@open-mercato/core 0.6.5-develop.5337.1.534b781eac → 0.6.5-develop.5382.1.f542de69af

package/src/modules/customers/acl.ts

@@ -89,7 +89,7 @@ export const features = [
   // privacy model is strict owner-only with NO admin bypass, so this feature is
   // declared but INERT — granting it does not unlock other users' private emails
   // (the visibility filter and the visibility-change gate ignore it). See
-  // .ai/specs/2026-05-27-crm-email-integration.md (v1 strict owner-only).
+  // .ai/specs/implemented/2026-05-27-crm-email-integration.md (v1 strict owner-only).
   {
     id: 'customers.email.view_private',
     title: 'View other users\' private emails (reserved — inert in v1)',

package/src/modules/customers/ai-tools/companies-pack.ts

@@ -1,7 +1,7 @@
 /**
  * `customers.list_companies` + `customers.get_company` (Phase 1 WS-C, Step 3.9).
  *
- * Phase 3a of `.ai/specs/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
+ * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
  * `customers.list_companies` is now an API-backed wrapper over
  * `GET /api/customers/companies`. Tool name, schema, requiredFeatures, and
  * output shape are unchanged.

package/src/modules/customers/ai-tools/deals-pack.ts

@@ -2,7 +2,7 @@
  * `customers.list_deals` + `customers.get_deal` (Phase 1 WS-C, Step 3.9).
  * `customers.update_deal_stage` mutation tool (Phase 3 WS-C, Step 5.13).
  *
- * Phase 3a of `.ai/specs/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
+ * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
  * `customers.list_deals` is now an API-backed wrapper over
  * `GET /api/customers/deals`. Tool name, schema, requiredFeatures, and output
  * shape are unchanged.

package/src/modules/customers/ai-tools/people-pack.ts

@@ -5,7 +5,7 @@
  * the existing customers query engine + encryption helpers. Mutation tools
  * are deferred to Step 5.13+ under the pending-action contract.
  *
- * Phase 3a of `.ai/specs/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
+ * Phase 3a of `.ai/specs/implemented/2026-04-27-ai-tools-api-backed-dry-refactor.md`:
  * `customers.list_people` is now an API-backed wrapper over
  * `GET /api/customers/people`. The `companyId` AI input has no inclusion
  * equivalent on the route (the route exposes `excludeLinkedCompanyId` only)

package/src/modules/customers/api/companies/route.ts

@@ -23,7 +23,7 @@ import {
   extractAllCustomFieldEntries,
   splitCustomFieldPayload,
 } from '@open-mercato/shared/lib/crud/custom-fields'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'
@@ -178,7 +178,7 @@ const crud = makeCrudRoute({
         if (matchingIds !== null && matchingIds.length > 0) {
           applyEntityIdRestriction(filters, matchingIds)
         } else {
-          const searchPattern = `%${escapeLikePattern(query.search)}%`
+          const searchPattern = buildIlikeTerm(query.search)
           filters.$or = [
             { display_name: { $ilike: searchPattern } },
             { primary_email: { $ilike: searchPattern } },
@@ -276,9 +276,9 @@ const crud = makeCrudRoute({
       if (email) {
         filters.primary_email = { $eq: email }
       } else if (emailStartsWith) {
-        filters.primary_email = { $ilike: `${escapeLikePattern(emailStartsWith)}%` }
+        filters.primary_email = { $ilike: buildIlikeTerm(emailStartsWith, 'startsWith') }
       } else if (emailContains) {
-        filters.primary_email = { $ilike: `%${escapeLikePattern(emailContains)}%` }
+        filters.primary_email = { $ilike: buildIlikeTerm(emailContains) }
       }
       const hasEmail = parseBooleanToken(query.hasEmail)
       if (!email && !emailStartsWith && !emailContains && hasEmail !== null) {

package/src/modules/customers/api/people/route.ts

@@ -19,7 +19,7 @@ import {
   withScopedPayload,
 } from '../utils'
 import { buildCustomFieldFiltersFromQuery, extractAllCustomFieldEntries, splitCustomFieldPayload } from '@open-mercato/shared/lib/crud/custom-fields'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { consumeAdvancedFilterState, mergeAdvancedFilterTree } from '@open-mercato/shared/lib/crud/advanced-filter-integration'
@@ -173,7 +173,7 @@ const crud = makeCrudRoute({
         if (matchingIds !== null && matchingIds.length > 0) {
           applyEntityIdRestriction(filters, matchingIds)
         } else {
-          const searchPattern = `%${escapeLikePattern(query.search)}%`
+          const searchPattern = buildIlikeTerm(query.search)
           filters.$or = [
             { display_name: { $ilike: searchPattern } },
             { primary_email: { $ilike: searchPattern } },
@@ -189,9 +189,9 @@ const crud = makeCrudRoute({
       if (email) {
         filters.primary_email = { $eq: email }
       } else if (emailStartsWith) {
-        filters.primary_email = { $ilike: `${escapeLikePattern(emailStartsWith)}%` }
+        filters.primary_email = { $ilike: buildIlikeTerm(emailStartsWith, 'startsWith') }
       } else if (emailContains) {
-        filters.primary_email = { $ilike: `%${escapeLikePattern(emailContains)}%` }
+        filters.primary_email = { $ilike: buildIlikeTerm(emailContains) }
       }
       if (query.status) {
         filters.status = { $eq: query.status }

package/src/modules/customers/commands/addresses.ts

@@ -109,7 +109,7 @@ const createAddressCommand: CommandHandler<AddressCreateInput, { addressId: stri
     ensureOrganizationScope(ctx, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entity = await requireCustomerEntity(em, parsed.entityId, undefined, 'Customer not found')
+    const entity = await requireCustomerEntity(em, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId }, undefined, 'Customer not found')
     ensureSameScope(entity, parsed.organizationId, parsed.tenantId)
 
     const address = em.create(CustomerAddress, {
@@ -198,7 +198,7 @@ const createAddressCommand: CommandHandler<AddressCreateInput, { addressId: stri
       throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for address create' })
     }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entity = await requireCustomerEntity(em, after.entityId, undefined, 'Customer not found')
+    const entity = await requireCustomerEntity(em, after.entityId, { tenantId: after.tenantId, organizationId: after.organizationId }, undefined, 'Customer not found')
     let address = await findOneWithDecryption(
       em,
       CustomerAddress,
@@ -293,7 +293,7 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
     ensureOrganizationScope(ctx, address.organizationId)
 
     if (parsed.entityId !== undefined) {
-      const entity = await requireCustomerEntity(em, parsed.entityId, undefined, 'Customer not found')
+      const entity = await requireCustomerEntity(em, parsed.entityId, { tenantId: address.tenantId, organizationId: address.organizationId }, undefined, 'Customer not found')
       ensureSameScope(entity, address.organizationId, address.tenantId)
       address.entity = entity
     }
@@ -396,7 +396,7 @@ const updateAddressCommand: CommandHandler<AddressUpdateInput, { addressId: stri
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let address = await em.findOne(CustomerAddress, { id: before.id })
-    const entity = await requireCustomerEntity(em, before.entityId, undefined, 'Customer not found')
+    const entity = await requireCustomerEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId }, undefined, 'Customer not found')
     if (!address) {
       address = em.create(CustomerAddress, {
         id: before.id,
@@ -523,7 +523,7 @@ const deleteAddressCommand: CommandHandler<{ body?: Record<string, unknown>; que
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const entity = await requireCustomerEntity(em, before.entityId, undefined, 'Customer not found')
+      const entity = await requireCustomerEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId }, undefined, 'Customer not found')
       let address = await em.findOne(CustomerAddress, { id: before.id })
       if (!address) {
         address = em.create(CustomerAddress, {

package/src/modules/customers/commands/comments.ts

@@ -84,7 +84,7 @@ const createCommentCommand: CommandHandler<CommentCreateInput, { commentId: stri
     const normalizedAuthor = normalizeAuthorUserId(parsed.authorUserId, ctx.auth)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entity = await requireTimelineParentEntity(em, parsed.entityId)
+    const entity = await requireTimelineParentEntity(em, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId })
     ensureSameScope(entity, parsed.organizationId, parsed.tenantId)
     const deal = await requireDealInScope(em, parsed.dealId, parsed.tenantId, parsed.organizationId)
 
@@ -176,7 +176,7 @@ const createCommentCommand: CommandHandler<CommentCreateInput, { commentId: stri
       appearanceColor: snapshot.appearanceColor,
     }),
     beforeRestore: async ({ em, snapshot }) => {
-      const entity = await requireTimelineParentEntity(em, snapshot.entityId)
+      const entity = await requireTimelineParentEntity(em, snapshot.entityId, { tenantId: snapshot.tenantId, organizationId: snapshot.organizationId })
       const deal = await requireDealInScope(em, snapshot.dealId, snapshot.tenantId, snapshot.organizationId)
       return { entity, deal }
     },
@@ -201,7 +201,7 @@ const updateCommentCommand: CommandHandler<CommentUpdateInput, { commentId: stri
     ensureOrganizationScope(ctx, comment.organizationId)
 
     if (parsed.entityId !== undefined) {
-      const entity = await requireTimelineParentEntity(em, parsed.entityId)
+      const entity = await requireTimelineParentEntity(em, parsed.entityId, { tenantId: comment.tenantId, organizationId: comment.organizationId })
       ensureSameScope(entity, comment.organizationId, comment.tenantId)
       comment.entity = entity
     }
@@ -275,7 +275,7 @@ const updateCommentCommand: CommandHandler<CommentUpdateInput, { commentId: stri
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let comment = await em.findOne(CustomerComment, { id: before.id })
-    const entity = await requireTimelineParentEntity(em, before.entityId)
+    const entity = await requireTimelineParentEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId })
     const deal = await requireDealInScope(em, before.dealId, before.tenantId, before.organizationId)
 
     if (!comment) {
@@ -380,7 +380,7 @@ const deleteCommentCommand: CommandHandler<{ body?: Record<string, unknown>; que
       const before = payload?.before
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
-      const entity = await requireTimelineParentEntity(em, before.entityId)
+      const entity = await requireTimelineParentEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId })
       const deal = await requireDealInScope(em, before.dealId, before.tenantId, before.organizationId)
       let comment = await em.findOne(CustomerComment, { id: before.id })
       if (!comment) {

package/src/modules/customers/commands/deals.ts

@@ -376,7 +376,7 @@ async function syncDealPeople(
   if (!personIds || !personIds.length) return
   const unique = Array.from(new Set(personIds))
   for (const personId of unique) {
-    const person = await requireCustomerEntity(em, personId, 'person', 'Person not found')
+    const person = await requireCustomerEntity(em, personId, { tenantId: deal.tenantId, organizationId: deal.organizationId }, 'person', 'Person not found')
     ensureSameScope(person, deal.organizationId, deal.tenantId)
     const link = em.create(CustomerDealPersonLink, {
       deal,
@@ -396,7 +396,7 @@ async function syncDealCompanies(
   if (!companyIds || !companyIds.length) return
   const unique = Array.from(new Set(companyIds))
   for (const companyId of unique) {
-    const company = await requireCustomerEntity(em, companyId, 'company', 'Company not found')
+    const company = await requireCustomerEntity(em, companyId, { tenantId: deal.tenantId, organizationId: deal.organizationId }, 'company', 'Company not found')
     ensureSameScope(company, deal.organizationId, deal.tenantId)
     const link = em.create(CustomerDealCompanyLink, {
       deal,

package/src/modules/customers/commands/entity-roles.ts

@@ -137,7 +137,7 @@ const createEntityRoleCommand: CommandHandler<EntityRoleCreateInput, { roleId: s
     ensureOrganizationScope(ctx, parsed.organizationId)
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const entity = await requireCustomerEntity(em, parsed.entityId, parsed.entityType, 'Customer not found')
+    const entity = await requireCustomerEntity(em, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId }, parsed.entityType, 'Customer not found')
     ensureSameScope(entity, parsed.organizationId, parsed.tenantId)
 
     const activeExisting = await findOneWithDecryption(
@@ -495,6 +495,7 @@ const deleteEntityRoleCommand: CommandHandler<EntityRoleDeleteInput, { roleId: s
     const entity = await requireCustomerEntity(
       em,
       before.role.entityId,
+      { tenantId: before.role.tenantId, organizationId: before.role.organizationId },
       before.role.entityType,
       'Customer not found',
     )

package/src/modules/customers/commands/interactions.ts

@@ -374,7 +374,7 @@ const createInteractionCommand: CommandHandler<InteractionCreateInput, { interac
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const normalizedAuthor = normalizeAuthorUserId(parsed.authorUserId ?? null, ctx.auth)
     const { interaction, entityId, nextInteractionId } = await runInTransaction(em, async (trx) => {
-      const entity = await requireTimelineParentEntity(trx, parsed.entityId)
+      const entity = await requireTimelineParentEntity(trx, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId })
       ensureTenantScope(ctx, entity.tenantId)
       ensureOrganizationScope(ctx, entity.organizationId)
 
@@ -510,7 +510,7 @@ const createInteractionCommand: CommandHandler<InteractionCreateInput, { interac
     }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const { interaction, nextInteractionId } = await runInTransaction(em, async (trx) => {
-      const entity = await requireTimelineParentEntity(trx, after.interaction.entityId)
+      const entity = await requireTimelineParentEntity(trx, after.interaction.entityId, { tenantId: after.interaction.tenantId, organizationId: after.interaction.organizationId })
       let interaction = await findOneWithDecryption(trx, CustomerInteraction, { id: after.interaction.id })
       if (!interaction) {
         interaction = buildInteractionGraph(trx, {
@@ -781,7 +781,7 @@ const updateInteractionCommand: CommandHandler<InteractionUpdateInput, { interac
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const { interaction, nextInteractionId } = await runInTransaction(em, async (trx) => {
       let interaction = await findOneWithDecryption(trx, CustomerInteraction, { id: before.interaction.id })
-      const entity = await requireTimelineParentEntity(trx, before.interaction.entityId)
+      const entity = await requireTimelineParentEntity(trx, before.interaction.entityId, { tenantId: before.interaction.tenantId, organizationId: before.interaction.organizationId })
 
       if (!interaction) {
         interaction = trx.create(CustomerInteraction, {
@@ -1252,7 +1252,7 @@ const deleteInteractionCommand: CommandHandler<{ body?: Record<string, unknown>;
       if (!before) return
       const em = (ctx.container.resolve('em') as EntityManager).fork()
       const { interaction, nextInteractionId } = await runInTransaction(em, async (trx) => {
-        const entity = await requireTimelineParentEntity(trx, before.interaction.entityId)
+        const entity = await requireTimelineParentEntity(trx, before.interaction.entityId, { tenantId: before.interaction.tenantId, organizationId: before.interaction.organizationId })
         let interaction = await findOneWithDecryption(trx, CustomerInteraction, { id: before.interaction.id })
         if (!interaction) {
           interaction = trx.create(CustomerInteraction, {
@@ -1372,7 +1372,10 @@ const recomputeNextCommand: CommandHandler<{ entityId: string }, { entityId: str
     const parsed = recomputeNextSchema.parse(rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const projection = await recomputeNextInteraction(em, parsed.entityId)
-    const entity = await requireTimelineParentEntity(em, parsed.entityId)
+    const entity = await requireTimelineParentEntity(em, parsed.entityId, {
+      tenantId: ctx.auth?.tenantId ?? '',
+      organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? '',
+    })
     await emitNextInteractionUpdatedEvent(ctx, {
       entityId: parsed.entityId,
       nextInteractionId: projection.nextInteractionId,

package/src/modules/customers/commands/shared.ts

@@ -26,13 +26,24 @@ export function normalizeDictionaryIcon(input: unknown): string | null {
 
 export { assertFound } from '@open-mercato/shared/lib/crud/errors'
 
+export type CustomerEntityScope = {
+  tenantId: string
+  organizationId: string
+}
+
 export async function requireCustomerEntity(
   em: EntityManager,
   id: string,
+  scope: CustomerEntityScope,
   kind?: CustomerEntityKind,
   message = 'Customer entity not found'
 ): Promise<CustomerEntity> {
-  const entity = await em.findOne(CustomerEntity, { id, deletedAt: null })
+  const entity = await em.findOne(CustomerEntity, {
+    id,
+    deletedAt: null,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   if (!entity) throw new CrudHttpError(404, { error: message })
   if (kind && entity.kind !== kind) {
     throw new CrudHttpError(400, { error: 'Invalid entity type' })
@@ -43,15 +54,26 @@ export async function requireCustomerEntity(
 export async function requireTimelineParentEntity(
   em: EntityManager,
   id: string,
+  scope: CustomerEntityScope,
 ): Promise<CustomerEntity> {
-  const entity = await em.findOne(CustomerEntity, { id, deletedAt: null })
+  const entity = await em.findOne(CustomerEntity, {
+    id,
+    deletedAt: null,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   if (entity) {
     if (entity.kind !== 'person' && entity.kind !== 'company') {
       throw new CrudHttpError(422, { error: 'entityId must reference a person or company' })
     }
     return entity
   }
-  const deal = await em.findOne(CustomerDeal, { id, deletedAt: null })
+  const deal = await em.findOne(CustomerDeal, {
+    id,
+    deletedAt: null,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   if (deal) {
     throw new CrudHttpError(422, { error: 'entityId must reference a person or company, not a deal' })
   }
@@ -111,7 +133,7 @@ export async function requireDealInScope(
   organizationId: string
 ): Promise<CustomerDeal | null> {
   if (!dealId) return null
-  const deal = await em.findOne(CustomerDeal, { id: dealId, deletedAt: null })
+  const deal = await em.findOne(CustomerDeal, { id: dealId, deletedAt: null, tenantId, organizationId })
   if (!deal) throw new CrudHttpError(400, { error: 'Deal not found' })
   ensureSameScope(deal, organizationId, tenantId)
   return deal

package/src/modules/customers/commands/tags.ts

@@ -387,7 +387,7 @@ const assignTagCommand: CommandHandler<TagAssignmentInput, { assignmentId: strin
     const em = (ctx.container.resolve('em') as EntityManager).fork()
   const tag = await em.findOne(CustomerTag, { id: parsed.tagId, tenantId: parsed.tenantId, organizationId: parsed.organizationId })
   if (!tag) throw new CrudHttpError(404, { error: 'Tag not found' })
-  const entity = await requireCustomerEntity(em, parsed.entityId, undefined, 'Customer not found')
+  const entity = await requireCustomerEntity(em, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId }, undefined, 'Customer not found')
   ensureSameScope(entity, parsed.organizationId, parsed.tenantId)
   const tagIds = await loadEntityTagIds(em, entity)
     if (tagIds.includes(parsed.tagId)) {
@@ -478,7 +478,7 @@ const assignTagCommand: CommandHandler<TagAssignmentInput, { assignmentId: strin
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const tag = await em.findOne(CustomerTag, { id: before.tagId })
     if (!tag) throw new CrudHttpError(404, { error: 'Tag not found' })
-    const entity = await requireCustomerEntity(em, before.entityId, undefined, 'Customer not found')
+    const entity = await requireCustomerEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId }, undefined, 'Customer not found')
     ensureSameScope(entity, before.organizationId, before.tenantId)
 
     let assignment = await em.findOne(CustomerTagAssignment, {
@@ -589,7 +589,7 @@ const unassignTagCommand: CommandHandler<TagAssignmentInput, { assignmentId: str
     if (!before) return
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const tag = await em.findOne(CustomerTag, { id: before.tagId })
-    const entity = await requireCustomerEntity(em, before.entityId, undefined, 'Customer not found')
+    const entity = await requireCustomerEntity(em, before.entityId, { tenantId: before.tenantId, organizationId: before.organizationId }, undefined, 'Customer not found')
     ensureSameScope(entity, before.organizationId, before.tenantId)
     if (!tag) throw new CrudHttpError(404, { error: 'Tag not found' })
     const existing = await em.findOne(CustomerTagAssignment, {

package/src/modules/customers/components/detail/assignableStaff.ts

@@ -23,22 +23,46 @@ export type AssignableStaffMembersPage = {
   pageSize: number
 }
 
+// The assignable-staff roster is owned by the optional, ejectable `staff` module.
+// When that module is disabled, its `/api/staff/team-members/assignable` endpoint is
+// absent and the request resolves to 404. Customers UI (deals / people / companies
+// owner filters, role-assignment dialogs) is core and always enabled, so it must not
+// break in that case — a missing staff module simply means there is no roster to
+// offer. Treat the 404 as an empty page and let any other failure propagate.
+function isAssignableEndpointMissing(error: unknown): boolean {
+  return (
+    typeof error === 'object' &&
+    error !== null &&
+    (error as { status?: unknown }).status === 404
+  )
+}
+
 export async function fetchAssignableStaffMembersPage(
   query: string,
   options?: { page?: number; pageSize?: number; signal?: AbortSignal },
 ): Promise<AssignableStaffMembersPage> {
+  const page = options?.page ?? 1
+  const pageSize = options?.pageSize ?? 24
   const params = new URLSearchParams()
-  params.set('page', String(options?.page ?? 1))
-  params.set('pageSize', String(options?.pageSize ?? 24))
+  params.set('page', String(page))
+  params.set('pageSize', String(pageSize))
   const normalizedQuery = query.trim()
   if (normalizedQuery.length > 0) {
     params.set('search', normalizedQuery)
   }
 
-  const data = await readApiResultOrThrow<AssignableStaffResponse>(
-    `/api/staff/team-members/assignable?${params.toString()}`,
-    options?.signal ? { signal: options.signal } : undefined,
-  )
+  let data: AssignableStaffResponse
+  try {
+    data = await readApiResultOrThrow<AssignableStaffResponse>(
+      `/api/staff/team-members/assignable?${params.toString()}`,
+      options?.signal ? { signal: options.signal } : undefined,
+    )
+  } catch (error) {
+    if (isAssignableEndpointMissing(error)) {
+      return { items: [], total: 0, page, pageSize }
+    }
+    throw error
+  }
 
   const rawItems = Array.isArray(data?.items) ? data.items : []
   const deduped = new Map<string, AssignableStaffMember>()
@@ -108,11 +132,11 @@ export async function fetchAssignableStaffMembersPage(
     page:
       typeof data?.page === 'number' && Number.isFinite(data.page)
         ? data.page
-        : options?.page ?? 1,
+        : page,
     pageSize:
       typeof data?.pageSize === 'number' && Number.isFinite(data.pageSize)
         ? data.pageSize
-        : options?.pageSize ?? 24,
+        : pageSize,
   }
 }
 

package/src/modules/customers/migrations/Migration20260519120000_pipeline_stage_color_tones.ts

@@ -15,7 +15,7 @@ import { Migration } from '@mikro-orm/migrations';
  *   'pink', '', or NULL. Lane.tsx now reads the value directly as a tone identifier.
  *
  * Unknown / unmappable hex values collapse to 'neutral'. Forward-only — reverting tones to
- * the original hex is lossy and not supported. See `.ai/specs/2026-05-19-customers-deals-kanban-ux-review-fixes.md`.
+ * the original hex is lossy and not supported. See `.ai/specs/implemented/2026-05-19-customers-deals-kanban-ux-review-fixes.md`.
  */
 export class Migration20260519120000_pipeline_stage_color_tones extends Migration {
   override up(): void | Promise<void> {

package/src/modules/data_sync/api/run.ts

@@ -107,7 +107,7 @@ export async function POST(req: Request) {
     const stack = error instanceof Error ? error.stack : undefined
     console.error('[data_sync.run] unhandled error', { message, stack })
     return NextResponse.json(
-      { error: 'Failed to start data sync run.', message, stack },
+      { error: 'Failed to start data sync run.' },
       { status: 500 },
     )
   }

package/src/modules/payment_gateways/api/transactions/route.ts

@@ -5,16 +5,13 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { GatewayTransaction } from '../../data/entities'
 import { listTransactionsQuerySchema } from '../../data/validators'
 import { paymentGatewaysTag } from '../openapi'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 
 export const metadata = {
   path: '/payment_gateways/transactions',
   GET: { requireAuth: true, requireFeatures: ['payment_gateways.view'] },
 }
 
-function escapeLikePattern(value: string): string {
-  return value.replace(/[\\%_]/g, '\\$&')
-}
-
 function formatDateValue(value: unknown): string | null {
   if (!value) return null
   if (value instanceof Date) return value.toISOString()
@@ -58,7 +55,7 @@ export async function GET(req: Request) {
     qb.andWhere({ unifiedStatus: status })
   }
   if (search) {
-    const pattern = `%${escapeLikePattern(search)}%`
+    const pattern = buildIlikeTerm(search)
     qb.andWhere(`(
       cast(gt.id as text) ilike ?
       or cast(gt.payment_id as text) ilike ?

package/src/modules/progress/api/jobs/[id]/route.ts

@@ -26,6 +26,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   const job = await em.findOne(ProgressJob, {
     id: params.id,
     tenantId: auth.tenantId,
+    ...(auth.orgId ? { organizationId: auth.orgId } : {}),
   })
 
   if (!job) {
@@ -74,7 +75,11 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  const existing = await em.findOne(ProgressJob, { id: params.id, tenantId: auth.tenantId })
+  const existing = await em.findOne(ProgressJob, {
+    id: params.id,
+    tenantId: auth.tenantId,
+    ...(auth.orgId ? { organizationId: auth.orgId } : {}),
+  })
   if (!existing) {
     return NextResponse.json({ error: 'Not found' }, { status: 404 })
   }

package/src/modules/progress/api/jobs/route.ts

@@ -165,7 +165,7 @@ export async function POST(req: Request) {
     const stack = error instanceof Error ? error.stack : undefined
     console.error('[progress.jobs.create] unhandled error', { message, stack })
     return NextResponse.json(
-      { error: 'Failed to create progress job.', message, stack },
+      { error: 'Failed to create progress job.' },
       { status: 500 },
     )
   }

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -75,7 +75,11 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
     },
 
     async updateProgress(jobId, input, ctx) {
-      const job = await em.findOneOrFail(ProgressJob, { id: jobId, tenantId: ctx.tenantId })
+      const job = await em.findOneOrFail(ProgressJob, {
+        id: jobId,
+        tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
+      })
       if (job.status === 'completed' || job.status === 'failed' || job.status === 'cancelled') {
         return job
       }
@@ -197,6 +201,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       const job = await em.findOneOrFail(ProgressJob, {
         id: jobId,
         tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
         cancellable: true,
         status: { $in: ['pending', 'running'] },
       })
@@ -279,6 +284,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       return em.findOne(ProgressJob, {
         id: jobId,
         tenantId: ctx.tenantId,
+        ...(ctx.organizationId ? { organizationId: ctx.organizationId } : {}),
       })
     },
 

package/src/modules/resources/api/resources.ts

@@ -2,7 +2,7 @@ import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { ResourcesResource, ResourcesResourceTagAssignment, ResourcesResourceTag } from '../data/entities'
 import { resourcesResourceCreateSchema, resourcesResourceUpdateSchema } from '../data/validators'
@@ -107,8 +107,7 @@ const crud = makeCrudRoute({
       }
       const term = sanitizeSearchTerm(query.search)
       if (term) {
-        const like = `%${escapeLikePattern(term)}%`
-        filters[F.name] = { $ilike: like }
+        filters[F.name] = { $ilike: buildIlikeTerm(term) }
       }
       if (query.resourceTypeId) {
         filters[F.resource_type_id] = query.resourceTypeId

package/src/modules/sales/api/documents/factory.ts

@@ -17,7 +17,7 @@ import {
 } from '../openapi'
 import { parseScopedCommandInput, resolveCrudRecordId } from '../utils'
 import { documentUpdateSchema } from '../../commands/documents'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
+import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { recalculateOrderTotalsForDisplay } from '../../commands/returns'
@@ -101,7 +101,7 @@ function buildFilters(query: ListQuery, numberColumn: string, kind: DocumentKind
   const filters: Record<string, unknown> = {}
   if (query.id) filters.id = { $eq: query.id }
   if (query.search && query.search.trim().length > 0) {
-    const term = `%${escapeLikePattern(query.search.trim())}%`
+    const term = buildIlikeTerm(query.search.trim())
     filters[numberColumn] = { $ilike: term }
   }
   if (query.customerId) {

package/src/modules/staff/AGENTS.md

@@ -2,7 +2,7 @@
 
 The `staff` module is **optional** and slated for extraction into a standalone `@open-mercato/staff` package published from the [official-modules](https://github.com/open-mercato/official-modules) repository. Core modules MUST NOT take direct dependencies on staff entities, helpers, or services — cross-module contact happens through the public surfaces listed below.
 
-See [`.ai/specs/2026-05-08-staff-decouple-from-core.md`](../../../../../.ai/specs/2026-05-08-staff-decouple-from-core.md) for the decoupling plan, and [`BACKWARD_COMPATIBILITY.md`](../../../../../BACKWARD_COMPATIBILITY.md) for the contract-surface taxonomy referenced below.
+See [`.ai/specs/implemented/2026-05-08-staff-decouple-from-core.md`](../../../../../.ai/specs/implemented/2026-05-08-staff-decouple-from-core.md) for the decoupling plan, and [`BACKWARD_COMPATIBILITY.md`](../../../../../BACKWARD_COMPATIBILITY.md) for the contract-surface taxonomy referenced below.
 
 ## MUST Rules
 

package/src/modules/sync_excel/api/import/route.ts

@@ -190,7 +190,7 @@ export async function POST(request: Request) {
     const stack = error instanceof Error ? error.stack : undefined
     console.error('[sync_excel.import] unhandled error', { message, stack })
     return NextResponse.json(
-      { error: 'Failed to start sync_excel import.', message, stack },
+      { error: 'Failed to start sync_excel import.' },
       { status: 500 },
     )
   }

package/src/modules/workflows/api/definitions/route.ts

@@ -9,6 +9,7 @@
 import { NextRequest, NextResponse } from 'next/server'
 import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
@@ -93,8 +94,8 @@ export async function GET(request: NextRequest) {
 
     if (search) {
       where.$or = [
-        { workflowId: { $ilike: `%${search}%` } },
-        { workflowName: { $ilike: `%${search}%` } },
+        { workflowId: { $ilike: `%${escapeLikePattern(search)}%` } },
+        { workflowName: { $ilike: `%${escapeLikePattern(search)}%` } },
       ]
     }