@open-mercato/core 0.6.6-develop.6543.1.49fadb4c31 → 0.6.6

package/src/modules/workflows/lib/activity-executor.ts

@@ -929,8 +929,28 @@ export async function executeCallApi(
   // 3. Import the one-time API key helper
   const { withOnetimeApiKey } = await import('../../api_keys/services/apiKeyService')
 
-  // 4. Get EntityManager from container (for correct type)
-  const apiKeyEm = container.resolve<PostgreSqlEntityManager>('em')
+  // 4. Create the one-time API key on an EntityManager that is fully detached
+  //    from the surrounding request/transaction context.
+  //
+  //    CALL_API runs inside `workflowExecutor.executeWorkflow()`, which wraps
+  //    the whole execution in `em.transactional(...)`. The request EM is forked
+  //    with `useContext: true`, so while that transaction is open, EVERY
+  //    operation on the container's `em` — including this API key's
+  //    persist/flush — is transparently redirected to the uncommitted
+  //    transaction fork (MikroORM `getContext()` → `TransactionContext`). The
+  //    key would therefore stay invisible until the transaction commits, but
+  //    the commit cannot happen until this activity returns. The outbound
+  //    self-authenticated `fetch` below opens a SEPARATE DB connection that
+  //    cannot see the uncommitted row, so the internal API responds `401` and
+  //    the activity fails (issue #4202).
+  //
+  //    Forking with `useContext: false` (matching the query_index/webhooks
+  //    isolated-EM convention) gives the key its own pooled connection with
+  //    autocommit, so it is committed and visible to the internal request
+  //    immediately.
+  const apiKeyEm = container
+    .resolve<PostgreSqlEntityManager>('em')
+    .fork({ clear: true, freshEventManager: true, useContext: false }) as PostgreSqlEntityManager
 
   // 5. Resolve the roles that the one-time API key will inherit.
   //

package/src/modules/workflows/lib/find-definition.ts

@@ -80,9 +80,17 @@ export async function findWorkflowDefinition(
   // so disabled code workflows aren't silently executable.
   if (version === undefined && !codeDef.enabled) return null
 
+  return buildVirtualCodeDefinition(codeDef, tenantId, organizationId)
+}
+
+function buildVirtualCodeDefinition(
+  codeDef: NonNullable<ReturnType<typeof getCodeWorkflow>>,
+  tenantId: string,
+  organizationId: string,
+): WorkflowDefinition {
   // Construct a virtual WorkflowDefinition object (not persisted)
   const virtual = new WorkflowDefinition()
-  virtual.id = codeWorkflowUuid(workflowId)
+  virtual.id = codeWorkflowUuid(codeDef.workflowId)
   virtual.workflowId = codeDef.workflowId
   virtual.workflowName = codeDef.workflowName
   virtual.description = codeDef.description ?? null
@@ -98,3 +106,47 @@ export async function findWorkflowDefinition(
 
   return virtual
 }
+
+/**
+ * Resolve a virtual code definition for an already-started instance whose
+ * `definitionId` does not exist in the database.
+ *
+ * Instances started from a virtual code definition persist the deterministic
+ * `codeWorkflowUuid(workflowId)` as their `definitionId`. Runtime handlers
+ * (step/transition/signal/timer/task) load definitions by that id, so without
+ * this fallback an unpersisted code workflow starts but can never advance.
+ *
+ * The UUID equality gate ensures the fallback never substitutes the code
+ * definition for a hard-deleted persisted row: those rows have their own
+ * random UUIDs that can never match the deterministic code UUID.
+ */
+export function resolveCodeDefinitionForInstance(instance: {
+  definitionId: string
+  workflowId: string
+  tenantId: string
+  organizationId: string
+}): WorkflowDefinition | null {
+  const codeDef = getCodeWorkflow(instance.workflowId)
+  if (!codeDef) return null
+  if (codeWorkflowUuid(instance.workflowId) !== instance.definitionId) return null
+  return buildVirtualCodeDefinition(codeDef, instance.tenantId, instance.organizationId)
+}
+
+/**
+ * Find the definition backing a workflow instance: database row by id first,
+ * falling back to the in-memory code registry for instances started from an
+ * unpersisted code definition.
+ */
+export async function findDefinitionForInstance(
+  em: EntityManager,
+  instance: {
+    definitionId: string
+    workflowId: string
+    tenantId: string
+    organizationId: string
+  },
+): Promise<WorkflowDefinition | null> {
+  const dbDef = await em.findOne(WorkflowDefinition, { id: instance.definitionId })
+  if (dbDef) return dbDef
+  return resolveCodeDefinitionForInstance(instance)
+}

package/src/modules/workflows/lib/signal-handler.ts

@@ -13,6 +13,7 @@ import type * as eventLoggerModule from './event-logger'
 import type * as stepHandlerModule from './step-handler'
 import type * as transitionHandlerModule from './transition-handler'
 import type * as workflowExecutorModule from './workflow-executor'
+import { resolveCodeDefinitionForInstance } from './find-definition'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -95,13 +96,13 @@ export async function sendSignal(
   // Branch-scoped signal: a FORKED instance routes the signal to the branch
   // paused at a matching WAIT_FOR_SIGNAL step.
   if (instance.status === 'FORKED') {
-    const branchDefinition = await findOneWithDecryption(
+    const branchDefinition = (await findOneWithDecryption(
       em as PostgreSqlEntityManager,
       WorkflowDefinition,
       { id: instance.definitionId, tenantId: instance.tenantId, organizationId: instance.organizationId, deletedAt: null },
       undefined,
       { tenantId: instance.tenantId, organizationId: instance.organizationId },
-    )
+    )) ?? resolveCodeDefinitionForInstance(instance)
     if (!branchDefinition) {
       throw new SignalError('Workflow definition not found', 'DEFINITION_NOT_FOUND', { definitionId: instance.definitionId })
     }
@@ -173,7 +174,7 @@ export async function sendSignal(
   }
 
   // Load workflow definition with tenant/org scope to check current step
-  const definition = await findOneWithDecryption(
+  const definition = (await findOneWithDecryption(
     em as PostgreSqlEntityManager,
     WorkflowDefinition,
     {
@@ -184,7 +185,7 @@ export async function sendSignal(
     },
     undefined,
     { tenantId: instance.tenantId, organizationId: instance.organizationId },
-  )
+  )) ?? resolveCodeDefinitionForInstance(instance)
   if (!definition) {
     throw new SignalError(
       'Workflow definition not found',

package/src/modules/workflows/lib/step-handler.ts

@@ -13,7 +13,6 @@ import { EntityManager } from '@mikro-orm/core'
 import {
   WorkflowInstance,
   WorkflowBranchInstance,
-  WorkflowDefinition,
   StepInstance,
   UserTask,
   WorkflowEvent,
@@ -22,6 +21,7 @@ import {
 } from '../data/entities'
 import { parseDuration } from './duration'
 import { logWorkflowEvent } from './event-logger'
+import { findDefinitionForInstance } from './find-definition'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -76,9 +76,7 @@ export async function enterStep(
   branch?: WorkflowBranchInstance | null
 ): Promise<StepInstance> {
   // Load workflow definition to get step details
-  const definition = await em.findOne(WorkflowDefinition, {
-    id: instance.definitionId,
-  })
+  const definition = await findDefinitionForInstance(em, instance)
 
   if (!definition) {
     throw new StepExecutionError(
@@ -213,9 +211,7 @@ export async function executeStep(
     const stepInstance = await enterStep(em, instance, stepId, context, branch)
 
     // Load workflow definition to get step configuration
-    const definition = await em.findOne(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (!definition) {
       throw new StepExecutionError(
@@ -359,7 +355,7 @@ async function executeStepByType(
           { stepType, stepId: stepDef.stepId }
         )
       }
-      const definition = await em.findOne(WorkflowDefinition, { id: instance.definitionId })
+      const definition = await findDefinitionForInstance(em, instance)
       if (!definition) {
         throw new StepExecutionError(
           `Workflow definition not found: ${instance.definitionId}`,

package/src/modules/workflows/lib/task-handler.ts

@@ -17,9 +17,9 @@ import {
   WorkflowInstance,
   WorkflowEvent,
   StepInstance,
-  WorkflowDefinition,
 } from '../data/entities'
 import { executeWorkflow } from './workflow-executor'
+import { findDefinitionForInstance } from './find-definition'
 import * as stepHandler from './step-handler'
 import * as transitionHandler from './transition-handler'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -191,9 +191,7 @@ export async function completeUserTask(
   const currentStepId = instance.currentStepId
 
   // Load workflow definition to find transitions
-  const definition = await em.findOne(WorkflowDefinition, {
-    id: instance.definitionId,
-  })
+  const definition = await findDefinitionForInstance(em, instance)
 
   if (!definition) {
     throw new UserTaskError(

package/src/modules/workflows/lib/timer-handler.ts

@@ -14,6 +14,7 @@ import type * as eventLoggerModule from './event-logger'
 import type * as stepHandlerModule from './step-handler'
 import type * as transitionHandlerModule from './transition-handler'
 import type * as workflowExecutorModule from './workflow-executor'
+import { resolveCodeDefinitionForInstance } from './find-definition'
 
 export interface FireTimerOptions {
   instanceId: string
@@ -110,7 +111,7 @@ export async function fireTimer(
     )
   }
 
-  const definition = await findOneWithDecryption(
+  const definition = (await findOneWithDecryption(
     em as PostgreSqlEntityManager,
     WorkflowDefinition,
     {
@@ -121,7 +122,7 @@ export async function fireTimer(
     },
     undefined,
     { tenantId: instance.tenantId, organizationId: instance.organizationId },
-  )
+  )) ?? resolveCodeDefinitionForInstance(instance)
   if (!definition) {
     throw new TimerError(
       'Workflow definition not found',

package/src/modules/workflows/lib/transition-handler.ts

@@ -15,7 +15,6 @@ import type { AwilixContainer } from 'awilix'
 import type { EventBus } from '@open-mercato/events'
 import {
   WorkflowInstance,
-  WorkflowDefinition,
   WorkflowEvent,
 } from '../data/entities'
 import * as ruleEvaluator from '../../business_rules/lib/rule-evaluator'
@@ -23,6 +22,7 @@ import * as ruleEngine from '../../business_rules/lib/rule-engine'
 import * as activityExecutor from './activity-executor'
 import type { ActivityDefinition } from './activity-executor'
 import * as stepHandler from './step-handler'
+import { findDefinitionForInstance } from './find-definition'
 import {
   type ExecutionToken,
   rootToken,
@@ -116,9 +116,7 @@ export async function evaluateTransition(
 
   try {
     // Load workflow definition
-    const definition = await em.findOne(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (!definition) {
       return {
@@ -227,9 +225,7 @@ export async function findValidTransitions(
 ): Promise<TransitionEvaluationResult[]> {
   try {
     // Load workflow definition
-    const definition = await em.findOne(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (!definition) {
       return []
@@ -752,9 +748,7 @@ async function evaluatePreConditions(
 ): Promise<ruleEngine.RuleEngineResult> {
   try {
     // Load workflow definition to get workflow ID
-    const definition = await em.findOne(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (!definition) {
       return {
@@ -881,9 +875,7 @@ async function evaluatePostConditions(
 ): Promise<ruleEngine.RuleEngineResult> {
   try {
     // Load workflow definition to get workflow ID
-    const definition = await em.findOne(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (!definition) {
       return {

package/src/modules/workflows/lib/workflow-executor.ts

@@ -19,7 +19,7 @@ import {
   type WorkflowInstanceStatus,
 } from '../data/entities'
 import { compensateWorkflow } from './compensation-handler'
-import { findWorkflowDefinition } from './find-definition'
+import { findWorkflowDefinition, findDefinitionForInstance } from './find-definition'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -278,9 +278,7 @@ export async function executeWorkflow(
         )
       }
 
-      const definition = await trx.findOne(WorkflowDefinition, {
-        id: instance.definitionId,
-      })
+      const definition = await findDefinitionForInstance(trx, instance)
 
       if (!definition) {
         throw new WorkflowExecutionError(
@@ -614,7 +612,7 @@ export async function completeWorkflow(
 
   // Trigger compensation if workflow failed and has compensatable activities (Phase 8.2)
   if (status === 'FAILED') {
-    const definition = await em.findOne(WorkflowDefinition, { id: instance.definitionId })
+    const definition = await findDefinitionForInstance(em, instance)
 
     if (definition && checkIfCompensationNeeded(definition)) {
       try {
@@ -836,9 +834,14 @@ export async function resumeWorkflowAfterActivities(
       fromStepId: instance.currentStepId,
     })
 
-    const definition = await trx.findOneOrFail(WorkflowDefinition, {
-      id: instance.definitionId,
-    })
+    const definition = await findDefinitionForInstance(trx, instance)
+    if (!definition) {
+      throw new WorkflowExecutionError(
+        `Workflow definition not found: ${instance.definitionId}`,
+        'DEFINITION_NOT_FOUND',
+        { definitionId: instance.definitionId }
+      )
+    }
 
     const step = definition.definition.steps.find(s => s.stepId === pendingTransition.toStepId)
 

package/src/modules/workflows/migrations/Migration20260715120000.ts

@@ -0,0 +1,114 @@
+import { Migration } from '@mikro-orm/migrations'
+
+const LEGACY_WORKFLOW_ID = 'workflows.checkout-demo'
+const LEGACY_WORKFLOW_NAME = 'Checkout with Payment Webhook'
+const LEGACY_ACTIVITY_ID = 'reserve_inventory'
+const LEGACY_ACTIVITY_URL = '{{env.INVENTORY_SERVICE_URL}}/api/inventory/reserve'
+const TRANSITIONS_REPLACED_BY_CODE_DEFINITION = [
+  'cart_to_customer_info',
+  'customer_info_to_payment',
+  'confirmation_to_order',
+] as const
+
+/**
+ * SQL fragment (for the UPDATE `where` clause) that matches ONLY the exact
+ * legacy checkout seed: workflow id, name, version, and the presence of the
+ * obsolete `reserve_inventory` `CALL_WEBHOOK` activity with its exact env-based
+ * URL. The match is intentionally strict so the repair never touches a row that
+ * is not the known-broken seed. A tenant whose persisted row diverges from this
+ * fingerprint (renamed, re-versioned, or a different webhook URL) is left
+ * untouched — the trade-off is safety over coverage for an unknown variant.
+ */
+export function legacyCheckoutPredicate(): string {
+  return `
+    "wf"."workflow_id" = '${LEGACY_WORKFLOW_ID}'
+    and "wf"."workflow_name" = '${LEGACY_WORKFLOW_NAME}'
+    and "wf"."version" = 1
+    and exists (
+      select 1
+      from jsonb_array_elements(coalesce("wf"."definition"->'transitions', '[]'::jsonb)) as "transition"("value")
+      cross join lateral jsonb_array_elements(coalesce("transition"."value"->'activities', '[]'::jsonb)) as "activity"("value")
+      where "activity"."value"->>'activityId' = '${LEGACY_ACTIVITY_ID}'
+        and "activity"."value"->>'activityType' = 'CALL_WEBHOOK'
+        and "activity"."value"#>>'{config,url}' = '${LEGACY_ACTIVITY_URL}'
+    )
+  `.trim()
+}
+
+/**
+ * The exact UPDATE the migration runs. Exported so the DB-level regression test
+ * (`__integration__/TC-WF-031`) executes the identical SQL against Postgres,
+ * making the jsonb transformation itself — not just its rendered string —
+ * the thing under test.
+ *
+ * It rebuilds the `transitions` array in original order, dropping the
+ * `activities` key from exactly the three transitions the maintained code
+ * definition made side-effect-free. All other keys (e.g. `preConditions`) and
+ * all other transitions — including `confirmation_to_end`, whose remaining
+ * activities are internal (`CALL_API`/`SEND_EMAIL`/`EMIT_EVENT`) and never trip
+ * the outbound URL guard — are preserved verbatim.
+ */
+export function buildLegacyCheckoutRepairSql(): string {
+  const strippedTransitionList = TRANSITIONS_REPLACED_BY_CODE_DEFINITION
+    .map((id) => `'${id}'`)
+    .join(', ')
+  return `
+    update "workflow_definitions" as "wf"
+    set "definition" = jsonb_set(
+          "wf"."definition",
+          '{transitions}',
+          coalesce(
+            (
+              select jsonb_agg(
+                case
+                  when "transition"."value"->>'transitionId' in (${strippedTransitionList})
+                    then "transition"."value" - 'activities'
+                  else "transition"."value"
+                end
+                order by "transition"."ordinality"
+              )
+              from jsonb_array_elements(
+                coalesce("wf"."definition"->'transitions', '[]'::jsonb)
+              ) with ordinality as "transition"("value", "ordinality")
+            ),
+            '[]'::jsonb
+          )
+        ),
+        "updated_at" = current_timestamp
+    where "wf"."code_workflow_id" is null
+      and "wf"."deleted_at" is null
+      and ${legacyCheckoutPredicate()};
+  `.trim()
+}
+
+/**
+ * Repairs the former seeded checkout demo after it was renamed to the same ID
+ * as the code-defined workflow. The DB-first lookup shadows the current code
+ * definition, including its obsolete external inventory webhook.
+ *
+ * The persisted row must remain active because historical and in-flight
+ * workflow instances reference it by definition_id — a random UUID the
+ * code-registry fallback in find-definition.ts deliberately never substitutes.
+ * The migration removes the activity arrays from the three transitions that
+ * the maintained code definition intentionally made side-effect-free,
+ * preserving the row and all instance references while keeping the demo
+ * self-contained. (Fresh installs never had this row; they execute the virtual
+ * code definition directly via findDefinitionForInstance.)
+ *
+ * `confirmation_to_end` is deliberately NOT rebuilt: unlike the three stripped
+ * transitions it still holds activities in the maintained code definition, and
+ * its legacy-only extra (`emit_order_completed`, an internal `EMIT_EVENT`) is
+ * harmless — it emits no external request, so leaving it costs nothing and
+ * avoids fragile per-activity surgery that could re-introduce a failure.
+ */
+export class Migration20260715120000 extends Migration {
+  override async up(): Promise<void> {
+    this.addSql(buildLegacyCheckoutRepairSql())
+  }
+
+  override async down(): Promise<void> {
+    // Forward-only data repair. The removed demo-only activity payloads cannot
+    // be reconstructed safely, and restoring obsolete external webhooks would
+    // re-open issue #4179.
+  }
+}

package/src/modules/workflows/migrations/Migration20260716120000.ts

@@ -0,0 +1,57 @@
+import { Migration } from '@mikro-orm/migrations'
+
+const CODE_WORKFLOW_ID = 'workflows.checkout-demo'
+
+/**
+ * Retires the persisted checkout-demo seed rows so runtime resolves the
+ * maintained CODE definition instead (issue #4211).
+ *
+ * Background: `workflows.checkout-demo` is now code-defined
+ * (`packages/core/src/modules/workflows/workflows.ts`), and only the code
+ * definition forwards the cart's line items + shipping/tax adjustments to
+ * `POST /api/sales/orders`. But existing tenants still carry a persisted
+ * `workflow_definitions` row from the old seed — originally seeded under ids
+ * like `checkout_simple_v1` / names like `Simple Checkout Flow` and later
+ * `Checkout with Payment Webhook`, then renamed to `workflows.checkout-demo`
+ * by Migration20260428102318. Its `create_order` body never sent `lines`, and
+ * because `findWorkflowDefinition` resolves the DB row first, that stale row
+ * SHADOWS the code definition — so orders come out with zero line items and
+ * $0.00 totals. Patching the persisted body is unreliable: the seed's name and
+ * body shape vary across historical versions, so a fingerprint on either misses
+ * whole cohorts of tenants (the defect QA hit).
+ *
+ * Instead, soft-delete the seeded rows. This is body/name-agnostic, so it fixes
+ * every historical seed variant:
+ *   - New instances: `findWorkflowDefinition` filters `deleted_at IS NULL`, so
+ *     the retired row is skipped and the code definition is used (correct body).
+ *   - In-flight instances: `findDefinitionForInstance` loads the definition by
+ *     `id` with no soft-delete filter (WorkflowDefinition has no global filter),
+ *     so instances that reference the row keep resolving and advancing.
+ *
+ * Scope is limited to `code_workflow_id IS NULL` rows — user customizations of
+ * the code definition set `code_workflow_id` and MUST NOT be retired. The
+ * `deleted_at IS NULL` guard makes the migration idempotent.
+ */
+export function buildRetireSeededCheckoutDemoSql(): string {
+  return `
+    update "workflow_definitions" as "wf"
+    set "deleted_at" = current_timestamp,
+        "updated_at" = current_timestamp
+    where "wf"."workflow_id" = '${CODE_WORKFLOW_ID}'
+      and "wf"."code_workflow_id" is null
+      and "wf"."deleted_at" is null;
+  `.trim()
+}
+
+export class Migration20260716120000 extends Migration {
+  override async up(): Promise<void> {
+    this.addSql(buildRetireSeededCheckoutDemoSql())
+  }
+
+  override async down(): Promise<void> {
+    // Forward-only. Restoring `deleted_at = null` would re-shadow the maintained
+    // code definition with the stale seed body and re-introduce zero-line orders
+    // (#4211). The code definition supersedes the seed, so there is nothing to
+    // restore.
+  }
+}

package/src/modules/workflows/workflows.ts

@@ -239,6 +239,8 @@ const checkoutDemo = defineWorkflow({
               customerEntityId: '{{context.customer.id}}',
               currencyCode: '{{context.cart.currency}}',
               placedAt: '{{now}}',
+              lines: '{{context.cart.orderLines}}',
+              adjustments: '{{context.cart.orderAdjustments}}',
               grandTotalGrossAmount: '{{context.cart.total}}',
             },
             validateTenantMatch: true,

package/dist/modules/attachments/lib/reconcileOrganization.js

@@ -1,110 +0,0 @@
-import { createLogger } from "@open-mercato/shared/lib/logger";
-import { Attachment } from "../data/entities.js";
-const logger = createLogger("attachments").child({ component: "reconcileOrganization" });
-const LIBRARY_ENTITY_ID = "attachments:library";
-const DEFAULT_BATCH_SIZE = 500;
-function readParentOrganizationId(record) {
-  const raw = record["organization_id"] ?? record["organizationId"];
-  if (typeof raw === "string" && raw.trim().length) return raw.trim();
-  return null;
-}
-function ensureBucket(report, entityId) {
-  const existing = report.byEntity[entityId];
-  if (existing) return existing;
-  const bucket = { scanned: 0, updated: 0, unresolved: 0 };
-  report.byEntity[entityId] = bucket;
-  return bucket;
-}
-async function reconcileAttachmentOrganizations(opts) {
-  const { em, queryEngine, tenantId } = opts;
-  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE;
-  const report = {
-    scanned: 0,
-    updated: 0,
-    unresolved: 0,
-    skippedVirtual: 0,
-    byEntity: {}
-  };
-  const rows = await em.getConnection().execute(
-    "select id, entity_id, record_id, organization_id from attachments where tenant_id = ?",
-    [tenantId]
-  );
-  report.scanned = rows.length;
-  if (!rows.length) return report;
-  const groups = /* @__PURE__ */ new Map();
-  for (const row of rows) {
-    if (!row.id || !row.entity_id || !row.record_id) continue;
-    const list = groups.get(row.entity_id) ?? [];
-    list.push(row);
-    groups.set(row.entity_id, list);
-  }
-  const pendingUpdates = [];
-  for (const [entityId, group] of groups) {
-    const bucket = ensureBucket(report, entityId);
-    bucket.scanned += group.length;
-    if (entityId === LIBRARY_ENTITY_ID) {
-      report.skippedVirtual += group.length;
-      continue;
-    }
-    const recordIds = Array.from(
-      new Set(group.map((row) => row.record_id).filter((value) => !!value))
-    );
-    const parentOrgByRecordId = /* @__PURE__ */ new Map();
-    let resolvable = true;
-    for (let index = 0; index < recordIds.length; index += batchSize) {
-      const chunk = recordIds.slice(index, index + batchSize);
-      try {
-        const result = await queryEngine.query(entityId, {
-          fields: ["id", "organization_id"],
-          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },
-          tenantId,
-          withDeleted: true,
-          page: { pageSize: Math.max(chunk.length, 1) }
-        });
-        for (const item of result.items ?? []) {
-          const record = item;
-          const recordId = record.id != null ? String(record.id) : null;
-          if (!recordId) continue;
-          parentOrgByRecordId.set(recordId, readParentOrganizationId(record));
-        }
-      } catch (error) {
-        resolvable = false;
-        logger.warn("org reconcile: cannot resolve parent organization for entity", {
-          entityId,
-          error
-        });
-        break;
-      }
-    }
-    if (!resolvable) {
-      bucket.unresolved += group.length;
-      report.unresolved += group.length;
-      continue;
-    }
-    for (const row of group) {
-      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null;
-      if (!target) {
-        bucket.unresolved += 1;
-        report.unresolved += 1;
-        continue;
-      }
-      if ((row.organization_id ?? null) === target) continue;
-      pendingUpdates.push({ id: row.id, organizationId: target });
-      bucket.updated += 1;
-      report.updated += 1;
-    }
-  }
-  for (let index = 0; index < pendingUpdates.length; index += batchSize) {
-    const chunk = pendingUpdates.slice(index, index + batchSize);
-    for (const update of chunk) {
-      const reference = em.getReference(Attachment, update.id);
-      reference.organizationId = update.organizationId;
-    }
-    await em.flush();
-  }
-  return report;
-}
-export {
-  reconcileAttachmentOrganizations
-};
-//# sourceMappingURL=reconcileOrganization.js.map

package/dist/modules/attachments/lib/reconcileOrganization.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../src/modules/attachments/lib/reconcileOrganization.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { Attachment } from '../data/entities'\n\nconst logger = createLogger('attachments').child({ component: 'reconcileOrganization' })\n\n/**\n * Virtual entity id for library attachments \u2014 these are not attached to a\n * parent record that owns an organization, so there is nothing to reconcile\n * against. They are counted as skipped rather than unresolved.\n */\nconst LIBRARY_ENTITY_ID = 'attachments:library'\n\nconst DEFAULT_BATCH_SIZE = 500\n\nexport type AttachmentOrgReconcileEntityStat = {\n  scanned: number\n  updated: number\n  unresolved: number\n}\n\nexport type AttachmentOrgReconcileReport = {\n  scanned: number\n  updated: number\n  unresolved: number\n  skippedVirtual: number\n  byEntity: Record<string, AttachmentOrgReconcileEntityStat>\n}\n\ntype AttachmentScanRow = {\n  id: string\n  entity_id: string | null\n  record_id: string | null\n  organization_id: string | null\n}\n\nfunction readParentOrganizationId(record: Record<string, unknown>): string | null {\n  const raw = record['organization_id'] ?? record['organizationId']\n  if (typeof raw === 'string' && raw.trim().length) return raw.trim()\n  return null\n}\n\nfunction ensureBucket(\n  report: AttachmentOrgReconcileReport,\n  entityId: string,\n): AttachmentOrgReconcileEntityStat {\n  const existing = report.byEntity[entityId]\n  if (existing) return existing\n  const bucket: AttachmentOrgReconcileEntityStat = { scanned: 0, updated: 0, unresolved: 0 }\n  report.byEntity[entityId] = bucket\n  return bucket\n}\n\n/**\n * Reconcile the `organization_id` of existing attachments to the organization\n * of the record they are attached to.\n *\n * Background (#3765): before the upload route became selected-organization\n * aware, a multi-org admin who switched the header organization uploaded files\n * that were silently stored under their *home* organization instead of the\n * selected one (the organization of the parent record). Those rows are now\n * invisible to org-scoped reads and stay orphaned. This heals them forward.\n *\n * The parent record's organization is the ground truth: an attachment is not\n * distinguishable from a legitimately home-org one by looking at the attachment\n * alone. Parent organizations are resolved generically through the Query Engine\n * by `entityId` (works for both base and custom entities, tenant-scoped and\n * organization-agnostic so the parent's real org is returned regardless of\n * which org the caller sits in) \u2014 the same mechanism the attachments module\n * already uses to enrich assignment details.\n *\n * The reconciliation is:\n * - idempotent \u2014 rows already matching their parent are left untouched;\n * - conservative \u2014 when the parent org cannot be resolved (unregistered\n *   entity id, hard-deleted parent, parent without an org column) the row is\n *   counted as `unresolved` and left as-is rather than guessed at;\n * - tenant-scoped \u2014 it reconciles every attachment in the tenant across all\n *   organizations (the whole point is moving rows between orgs).\n *\n * Writes go through the passed `EntityManager` (which the caller runs inside a\n * transaction) so the whole reconciliation commits atomically.\n */\nexport async function reconcileAttachmentOrganizations(opts: {\n  em: EntityManager\n  queryEngine: QueryEngine\n  tenantId: string\n  batchSize?: number\n}): Promise<AttachmentOrgReconcileReport> {\n  const { em, queryEngine, tenantId } = opts\n  const batchSize = opts.batchSize && opts.batchSize > 0 ? opts.batchSize : DEFAULT_BATCH_SIZE\n  const report: AttachmentOrgReconcileReport = {\n    scanned: 0,\n    updated: 0,\n    unresolved: 0,\n    skippedVirtual: 0,\n    byEntity: {},\n  }\n\n  const rows = (await em.getConnection().execute(\n    'select id, entity_id, record_id, organization_id from attachments where tenant_id = ?',\n    [tenantId],\n  )) as AttachmentScanRow[]\n  report.scanned = rows.length\n  if (!rows.length) return report\n\n  const groups = new Map<string, AttachmentScanRow[]>()\n  for (const row of rows) {\n    if (!row.id || !row.entity_id || !row.record_id) continue\n    const list = groups.get(row.entity_id) ?? []\n    list.push(row)\n    groups.set(row.entity_id, list)\n  }\n\n  const pendingUpdates: Array<{ id: string; organizationId: string }> = []\n\n  for (const [entityId, group] of groups) {\n    const bucket = ensureBucket(report, entityId)\n    bucket.scanned += group.length\n\n    if (entityId === LIBRARY_ENTITY_ID) {\n      report.skippedVirtual += group.length\n      continue\n    }\n\n    const recordIds = Array.from(\n      new Set(group.map((row) => row.record_id).filter((value): value is string => !!value)),\n    )\n    const parentOrgByRecordId = new Map<string, string | null>()\n    let resolvable = true\n\n    for (let index = 0; index < recordIds.length; index += batchSize) {\n      const chunk = recordIds.slice(index, index + batchSize)\n      try {\n        const result = await queryEngine.query(entityId as any, {\n          fields: ['id', 'organization_id'],\n          filters: { id: chunk.length === 1 ? { $eq: chunk[0] } : { $in: chunk } },\n          tenantId,\n          withDeleted: true,\n          page: { pageSize: Math.max(chunk.length, 1) },\n        })\n        for (const item of result.items ?? []) {\n          const record = item as Record<string, unknown>\n          const recordId = record.id != null ? String(record.id) : null\n          if (!recordId) continue\n          parentOrgByRecordId.set(recordId, readParentOrganizationId(record))\n        }\n      } catch (error) {\n        resolvable = false\n        logger.warn('org reconcile: cannot resolve parent organization for entity', {\n          entityId,\n          error,\n        })\n        break\n      }\n    }\n\n    if (!resolvable) {\n      bucket.unresolved += group.length\n      report.unresolved += group.length\n      continue\n    }\n\n    for (const row of group) {\n      const target = row.record_id ? parentOrgByRecordId.get(row.record_id) : null\n      if (!target) {\n        bucket.unresolved += 1\n        report.unresolved += 1\n        continue\n      }\n      if ((row.organization_id ?? null) === target) continue\n      pendingUpdates.push({ id: row.id, organizationId: target })\n      bucket.updated += 1\n      report.updated += 1\n    }\n  }\n\n  for (let index = 0; index < pendingUpdates.length; index += batchSize) {\n    const chunk = pendingUpdates.slice(index, index + batchSize)\n    for (const update of chunk) {\n      const reference = em.getReference(Attachment, update.id)\n      reference.organizationId = update.organizationId\n    }\n    await em.flush()\n  }\n\n  return report\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAE7B,SAAS,kBAAkB;AAE3B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAOvF,MAAM,oBAAoB;AAE1B,MAAM,qBAAqB;AAuB3B,SAAS,yBAAyB,QAAgD;AAChF,QAAM,MAAM,OAAO,iBAAiB,KAAK,OAAO,gBAAgB;AAChE,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,OAAQ,QAAO,IAAI,KAAK;AAClE,SAAO;AACT;AAEA,SAAS,aACP,QACA,UACkC;AAClC,QAAM,WAAW,OAAO,SAAS,QAAQ;AACzC,MAAI,SAAU,QAAO;AACrB,QAAM,SAA2C,EAAE,SAAS,GAAG,SAAS,GAAG,YAAY,EAAE;AACzF,SAAO,SAAS,QAAQ,IAAI;AAC5B,SAAO;AACT;AA+BA,eAAsB,iCAAiC,MAKb;AACxC,QAAM,EAAE,IAAI,aAAa,SAAS,IAAI;AACtC,QAAM,YAAY,KAAK,aAAa,KAAK,YAAY,IAAI,KAAK,YAAY;AAC1E,QAAM,SAAuC;AAAA,IAC3C,SAAS;AAAA,IACT,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,UAAU,CAAC;AAAA,EACb;AAEA,QAAM,OAAQ,MAAM,GAAG,cAAc,EAAE;AAAA,IACrC;AAAA,IACA,CAAC,QAAQ;AAAA,EACX;AACA,SAAO,UAAU,KAAK;AACtB,MAAI,CAAC,KAAK,OAAQ,QAAO;AAEzB,QAAM,SAAS,oBAAI,IAAiC;AACpD,aAAW,OAAO,MAAM;AACtB,QAAI,CAAC,IAAI,MAAM,CAAC,IAAI,aAAa,CAAC,IAAI,UAAW;AACjD,UAAM,OAAO,OAAO,IAAI,IAAI,SAAS,KAAK,CAAC;AAC3C,SAAK,KAAK,GAAG;AACb,WAAO,IAAI,IAAI,WAAW,IAAI;AAAA,EAChC;AAEA,QAAM,iBAAgE,CAAC;AAEvE,aAAW,CAAC,UAAU,KAAK,KAAK,QAAQ;AACtC,UAAM,SAAS,aAAa,QAAQ,QAAQ;AAC5C,WAAO,WAAW,MAAM;AAExB,QAAI,aAAa,mBAAmB;AAClC,aAAO,kBAAkB,MAAM;AAC/B;AAAA,IACF;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB,IAAI,IAAI,MAAM,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK,CAAC;AAAA,IACvF;AACA,UAAM,sBAAsB,oBAAI,IAA2B;AAC3D,QAAI,aAAa;AAEjB,aAAS,QAAQ,GAAG,QAAQ,UAAU,QAAQ,SAAS,WAAW;AAChE,YAAM,QAAQ,UAAU,MAAM,OAAO,QAAQ,SAAS;AACtD,UAAI;AACF,cAAM,SAAS,MAAM,YAAY,MAAM,UAAiB;AAAA,UACtD,QAAQ,CAAC,MAAM,iBAAiB;AAAA,UAChC,SAAS,EAAE,IAAI,MAAM,WAAW,IAAI,EAAE,KAAK,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,MAAM,EAAE;AAAA,UACvE;AAAA,UACA,aAAa;AAAA,UACb,MAAM,EAAE,UAAU,KAAK,IAAI,MAAM,QAAQ,CAAC,EAAE;AAAA,QAC9C,CAAC;AACD,mBAAW,QAAQ,OAAO,SAAS,CAAC,GAAG;AACrC,gBAAM,SAAS;AACf,gBAAM,WAAW,OAAO,MAAM,OAAO,OAAO,OAAO,EAAE,IAAI;AACzD,cAAI,CAAC,SAAU;AACf,8BAAoB,IAAI,UAAU,yBAAyB,MAAM,CAAC;AAAA,QACpE;AAAA,MACF,SAAS,OAAO;AACd,qBAAa;AACb,eAAO,KAAK,gEAAgE;AAAA,UAC1E;AAAA,UACA;AAAA,QACF,CAAC;AACD;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,YAAY;AACf,aAAO,cAAc,MAAM;AAC3B,aAAO,cAAc,MAAM;AAC3B;AAAA,IACF;AAEA,eAAW,OAAO,OAAO;AACvB,YAAM,SAAS,IAAI,YAAY,oBAAoB,IAAI,IAAI,SAAS,IAAI;AACxE,UAAI,CAAC,QAAQ;AACX,eAAO,cAAc;AACrB,eAAO,cAAc;AACrB;AAAA,MACF;AACA,WAAK,IAAI,mBAAmB,UAAU,OAAQ;AAC9C,qBAAe,KAAK,EAAE,IAAI,IAAI,IAAI,gBAAgB,OAAO,CAAC;AAC1D,aAAO,WAAW;AAClB,aAAO,WAAW;AAAA,IACpB;AAAA,EACF;AAEA,WAAS,QAAQ,GAAG,QAAQ,eAAe,QAAQ,SAAS,WAAW;AACrE,UAAM,QAAQ,eAAe,MAAM,OAAO,QAAQ,SAAS;AAC3D,eAAW,UAAU,OAAO;AAC1B,YAAM,YAAY,GAAG,aAAa,YAAY,OAAO,EAAE;AACvD,gBAAU,iBAAiB,OAAO;AAAA,IACpC;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,SAAO;AACT;",
-  "names": []
-}