
-          seniority: profile.seniority ?? null,
-          timezone: profile.timezone ?? null,
-          linked_in_url: profile.linkedInUrl ?? null,
-          twitter_url: profile.twitterUrl ?? null,
+          display_name: entity?.displayName ?? record.display_name ?? null,
+          description: entity?.description ?? record.description ?? null,
+          owner_user_id: entity?.ownerUserId ?? record.owner_user_id ?? null,
+          primary_email: entity?.primaryEmail ?? record.primary_email ?? null,
+          primary_phone: entity?.primaryPhone ?? record.primary_phone ?? null,
+          status: entity?.status ?? record.status ?? null,
+          lifecycle_stage: entity?.lifecycleStage ?? record.lifecycle_stage ?? null,
+          source: entity?.source ?? record.source ?? null,
+          next_interaction_at: entity?.nextInteractionAt ? entity.nextInteractionAt.toISOString() : record.next_interaction_at ?? null,
+          next_interaction_name: entity?.nextInteractionName ?? record.next_interaction_name ?? null,
+          next_interaction_ref_id: entity?.nextInteractionRefId ?? record.next_interaction_ref_id ?? null,
+          next_interaction_icon: entity?.nextInteractionIcon ?? record.next_interaction_icon ?? null,
+          next_interaction_color: entity?.nextInteractionColor ?? record.next_interaction_color ?? null,
+          first_name: profile?.firstName ?? null,
+          last_name: profile?.lastName ?? null,
+          preferred_name: profile?.preferredName ?? null,
+          job_title: profile?.jobTitle ?? null,
+          department: profile?.department ?? null,
+          seniority: profile?.seniority ?? null,
+          timezone: profile?.timezone ?? null,
+          linked_in_url: profile?.linkedInUrl ?? null,
+          twitter_url: profile?.twitterUrl ?? null,
           company_entity_id:
-            profile.company && typeof profile.company === 'object'
+            profile?.company && typeof profile.company === 'object'
               ? profile.company.id
-              : profile.company ?? null,
+              : profile?.company ?? null,
         }
       })
     },

package/src/modules/customers/api/todos/route.ts

@@ -181,6 +181,8 @@ async function ensureCanonicalTodoBridge(
   await commandBus.execute('customers.interactions.create', {
     input: {
       id: link.todoId,
+      tenantId: link.tenantId,
+      organizationId: link.organizationId,
       entityId,
       interactionType: 'task',
       title: detail?.title ?? null,
@@ -344,6 +346,8 @@ export async function POST(request: Request): Promise<Response> {
 
     const { result } = await commandBus.execute('customers.interactions.create', {
       input: {
+        tenantId: auth.tenantId,
+        organizationId: selectedOrganizationId ?? auth.orgId,
         entityId: body.entityId,
         interactionType: 'task',
         title: body.title,

package/src/modules/customers/api/utils.ts

@@ -234,6 +234,42 @@ export function applyEntityIdRestriction(
   filters.id = ids.length > 0 ? { $in: ids } : { $eq: NO_MATCH_ID }
 }
 
+export function applyEntityIdExclusion(
+  filters: Record<string, unknown>,
+  ids: string[],
+): void {
+  const uniqueIds = Array.from(new Set(ids.filter((id) => typeof id === 'string' && id.length > 0)))
+  if (!uniqueIds.length) return
+
+  const currentIdFilter =
+    filters.id && typeof filters.id === 'object' && !Array.isArray(filters.id)
+      ? (filters.id as { $eq?: unknown; $in?: unknown; $nin?: unknown })
+      : null
+  const currentEq = typeof currentIdFilter?.$eq === 'string' ? currentIdFilter.$eq : null
+  const currentIn = Array.isArray(currentIdFilter?.$in)
+    ? currentIdFilter.$in.filter((value): value is string => typeof value === 'string' && value.length > 0)
+    : null
+  const currentNotIn = Array.isArray(currentIdFilter?.$nin)
+    ? currentIdFilter.$nin.filter((value): value is string => typeof value === 'string' && value.length > 0)
+    : []
+
+  if (currentEq) {
+    filters.id = uniqueIds.includes(currentEq) ? { $eq: NO_MATCH_ID } : { $eq: currentEq }
+    return
+  }
+
+  if (currentIn) {
+    const nextIds = currentIn.filter((id) => !uniqueIds.includes(id))
+    filters.id = nextIds.length > 0 ? { $in: nextIds } : { $eq: NO_MATCH_ID }
+    return
+  }
+
+  filters.id = {
+    ...(currentIdFilter ?? {}),
+    $nin: Array.from(new Set([...currentNotIn, ...uniqueIds])),
+  }
+}
+
 export function consumeAdvancedFilterState(query: Record<string, unknown>) {
   const state = deserializeAdvancedFilter(query)
   if (!state) return null

package/src/modules/customers/backend/config/customers/page.tsx

@@ -2,9 +2,7 @@ import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
-import DictionarySettings from '../../../components/DictionarySettings'
-import AddressFormatSettings from '../../../components/AddressFormatSettings'
-import PipelineSettings from '../../../components/PipelineSettings'
+import CustomersConfigurationSections from '../../../components/CustomersConfigurationSections'
 
 export default async function CustomersConfigurationPage({
   searchParams,
@@ -27,9 +25,7 @@ export default async function CustomersConfigurationPage({
               </Link>
             </Button>
           ) : null}
-          <AddressFormatSettings />
-          <PipelineSettings />
-          <DictionarySettings />
+          <CustomersConfigurationSections />
         </div>
       </PageBody>
     </Page>