@open-mercato/core 0.6.6-develop.6543.1.49fadb4c31 → 0.6.6

package/dist/modules/workflows/migrations/Migration20260716120000.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/workflows/migrations/Migration20260716120000.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations'\n\nconst CODE_WORKFLOW_ID = 'workflows.checkout-demo'\n\n/**\n * Retires the persisted checkout-demo seed rows so runtime resolves the\n * maintained CODE definition instead (issue #4211).\n *\n * Background: `workflows.checkout-demo` is now code-defined\n * (`packages/core/src/modules/workflows/workflows.ts`), and only the code\n * definition forwards the cart's line items + shipping/tax adjustments to\n * `POST /api/sales/orders`. But existing tenants still carry a persisted\n * `workflow_definitions` row from the old seed \u2014 originally seeded under ids\n * like `checkout_simple_v1` / names like `Simple Checkout Flow` and later\n * `Checkout with Payment Webhook`, then renamed to `workflows.checkout-demo`\n * by Migration20260428102318. Its `create_order` body never sent `lines`, and\n * because `findWorkflowDefinition` resolves the DB row first, that stale row\n * SHADOWS the code definition \u2014 so orders come out with zero line items and\n * $0.00 totals. Patching the persisted body is unreliable: the seed's name and\n * body shape vary across historical versions, so a fingerprint on either misses\n * whole cohorts of tenants (the defect QA hit).\n *\n * Instead, soft-delete the seeded rows. This is body/name-agnostic, so it fixes\n * every historical seed variant:\n *   - New instances: `findWorkflowDefinition` filters `deleted_at IS NULL`, so\n *     the retired row is skipped and the code definition is used (correct body).\n *   - In-flight instances: `findDefinitionForInstance` loads the definition by\n *     `id` with no soft-delete filter (WorkflowDefinition has no global filter),\n *     so instances that reference the row keep resolving and advancing.\n *\n * Scope is limited to `code_workflow_id IS NULL` rows \u2014 user customizations of\n * the code definition set `code_workflow_id` and MUST NOT be retired. The\n * `deleted_at IS NULL` guard makes the migration idempotent.\n */\nexport function buildRetireSeededCheckoutDemoSql(): string {\n  return `\n    update \"workflow_definitions\" as \"wf\"\n    set \"deleted_at\" = current_timestamp,\n        \"updated_at\" = current_timestamp\n    where \"wf\".\"workflow_id\" = '${CODE_WORKFLOW_ID}'\n      and \"wf\".\"code_workflow_id\" is null\n      and \"wf\".\"deleted_at\" is null;\n  `.trim()\n}\n\nexport class Migration20260716120000 extends Migration {\n  override async up(): Promise<void> {\n    this.addSql(buildRetireSeededCheckoutDemoSql())\n  }\n\n  override async down(): Promise<void> {\n    // Forward-only. Restoring `deleted_at = null` would re-shadow the maintained\n    // code definition with the stale seed body and re-introduce zero-line orders\n    // (#4211). The code definition supersedes the seed, so there is nothing to\n    // restore.\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAE1B,MAAM,mBAAmB;AAgClB,SAAS,mCAA2C;AACzD,SAAO;AAAA;AAAA;AAAA;AAAA,kCAIyB,gBAAgB;AAAA;AAAA;AAAA,IAG9C,KAAK;AACT;AAEO,MAAM,gCAAgC,UAAU;AAAA,EACrD,MAAe,KAAoB;AACjC,SAAK,OAAO,iCAAiC,CAAC;AAAA,EAChD;AAAA,EAEA,MAAe,OAAsB;AAAA,EAKrC;AACF;",
+  "names": []
+}

package/dist/modules/workflows/workflows.js

@@ -222,6 +222,8 @@ const checkoutDemo = defineWorkflow({
               customerEntityId: "{{context.customer.id}}",
               currencyCode: "{{context.cart.currency}}",
               placedAt: "{{now}}",
+              lines: "{{context.cart.orderLines}}",
+              adjustments: "{{context.cart.orderAdjustments}}",
               grandTotalGrossAmount: "{{context.cart.total}}"
             },
             validateTenantMatch: true

package/dist/modules/workflows/workflows.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/workflows/workflows.ts"],
-  "sourcesContent": ["/**\n * Workflows Module \u2014 Code-Based Workflow Definitions\n *\n * Demo workflows shipped with the workflows module.\n * These are auto-discovered by the generator and loaded into the in-memory registry.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\n\n// ============================================================================\n// Simple Approval Workflow\n// ============================================================================\n\nconst simpleApproval = defineWorkflow({\n  workflowId: 'workflows.simple-approval',\n  workflowName: 'Simple Approval Workflow',\n  description: 'Basic three-step approval workflow: Start \u2192 Approval \u2192 End',\n  metadata: { category: 'Testing', tags: ['test', 'approval', 'simple'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize workflow' },\n    {\n      stepId: 'approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Approve or reject request',\n      userTaskConfig: { assignedTo: 'approver', slaDuration: 'PT1H' },\n    },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_approval',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'approval',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_approver',\n          activityName: 'Notify Approver',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.approver.email}}',\n            subject: 'Approval Required: {{context.request.title}}',\n            template: 'approval_request',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              requester: '{{context.requester.name}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.requested',\n            payload: { requestId: '{{context.request.id}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n          async: true,\n        },\n      ],\n    },\n    {\n      transitionId: 'approval_to_end',\n      transitionName: 'Approval Decision',\n      fromStepId: 'approval',\n      toStepId: 'end',\n      trigger: 'manual',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_requester',\n          activityName: 'Notify Requester of Decision',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.requester.email}}',\n            subject: 'Approval Decision: {{context.request.title}}',\n            template: 'approval_decision',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              decision: '{{task.result.approved}}',\n              comments: '{{task.result.comments}}',\n              approver: '{{task.completedBy}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n        },\n        {\n          activityId: 'emit_approval_completed',\n          activityName: 'Emit Approval Completed Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.completed',\n            payload: {\n              requestId: '{{context.request.id}}',\n              approved: '{{task.result.approved}}',\n              approvedBy: '{{task.completedBy}}',\n              timestamp: '{{now}}',\n            },\n          },\n          async: true,\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Checkout Demo Workflow\n// ============================================================================\n\nconst checkoutDemo = defineWorkflow({\n  workflowId: 'workflows.checkout-demo',\n  workflowName: 'Checkout with Payment Webhook',\n  description: 'Realistic checkout workflow with signal-based payment confirmation',\n  metadata: { category: 'E-commerce', tags: ['checkout', 'demo', 'payments', 'signals'], icon: 'ShoppingCart' },\n  steps: [\n    {\n      stepId: 'start',\n      stepName: 'Start',\n      stepType: 'START',\n      description: 'Checkout process initiated',\n      preConditions: [{\n        ruleId: 'workflow_checkout_cart_not_empty',\n        required: true,\n        validationMessage: {\n          en: 'Your shopping cart is empty. Please add items before starting checkout.',\n          pl: 'Tw\u00F3j koszyk jest pusty. Dodaj produkty przed rozpocz\u0119ciem zakupu.',\n        },\n      }],\n    },\n    { stepId: 'cart_validation', stepName: 'Cart Validation', stepType: 'AUTOMATED', description: 'Validate cart has items and inventory is available', timeout: 'PT10S' },\n    {\n      stepId: 'customer_info',\n      stepName: 'Customer Information',\n      stepType: 'USER_TASK',\n      description: 'Collect customer shipping and contact information',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          properties: {\n            fullName: { type: 'string', title: 'Full Name', description: \"Customer's full legal name\" },\n            email: { type: 'string', format: 'email', title: 'Email Address', description: 'Email for order confirmation' },\n            phone: { type: 'string', title: 'Phone Number', description: 'Contact number for delivery' },\n            comment: { type: 'string', title: 'Order Comment', maxLength: 500, description: 'Special instructions or notes' },\n          },\n          required: ['fullName', 'email'],\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'payment_initiation', stepName: 'Initiate Payment', stepType: 'AUTOMATED', description: 'Send payment request to payment provider', timeout: 'PT10S' },\n    {\n      stepId: 'wait_payment_confirmation',\n      stepName: 'Wait for Payment Confirmation',\n      stepType: 'WAIT_FOR_SIGNAL',\n      description: 'Waiting for payment provider webhook confirmation',\n      signalConfig: { signalName: 'payment_confirmed', timeout: 'PT5M' },\n    },\n    { stepId: 'order_confirmation', stepName: 'Order Confirmation', stepType: 'AUTOMATED', description: 'Create order record and send confirmation', timeout: 'PT15S' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Checkout completed successfully' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_cart',\n      transitionName: 'Initialize Checkout',\n      fromStepId: 'start',\n      toStepId: 'cart_validation',\n      trigger: 'auto',\n      priority: 100,\n      activities: [{\n        activityId: 'log_checkout_start',\n        activityName: 'Log Checkout Start',\n        activityType: 'EMIT_EVENT',\n        config: {\n          eventName: 'checkout.started',\n          payload: { customerId: '{{context.customerId}}', cartId: '{{context.cartId}}', currency: '{{context.currency}}', timestamp: '{{now}}' },\n        },\n        async: false,\n      }],\n    },\n    {\n      transitionId: 'cart_to_customer_info',\n      transitionName: 'Collect Customer Information',\n      fromStepId: 'cart_validation',\n      toStepId: 'customer_info',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_checkout_cart_not_empty', required: true }],\n    },\n    {\n      transitionId: 'customer_info_to_payment',\n      transitionName: 'Initiate Payment',\n      fromStepId: 'customer_info',\n      toStepId: 'payment_initiation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'payment_to_wait_confirmation',\n      transitionName: 'Wait for Confirmation',\n      fromStepId: 'payment_initiation',\n      toStepId: 'wait_payment_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_order',\n      transitionName: 'Payment Confirmed',\n      fromStepId: 'wait_payment_confirmation',\n      toStepId: 'order_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_end',\n      transitionName: 'Finalize Order',\n      fromStepId: 'order_confirmation',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'create_order',\n          activityName: 'Create Order Record',\n          activityType: 'CALL_API',\n          config: {\n            endpoint: '/api/sales/orders',\n            method: 'POST',\n            body: {\n              customerEntityId: '{{context.customer.id}}',\n              currencyCode: '{{context.cart.currency}}',\n              placedAt: '{{now}}',\n              grandTotalGrossAmount: '{{context.cart.total}}',\n            },\n            validateTenantMatch: true,\n          },\n          timeout: 'PT10S',\n          async: false,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'send_confirmation_email',\n          activityName: 'Send Order Confirmation Email',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.customer.email}}',\n            subject: 'Order Confirmation',\n            template: 'order_confirmation',\n            data: { customerName: '{{context.customer.name}}', total: '{{context.cart.total}}' },\n          },\n          timeout: 'PT15S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Module Export\n// ============================================================================\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'workflows',\n  workflows: [simpleApproval, checkoutDemo],\n})\n\nexport default workflowsConfig\n"],
-  "mappings": "AAOA,SAAS,gBAAgB,mCAAmC;AAM5D,MAAM,iBAAiB,eAAe;AAAA,EACpC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,WAAW,MAAM,CAAC,QAAQ,YAAY,QAAQ,GAAG,MAAM,eAAe;AAAA,EAC5F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,sBAAsB;AAAA,IAC5F;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB,EAAE,YAAY,YAAY,aAAa,OAAO;AAAA,IAChE;AAAA,IACA,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,WAAW,0BAA0B,oBAAoB,0BAA0B;AAAA,UAChG;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,UAAU;AAAA,cACV,UAAU;AAAA,cACV,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,WAAW;AAAA,cACX,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMD,MAAM,eAAe,eAAe;AAAA,EAClC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,cAAc,MAAM,CAAC,YAAY,QAAQ,YAAY,SAAS,GAAG,MAAM,eAAe;AAAA,EAC5G,OAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,QACd,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,mBAAmB;AAAA,UACjB,IAAI;AAAA,UACJ,IAAI;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,EAAE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,aAAa,aAAa,sDAAsD,SAAS,QAAQ;AAAA,IACrK;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,aAAa,aAAa,6BAA6B;AAAA,YAC1F,OAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO,iBAAiB,aAAa,+BAA+B;AAAA,YAC9G,OAAO,EAAE,MAAM,UAAU,OAAO,gBAAgB,aAAa,8BAA8B;AAAA,YAC3F,SAAS,EAAE,MAAM,UAAU,OAAO,iBAAiB,WAAW,KAAK,aAAa,gCAAgC;AAAA,UAClH;AAAA,UACA,UAAU,CAAC,YAAY,OAAO;AAAA,QAChC;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,oBAAoB,UAAU,aAAa,aAAa,4CAA4C,SAAS,QAAQ;AAAA,IAC/J;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,cAAc,EAAE,YAAY,qBAAqB,SAAS,OAAO;AAAA,IACnE;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,sBAAsB,UAAU,aAAa,aAAa,6CAA6C,SAAS,QAAQ;AAAA,IAClK,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,kCAAkC;AAAA,EACzG;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY,CAAC;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,QACd,QAAQ;AAAA,UACN,WAAW;AAAA,UACX,SAAS,EAAE,YAAY,0BAA0B,QAAQ,sBAAsB,UAAU,wBAAwB,WAAW,UAAU;AAAA,QACxI;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,oCAAoC,UAAU,KAAK,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,kBAAkB;AAAA,cAClB,cAAc;AAAA,cACd,UAAU;AAAA,cACV,uBAAuB;AAAA,YACzB;AAAA,YACA,qBAAqB;AAAA,UACvB;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM,EAAE,cAAc,6BAA6B,OAAO,yBAAyB;AAAA,UACrF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,gBAAgB,YAAY;AAC1C,CAAC;AAED,IAAO,oBAAQ;",
+  "sourcesContent": ["/**\n * Workflows Module \u2014 Code-Based Workflow Definitions\n *\n * Demo workflows shipped with the workflows module.\n * These are auto-discovered by the generator and loaded into the in-memory registry.\n */\n\nimport { defineWorkflow, createWorkflowsModuleConfig } from '@open-mercato/shared/modules/workflows'\n\n// ============================================================================\n// Simple Approval Workflow\n// ============================================================================\n\nconst simpleApproval = defineWorkflow({\n  workflowId: 'workflows.simple-approval',\n  workflowName: 'Simple Approval Workflow',\n  description: 'Basic three-step approval workflow: Start \u2192 Approval \u2192 End',\n  metadata: { category: 'Testing', tags: ['test', 'approval', 'simple'], icon: 'check-circle' },\n  steps: [\n    { stepId: 'start', stepName: 'Start', stepType: 'START', description: 'Initialize workflow' },\n    {\n      stepId: 'approval',\n      stepName: 'Pending Approval',\n      stepType: 'USER_TASK',\n      description: 'Approve or reject request',\n      userTaskConfig: { assignedTo: 'approver', slaDuration: 'PT1H' },\n    },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Workflow complete' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_approval',\n      transitionName: 'Submit for Approval',\n      fromStepId: 'start',\n      toStepId: 'approval',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_approver',\n          activityName: 'Notify Approver',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.approver.email}}',\n            subject: 'Approval Required: {{context.request.title}}',\n            template: 'approval_request',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              requester: '{{context.requester.name}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n        {\n          activityId: 'emit_approval_requested',\n          activityName: 'Emit Approval Requested Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.requested',\n            payload: { requestId: '{{context.request.id}}', workflowInstanceId: '{{workflow.instanceId}}' },\n          },\n          async: true,\n        },\n      ],\n    },\n    {\n      transitionId: 'approval_to_end',\n      transitionName: 'Approval Decision',\n      fromStepId: 'approval',\n      toStepId: 'end',\n      trigger: 'manual',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'notify_requester',\n          activityName: 'Notify Requester of Decision',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.requester.email}}',\n            subject: 'Approval Decision: {{context.request.title}}',\n            template: 'approval_decision',\n            data: {\n              requestId: '{{context.request.id}}',\n              title: '{{context.request.title}}',\n              decision: '{{task.result.approved}}',\n              comments: '{{task.result.comments}}',\n              approver: '{{task.completedBy}}',\n            },\n          },\n          timeout: 'PT10S',\n          async: true,\n        },\n        {\n          activityId: 'emit_approval_completed',\n          activityName: 'Emit Approval Completed Event',\n          activityType: 'EMIT_EVENT',\n          config: {\n            eventType: 'approval.completed',\n            payload: {\n              requestId: '{{context.request.id}}',\n              approved: '{{task.result.approved}}',\n              approvedBy: '{{task.completedBy}}',\n              timestamp: '{{now}}',\n            },\n          },\n          async: true,\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Checkout Demo Workflow\n// ============================================================================\n\nconst checkoutDemo = defineWorkflow({\n  workflowId: 'workflows.checkout-demo',\n  workflowName: 'Checkout with Payment Webhook',\n  description: 'Realistic checkout workflow with signal-based payment confirmation',\n  metadata: { category: 'E-commerce', tags: ['checkout', 'demo', 'payments', 'signals'], icon: 'ShoppingCart' },\n  steps: [\n    {\n      stepId: 'start',\n      stepName: 'Start',\n      stepType: 'START',\n      description: 'Checkout process initiated',\n      preConditions: [{\n        ruleId: 'workflow_checkout_cart_not_empty',\n        required: true,\n        validationMessage: {\n          en: 'Your shopping cart is empty. Please add items before starting checkout.',\n          pl: 'Tw\u00F3j koszyk jest pusty. Dodaj produkty przed rozpocz\u0119ciem zakupu.',\n        },\n      }],\n    },\n    { stepId: 'cart_validation', stepName: 'Cart Validation', stepType: 'AUTOMATED', description: 'Validate cart has items and inventory is available', timeout: 'PT10S' },\n    {\n      stepId: 'customer_info',\n      stepName: 'Customer Information',\n      stepType: 'USER_TASK',\n      description: 'Collect customer shipping and contact information',\n      userTaskConfig: {\n        formSchema: {\n          type: 'object',\n          properties: {\n            fullName: { type: 'string', title: 'Full Name', description: \"Customer's full legal name\" },\n            email: { type: 'string', format: 'email', title: 'Email Address', description: 'Email for order confirmation' },\n            phone: { type: 'string', title: 'Phone Number', description: 'Contact number for delivery' },\n            comment: { type: 'string', title: 'Order Comment', maxLength: 500, description: 'Special instructions or notes' },\n          },\n          required: ['fullName', 'email'],\n        },\n        slaDuration: 'PT24H',\n      },\n    },\n    { stepId: 'payment_initiation', stepName: 'Initiate Payment', stepType: 'AUTOMATED', description: 'Send payment request to payment provider', timeout: 'PT10S' },\n    {\n      stepId: 'wait_payment_confirmation',\n      stepName: 'Wait for Payment Confirmation',\n      stepType: 'WAIT_FOR_SIGNAL',\n      description: 'Waiting for payment provider webhook confirmation',\n      signalConfig: { signalName: 'payment_confirmed', timeout: 'PT5M' },\n    },\n    { stepId: 'order_confirmation', stepName: 'Order Confirmation', stepType: 'AUTOMATED', description: 'Create order record and send confirmation', timeout: 'PT15S' },\n    { stepId: 'end', stepName: 'Complete', stepType: 'END', description: 'Checkout completed successfully' },\n  ] as const,\n  transitions: [\n    {\n      transitionId: 'start_to_cart',\n      transitionName: 'Initialize Checkout',\n      fromStepId: 'start',\n      toStepId: 'cart_validation',\n      trigger: 'auto',\n      priority: 100,\n      activities: [{\n        activityId: 'log_checkout_start',\n        activityName: 'Log Checkout Start',\n        activityType: 'EMIT_EVENT',\n        config: {\n          eventName: 'checkout.started',\n          payload: { customerId: '{{context.customerId}}', cartId: '{{context.cartId}}', currency: '{{context.currency}}', timestamp: '{{now}}' },\n        },\n        async: false,\n      }],\n    },\n    {\n      transitionId: 'cart_to_customer_info',\n      transitionName: 'Collect Customer Information',\n      fromStepId: 'cart_validation',\n      toStepId: 'customer_info',\n      trigger: 'auto',\n      priority: 100,\n      preConditions: [{ ruleId: 'workflow_checkout_cart_not_empty', required: true }],\n    },\n    {\n      transitionId: 'customer_info_to_payment',\n      transitionName: 'Initiate Payment',\n      fromStepId: 'customer_info',\n      toStepId: 'payment_initiation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'payment_to_wait_confirmation',\n      transitionName: 'Wait for Confirmation',\n      fromStepId: 'payment_initiation',\n      toStepId: 'wait_payment_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_order',\n      transitionName: 'Payment Confirmed',\n      fromStepId: 'wait_payment_confirmation',\n      toStepId: 'order_confirmation',\n      trigger: 'auto',\n      priority: 100,\n    },\n    {\n      transitionId: 'confirmation_to_end',\n      transitionName: 'Finalize Order',\n      fromStepId: 'order_confirmation',\n      toStepId: 'end',\n      trigger: 'auto',\n      priority: 100,\n      activities: [\n        {\n          activityId: 'create_order',\n          activityName: 'Create Order Record',\n          activityType: 'CALL_API',\n          config: {\n            endpoint: '/api/sales/orders',\n            method: 'POST',\n            body: {\n              customerEntityId: '{{context.customer.id}}',\n              currencyCode: '{{context.cart.currency}}',\n              placedAt: '{{now}}',\n              lines: '{{context.cart.orderLines}}',\n              adjustments: '{{context.cart.orderAdjustments}}',\n              grandTotalGrossAmount: '{{context.cart.total}}',\n            },\n            validateTenantMatch: true,\n          },\n          timeout: 'PT10S',\n          async: false,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 10000 },\n        },\n        {\n          activityId: 'send_confirmation_email',\n          activityName: 'Send Order Confirmation Email',\n          activityType: 'SEND_EMAIL',\n          config: {\n            to: '{{context.customer.email}}',\n            subject: 'Order Confirmation',\n            template: 'order_confirmation',\n            data: { customerName: '{{context.customer.name}}', total: '{{context.cart.total}}' },\n          },\n          timeout: 'PT15S',\n          async: true,\n          retryPolicy: { maxAttempts: 3, initialIntervalMs: 2000, backoffCoefficient: 2, maxIntervalMs: 20000 },\n        },\n      ],\n    },\n  ],\n})\n\n// ============================================================================\n// Module Export\n// ============================================================================\n\nexport const workflowsConfig = createWorkflowsModuleConfig({\n  moduleId: 'workflows',\n  workflows: [simpleApproval, checkoutDemo],\n})\n\nexport default workflowsConfig\n"],
+  "mappings": "AAOA,SAAS,gBAAgB,mCAAmC;AAM5D,MAAM,iBAAiB,eAAe;AAAA,EACpC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,WAAW,MAAM,CAAC,QAAQ,YAAY,QAAQ,GAAG,MAAM,eAAe;AAAA,EAC5F,OAAO;AAAA,IACL,EAAE,QAAQ,SAAS,UAAU,SAAS,UAAU,SAAS,aAAa,sBAAsB;AAAA,IAC5F;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB,EAAE,YAAY,YAAY,aAAa,OAAO;AAAA,IAChE;AAAA,IACA,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,oBAAoB;AAAA,EAC3F;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS,EAAE,WAAW,0BAA0B,oBAAoB,0BAA0B;AAAA,UAChG;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM;AAAA,cACJ,WAAW;AAAA,cACX,OAAO;AAAA,cACP,UAAU;AAAA,cACV,UAAU;AAAA,cACV,UAAU;AAAA,YACZ;AAAA,UACF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,QACT;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,WAAW;AAAA,YACX,SAAS;AAAA,cACP,WAAW;AAAA,cACX,UAAU;AAAA,cACV,YAAY;AAAA,cACZ,WAAW;AAAA,YACb;AAAA,UACF;AAAA,UACA,OAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMD,MAAM,eAAe,eAAe;AAAA,EAClC,YAAY;AAAA,EACZ,cAAc;AAAA,EACd,aAAa;AAAA,EACb,UAAU,EAAE,UAAU,cAAc,MAAM,CAAC,YAAY,QAAQ,YAAY,SAAS,GAAG,MAAM,eAAe;AAAA,EAC5G,OAAO;AAAA,IACL;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,QACd,QAAQ;AAAA,QACR,UAAU;AAAA,QACV,mBAAmB;AAAA,UACjB,IAAI;AAAA,UACJ,IAAI;AAAA,QACN;AAAA,MACF,CAAC;AAAA,IACH;AAAA,IACA,EAAE,QAAQ,mBAAmB,UAAU,mBAAmB,UAAU,aAAa,aAAa,sDAAsD,SAAS,QAAQ;AAAA,IACrK;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,gBAAgB;AAAA,QACd,YAAY;AAAA,UACV,MAAM;AAAA,UACN,YAAY;AAAA,YACV,UAAU,EAAE,MAAM,UAAU,OAAO,aAAa,aAAa,6BAA6B;AAAA,YAC1F,OAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO,iBAAiB,aAAa,+BAA+B;AAAA,YAC9G,OAAO,EAAE,MAAM,UAAU,OAAO,gBAAgB,aAAa,8BAA8B;AAAA,YAC3F,SAAS,EAAE,MAAM,UAAU,OAAO,iBAAiB,WAAW,KAAK,aAAa,gCAAgC;AAAA,UAClH;AAAA,UACA,UAAU,CAAC,YAAY,OAAO;AAAA,QAChC;AAAA,QACA,aAAa;AAAA,MACf;AAAA,IACF;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,oBAAoB,UAAU,aAAa,aAAa,4CAA4C,SAAS,QAAQ;AAAA,IAC/J;AAAA,MACE,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,cAAc,EAAE,YAAY,qBAAqB,SAAS,OAAO;AAAA,IACnE;AAAA,IACA,EAAE,QAAQ,sBAAsB,UAAU,sBAAsB,UAAU,aAAa,aAAa,6CAA6C,SAAS,QAAQ;AAAA,IAClK,EAAE,QAAQ,OAAO,UAAU,YAAY,UAAU,OAAO,aAAa,kCAAkC;AAAA,EACzG;AAAA,EACA,aAAa;AAAA,IACX;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY,CAAC;AAAA,QACX,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,cAAc;AAAA,QACd,QAAQ;AAAA,UACN,WAAW;AAAA,UACX,SAAS,EAAE,YAAY,0BAA0B,QAAQ,sBAAsB,UAAU,wBAAwB,WAAW,UAAU;AAAA,QACxI;AAAA,QACA,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,eAAe,CAAC,EAAE,QAAQ,oCAAoC,UAAU,KAAK,CAAC;AAAA,IAChF;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAAA,IACA;AAAA,MACE,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,YAAY;AAAA,MACZ,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,MACV,YAAY;AAAA,QACV;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,cACJ,kBAAkB;AAAA,cAClB,cAAc;AAAA,cACd,UAAU;AAAA,cACV,OAAO;AAAA,cACP,aAAa;AAAA,cACb,uBAAuB;AAAA,YACzB;AAAA,YACA,qBAAqB;AAAA,UACvB;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,QACA;AAAA,UACE,YAAY;AAAA,UACZ,cAAc;AAAA,UACd,cAAc;AAAA,UACd,QAAQ;AAAA,YACN,IAAI;AAAA,YACJ,SAAS;AAAA,YACT,UAAU;AAAA,YACV,MAAM,EAAE,cAAc,6BAA6B,OAAO,yBAAyB;AAAA,UACrF;AAAA,UACA,SAAS;AAAA,UACT,OAAO;AAAA,UACP,aAAa,EAAE,aAAa,GAAG,mBAAmB,KAAM,oBAAoB,GAAG,eAAe,IAAM;AAAA,QACtG;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF,CAAC;AAMM,MAAM,kBAAkB,4BAA4B;AAAA,EACzD,UAAU;AAAA,EACV,WAAW,CAAC,gBAAgB,YAAY;AAC1C,CAAC;AAED,IAAO,oBAAQ;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6543.1.49fadb4c31",
+  "version": "0.6.6",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6543.1.49fadb4c31",
-    "@open-mercato/shared": "0.6.6-develop.6543.1.49fadb4c31",
-    "@open-mercato/ui": "0.6.6-develop.6543.1.49fadb4c31",
+    "@open-mercato/ai-assistant": "0.6.6",
+    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/ui": "0.6.6",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6543.1.49fadb4c31",
-    "@open-mercato/shared": "0.6.6-develop.6543.1.49fadb4c31",
-    "@open-mercato/ui": "0.6.6-develop.6543.1.49fadb4c31",
+    "@open-mercato/ai-assistant": "0.6.6",
+    "@open-mercato/shared": "0.6.6",
+    "@open-mercato/ui": "0.6.6",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",
@@ -285,6 +285,5 @@
     "type": "git",
     "url": "https://github.com/open-mercato/open-mercato",
     "directory": "packages/core"
-  },
-  "stableVersion": "0.6.5"
+  }
 }

package/src/modules/api_keys/api/keys/route.ts

@@ -13,8 +13,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { enforceTenantSelection, resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { assertActorCanGrantRoles } from '@open-mercato/core/modules/auth/lib/grantChecks'
-import { isOrganizationAccessAllowed } from '@open-mercato/shared/lib/auth/organizationAccess'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 
 type ApiKeyCrudCtx = CrudCtx & {
   __apiKeySecret?: { secret: string; prefix: string }
@@ -324,34 +322,18 @@ const crud = makeCrudRoute<
       const { translate } = await resolveTranslations()
       if (!auth?.tenantId) throw json({ error: translate('api_keys.errors.tenantRequired', 'Tenant context required') }, { status: 400 })
       const em = (ctx.container.resolve('em') as EntityManager)
+      const record = await em.findOne(ApiKey, { id, deletedAt: null })
+      if (!record) throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
       const scopedCtx = ctx as ApiKeyCrudCtx
       const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
-      const allowedIds = ctx.organizationScope?.allowedIds ?? null
-      const recordFilter: FilterQuery<ApiKey> = {
-        id,
-        tenantId: auth.tenantId,
-        deletedAt: null,
-      }
-      if (!isSuperAdmin && Array.isArray(allowedIds)) {
-        recordFilter.organizationId = { $in: allowedIds }
+      if (!isSuperAdmin && record.tenantId && record.tenantId !== auth.tenantId) {
+        throw json({ error: translate('api_keys.errors.forbidden', 'Forbidden') }, { status: 403 })
       }
-      const record = await findOneWithDecryption(
-        em,
-        ApiKey,
-        recordFilter,
-        undefined,
-        { tenantId: auth.tenantId, organizationId: null },
-      )
-      if (
-        !record ||
-        record.tenantId !== auth.tenantId ||
-        !isOrganizationAccessAllowed({
-          isSuperAdmin,
-          allowedOrganizationIds: allowedIds,
-          targetOrganizationId: record.organizationId ?? null,
-        })
-      ) {
-        throw json({ error: translate('api_keys.errors.notFound', 'Not found') }, { status: 404 })
+      const allowedIds = ctx.organizationScope?.allowedIds ?? null
+      if (record.organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
+        if (!allowedIds.includes(record.organizationId)) {
+          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
+        }
       }
       scopedCtx.__apiKeyOrganizationId = record.organizationId ?? null
     },

package/src/modules/api_keys/cli.ts

@@ -3,7 +3,6 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { createApiKey } from './services/apiKeyService'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
-import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 
 function parseArgs(rest: string[]): Record<string, string> {
   const args: Record<string, string> = {}
@@ -48,7 +47,9 @@ const addApiKey: ModuleCli = {
       return
     }
 
-    const roleInputs = parseCommaSeparatedList(rolesCsv)
+    const roleInputs = rolesCsv
+      ? rolesCsv.split(',').map((value) => value.trim()).filter(Boolean)
+      : []
     const roleIds: string[] = []
     if (roleInputs.length) {
       for (const token of roleInputs) {

package/src/modules/attachments/api/file/[id]/route.ts

@@ -15,7 +15,6 @@ import {
   canRenderInlineAttachment,
 } from "@open-mercato/core/modules/attachments/lib/security";
 import { StorageDriverFactory } from '../../../lib/drivers';
-import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope';
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -33,19 +32,16 @@ export async function GET(
     );
   }
   const auth = await getAuthFromRequest(req);
-  const container = await createRequestContainer();
-  const em = container.resolve("em") as EntityManager;
+  const { resolve } = await createRequestContainer();
+  const em = resolve("em") as EntityManager;
   const storageDriverFactory =
-    (container.resolve("storageDriverFactory") as StorageDriverFactory | null) ??
+    (resolve("storageDriverFactory") as StorageDriverFactory | null) ??
     new StorageDriverFactory(em);
 
-  const scopedAuth = auth
-    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
-    : auth;
   const findFilter: Record<string, unknown> = { id };
-  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
-    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;
-    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId;
+    if (auth.orgId) findFilter.organizationId = auth.orgId;
   }
   const attachment = await em.findOne(Attachment, findFilter);
   if (!attachment) {
@@ -64,7 +60,7 @@ export async function GET(
     );
   }
 
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition);
+  const access = checkAttachmentAccess(auth, attachment, partition);
   if (!access.ok) {
     const message = access.status === 401 ? "Unauthorized" : "Forbidden";
     return NextResponse.json({ error: message }, { status: access.status });

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -20,7 +20,6 @@ import {
   validateImageMagicBytes,
 } from '@open-mercato/core/modules/attachments/lib/imageSafety'
 import { StorageDriverFactory } from '../../../../lib/drivers'
-import { resolveAttachmentOrganizationId } from '@open-mercato/core/modules/attachments/lib/requestScope'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('attachments').child({ component: 'image' })
@@ -52,18 +51,15 @@ export async function GET(
   }
   const { width, height, cropType } = parsedQuery.data
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
 
-  const scopedAuth = auth
-    ? { ...auth, orgId: await resolveAttachmentOrganizationId(container, auth, req) }
-    : auth
   const findFilter: Record<string, unknown> = { id }
-  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {
-    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId
-    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId
+  if (auth && !isSuperAdminAuth(auth)) {
+    if (auth.tenantId) findFilter.tenantId = auth.tenantId
+    if (auth.orgId) findFilter.organizationId = auth.orgId
   }
   const attachment = await em.findOne(Attachment, findFilter)
   if (!attachment) {
@@ -76,7 +72,7 @@ export async function GET(
   if (!partition) {
     return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })
   }
-  const access = checkAttachmentAccess(scopedAuth, attachment, partition)
+  const access = checkAttachmentAccess(auth, attachment, partition)
   if (!access.ok) {
     const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'
     return NextResponse.json({ error: message }, { status: access.status })

package/src/modules/attachments/api/route.ts

@@ -13,7 +13,6 @@ import { StorageDriverFactory } from '../lib/drivers'
 import { OcrService, shouldUseLlmOcr } from '../lib/ocrService'
 import { clearAttachmentThumbnailCache } from '../lib/thumbnailCache'
 import { assertAttachmentScopeInvariant } from '../lib/access'
-import { resolveAttachmentOrganizationId } from '../lib/requestScope'
 import {
   mergeAttachmentMetadata,
   normalizeAttachmentAssignments,
@@ -199,11 +198,10 @@ export async function GET(req: Request) {
   }
   const { entityId, recordId, page, pageSize } = parsedQuery.data
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
   const filter: Record<string, unknown> = { entityId, recordId, tenantId: auth.tenantId! }
-  if (orgId) filter.organizationId = orgId
+  if (auth.orgId) filter.organizationId = auth.orgId
   const orderBy: Record<string, 'ASC' | 'DESC'> = { createdAt: 'DESC' }
   const usePaging = typeof page === 'number' && typeof pageSize === 'number'
   const total = usePaging ? await em.count(Attachment, filter) : null
@@ -226,7 +224,7 @@ export async function GET(req: Request) {
     },
     {
       tenantId: auth.tenantId ?? null,
-      organizationId: orgId ?? null,
+      organizationId: auth.orgId ?? null,
     },
   )
   return NextResponse.json({
@@ -277,6 +275,7 @@ export async function POST(req: Request) {
     }, { status: 400 })
   }
   const tenantId = auth.tenantId
+  const orgId = auth.orgId
 
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
@@ -302,13 +301,11 @@ export async function POST(req: Request) {
   const tags = parseFormTags(form.get('tags'))
   const assignmentsFromForm = parseFormAssignments(form.get('assignments'))
 
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const dataEngine = container.resolve('dataEngine')
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
+  const dataEngine = resolve('dataEngine')
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
-  if (!orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
   await ensureDefaultPartitions(em)
   // Optional per-field validations
   let partitionFromField: string | null = null
@@ -439,12 +436,12 @@ export async function POST(req: Request) {
   }
   const metadata = mergeAttachmentMetadata(null, { assignments, tags })
   const attachmentId = randomUUID()
-  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: orgId })
+  assertAttachmentScopeInvariant({ tenantId: auth.tenantId, organizationId: auth.orgId })
   const att = em.create(Attachment, {
     id: attachmentId,
     entityId,
     recordId,
-    organizationId: orgId,
+    organizationId: auth.orgId!,
     tenantId: auth.tenantId!,
     fileName: safeName,
     mimeType: fileMimeType,
@@ -548,19 +545,17 @@ export async function DELETE(req: Request) {
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
-  const container = await createRequestContainer()
-  const em = container.resolve('em') as EntityManager
-  const dataEngine = container.resolve('dataEngine')
+  const { resolve } = await createRequestContainer()
+  const em = resolve('em') as EntityManager
+  const dataEngine = resolve('dataEngine')
   const storageDriverFactory =
-    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  // Resolve the currently selected organization (#3765) so a multi-org admin who
-  // switched the header org deletes within that org, not their pinned home org.
-  // A superadmin browsing with "All organizations" selected has no concrete org,
-  // so resolution returns null and the delete falls back to a tenant-only scope
-  // (#3764) — letting them remove any attachment in the tenant.
-  const orgId = await resolveAttachmentOrganizationId(container, auth, req)
+    (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
+  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
+  // organizations" selected has no concrete org, so scope the delete by tenant
+  // only and let them remove any attachment in the tenant. Non-superadmins stay
+  // scoped to their own organization (#3764).
   const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
-  if (orgId) deleteFilter.organizationId = orgId
+  if (auth.orgId) deleteFilter.organizationId = auth.orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -570,7 +565,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? orgId ?? '',
+      organizationId: record.organizationId ?? auth.orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/auth/api/users/route.ts

@@ -22,7 +22,6 @@ import {
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
@@ -42,7 +41,6 @@ const querySchema = z.object({
   search: z.string().optional(),
   name: z.string().optional(),
   organizationId: z.string().uuid().optional(),
-  scopeToActiveOrganization: z.boolean().optional(),
   roleIds: z.array(z.string().uuid()).optional(),
 }).passthrough()
 
@@ -182,7 +180,6 @@ export async function GET(req: Request) {
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
-    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),
     roleIds: rawRoleIds.length ? rawRoleIds : undefined,
   })
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
@@ -198,7 +195,7 @@ export async function GET(req: Request) {
   } catch (err) {
     logger.error('Failed to resolve rbac', { err })
   }
-  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
+  const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -247,12 +244,6 @@ export async function GET(req: Request) {
     ? effectiveSelectedOrganizationId
     : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
-  // Recipient/assignee pickers scope to the caller's active organization so they never
-  // suggest users outside it. A message composed here is stamped with the caller's
-  // active org (auth.orgId), and the message detail endpoint enforces
-  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the
-  // suggestions to the same org keeps a picked recipient able to open what they were sent.
-  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
     const searchPattern = `%${escapeLikePattern(trimmedName)}%`
@@ -629,7 +620,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/cli.ts

@@ -9,7 +9,6 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
-import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
@@ -72,7 +71,7 @@ const addUser: ModuleCli = {
     })
     await em.persist(u).flush()
     if (rolesCsv) {
-      const names = parseCommaSeparatedList(rolesCsv)
+      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
       for (const name of names) {
         const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
@@ -494,7 +493,7 @@ const setupApp: ModuleCli = {
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
     const roleNames = rolesCsv
-      ? parseCommaSeparatedList(rolesCsv)
+      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)
       : undefined
 
     try {

package/src/modules/configs/i18n/de.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup-Drosselfenster",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatisch Query-Index-Neuindizierungsaufträge bei Lücken planen.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatische Neuindizierung",
-  "configs.systemStatus.viewDocs": "Dokumentation anzeigen",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Anhang-Organisationen abgleichen",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Anhang-Organisationen werden abgeglichen…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} behebt Anhänge, die unter der falschen Organisation gespeichert wurden. Führen Sie den Abgleich aus, um vorhandene Anhänge in die Organisation des zugehörigen Datensatzes zu verschieben.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Anhang-Organisationen abgeglichen."
+  "configs.systemStatus.viewDocs": "Dokumentation anzeigen"
 }

package/src/modules/configs/i18n/en.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup throttle window",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatically schedule query index reindex jobs when gaps appear.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Auto reindex",
-  "configs.systemStatus.viewDocs": "View documentation",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconcile attachment organizations",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciling attachment organizations…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} fixes attachments that were saved under the wrong organization. Run the reconciliation to move existing attachments to the organization of the record they belong to.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Attachment organizations reconciled."
+  "configs.systemStatus.viewDocs": "View documentation"
 }

package/src/modules/configs/i18n/es.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Ventana de limitación del calentamiento",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Programar automáticamente trabajos de reindexación cuando se detecten brechas.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Reindexación automática",
-  "configs.systemStatus.viewDocs": "Ver documentación",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconciliar organizaciones de adjuntos",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciliando organizaciones de adjuntos…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "La versión {{version}} corrige los adjuntos guardados en la organización incorrecta. Ejecuta la reconciliación para mover los adjuntos existentes a la organización del registro al que pertenecen.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Organizaciones de adjuntos reconciliadas."
+  "configs.systemStatus.viewDocs": "Ver documentación"
 }

package/src/modules/configs/i18n/pl.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Okno throttlingu rozgrzewki",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatycznie uruchamia przebudowę indeksu zapytań, gdy wykryte zostaną luki.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatyczna przebudowa indeksu",
-  "configs.systemStatus.viewDocs": "Zobacz dokumentację",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Uzgodnij organizacje załączników",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Uzgadnianie organizacji załączników…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Wersja {{version}} naprawia załączniki zapisane pod niewłaściwą organizacją. Uruchom uzgadnianie, aby przenieść istniejące załączniki do organizacji rekordu, do którego należą.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Organizacje załączników zostały uzgodnione."
+  "configs.systemStatus.viewDocs": "Zobacz dokumentację"
 }

package/src/modules/configs/lib/upgrade-actions.ts

@@ -1,11 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import * as semver from 'semver'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
-import { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'
-
-const logger = createLogger('configs').child({ component: 'upgrade-actions' })
 
 export type UpgradeActionContext = {
   tenantId: string
@@ -43,25 +38,6 @@ export function compareVersions(a: string, b: string): number {
 }
 
 export const upgradeActions: UpgradeActionDefinition[] = [
-  {
-    id: 'attachments.reconcile-organization',
-    version: '0.6.6',
-    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',
-    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',
-    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',
-    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',
-    async run({ container, em, tenantId }) {
-      const queryEngine = container.resolve('queryEngine') as QueryEngine
-      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })
-      logger.info('attachments organization reconcile completed', {
-        tenantId,
-        scanned: report.scanned,
-        updated: report.updated,
-        unresolved: report.unresolved,
-        skippedVirtual: report.skippedVirtual,
-      })
-    },
-  },
   {
     id: 'customers.seed-interaction-statuses',
     version: '0.6.5',

package/src/modules/customer_accounts/AGENTS.md

@@ -306,17 +306,15 @@ Both link to `/backend/customer_accounts/{sourceEntityId}` for staff review.
 
 | Spot ID | Widget | Purpose |
 |---------|--------|---------|
-| `customers.person` | `account-status` | Alias for hosts requesting the bare `customers.person` entity spot |
-| `crud-form:customers.person` | `account-status` | Shows portal account status on the person v2 detail page (`people-v2/[id]`) |
-| `customers.company` | `company-users` | Alias for hosts requesting the bare `customers.company` entity spot |
-| `crud-form:customers.company` | `company-users` | Shows portal users on the company v2 detail page (`companies-v2/[id]`) |
+| `customers.person` | `account-status` | Shows portal account status on Customers v2 person detail forms |
+| `crud-form:customers.person` | `account-status` | Alias for CrudForm hosts deriving the spot from `customers.person` |
+| `crud-form:customers:customer_person_profile:fields` | `account-status` | Shows portal account status on CRM person detail page |
+| `customers.company` | `company-users` | Shows portal users on Customers v2 company detail forms |
+| `crud-form:customers.company` | `company-users` | Alias for CrudForm hosts deriving the spot from `customers.company` |
+| `crud-form:customers:customer_company_profile:fields` | `company-users` | Shows portal users linked to a CRM company |
 
 Both inject as column 2 groups with priority 200, gated by `customer_accounts.view` feature.
 
-CrudForm derives its spot id as `crud-form:${entityId}` with every `:` normalized to `.`, so a
-registered `crud-form:` key whose entity segment still contains `:` can never be requested by any
-host. Register against the normalized (dot) form only — `injection-table.test.ts` enforces this.
-
 ## Backend Pages
 
 | Path | Purpose |