@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/src/modules/customer_accounts/lib/customerEntityOwnership.ts

@@ -0,0 +1,39 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export type CustomerEntityScope = {
+  tenantId: string | null | undefined
+  organizationId: string | null | undefined
+}
+
+/**
+ * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked
+ * onto a customer user) exists, is a company, is not soft-deleted, and belongs
+ * to the caller's tenant and organization.
+ *
+ * Without this check an admin in org A could pass a company UUID from org B in
+ * the same tenant and cross-link a customer user into another org's portal
+ * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows
+ * are created and listed.
+ */
+export async function isOwnedCompanyEntity(
+  em: EntityManager,
+  customerEntityId: string,
+  scope: CustomerEntityScope,
+): Promise<boolean> {
+  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
+  const entity = await findOneWithDecryption(
+    em,
+    CustomerEntity,
+    {
+      id: customerEntityId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      kind: 'company',
+      deletedAt: null,
+    } as any,
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  return !!entity
+}

package/src/modules/customer_accounts/lib/rateLimiter.ts

@@ -33,6 +33,20 @@ export const customerMagicLinkIpRateLimitConfig = readEndpointRateLimitConfig('C
   points: 10, duration: 60, blockDuration: 120, keyPrefix: 'customer-magic-link-ip',
 })
 
+// Staff- and portal-facing customer invitation endpoints
+// (`/api/customer_accounts/admin/users-invite`, `/api/customer_accounts/portal/users-invite`).
+// Both are authenticated, but a single authorized actor must not be able to mint
+// unbounded invitation rows/tokens. The compound layer caps repeated invitations
+// targeting the same recipient address from the same client, while the IP layer
+// caps overall invitation throughput per client.
+export const customerInviteRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_INVITE', {
+  points: 5, duration: 60, blockDuration: 120, keyPrefix: 'customer-invite',
+})
+
+export const customerInviteIpRateLimitConfig = readEndpointRateLimitConfig('CUSTOMER_INVITE_IP', {
+  points: 20, duration: 60, blockDuration: 120, keyPrefix: 'customer-invite-ip',
+})
+
 // Bulk custom-domain warm-up endpoint (`/api/customer_accounts/domain-resolve/all`).
 // Single shared `DOMAIN_RESOLVE_SECRET` gates a payload that lists every active
 // custom-domain mapping in the deployment, so we cap requests per IP to make

package/src/modules/customer_accounts/lib/resolveTenantContext.ts

@@ -1,7 +1,10 @@
 /**
  * Resolve the tenant context for a customer-portal request.
  *
- * - Platform-domain hosts: require `tenantId` in the request body.
+ * - Platform-domain hosts: resolve the tenant server-side from the body
+ *   `organizationId` (org → tenant). A legacy body `tenantId` is still accepted
+ *   and cross-checked against the resolved tenant (fail closed on mismatch); if
+ *   no `organizationId` is supplied it falls back to the legacy `tenantId`.
  * - Custom-domain hosts: resolve via `domainMappingService.resolveByHostname()`.
  *   If the body supplied a different `tenantId`, fail closed (mismatch).
  *
@@ -9,12 +12,15 @@
  * signup, magic-link, password-reset) so they all behave consistently when
  * the request arrives on a tenant's branded URL.
  *
- * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5.
+ * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5 and
+ * `.ai/specs/2026-06-05-tenant-ownership-and-module-acl-authorization.md` § C.
  */
 
 import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
 import { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'
 import { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'
+import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
 
@@ -44,18 +50,69 @@ function readForcedHost(req: Request): string | null {
   return host && host.length > 0 ? host : null
 }
 
+async function resolveTenantFromOrganization(
+  organizationId: string,
+  container: AppContainer | undefined,
+): Promise<{ tenantId: string; organizationId: string }> {
+  let em: EntityManager
+  if (container) {
+    em = container.resolve('em') as EntityManager
+  } else {
+    const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+    const requestContainer = await createRequestContainer()
+    em = requestContainer.resolve('em') as EntityManager
+  }
+
+  const organization = await em.findOne(
+    Organization,
+    { id: organizationId, deletedAt: null },
+    { populate: ['tenant'] },
+  )
+  if (!organization) {
+    throw new TenantResolutionError('Organization not found', 400)
+  }
+  const tenantId = typeof organization.tenant === 'string'
+    ? organization.tenant
+    : organization.tenant?.id
+      ? String(organization.tenant.id)
+      : null
+  if (!tenantId) {
+    throw new TenantResolutionError('Organization not found', 400)
+  }
+  return { tenantId, organizationId: String(organization.id) }
+}
+
 export async function resolveTenantContext(
   req: Request,
   bodyTenantId: string | null | undefined,
-  options?: { container?: AppContainer },
+  options?: { container?: AppContainer; organizationId?: string | null },
 ): Promise<ResolvedTenantContext> {
   const rawHost = readForcedHost(req) ?? req.headers.get('host')
   const hostname = rawHost ? tryNormalizeHostname(rawHost) : null
   const isPlatform = hostname ? platformDomains().includes(hostname) : true
+  const bodyOrganizationId = options?.organizationId ?? null
 
   if (isPlatform) {
+    if (bodyOrganizationId) {
+      const resolved = await resolveTenantFromOrganization(bodyOrganizationId, options?.container)
+      if (bodyTenantId && bodyTenantId !== resolved.tenantId) {
+        throw new TenantResolutionError(
+          'tenantId in request body does not match the resolved organization',
+          400,
+        )
+      }
+      return {
+        source: 'body',
+        tenantId: resolved.tenantId,
+        organizationId: resolved.organizationId,
+        hostname,
+      }
+    }
     if (!bodyTenantId) {
-      throw new TenantResolutionError('tenantId is required for platform-domain logins', 400)
+      throw new TenantResolutionError(
+        'organizationId or tenantId is required for platform-domain logins',
+        400,
+      )
     }
     return { source: 'body', tenantId: bodyTenantId, organizationId: null, hostname }
   }

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -29,13 +29,46 @@ export class CustomerInvitationService {
   ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {
     const token = generateSecureToken()
     const emailHash = hashForLookup(email)
+    const normalizedEmail = email.toLowerCase().trim()
     const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)
-
     const tokenHashed = hashToken(token)
+
+    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)
+    // invitation for the same recipient instead of inserting a new row. This caps
+    // row/token growth and keeps a single live token per concurrently-pending
+    // (tenant, organization, email) tuple.
+    const existing = await findOneWithDecryption(
+      this.em,
+      CustomerUserInvitation,
+      {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        emailHash,
+        acceptedAt: null,
+        cancelledAt: null,
+        expiresAt: { $gt: new Date() },
+      } as any,
+      undefined,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
+    )
+
+    if (existing) {
+      existing.email = normalizedEmail
+      existing.token = tokenHashed
+      existing.customerEntityId = options.customerEntityId || null
+      existing.roleIdsJson = options.roleIds
+      existing.invitedByUserId = options.invitedByUserId || null
+      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null
+      existing.displayName = options.displayName || null
+      existing.expiresAt = expiresAt
+      await this.em.flush()
+      return { invitation: existing, rawToken: token }
+    }
+
     const invitation = this.em.create(CustomerUserInvitation, {
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      email: email.toLowerCase().trim(),
+      email: normalizedEmail,
       emailHash,
       token: tokenHashed,
       customerEntityId: options.customerEntityId || null,

package/src/modules/customer_accounts/services/customerUserService.ts

@@ -1,7 +1,8 @@
 import { EntityManager } from '@mikro-orm/postgresql'
 import { hash, compare } from 'bcryptjs'
 import { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'
-import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 const BCRYPT_COST = 10
 const MAX_FAILED_ATTEMPTS = 5
@@ -33,12 +34,17 @@ export class CustomerUserService {
   }
 
   async findByEmail(email: string, tenantId: string): Promise<CustomerUser | null> {
-    const emailHash = hashForLookup(email)
-    return this.em.findOne(CustomerUser, {
-      emailHash,
-      tenantId,
-      deletedAt: null,
-    })
+    return findOneWithDecryption(
+      this.em,
+      CustomerUser,
+      {
+        emailHash: { $in: lookupHashCandidates(email) },
+        tenantId,
+        deletedAt: null,
+      } as any,
+      undefined,
+      { tenantId },
+    )
   }
 
   async findById(id: string, tenantId: string): Promise<CustomerUser | null> {

package/src/modules/customer_accounts/subscribers/autoLinkCrmReverse.ts

@@ -1,6 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'
-import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 export const metadata = {
@@ -50,14 +50,14 @@ export default async function handle(
     const email = (entity as any).primaryEmail as string | null
     if (!email) return
 
-    const emailHash = hashForLookup(email.toLowerCase().trim())
+    const emailHashes = lookupHashCandidates(email.toLowerCase().trim())
 
     const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')
     const personProfile = await em.findOne(CustomerPersonProfile as any, { entity: (entity as any).id } as any) as any
     const companyEntityId = personProfile?.companyEntityId as string | undefined
 
     const customerUser = await em.findOne(CustomerUser, {
-      emailHash,
+      emailHash: { $in: emailHashes },
       tenantId,
       deletedAt: null,
       personEntityId: null,

package/src/modules/customers/AGENTS.md

@@ -63,8 +63,8 @@ yarn workspace @open-mercato/core build
 When creating a new entity or CRUD slice, copy the customers module structure first, then align with `packages/core/AGENTS.md` and `packages/cli/AGENTS.md`.
 
 1. Define MikroORM v7 entities in `data/entities.ts` with decorators imported from `@mikro-orm/decorators/legacy`.
-2. Use UUID primary keys, snake_case table/column names, `organization_id`, `tenant_id`, and standard timestamp/soft-delete columns.
-3. Add validators, commands, CRUD route, backend pages, ACL, setup grants, events, search, and translations as applicable.
+2. Use UUID primary keys, snake_case table/column names, `organization_id`, `tenant_id`, and standard timestamp/soft-delete columns. For a **user-editable** entity, include `updated_at` (onCreate+onUpdate) so optimistic locking works, and return `updatedAt` from its CRUD list/detail responses.
+3. Add validators, commands, CRUD route, backend pages, ACL, setup grants, events, search, and translations as applicable. Edit/delete UI: prefer `CrudForm` (auto-derives the optimistic-lock header from `initialValues.updatedAt`); for custom list-row/dialog mutations, wrap with `withScopedApiRequestHeaders(buildOptimisticLockHeader(record.updatedAt), …)` and `surfaceRecordConflict(err, t)`.
 4. Generate or author the migration for only this entity change, then update the module's `migrations/.snapshot-open-mercato.json`.
 5. Run `yarn db:generate` again as a no-op check; expected output for the touched module is `no changes`.
 
@@ -87,6 +87,12 @@ Commands (`commands/people.ts`) demonstrate:
 3. Restore via `buildCustomFieldResetMap(before.custom, after.custom)` in undo
 4. Side effects with `emitCrudSideEffects` and `emitCrudUndoSideEffects`
 5. Include `indexer: { entityType, cacheAliases }` in both directions
+6. **Prefer `runCrudCommandWrite` for new commands** that combine entity writes + custom fields + side effects in one logical step. Reference: the migrated `updateDealCommand.execute` in `commands/deals.ts`. See `packages/core/AGENTS.md` → Entity Update Safety for the contract and `packages/shared/AGENTS.md` → `commands/runCrudCommandWrite` for the import.
+
+## Transaction Safety
+
+- Multi-phase scalar + relation mutations (e.g. update commands that also sync tags) use `withAtomicFlush(em, phases, { transaction: true })` from `@open-mercato/shared/lib/commands/flush` — never interleave `em.find`/`em.findOne` between a scalar mutation and `em.flush()`.
+- Side effects (`emitCrudSideEffects`) and cache invalidation fire **after** commit, outside the `withAtomicFlush` block. See `packages/core/AGENTS.md` → "Entity Update Safety — `withAtomicFlush`" and `.ai/specs/2026-06-05-cache-safety-always-consistent.md`.
 
 ## Custom Field Integration
 

package/src/modules/customers/acl.ts

@@ -78,6 +78,24 @@ export const features = [
     module: 'customers',
     dependsOn: ['customers.roles.view'],
   },
+  // Email integration (2026-05-27)
+  {
+    id: 'customers.email.compose',
+    title: 'Compose / send emails from CRM',
+    module: 'customers',
+    dependsOn: ['customers.people.view'],
+  },
+  // Reserved for a future v2 admin-oversight capability. In v1 the email
+  // privacy model is strict owner-only with NO admin bypass, so this feature is
+  // declared but INERT — granting it does not unlock other users' private emails
+  // (the visibility filter and the visibility-change gate ignore it). See
+  // .ai/specs/2026-05-27-crm-email-integration.md (v1 strict owner-only).
+  {
+    id: 'customers.email.view_private',
+    title: 'View other users\' private emails (reserved — inert in v1)',
+    module: 'customers',
+    dependsOn: ['customers.interactions.view'],
+  },
 ]
 
 export default features

package/src/modules/customers/agentic/standalone-guide.md

@@ -135,4 +135,4 @@ await withAtomicFlush(em, [
 await emitCrudSideEffects({ ... })
 ```
 
-Never run `em.find`/`em.findOne` between scalar mutations and `em.flush()` without `withAtomicFlush` — changes will be silently lost.
+Never run `em.find`/`em.findOne` between scalar mutations and `em.flush()` without `withAtomicFlush` — changes will be silently lost. Cache invalidation must also stay outside `withAtomicFlush` and fire after commit, so the opt-in `OM_CACHE_SAFETY_ALWAYS_CONSISTENT` mode (default OFF) never serves stale or partially-committed reads.

package/src/modules/customers/api/activities/route.ts

@@ -24,10 +24,12 @@ import {
   mapInteractionRecordToActivitySummary,
   CUSTOMER_INTERACTION_ACTIVITY_ADAPTER_SOURCE,
 } from '../../lib/interactionCompatibility'
+import { withOperationMetadata } from '../../lib/operationMetadata'
 import { resolveCustomerInteractionFeatureFlags } from '../../lib/interactionFeatureFlags'
 import { resolveCustomersRequestContext } from '../../lib/interactionRequestContext'
 import { hydrateCanonicalInteractions } from '../../lib/interactionReadModel'
 import { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'
+import { buildEmailVisibilityMikroFilter } from '../../lib/visibilityFilter'
 
 const listSchema = z.object({
   page: z.coerce.number().min(1).default(1),
@@ -291,6 +293,18 @@ async function listCanonicalActivities(
     where.source = Array.isArray(options.source) ? { $in: options.source } : options.source
   }
 
+  // Per-user email privacy: exclude other users' private email interactions from
+  // the deprecated /activities surface (mirrors the /interactions Layer-1 filter).
+  // v1 strict owner-only — no admin bypass (the filter ignores caller features).
+  const activitiesViewerUserId = auth.keyId ? null : (auth.sub ?? auth.userId ?? null)
+  Object.assign(
+    where,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: activitiesViewerUserId,
+      userFeatures: undefined,
+    }),
+  )
+
   const findOptions = {
     orderBy: buildCanonicalOrderBy(query.sortField, query.sortDir ?? 'desc'),
     ...(options?.paginate === false
@@ -500,7 +514,7 @@ export async function POST(request: Request): Promise<Response> {
       return withAdapterHeaders(NextResponse.json(guardResult.body, { status: guardResult.status }))
     }
     const commandBus = container.resolve('commandBus') as CommandBus
-    const { result } = await commandBus.execute('customers.interactions.create', {
+    const { result, logEntry } = await commandBus.execute('customers.interactions.create', {
       input: {
         tenantId: auth.tenantId,
         organizationId: selectedOrganizationId ?? auth.orgId,
@@ -534,23 +548,18 @@ export async function POST(request: Request): Promise<Response> {
       })
     }
 
+    const createdId =
+      result && typeof result === 'object' && 'interactionId' in result && typeof result.interactionId === 'string'
+        ? result.interactionId
+        : result && typeof result === 'object' && 'id' in result && typeof result.id === 'string'
+          ? result.id
+          : null
+
     return withAdapterHeaders(
-      NextResponse.json(
-        {
-          id:
-            result &&
-            typeof result === 'object' &&
-            'interactionId' in result &&
-            typeof result.interactionId === 'string'
-              ? result.interactionId
-              : result &&
-                  typeof result === 'object' &&
-                  'id' in result &&
-                  typeof result.id === 'string'
-                ? result.id
-                : null,
-        },
-        { status: 201 },
+      withOperationMetadata(
+        NextResponse.json({ id: createdId }, { status: 201 }),
+        logEntry,
+        { resourceKind: 'customers.activity', resourceId: createdId },
       ),
     )
   } catch (err) {
@@ -598,7 +607,7 @@ export async function PUT(request: Request): Promise<Response> {
       ? parsed.id
       : await resolveCanonicalActivityTargetId(em, commandBus, commandContext, parsed.id, auth.tenantId)
 
-    await commandBus.execute('customers.interactions.update', {
+    const { logEntry } = await commandBus.execute('customers.interactions.update', {
       input: {
         id: interactionId,
         interactionType: parsed.activityType,
@@ -629,7 +638,13 @@ export async function PUT(request: Request): Promise<Response> {
       })
     }
 
-    return withAdapterHeaders(NextResponse.json({ ok: true }))
+    return withAdapterHeaders(
+      withOperationMetadata(
+        NextResponse.json({ ok: true }),
+        logEntry,
+        { resourceKind: 'customers.activity', resourceId: parsed.id },
+      ),
+    )
   } catch (err) {
     if (isCrudHttpError(err)) {
       return withAdapterHeaders(NextResponse.json(err.body, { status: err.status }))
@@ -674,7 +689,7 @@ export async function DELETE(request: Request): Promise<Response> {
     const interactionId = flags.unified
       ? parsed.id
       : await resolveCanonicalActivityTargetId(em, commandBus, commandContext, parsed.id, auth.tenantId)
-    await commandBus.execute('customers.interactions.delete', {
+    const { logEntry } = await commandBus.execute('customers.interactions.delete', {
       input: { id: interactionId },
       ctx: commandContext,
     })
@@ -691,7 +706,13 @@ export async function DELETE(request: Request): Promise<Response> {
         metadata: guardResult.metadata ?? null,
       })
     }
-    return withAdapterHeaders(NextResponse.json({ ok: true }))
+    return withAdapterHeaders(
+      withOperationMetadata(
+        NextResponse.json({ ok: true }),
+        logEntry,
+        { resourceKind: 'customers.activity', resourceId: parsed.id },
+      ),
+    )
   } catch (err) {
     if (isCrudHttpError(err)) {
       return withAdapterHeaders(NextResponse.json(err.body, { status: err.status }))

package/src/modules/customers/api/addresses/route.ts

@@ -20,6 +20,7 @@ const listSchema = z
     page: z.coerce.number().min(1).default(1),
     pageSize: z.coerce.number().min(1).max(100).default(50),
     entityId: z.string().uuid().optional(),
+    id: z.string().uuid().optional(),
     sortField: z.string().optional(),
     sortDir: z.enum(['asc', 'desc']).optional(),
   })
@@ -75,6 +76,7 @@ const crud = makeCrudRoute({
     buildFilters: async (query: any) => {
       const filters: Record<string, any> = {}
       if (query.entityId) filters.entity_id = { $eq: query.entityId }
+      if (query.id) filters.id = { $eq: query.id }
       return filters
     },
   },

package/src/modules/customers/api/companies/[id]/route.ts

@@ -37,6 +37,8 @@ import {
 } from '../../../lib/interactionCompatibility'
 import { resolveCustomerInteractionFeatureFlags } from '../../../lib/interactionFeatureFlags'
 import { hydrateCanonicalInteractions } from '../../../lib/interactionReadModel'
+import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
+import { resolveCustomerDetailTenantScope } from '../../../lib/detailTenantScope'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -374,10 +376,13 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   const interactionFlags = await resolveCustomerInteractionFeatureFlags(container, scope?.tenantId ?? auth.tenantId)
   const interactionMode = interactionFlags.unified ? 'canonical' : 'legacy'
 
+  const tenantScope = resolveCustomerDetailTenantScope(parse.data.id, 'company', auth)
+  if (!tenantScope.allowed) return notFound('Company not found')
+
   const company = await findOneWithDecryption(
     em,
     CustomerEntity,
-    { id: parse.data.id, kind: 'company', deletedAt: null },
+    tenantScope.where,
     { populate: ['companyProfile'] },
     {
       tenantId: auth.tenantId ?? null,
@@ -386,7 +391,6 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
   )
   if (!company) return notFound('Company not found')
 
-  if (auth.tenantId && company.tenantId !== auth.tenantId) return notFound('Company not found')
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: company.organizationId })) {
     return forbidden('Access denied')
   }
@@ -396,6 +400,20 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
   }
 
+  // Per-user email privacy (CRM email integration): exclude private email
+  // interactions owned by other users from every read path that returns
+  // customer_interactions. Non-email rows, shared emails, and legacy
+  // null-visibility rows pass through. v1 is strict owner-only: there is NO
+  // admin bypass — the filter ignores caller features, and
+  // `customers.email.view_private` is reserved (inert) for v2 oversight.
+  // Mirrors the people detail route. API-key callers resolve to null
+  // (no author match — shared/non-email rows only).
+  const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)
+  const emailVisibilityFilter = buildEmailVisibilityMikroFilter({
+    currentUserId: viewerUserId,
+    userFeatures: undefined,
+  })
+
   const profile = company.companyProfile
     ? await findOneWithDecryption(
         em,
@@ -480,11 +498,13 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
               tenantId: company.tenantId,
               organizationId: company.organizationId,
               deletedAt: null,
+              ...emailVisibilityFilter,
             }
           : {
               entity: company.id,
               tenantId: company.tenantId,
               organizationId: company.organizationId,
+              ...emailVisibilityFilter,
             },
         { orderBy: { scheduledAt: 'asc', createdAt: 'desc' }, limit: 100 },
         companyScope,
@@ -523,6 +543,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
             deletedAt: null,
             status: 'planned',
             interactionType: { $ne: 'task' },
+            ...emailVisibilityFilter,
           },
           { orderBy: { scheduledAt: 'ASC', createdAt: 'ASC' }, limit: plannedPreviewLimit },
           companyScope,
@@ -609,7 +630,6 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       if (comment.authorUserId) authorIds.add(comment.authorUserId)
     }
   }
-  const viewerUserId = auth.isApiKey ? null : auth.sub ?? null
   if (viewerUserId) authorIds.add(viewerUserId)
 
   let userMap = new Map<string, { name: string | null; email: string | null }>()
@@ -795,12 +815,14 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     tenantId: company.tenantId,
     deletedAt: null,
     interactionType: { $ne: 'task' },
+    ...emailVisibilityFilter,
   })
   const interactionCount = await em.count(CustomerInteraction, {
     entity: company.id,
     organizationId: company.organizationId,
     tenantId: company.tenantId,
     deletedAt: null,
+    ...emailVisibilityFilter,
   })
   const todoCount = interactionFlags.unified
     ? await em.count(CustomerInteraction, {
@@ -858,6 +880,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
           organizationId: company.organizationId,
           tenantId: company.tenantId,
           deletedAt: null,
+          ...emailVisibilityFilter,
         },
         {
           fields: ['id', 'occurredAt', 'scheduledAt', 'createdAt'],

package/src/modules/customers/api/companies/route.ts

@@ -35,6 +35,8 @@ import {
 import {
   filterActivePersonCompanyLinks,
   withActiveCustomerPersonCompanyLinkFilter,
+  withCustomerPersonCompanyLinkScope,
+  withScopedCustomerDealLinkWhere,
 } from '../../lib/personCompanyLinkTable'
 import { normalizeCompanyProfilePayload } from './payload'
 
@@ -111,6 +113,7 @@ const crud = makeCrudRoute({
       'tenant_id',
       'kind',
       'created_at',
+      'updated_at',
     ],
     sortFieldMap: {
       name: 'display_name',
@@ -221,7 +224,7 @@ const crud = makeCrudRoute({
           }
           const linkWhere = await withActiveCustomerPersonCompanyLinkFilter(
             em,
-            { person: query.excludeLinkedPersonId },
+            withCustomerPersonCompanyLinkScope({ person: query.excludeLinkedPersonId }, decryptionScope),
             'customers.companies.GET',
           )
           const links = filterActivePersonCompanyLinks(
@@ -254,9 +257,7 @@ const crud = makeCrudRoute({
           const links = await findWithDecryption(
             em,
             CustomerDealCompanyLink,
-            {
-              deal: query.excludeLinkedDealId,
-            },
+            withScopedCustomerDealLinkWhere(query.excludeLinkedDealId, decryptionScope),
             { populate: ['company'] },
             decryptionScope,
           )
@@ -406,7 +407,19 @@ const crud = makeCrudRoute({
         const parsed = companyUpdateSchema.parse(base)
         return Object.keys(custom).length ? { ...parsed, customFields: custom } : parsed
       },
-      response: () => ({ ok: true }),
+      // Return the freshly-bumped updatedAt so inline-edit detail pages can refresh
+      // their optimistic-lock token between sequential saves (avoids a false 409 on
+      // the 2nd inline edit now that locking is default-ON). #2055. The factory hands
+      // the updated entity here; read defensively in case a `{ result }` wrapper arrives.
+      response: (arg: { result?: unknown; updatedAt?: Date | string | null }) => {
+        const raw = arg?.updatedAt
+          ?? (arg?.result as { updatedAt?: Date | string | null } | null | undefined)?.updatedAt
+          ?? null
+        return {
+          ok: true,
+          updatedAt: raw instanceof Date ? raw.toISOString() : (typeof raw === 'string' ? raw : null),
+        }
+      },
     },
     delete: {
       commandId: 'customers.companies.delete',

package/src/modules/customers/api/deals/route.ts

@@ -36,6 +36,7 @@ export const dealListQuerySchema = z
   .object({
     page: z.coerce.number().min(1).default(1),
     pageSize: z.coerce.number().min(1).max(100).default(50),
+    id: z.string().uuid().optional(),
     search: z.string().optional(),
     status: stringOrStringArray.optional(),
     pipelineStage: z.string().optional(),
@@ -214,6 +215,8 @@ export async function buildDealListFilters(query: DealListQuery, ctx?: import('@
     restrictedIds = restrictedIds.filter((id) => lookup.has(id))
   }
 
+  if (query.id) filters.id = { $eq: query.id }
+
   if (query.search) {
     const matchingIds = ctx
       ? await findMatchingEntityIdsBySearchTokensAcrossSources({