@open-mercato/core 0.6.6-develop.6535.1.5cf43724de → 0.6.6-develop.6536.1.799f7f795b

package/dist/modules/attachments/lib/reconcileOrganization.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/reconcileOrganization.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { Attachment } from '../data/entities'\n\nconst logger = createLogger('attachments').child({ component: 'reconcileOrganization' })\n\n/**\n * Virtual entity id for library attachments \u2014 these are not attached to a\n * parent record that owns an organization, so there is nothing to reconcile\n * against. They are counted as skipped rather than unresolved.\n */\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nconst DEFAULT_BATCH_SIZE = 500\n\nexport type AttachmentOrgReconcileEntityStat = {\n  scanned: number\n  updated: number\n  unresolved: number\n}\n\nexport type AttachmentOrgReconcileReport = {\n  scanned: number\n  updated: number\n  unresolved: number\n  skippedVirtual: number\n  byEntity: Record<string, AttachmentOrgReconcileEntityStat>\n}\n\ntype AttachmentScanRow = {\n  id: string\n  entity_id: string | null\n  record_id: string | null\n  organization_id: string | null\n}\n\nfunction readParentOrganizationId(record: Record<string, unknown>): string | null {\n  const raw = record['organization_id'] ?? record['organizationId']\n  if (typeof raw === 'string' && raw.trim().length) return raw.trim()\n  return null\n}\n\nfunction ensureBucket(\n  report: AttachmentOrgReconcileReport,\n  entityId: string,\n): AttachmentOrgReconcileEntityStat {\n  const existing = report.byEntity[entityId]\n  if (existing) return existing\n  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }\n  report.byEntity[entityId] = bucket\n  return bucket\n}\n\n/**\n * Reconcile the `organization_id` of existing attachments to the organization\n * of the record they are attached to.\n *\n * Background (#3765): before the upload route became selected-organization\n * aware, a multi-org admin who switched the header organization uploaded files\n * that were silently stored under their *home* organization instead of the\n * selected one (the organization of the parent record). Those rows are now\n * invisible to org-scoped reads and stay orphaned. This heals them forward.\n *\n * The parent record's organization is the ground truth: an attachment is not\n * distinguishable from a legitimately home-org one by looking at the attachment\n * alone. Parent organizations are resolved generically through the Query Engine\n * by `entityId` (works for both base and custom entities, tenant-scoped and\n * organization-agnostic so the parent's real org is returned regardless of\n * which org the caller sits in) \u2014 the same mechanism the attachments module\n * already uses to enrich assignment details.\n *\n * The reconciliation is:\n * - idempotent \u2014 rows already matching their parent are left untouched;\n * - conservative \u2014 when the parent org cannot be resolved (unregistered\n *   entity id, hard-deleted parent, parent without an org column) the row is\n *   counted as `unresolved` and left as-is rather than guessed at;\n * - tenant-scoped \u2014 it reconciles every attachment in the tenant across all\n *   organizations (the whole point is moving rows between orgs).\n *\n * Writes go through the passed `EntityManager` (which the caller runs inside a\n * transaction) so the whole reconciliation commits atomically.\n */\nexport async function reconcileAttachmentOrganizations(opts: {\n  em: EntityManager\n  queryEngine: QueryEngine\n  tenantId: string\n  batchSize?: number\n}): Promise<AttachmentOrgReconcileReport> {\n  const { em, queryEngine, tenantId } = opts\n  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE\n  const report: AttachmentOrgReconcileReport = {\n    scanned: 0,\n    updated: 0,\n    unresolved: 0,\n    skippedVirtual: 0,\n    byEntity: {},\n  }\n\n  const rows = (await em.getConnection().execute(\n    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',\n    [tenantId],\n  )) as AttachmentScanRow[]\n  report.scanned = rows.length\n  if (!rows.length) return report\n\n  const groups = new Map<string, AttachmentScanRow[]>()\n  for (const row of rows) {\n    if (!row.id || !row.entity_id || !row.record_id) continue\n    const list = groups.get(row.entity_id) ?? []\n    list.push(row)\n    groups.set(row.entity_id, list)\n  }\n\n  const pendingUpdates: Array<{ id: string; organizationId: string }> = []\n\n  for (const [entityId, group] of groups) {\n    const bucket = ensureBucket(report, entityId)\n    bucket.scanned += group.length\n\n    if (entityId === LIBRARY_ENTITY_ID) {\n      report.skippedVirtual += group.length\n      continue\n    }\n\n    const recordIds = Array.from(\n      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),\n    )\n    const parentOrgByRecordId = new Map<string, string | null>()\n    let resolvable = true\n\n    for (let index = 0; index < recordIds.length; index += batchSize) {\n      const chunk = recordIds.slice(index, index + batchSize)\n      try {\n        const result = await queryEngine.query(entityId as any, {\n          fields: ['id', 'organization_id'],\n          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },\n          tenantId,\n          withDeleted: true,\n          page: { pageSize: Math.max(chunk.length, 1) },\n        })\n        for (const item of result.items ?? []) {\n          const record = item as Record<string, unknown>\n          const recordId = record.id != null ? String(record.id) : null\n          if (!recordId) continue\n          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))\n        }\n      } catch (error) {\n        resolvable = false\n        logger.warn('org reconcile: cannot resolve parent organization for entity', {\n          entityId,\n          error,\n        })\n        break\n      }\n    }\n\n    if (!resolvable) {\n      bucket.unresolved += group.length\n      report.unresolved += group.length\n      continue\n    }\n\n    for (const row of group) {\n      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null\n      if (!target) {\n        bucket.unresolved += 1\n        report.unresolved += 1\n        continue\n      }\n      if ((row.organization_id ?? null) === target) continue\n      pendingUpdates.push({ id: row.id, organizationId: target })\n      bucket.updated += 1\n      report.updated += 1\n    }\n  }\n\n  for (let index = 0; index < pendingUpdates.length; index += batchSize) {\n    const chunk = pendingUpdates.slice(index, index + batchSize)\n    for (const update of chunk) {\n      const reference = em.getReference(Attachment, update.id)\n      reference.organizationId = update.organizationId\n    }\n    await em.flush()\n  }\n\n  return report\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB;AAE3B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAOvF,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAuB3B,SAAS,yBAAyB,QAAgD;AAChF,QAAM,MAAM,OAAO,iBAAiB,KAAK,OAAO,gBAAgB;AAChE,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,OAAQ,QAAO,IAAI,KAAK;AAClE,SAAO;AACT;AAEA,SAAS,aACP,QACA,UACkC;AAClC,QAAM,WAAW,OAAO,SAAS,QAAQ;AACzC,MAAI,SAAU,QAAO;AACrB,QAAM,SAA2C,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,EAAE;AACzF,SAAO,SAAS,QAAQ,IAAI;AAC5B,SAAO;AACT;AA+BA,eAAsB,iCAAiC,MAKb;AACxC,QAAM,EAAE,IAAI,aAAa,SAAS,IAAI;AACtC,QAAM,YAAY,KAAK,aAAa,KAAK,YAAY,IAAI,KAAK,YAAY;AAC1E,QAAM,SAAuC;AAAA,IAC3C,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,EACb;AAEA,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,UAAU,KAAK;AACtB,MAAI,CAAC,KAAK,OAAQ,QAAO;AAEzB,QAAM,SAAS,oBAAI,IAAiC;AACpD,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,UAAW;AACjD,UAAM,OAAO,OAAO,IAAI,IAAI,SAAS,KAAK,CAAC;AAC3C,SAAK,KAAK,GAAG;AACb,WAAO,IAAI,IAAI,WAAW,IAAI;AAAA,EAChC;AAEA,QAAM,iBAAgE,CAAC;AAEvE,aAAW,CAAC,UAAU,KAAK,KAAK,QAAQ;AACtC,UAAM,SAAS,aAAa,QAAQ,QAAQ;AAC5C,WAAO,WAAW,MAAM;AAExB,QAAI,aAAa,mBAAmB;AAClC,aAAO,kBAAkB,MAAM;AAC/B;AAAA,IACF;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK,CAAC;AAAA,IACvF;AACA,UAAM,sBAAsB,oBAAI,IAA2B;AAC3D,QAAI,aAAa;AAEjB,aAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,WAAW;AAChE,YAAM,QAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS;AACtD,UAAI;AACF,cAAM,SAAS,MAAM,YAAY,MAAM,UAAiB;AAAA,UACtD,QAAQ,CAAC,MAAM,iBAAiB;AAAA,UAChC,SAAS,EAAE,IAAI,MAAM,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE;AAAA,UACvE;AAAA,UACA,aAAa;AAAA,UACb,MAAM,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,CAAC,EAAE;AAAA,QAC9C,CAAC;AACD,mBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,gBAAM,SAAS;AACf,gBAAM,WAAW,OAAO,MAAM,OAAO,OAAO,OAAO,EAAE,IAAI;AACzD,cAAI,CAAC,SAAU;AACf,8BAAoB,IAAI,UAAU,yBAAyB,MAAM,CAAC;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,qBAAa;AACb,eAAO,KAAK,gEAAgE;AAAA,UAC1E;AAAA,UACA;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,aAAO,cAAc,MAAM;AAC3B,aAAO,cAAc,MAAM;AAC3B;AAAA,IACF;AAEA,eAAW,OAAO,OAAO;AACvB,YAAM,SAAS,IAAI,YAAY,oBAAoB,IAAI,IAAI,SAAS,IAAI;AACxE,UAAI,CAAC,QAAQ;AACX,eAAO,cAAc;AACrB,eAAO,cAAc;AACrB;AAAA,MACF;AACA,WAAK,IAAI,mBAAmB,UAAU,OAAQ;AAC9C,qBAAe,KAAK,EAAE,IAAI,IAAI,IAAI,gBAAgB,OAAO,CAAC;AAC1D,aAAO,WAAW;AAClB,aAAO,WAAW;AAAA,IACpB;AAAA,EACF;AAEA,WAAS,QAAQ,GAAG,QAAQ,eAAe,QAAQ,SAAS,WAAW;AACrE,UAAM,QAAQ,eAAe,MAAM,OAAO,QAAQ,SAAS;AAC3D,eAAW,UAAU,OAAO;AAC1B,YAAM,YAAY,GAAG,aAAa,YAAY,OAAO,EAAE;AACvD,gBAAU,iBAAiB,OAAO;AAAA,IACpC;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/attachments/lib/requestScope.js

@@ -0,0 +1,10 @@
+import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+async function resolveAttachmentOrganizationId(container, auth, request) {
+  if (!auth) return null;
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request });
+  return scope?.selectedId ?? auth.orgId ?? null;
+}
+export {
+  resolveAttachmentOrganizationId
+};
+//# sourceMappingURL=requestScope.js.map

package/dist/modules/attachments/lib/requestScope.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/attachments/lib/requestScope.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\n/**\n * Resolve the organization an attachment request should act within.\n *\n * `auth.orgId` alone is NOT selected-organization aware for non-superadmin\n * principals: `applySuperAdminScope` only rewrites `orgId` from the\n * `om_selected_org` cookie for superadmins, so a regular multi-org admin who\n * switches the header organization keeps `auth.orgId` pinned to their own home\n * organization. The CRUD factory and other org-scoped routes derive the active\n * organization via `resolveOrganizationScopeForRequest` (cookie-driven and\n * RBAC-validated for ALL users, falling back to the home org when the selection\n * is absent or inaccessible). Attachments must do the same so uploaded files\n * land under \u2014 and are read back from \u2014 the currently selected organization\n * rather than the uploader's home organization (#3765).\n */\nexport async function resolveAttachmentOrganizationId(\n  container: AwilixContainer,\n  auth: AuthContext,\n  request: Request,\n): Promise<string | null> {\n  if (!auth) return null\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return scope?.selectedId ?? auth.orgId ?? null\n}\n"],
+  "mappings": "AAEA,SAAS,0CAA0C;AAgBnD,eAAsB,gCACpB,WACA,MACA,SACwB;AACxB,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO,OAAO,cAAc,KAAK,SAAS;AAC5C;",
+  "names": []
+}

package/dist/modules/configs/lib/upgrade-actions.js

@@ -1,4 +1,7 @@
 import * as semver from "semver";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { reconcileAttachmentOrganizations } from "@open-mercato/core/modules/attachments/lib/reconcileOrganization";
+const logger = createLogger("configs").child({ component: "upgrade-actions" });
 function compareVersions(a, b) {
   const cleanA = semver.valid(semver.coerce(a));
   const cleanB = semver.valid(semver.coerce(b));
@@ -11,6 +14,25 @@ function compareVersions(a, b) {
   return semver.compare(cleanA, cleanB);
 }
 const upgradeActions = [
+  {
+    id: "attachments.reconcile-organization",
+    version: "0.6.6",
+    messageKey: "configs.upgrades.attachmentsOrgReconcile.message",
+    ctaKey: "configs.upgrades.attachmentsOrgReconcile.cta",
+    successKey: "configs.upgrades.attachmentsOrgReconcile.success",
+    loadingKey: "configs.upgrades.attachmentsOrgReconcile.loading",
+    async run({ container, em, tenantId }) {
+      const queryEngine = container.resolve("queryEngine");
+      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId });
+      logger.info("attachments organization reconcile completed", {
+        tenantId,
+        scanned: report.scanned,
+        updated: report.updated,
+        unresolved: report.unresolved,
+        skippedVirtual: report.skippedVirtual
+      });
+    }
+  },
   {
     id: "customers.seed-interaction-statuses",
     version: "0.6.5",

package/dist/modules/configs/lib/upgrade-actions.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/configs/lib/upgrade-actions.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport * as semver from 'semver'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\n\nexport type UpgradeActionContext = {\n  tenantId: string\n  organizationId: string\n  container: AppContainer\n  em: EntityManager\n}\n\nexport type UpgradeActionDefinition = {\n  id: string\n  version: string\n  messageKey: string\n  ctaKey: string\n  successKey: string\n  loadingKey?: string\n  run: (ctx: UpgradeActionContext) => Promise<void>\n}\n\n/**\n * Compare two semantic version strings.\n * Uses the semver library for robust version comparison.\n * Returns negative if a < b, positive if a > b, 0 if equal.\n * Throws an error if either version string is invalid.\n */\nexport function compareVersions(a: string, b: string): number {\n  const cleanA = semver.valid(semver.coerce(a))\n  const cleanB = semver.valid(semver.coerce(b))\n  if (!cleanA) {\n    throw new Error(`Invalid version string: \"${a}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  if (!cleanB) {\n    throw new Error(`Invalid version string: \"${b}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  return semver.compare(cleanA, cleanB)\n}\n\nexport const upgradeActions: UpgradeActionDefinition[] = [\n  {\n    id: 'customers.seed-interaction-statuses',\n    version: '0.6.5',\n    messageKey: 'customers.config.upgradeActions.interactionStatuses.message',\n    ctaKey: 'customers.config.upgradeActions.interactionStatuses.cta',\n    successKey: 'customers.config.upgradeActions.interactionStatuses.success',\n    loadingKey: 'customers.config.upgradeActions.interactionStatuses.loading',\n    // Existing tenants predate the `interaction_status` dictionary, so their status\n    // dropdown is empty until seeded. New tenants get it via customers `seedDefaults`.\n    // Lazy-imported so configs stays decoupled from customers (the catalog of actions\n    // lives here, but customers code only loads when the action actually runs).\n    run: async ({ em, tenantId, organizationId }) => {\n      const [{ INTERACTION_STATUS_DEFAULTS }, { ensureDictionaryEntry }] = await Promise.all([\n        import('@open-mercato/core/modules/customers/cli'),\n        import('@open-mercato/core/modules/customers/commands/shared'),\n      ])\n      for (const entry of INTERACTION_STATUS_DEFAULTS) {\n        await ensureDictionaryEntry(em, {\n          tenantId,\n          organizationId,\n          kind: 'interaction_status',\n          value: entry.value,\n          label: entry.label,\n          color: entry.color,\n          icon: entry.icon,\n        })\n      }\n    },\n  },\n]\n\nexport function actionsUpToVersion(version: string): UpgradeActionDefinition[] {\n  return upgradeActions // NOSONAR \u2014 upgradeActions is populated at boot time by modules\n    .filter((action) => compareVersions(action.version, version) <= 0)\n    .sort((a, b) => compareVersions(a.version, b.version) || a.id.localeCompare(b.id))\n}\n\nexport function findUpgradeAction(actionId: string, maxVersion: string): UpgradeActionDefinition | undefined {\n  const matches = actionsUpToVersion(maxVersion).filter((action) => action.id === actionId)\n  if (!matches.length) return undefined\n  return matches[matches.length - 1]\n}\n"],
-  "mappings": "AACA,YAAY,YAAY;AA0BjB,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,SAAO,OAAO,QAAQ,QAAQ,MAAM;AACtC;AAEO,MAAM,iBAA4C;AAAA,EACvD;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,KAAK,OAAO,EAAE,IAAI,UAAU,eAAe,MAAM;AAC/C,YAAM,CAAC,EAAE,4BAA4B,GAAG,EAAE,sBAAsB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrF,OAAO,0CAA0C;AAAA,QACjD,OAAO,sDAAsD;AAAA,MAC/D,CAAC;AACD,iBAAW,SAAS,6BAA6B;AAC/C,cAAM,sBAAsB,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,SAAO,eACJ,OAAO,CAAC,WAAW,gBAAgB,OAAO,SAAS,OAAO,KAAK,CAAC,EAChE,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AACrF;AAEO,SAAS,kBAAkB,UAAkB,YAAyD;AAC3G,QAAM,UAAU,mBAAmB,UAAU,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,QAAQ;AACxF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,QAAQ,QAAQ,SAAS,CAAC;AACnC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport * as semver from 'semver'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'\n\nconst logger = createLogger('configs').child({ component: 'upgrade-actions' })\n\nexport type UpgradeActionContext = {\n  tenantId: string\n  organizationId: string\n  container: AppContainer\n  em: EntityManager\n}\n\nexport type UpgradeActionDefinition = {\n  id: string\n  version: string\n  messageKey: string\n  ctaKey: string\n  successKey: string\n  loadingKey?: string\n  run: (ctx: UpgradeActionContext) => Promise<void>\n}\n\n/**\n * Compare two semantic version strings.\n * Uses the semver library for robust version comparison.\n * Returns negative if a < b, positive if a > b, 0 if equal.\n * Throws an error if either version string is invalid.\n */\nexport function compareVersions(a: string, b: string): number {\n  const cleanA = semver.valid(semver.coerce(a))\n  const cleanB = semver.valid(semver.coerce(b))\n  if (!cleanA) {\n    throw new Error(`Invalid version string: \"${a}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  if (!cleanB) {\n    throw new Error(`Invalid version string: \"${b}\". Expected a valid semver format (e.g., \"1.2.3\").`)\n  }\n  return semver.compare(cleanA, cleanB)\n}\n\nexport const upgradeActions: UpgradeActionDefinition[] = [\n  {\n    id: 'attachments.reconcile-organization',\n    version: '0.6.6',\n    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',\n    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',\n    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',\n    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',\n    async run({ container, em, tenantId }) {\n      const queryEngine = container.resolve('queryEngine') as QueryEngine\n      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })\n      logger.info('attachments organization reconcile completed', {\n        tenantId,\n        scanned: report.scanned,\n        updated: report.updated,\n        unresolved: report.unresolved,\n        skippedVirtual: report.skippedVirtual,\n      })\n    },\n  },\n  {\n    id: 'customers.seed-interaction-statuses',\n    version: '0.6.5',\n    messageKey: 'customers.config.upgradeActions.interactionStatuses.message',\n    ctaKey: 'customers.config.upgradeActions.interactionStatuses.cta',\n    successKey: 'customers.config.upgradeActions.interactionStatuses.success',\n    loadingKey: 'customers.config.upgradeActions.interactionStatuses.loading',\n    // Existing tenants predate the `interaction_status` dictionary, so their status\n    // dropdown is empty until seeded. New tenants get it via customers `seedDefaults`.\n    // Lazy-imported so configs stays decoupled from customers (the catalog of actions\n    // lives here, but customers code only loads when the action actually runs).\n    run: async ({ em, tenantId, organizationId }) => {\n      const [{ INTERACTION_STATUS_DEFAULTS }, { ensureDictionaryEntry }] = await Promise.all([\n        import('@open-mercato/core/modules/customers/cli'),\n        import('@open-mercato/core/modules/customers/commands/shared'),\n      ])\n      for (const entry of INTERACTION_STATUS_DEFAULTS) {\n        await ensureDictionaryEntry(em, {\n          tenantId,\n          organizationId,\n          kind: 'interaction_status',\n          value: entry.value,\n          label: entry.label,\n          color: entry.color,\n          icon: entry.icon,\n        })\n      }\n    },\n  },\n]\n\nexport function actionsUpToVersion(version: string): UpgradeActionDefinition[] {\n  return upgradeActions // NOSONAR \u2014 upgradeActions is populated at boot time by modules\n    .filter((action) => compareVersions(action.version, version) <= 0)\n    .sort((a, b) => compareVersions(a.version, b.version) || a.id.localeCompare(b.id))\n}\n\nexport function findUpgradeAction(actionId: string, maxVersion: string): UpgradeActionDefinition | undefined {\n  const matches = actionsUpToVersion(maxVersion).filter((action) => action.id === actionId)\n  if (!matches.length) return undefined\n  return matches[matches.length - 1]\n}\n"],
+  "mappings": "AACA,YAAY,YAAY;AAExB,SAAS,oBAAoB;AAE7B,SAAS,wCAAwC;AAEjD,MAAM,SAAS,aAAa,SAAS,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAyBtE,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,QAAM,SAAS,OAAO,MAAM,OAAO,OAAO,CAAC,CAAC;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4BAA4B,CAAC,oDAAoD;AAAA,EACnG;AACA,SAAO,OAAO,QAAQ,QAAQ,MAAM;AACtC;AAEO,MAAM,iBAA4C;AAAA,EACvD;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA,IACZ,MAAM,IAAI,EAAE,WAAW,IAAI,SAAS,GAAG;AACrC,YAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,YAAM,SAAS,MAAM,iCAAiC,EAAE,IAAI,aAAa,SAAS,CAAC;AACnF,aAAO,KAAK,gDAAgD;AAAA,QAC1D;AAAA,QACA,SAAS,OAAO;AAAA,QAChB,SAAS,OAAO;AAAA,QAChB,YAAY,OAAO;AAAA,QACnB,gBAAgB,OAAO;AAAA,MACzB,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,QAAQ;AAAA,IACR,YAAY;AAAA,IACZ,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKZ,KAAK,OAAO,EAAE,IAAI,UAAU,eAAe,MAAM;AAC/C,YAAM,CAAC,EAAE,4BAA4B,GAAG,EAAE,sBAAsB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,QACrF,OAAO,0CAA0C;AAAA,QACjD,OAAO,sDAAsD;AAAA,MAC/D,CAAC;AACD,iBAAW,SAAS,6BAA6B;AAC/C,cAAM,sBAAsB,IAAI;AAAA,UAC9B;AAAA,UACA;AAAA,UACA,MAAM;AAAA,UACN,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,OAAO,MAAM;AAAA,UACb,MAAM,MAAM;AAAA,QACd,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AACF;AAEO,SAAS,mBAAmB,SAA4C;AAC7E,SAAO,eACJ,OAAO,CAAC,WAAW,gBAAgB,OAAO,SAAS,OAAO,KAAK,CAAC,EAChE,KAAK,CAAC,GAAG,MAAM,gBAAgB,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,cAAc,EAAE,EAAE,CAAC;AACrF;AAEO,SAAS,kBAAkB,UAAkB,YAAyD;AAC3G,QAAM,UAAU,mBAAmB,UAAU,EAAE,OAAO,CAAC,WAAW,OAAO,OAAO,QAAQ;AACxF,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,SAAO,QAAQ,QAAQ,SAAS,CAAC;AACnC;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6535.1.5cf43724de",
+  "version": "0.6.6-develop.6536.1.799f7f795b",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6535.1.5cf43724de",
-    "@open-mercato/shared": "0.6.6-develop.6535.1.5cf43724de",
-    "@open-mercato/ui": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6536.1.799f7f795b",
+    "@open-mercato/shared": "0.6.6-develop.6536.1.799f7f795b",
+    "@open-mercato/ui": "0.6.6-develop.6536.1.799f7f795b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6535.1.5cf43724de",
-    "@open-mercato/shared": "0.6.6-develop.6535.1.5cf43724de",
-    "@open-mercato/ui": "0.6.6-develop.6535.1.5cf43724de",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6536.1.799f7f795b",
+    "@open-mercato/shared": "0.6.6-develop.6536.1.799f7f795b",
+    "@open-mercato/ui": "0.6.6-develop.6536.1.799f7f795b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/attachments/api/file/[id]/route.ts

@@ -15,6 +15,7 @@ import {
   canRenderInlineAttachment,
 } from "@open-mercato/core/modules/attachments/lib/security";
 import { StorageDriverFactory } from '../../../lib/drivers';
+import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope';
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -32,16 +33,19 @@ export async function GET(
     );
   }
   const auth = await getAuthFromRequest(req);
-  const { resolve } = await createRequestContainer();
-  const em = resolve("em") as EntityManager;
+  const container = await createRequestContainer();
+  const em = container.resolve("em") as EntityManager;
   const storageDriverFactory =
-    (resolve("storageDriverFactory") as StorageDriverFactory | null) ??
+    (container.resolve("storageDriverFactory") as StorageDriverFactory | null) ??
     new StorageDriverFactory(em);
 
+  const scopedAuth = auth
+    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
+    : auth;
   const findFilter: Record<string, unknown> = { id };
-  if (auth && !isSuperAdminAuth(auth)) {
-    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
-    if (auth.orgId) findFilter.organizationId = auth.orgId;
+  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
+    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;
+    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;
   }
   const attachment = await em.findOne(Attachment, findFilter);
   if (!attachment) {
@@ -60,7 +64,7 @@ export async function GET(
     );
   }
 
-  const access = checkAttachmentAccess(auth, attachment, partition);
+  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
   if (!access.ok) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -20,6 +20,7 @@ import {
   validateImageMagicBytes,
 } from '@open-mercato/core/modules/attachments/lib/imageSafety'
 import { StorageDriverFactory } from '../../../../lib/drivers'
+import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('attachments').child({ component: 'image' })
@@ -51,15 +52,18 @@ export async function GET(
   }
   const { width, height, cropType } = parsedQuery.data
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
 
+  const scopedAuth = auth
+    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
+    : auth
   const findFilter: Record<string, unknown> = { id }
-  if (auth && !isSuperAdminAuth(auth)) {
-    if (auth.tenantId) findFilter.tenantId = auth.tenantId
-    if (auth.orgId) findFilter.organizationId = auth.orgId
+  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
+    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId
+    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId
   }
   const attachment = await em.findOne(Attachment, findFilter)
   if (!attachment) {
@@ -72,7 +76,7 @@ export async function GET(
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
-  const access = checkAttachmentAccess(auth, attachment, partition)
+  const access = checkAttachmentAccess(scopedAuth, attachment, partition)
   if (!access.ok) {
     const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'
     return NextResponse.json({ error: message }, { status: access.status })

package/src/modules/attachments/api/route.ts

@@ -13,6 +13,7 @@ import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
 import { assertAttachmentScopeInvariant } from '../lib/access'
+import { resolveAttachmentOrganizationId } from '../lib/requestScope'
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -198,10 +199,11 @@ export async function GET(req: Request) {
   }
   const { entityId, recordId, page, pageSize } = parsedQuery.data
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }
-  if (auth.orgId) filter.organizationId = auth.orgId
+  if (orgId) filter.organizationId = orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
   const total = usePaging ? await em.count(Attachment, filter) : null
@@ -224,7 +226,7 @@ export async function GET(req: Request) {
     },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: auth.orgId ?? null,
+      organizationId: orgId ?? null,
     },
   )
   return NextResponse.json({
@@ -275,7 +277,6 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
   const tenantId = auth.tenantId
-  const orgId = auth.orgId
 
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
@@ -301,11 +302,13 @@ export async function POST(req: Request) {
   const tags = parseFormTags(form.get('tags'))
   const assignmentsFromForm = parseFormAssignments(form.get('assignments'))
 
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
@@ -436,12 +439,12 @@ export async function POST(req: Request) {
   }
   const metadata = mergeAttachmentMetadata(null, { assignments, tags })
   const attachmentId = randomUUID()
-  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,
     recordId,
-    organizationId: auth.orgId!,
+    organizationId: orgId,
     tenantId: auth.tenantId!,
     fileName: safeName,
     mimeType: fileMimeType,
@@ -545,17 +548,19 @@ export async function DELETE(req: Request) {
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
-  const { resolve } = await createRequestContainer()
-  const em = resolve('em') as EntityManager
-  const dataEngine = resolve('dataEngine')
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const dataEngine = container.resolve('dataEngine')
   const storageDriverFactory =
-    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
-  // organizations" selected has no concrete org, so scope the delete by tenant
-  // only and let them remove any attachment in the tenant. Non-superadmins stay
-  // scoped to their own organization (#3764).
+    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  // Resolve the currently selected organization (#3765) so a multi-org admin who
+  // switched the header org deletes within that org, not their pinned home org.
+  // A superadmin browsing with "All organizations" selected has no concrete org,
+  // so resolution returns null and the delete falls back to a tenant-only scope
+  // (#3764) — letting them remove any attachment in the tenant.
+  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
-  if (auth.orgId) deleteFilter.organizationId = auth.orgId
+  if (orgId) deleteFilter.organizationId = orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -565,7 +570,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? auth.orgId ?? '',
+      organizationId: record.organizationId ?? orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/attachments/lib/reconcileOrganization.ts

@@ -0,0 +1,188 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
+import { Attachment } from '../data/entities'
+
+const logger = createLogger('attachments').child({ component: 'reconcileOrganization' })
+
+/**
+ * Virtual entity id for library attachments — these are not attached to a
+ * parent record that owns an organization, so there is nothing to reconcile
+ * against. They are counted as skipped rather than unresolved.
+ */
+const LIBRARY_ENTITY_ID = 'attachments:library'
+
+const DEFAULT_BATCH_SIZE = 500
+
+export type AttachmentOrgReconcileEntityStat = {
+  scanned: number
+  updated: number
+  unresolved: number
+}
+
+export type AttachmentOrgReconcileReport = {
+  scanned: number
+  updated: number
+  unresolved: number
+  skippedVirtual: number
+  byEntity: Record<string, AttachmentOrgReconcileEntityStat>
+}
+
+type AttachmentScanRow = {
+  id: string
+  entity_id: string | null
+  record_id: string | null
+  organization_id: string | null
+}
+
+function readParentOrganizationId(record: Record<string, unknown>): string | null {
+  const raw = record['organization_id'] ?? record['organizationId']
+  if (typeof raw === 'string' && raw.trim().length) return raw.trim()
+  return null
+}
+
+function ensureBucket(
+  report: AttachmentOrgReconcileReport,
+  entityId: string,
+): AttachmentOrgReconcileEntityStat {
+  const existing = report.byEntity[entityId]
+  if (existing) return existing
+  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }
+  report.byEntity[entityId] = bucket
+  return bucket
+}
+
+/**
+ * Reconcile the `organization_id` of existing attachments to the organization
+ * of the record they are attached to.
+ *
+ * Background (#3765): before the upload route became selected-organization
+ * aware, a multi-org admin who switched the header organization uploaded files
+ * that were silently stored under their *home* organization instead of the
+ * selected one (the organization of the parent record). Those rows are now
+ * invisible to org-scoped reads and stay orphaned. This heals them forward.
+ *
+ * The parent record's organization is the ground truth: an attachment is not
+ * distinguishable from a legitimately home-org one by looking at the attachment
+ * alone. Parent organizations are resolved generically through the Query Engine
+ * by `entityId` (works for both base and custom entities, tenant-scoped and
+ * organization-agnostic so the parent's real org is returned regardless of
+ * which org the caller sits in) — the same mechanism the attachments module
+ * already uses to enrich assignment details.
+ *
+ * The reconciliation is:
+ * - idempotent — rows already matching their parent are left untouched;
+ * - conservative — when the parent org cannot be resolved (unregistered
+ *   entity id, hard-deleted parent, parent without an org column) the row is
+ *   counted as `unresolved` and left as-is rather than guessed at;
+ * - tenant-scoped — it reconciles every attachment in the tenant across all
+ *   organizations (the whole point is moving rows between orgs).
+ *
+ * Writes go through the passed `EntityManager` (which the caller runs inside a
+ * transaction) so the whole reconciliation commits atomically.
+ */
+export async function reconcileAttachmentOrganizations(opts: {
+  em: EntityManager
+  queryEngine: QueryEngine
+  tenantId: string
+  batchSize?: number
+}): Promise<AttachmentOrgReconcileReport> {
+  const { em, queryEngine, tenantId } = opts
+  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE
+  const report: AttachmentOrgReconcileReport = {
+    scanned: 0,
+    updated: 0,
+    unresolved: 0,
+    skippedVirtual: 0,
+    byEntity: {},
+  }
+
+  const rows = (await em.getConnection().execute(
+    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',
+    [tenantId],
+  )) as AttachmentScanRow[]
+  report.scanned = rows.length
+  if (!rows.length) return report
+
+  const groups = new Map<string, AttachmentScanRow[]>()
+  for (const row of rows) {
+    if (!row.id || !row.entity_id || !row.record_id) continue
+    const list = groups.get(row.entity_id) ?? []
+    list.push(row)
+    groups.set(row.entity_id, list)
+  }
+
+  const pendingUpdates: Array<{ id: string; organizationId: string }> = []
+
+  for (const [entityId, group] of groups) {
+    const bucket = ensureBucket(report, entityId)
+    bucket.scanned += group.length
+
+    if (entityId === LIBRARY_ENTITY_ID) {
+      report.skippedVirtual += group.length
+      continue
+    }
+
+    const recordIds = Array.from(
+      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),
+    )
+    const parentOrgByRecordId = new Map<string, string | null>()
+    let resolvable = true
+
+    for (let index = 0; index < recordIds.length; index += batchSize) {
+      const chunk = recordIds.slice(index, index + batchSize)
+      try {
+        const result = await queryEngine.query(entityId as any, {
+          fields: ['id', 'organization_id'],
+          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
+          tenantId,
+          withDeleted: true,
+          page: { pageSize: Math.max(chunk.length, 1) },
+        })
+        for (const item of result.items ?? []) {
+          const record = item as Record<string, unknown>
+          const recordId = record.id != null ? String(record.id) : null
+          if (!recordId) continue
+          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))
+        }
+      } catch (error) {
+        resolvable = false
+        logger.warn('org reconcile: cannot resolve parent organization for entity', {
+          entityId,
+          error,
+        })
+        break
+      }
+    }
+
+    if (!resolvable) {
+      bucket.unresolved += group.length
+      report.unresolved += group.length
+      continue
+    }
+
+    for (const row of group) {
+      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null
+      if (!target) {
+        bucket.unresolved += 1
+        report.unresolved += 1
+        continue
+      }
+      if ((row.organization_id ?? null) === target) continue
+      pendingUpdates.push({ id: row.id, organizationId: target })
+      bucket.updated += 1
+      report.updated += 1
+    }
+  }
+
+  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
+    const chunk = pendingUpdates.slice(index, index + batchSize)
+    for (const update of chunk) {
+      const reference = em.getReference(Attachment, update.id)
+      reference.organizationId = update.organizationId
+    }
+    await em.flush()
+  }
+
+  return report
+}

package/src/modules/attachments/lib/requestScope.ts

@@ -0,0 +1,27 @@
+import type { AwilixContainer } from 'awilix'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+
+/**
+ * Resolve the organization an attachment request should act within.
+ *
+ * `auth.orgId` alone is NOT selected-organization aware for non-superadmin
+ * principals: `applySuperAdminScope` only rewrites `orgId` from the
+ * `om_selected_org` cookie for superadmins, so a regular multi-org admin who
+ * switches the header organization keeps `auth.orgId` pinned to their own home
+ * organization. The CRUD factory and other org-scoped routes derive the active
+ * organization via `resolveOrganizationScopeForRequest` (cookie-driven and
+ * RBAC-validated for ALL users, falling back to the home org when the selection
+ * is absent or inaccessible). Attachments must do the same so uploaded files
+ * land under — and are read back from — the currently selected organization
+ * rather than the uploader's home organization (#3765).
+ */
+export async function resolveAttachmentOrganizationId(
+  container: AwilixContainer,
+  auth: AuthContext,
+  request: Request,
+): Promise<string | null> {
+  if (!auth) return null
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+  return scope?.selectedId ?? auth.orgId ?? null
+}

package/src/modules/configs/i18n/de.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup-Drosselfenster",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatisch Query-Index-Neuindizierungsaufträge bei Lücken planen.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatische Neuindizierung",
-  "configs.systemStatus.viewDocs": "Dokumentation anzeigen"
+  "configs.systemStatus.viewDocs": "Dokumentation anzeigen",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Anhang-Organisationen abgleichen",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Anhang-Organisationen werden abgeglichen…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} behebt Anhänge, die unter der falschen Organisation gespeichert wurden. Führen Sie den Abgleich aus, um vorhandene Anhänge in die Organisation des zugehörigen Datensatzes zu verschieben.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Anhang-Organisationen abgeglichen."
 }

package/src/modules/configs/i18n/en.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup throttle window",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatically schedule query index reindex jobs when gaps appear.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Auto reindex",
-  "configs.systemStatus.viewDocs": "View documentation"
+  "configs.systemStatus.viewDocs": "View documentation",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconcile attachment organizations",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciling attachment organizations…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} fixes attachments that were saved under the wrong organization. Run the reconciliation to move existing attachments to the organization of the record they belong to.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Attachment organizations reconciled."
 }

package/src/modules/configs/i18n/es.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Ventana de limitación del calentamiento",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Programar automáticamente trabajos de reindexación cuando se detecten brechas.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Reindexación automática",
-  "configs.systemStatus.viewDocs": "Ver documentación"
+  "configs.systemStatus.viewDocs": "Ver documentación",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconciliar organizaciones de adjuntos",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciliando organizaciones de adjuntos…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "La versión {{version}} corrige los adjuntos guardados en la organización incorrecta. Ejecuta la reconciliación para mover los adjuntos existentes a la organización del registro al que pertenecen.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizaciones de adjuntos reconciliadas."
 }

package/src/modules/configs/i18n/pl.json

@@ -189,5 +189,9 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Okno throttlingu rozgrzewki",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatycznie uruchamia przebudowę indeksu zapytań, gdy wykryte zostaną luki.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatyczna przebudowa indeksu",
-  "configs.systemStatus.viewDocs": "Zobacz dokumentację"
+  "configs.systemStatus.viewDocs": "Zobacz dokumentację",
+  "configs.upgrades.attachmentsOrgReconcile.cta": "Uzgodnij organizacje załączników",
+  "configs.upgrades.attachmentsOrgReconcile.loading": "Uzgadnianie organizacji załączników…",
+  "configs.upgrades.attachmentsOrgReconcile.message": "Wersja {{version}} naprawia załączniki zapisane pod niewłaściwą organizacją. Uruchom uzgadnianie, aby przenieść istniejące załączniki do organizacji rekordu, do którego należą.",
+  "configs.upgrades.attachmentsOrgReconcile.success": "Organizacje załączników zostały uzgodnione."
 }