@open-mercato/core 0.6.6-develop.6551.1.1511bfa890 → 0.6.6

package/src/modules/auth/api/users/route.ts

@@ -22,7 +22,6 @@ import {
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
 import { sql } from 'kysely'
@@ -42,7 +41,6 @@ const querySchema = z.object({
   search: z.string().optional(),
   name: z.string().optional(),
   organizationId: z.string().uuid().optional(),
-  scopeToActiveOrganization: z.boolean().optional(),
   roleIds: z.array(z.string().uuid()).optional(),
 }).passthrough()
 
@@ -182,7 +180,6 @@ export async function GET(req: Request) {
     search: url.searchParams.get('search') || undefined,
     name: url.searchParams.get('name') || undefined,
     organizationId: url.searchParams.get('organizationId') || undefined,
-    scopeToActiveOrganization: parseBooleanFlag(url.searchParams.get('scopeToActiveOrganization') || undefined),
     roleIds: rawRoleIds.length ? rawRoleIds : undefined,
   })
   if (!parsed.success) return NextResponse.json({ items: [], total: 0, totalPages: 1 })
@@ -198,7 +195,7 @@ export async function GET(req: Request) {
   } catch (err) {
     logger.error('Failed to resolve rbac', { err })
   }
-  const { id, page, pageSize, search, name, organizationId, scopeToActiveOrganization, roleIds } = parsed.data
+  const { id, page, pageSize, search, name, organizationId, roleIds } = parsed.data
   const filters: any[] = [{ deletedAt: null }]
   const actorTenantId = auth.tenantId ? String(auth.tenantId) : null
   let effectiveTenantId: string | null = null
@@ -247,12 +244,6 @@ export async function GET(req: Request) {
     ? effectiveSelectedOrganizationId
     : auth.orgId ?? null
   if (organizationId) filters.push({ organizationId })
-  // Recipient/assignee pickers scope to the caller's active organization so they never
-  // suggest users outside it. A message composed here is stamped with the caller's
-  // active org (auth.orgId), and the message detail endpoint enforces
-  // hasOrganizationAccess(scope.organizationId, message.organizationId); scoping the
-  // suggestions to the same org keeps a picked recipient able to open what they were sent.
-  if (scopeToActiveOrganization) filters.push({ organizationId: auth.orgId ?? null })
   const trimmedName = typeof name === 'string' ? name.trim() : ''
   if (trimmedName) {
     const searchPattern = `%${escapeLikePattern(trimmedName)}%`
@@ -629,7 +620,7 @@ export const openApi: OpenApiRouteDoc = {
     GET: {
       summary: 'List users',
       description:
-        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters. Pass scopeToActiveOrganization=1 to restrict results to the caller\'s active organization (used by recipient/assignee pickers so suggestions stay within the org that owns the resulting record).',
+        'Returns users for the effective selected tenant and organization scope. Search matches email, organization name, and role name. Super administrators may scope the response via the topbar context, organization filters, or role filters.',
       query: querySchema,
       responses: [
         { status: 200, description: 'User collection', schema: userListResponseSchema },

package/src/modules/auth/cli.ts

@@ -9,7 +9,6 @@ import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { ensureRoles, setupInitialTenant, ensureDefaultRoleAcls, ensureCustomRoleAcls, OrgSlugExistsError, DerivedUserPasswordRequiredError } from './lib/setup-app'
 import { normalizeTenantId } from './lib/tenantAccess'
-import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
 import { computeEmailHash, emailHashLookupValues } from './lib/emailHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
@@ -72,7 +71,7 @@ const addUser: ModuleCli = {
     })
     await em.persist(u).flush()
     if (rolesCsv) {
-      const names = parseCommaSeparatedList(rolesCsv)
+      const names = rolesCsv.split(',').map(s => s.trim()).filter(Boolean)
       for (const name of names) {
         const role = await resolveTenantScopedRole(em, name, normalizedTenantId)
         const link = em.create(UserRole, { user: u, role })
@@ -494,7 +493,7 @@ const setupApp: ModuleCli = {
     const container = await createRequestContainer()
     const em = container.resolve<EntityManager>('em')
     const roleNames = rolesCsv
-      ? parseCommaSeparatedList(rolesCsv)
+      ? rolesCsv.split(',').map((s) => s.trim()).filter(Boolean)
       : undefined
 
     try {

package/src/modules/configs/i18n/de.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup-Drosselfenster",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatisch Query-Index-Neuindizierungsaufträge bei Lücken planen.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatische Neuindizierung",
-  "configs.systemStatus.viewDocs": "Dokumentation anzeigen",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Anhang-Organisationen abgleichen",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Anhang-Organisationen werden abgeglichen…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} behebt Anhänge, die unter der falschen Organisation gespeichert wurden. Führen Sie den Abgleich aus, um vorhandene Anhänge in die Organisation des zugehörigen Datensatzes zu verschieben.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Anhang-Organisationen abgeglichen."
+  "configs.systemStatus.viewDocs": "Dokumentation anzeigen"
 }

package/src/modules/configs/i18n/en.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Warmup throttle window",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatically schedule query index reindex jobs when gaps appear.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Auto reindex",
-  "configs.systemStatus.viewDocs": "View documentation",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconcile attachment organizations",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciling attachment organizations…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Version {{version}} fixes attachments that were saved under the wrong organization. Run the reconciliation to move existing attachments to the organization of the record they belong to.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Attachment organizations reconciled."
+  "configs.systemStatus.viewDocs": "View documentation"
 }

package/src/modules/configs/i18n/es.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Ventana de limitación del calentamiento",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Programar automáticamente trabajos de reindexación cuando se detecten brechas.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Reindexación automática",
-  "configs.systemStatus.viewDocs": "Ver documentación",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Reconciliar organizaciones de adjuntos",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Reconciliando organizaciones de adjuntos…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "La versión {{version}} corrige los adjuntos guardados en la organización incorrecta. Ejecuta la reconciliación para mover los adjuntos existentes a la organización del registro al que pertenecen.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Organizaciones de adjuntos reconciliadas."
+  "configs.systemStatus.viewDocs": "Ver documentación"
 }

package/src/modules/configs/i18n/pl.json

@@ -189,9 +189,5 @@
   "configs.systemStatus.variables.queryIndexWarmupThrottleMs.label": "Okno throttlingu rozgrzewki",
   "configs.systemStatus.variables.scheduleAutoReindex.description": "Automatycznie uruchamia przebudowę indeksu zapytań, gdy wykryte zostaną luki.",
   "configs.systemStatus.variables.scheduleAutoReindex.label": "Automatyczna przebudowa indeksu",
-  "configs.systemStatus.viewDocs": "Zobacz dokumentację",
-  "configs.upgrades.attachmentsOrgReconcile.cta": "Uzgodnij organizacje załączników",
-  "configs.upgrades.attachmentsOrgReconcile.loading": "Uzgadnianie organizacji załączników…",
-  "configs.upgrades.attachmentsOrgReconcile.message": "Wersja {{version}} naprawia załączniki zapisane pod niewłaściwą organizacją. Uruchom uzgadnianie, aby przenieść istniejące załączniki do organizacji rekordu, do którego należą.",
-  "configs.upgrades.attachmentsOrgReconcile.success": "Organizacje załączników zostały uzgodnione."
+  "configs.systemStatus.viewDocs": "Zobacz dokumentację"
 }

package/src/modules/configs/lib/upgrade-actions.ts

@@ -1,11 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import * as semver from 'semver'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
-import { reconcileAttachmentOrganizations } from '@open-mercato/core/modules/attachments/lib/reconcileOrganization'
-
-const logger = createLogger('configs').child({ component: 'upgrade-actions' })
 
 export type UpgradeActionContext = {
   tenantId: string
@@ -43,25 +38,6 @@ export function compareVersions(a: string, b: string): number {
 }
 
 export const upgradeActions: UpgradeActionDefinition[] = [
-  {
-    id: 'attachments.reconcile-organization',
-    version: '0.6.6',
-    messageKey: 'configs.upgrades.attachmentsOrgReconcile.message',
-    ctaKey: 'configs.upgrades.attachmentsOrgReconcile.cta',
-    successKey: 'configs.upgrades.attachmentsOrgReconcile.success',
-    loadingKey: 'configs.upgrades.attachmentsOrgReconcile.loading',
-    async run({ container, em, tenantId }) {
-      const queryEngine = container.resolve('queryEngine') as QueryEngine
-      const report = await reconcileAttachmentOrganizations({ em, queryEngine, tenantId })
-      logger.info('attachments organization reconcile completed', {
-        tenantId,
-        scanned: report.scanned,
-        updated: report.updated,
-        unresolved: report.unresolved,
-        skippedVirtual: report.skippedVirtual,
-      })
-    },
-  },
   {
     id: 'customers.seed-interaction-statuses',
     version: '0.6.5',

package/src/modules/customer_accounts/AGENTS.md

@@ -306,17 +306,15 @@ Both link to `/backend/customer_accounts/{sourceEntityId}` for staff review.
 
 | Spot ID | Widget | Purpose |
 |---------|--------|---------|
-| `customers.person` | `account-status` | Alias for hosts requesting the bare `customers.person` entity spot |
-| `crud-form:customers.person` | `account-status` | Shows portal account status on the person v2 detail page (`people-v2/[id]`) |
-| `customers.company` | `company-users` | Alias for hosts requesting the bare `customers.company` entity spot |
-| `crud-form:customers.company` | `company-users` | Shows portal users on the company v2 detail page (`companies-v2/[id]`) |
+| `customers.person` | `account-status` | Shows portal account status on Customers v2 person detail forms |
+| `crud-form:customers.person` | `account-status` | Alias for CrudForm hosts deriving the spot from `customers.person` |
+| `crud-form:customers:customer_person_profile:fields` | `account-status` | Shows portal account status on CRM person detail page |
+| `customers.company` | `company-users` | Shows portal users on Customers v2 company detail forms |
+| `crud-form:customers.company` | `company-users` | Alias for CrudForm hosts deriving the spot from `customers.company` |
+| `crud-form:customers:customer_company_profile:fields` | `company-users` | Shows portal users linked to a CRM company |
 
 Both inject as column 2 groups with priority 200, gated by `customer_accounts.view` feature.
 
-CrudForm derives its spot id as `crud-form:${entityId}` with every `:` normalized to `.`, so a
-registered `crud-form:` key whose entity segment still contains `:` can never be requested by any
-host. Register against the normalized (dot) form only — `injection-table.test.ts` enforces this.
-
 ## Backend Pages
 
 | Path | Purpose |

package/src/modules/customer_accounts/api/admin/roles/[id]/acl.ts

@@ -49,7 +49,6 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId,
-    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {

package/src/modules/customer_accounts/api/admin/roles/[id].ts

@@ -36,7 +36,6 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -95,7 +94,6 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -129,11 +127,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault
   if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable
 
-  await em.nativeUpdate(CustomerRole, {
-    id: role.id,
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  }, updates)
+  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)
 
   void emitCustomerAccountsEvent('customer_accounts.role.updated', {
     id: role.id,
@@ -163,7 +157,6 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
-    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -198,15 +191,8 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })
   }
 
-  await em.nativeUpdate(CustomerRole, {
-    id: role.id,
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  }, { deletedAt: new Date() })
-  await em.nativeUpdate(CustomerRoleAcl, {
-    role: role.id as any,
-    tenantId: auth.tenantId,
-  }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRoleAcl, { role: role.id as any }, { deletedAt: new Date() })
 
   void emitCustomerAccountsEvent('customer_accounts.role.deleted', {
     id: role.id,

package/src/modules/customer_accounts/api/portal/users/[id]/roles.ts

@@ -60,12 +60,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     ? await findWithDecryption(
         em,
         CustomerRole,
-        {
-          id: { $in: requestedRoleIds },
-          tenantId: auth.tenantId,
-          organizationId: auth.orgId,
-          deletedAt: null,
-        } as any,
+        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -67,12 +67,7 @@ export async function POST(req: Request) {
     ? await findWithDecryption(
         em,
         CustomerRole,
-        {
-          id: { $in: requestedRoleIds },
-          tenantId: auth.tenantId,
-          organizationId: auth.orgId,
-          deletedAt: null,
-        } as any,
+        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -133,7 +133,6 @@ export class CustomerInvitationService {
           {
             id: { $in: roleIds } as any,
             tenantId: invitation.tenantId,
-            organizationId: invitation.organizationId,
             deletedAt: null,
           } as any,
           undefined,

package/src/modules/customer_accounts/services/customerRbacService.ts

@@ -29,9 +29,7 @@ export class CustomerRbacService {
   }
 
   private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {
-    // Keep the authorization query versioned in the key so cache entries created
-    // before scope hardening cannot preserve grants that are no longer valid.
-    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`
+    return `customer_rbac:${userId}:${scope.tenantId}:${scope.organizationId}`
   }
 
   private getUserTag(userId: string): string {
@@ -91,13 +89,8 @@ export class CustomerRbacService {
     // Aggregate role ACLs
     const links = await em.find(CustomerUserRole, {
       user: userId as any,
-      role: {
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        deletedAt: null,
-      },
       deletedAt: null,
-    } as any, { populate: ['role'] })
+    }, { populate: ['role'] })
     const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)
 
     let isPortalAdmin = false

package/src/modules/customer_accounts/widgets/injection-table.ts

@@ -19,8 +19,10 @@ const companyUsersWidget = {
 export const injectionTable: ModuleInjectionTable = {
   'customers.person': [accountStatusWidget],
   'crud-form:customers.person': [accountStatusWidget],
+  'crud-form:customers:customer_person_profile:fields': [accountStatusWidget],
   'customers.company': [companyUsersWidget],
   'crud-form:customers.company': [companyUsersWidget],
+  'crud-form:customers:customer_company_profile:fields': [companyUsersWidget],
   // Step 4.10 — Portal AiChat injection example.
   // Mapped to the portal profile page's `pageAfter('profile')` spot;
   // third-party modules targeting other portal pages can copy this entry.

package/src/modules/customers/backend/customers/companies-v2/[id]/page.tsx

@@ -31,7 +31,6 @@ import type { TagsSectionController } from '@open-mercato/ui/backend/detail'
 import { coerceDisplayName } from '../../../../lib/displayName'
 import { CompanyDetailHeader } from '../../../../components/detail/CompanyDetailHeader'
 import { CompanyDetailTabs, resolveLegacyTab, type CompanyTabId } from '../../../../components/detail/CompanyDetailTabs'
-import { useDealsAccess } from '../../../../components/detail/useDealsAccess'
 import { CompanyKpiBar } from '../../../../components/detail/CompanyKpiBar'
 import { ScheduleActivityDialog, type ScheduleActivityEditData } from '../../../../components/detail/ScheduleActivityDialog'
 import { ChangelogTab } from '../../../../components/detail/ChangelogTab'
@@ -70,7 +69,6 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
   }, [searchParams])
   const [activeTab, setActiveTab] = React.useState<CompanyTabId>(initialTab)
   const [sectionAction, setSectionAction] = React.useState<SectionAction | null>(null)
-  const { canViewDeals, isReady: isDealsAccessReady } = useDealsAccess()
 
   // Form state
   const [isDirty, setIsDirty] = React.useState(false)
@@ -330,14 +328,6 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
     setSectionAction(null)
   }, [activeTab])
 
-  // A `?tab=deals` deep link must not strand users without `customers.deals.view`
-  // on a tab that no longer exists for them. Wait for the granted features to load
-  // so a permitted user is never bounced off the tab mid-fetch.
-  React.useEffect(() => {
-    if (!isDealsAccessReady || canViewDeals) return
-    setActiveTab((current) => (current === 'deals' ? 'people' : current))
-  }, [isDealsAccessReady, canViewDeals])
-
   // Deals scope
   const dealsScope = React.useMemo(
     () => (currentCompanyId ? ({ kind: 'company', entityId: currentCompanyId } as const) : null),
@@ -554,7 +544,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
                   />
                 )}
 
-                {activeTab === 'deals' && canViewDeals && (
+                {activeTab === 'deals' && (
                   <DealsSection
                     scope={dealsScope}
                     emptyLabel={t('customers.companies.detail.empty.deals', 'No deals linked to this company.')}

package/src/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.tsx

@@ -24,13 +24,9 @@ export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.Reac
     map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),
   }
 
-  // Link-based tab row (two routes), so the Tabs primitive (state-driven,
-  // onValueChange) does not fit — real <Link> semantics must stay. Classes
-  // mirror the Tabs underline variant: accent-indigo active border,
-  // shadow-focus halo.
   const baseTab =
-    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:shadow-focus'
-  const activeTab = 'border-b-2 border-accent-indigo font-semibold text-foreground'
+    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2'
+  const activeTab = 'border-b-2 border-foreground font-semibold text-foreground'
   const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'
 
   // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,

package/src/modules/customers/components/detail/CompanyDetailTabs.tsx

@@ -1,9 +1,10 @@
 "use client"
 
 import * as React from 'react'
+import { cn } from '@open-mercato/shared/lib/utils'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
+import { Badge } from '@open-mercato/ui/primitives/badge'
 import {
   Users,
   Handshake,
@@ -13,7 +14,6 @@ import {
   Plus,
 } from 'lucide-react'
 import type { SectionAction } from '@open-mercato/ui/backend/detail'
-import { useDealsAccess } from './useDealsAccess'
 
 export type CompanyTabId =
   | 'people'
@@ -27,7 +27,7 @@ type TabDef = {
   id: CompanyTabId
   label: string
   icon?: React.ReactNode
-  count?: React.ReactNode
+  badge?: React.ReactNode
 }
 
 type CompanyDetailTabsProps = {
@@ -58,9 +58,21 @@ export function resolveLegacyTab(tab: string | null | undefined): CompanyTabId {
   return tab as CompanyTabId
 }
 
-function formatTabCount(count: number): string | number | undefined {
-  if (count <= 0) return undefined
-  return count > 999 ? '999+' : count
+function NewBadge() {
+  return (
+    <span className="ml-1.5 rounded bg-foreground px-1.5 py-0.5 text-overline font-semibold leading-none text-background">
+      NEW
+    </span>
+  )
+}
+
+function CountBadge({ count }: { count: number }) {
+  if (count <= 0) return null
+  return (
+    <span className="ml-1.5 rounded-full bg-muted px-1.5 py-0.5 text-xs font-medium leading-none text-muted-foreground">
+      {count > 999 ? '999+' : count}
+    </span>
+  )
 }
 
 export function CompanyDetailTabs({
@@ -75,7 +87,6 @@ export function CompanyDetailTabs({
   children,
 }: CompanyDetailTabsProps) {
   const t = useT()
-  const { canViewDeals } = useDealsAccess()
 
   const builtInTabs: TabDef[] = React.useMemo(
     () => [
@@ -83,38 +94,34 @@ export function CompanyDetailTabs({
         id: 'people',
         label: t('customers.companies.detail.tabs.people', 'People'),
         icon: <Users className="size-4" />,
-        count: formatTabCount(peopleCount),
+        badge: <CountBadge count={peopleCount} />,
+      },
+      {
+        id: 'deals',
+        label: t('customers.companies.detail.tabs.deals', 'Deals'),
+        icon: <Handshake className="size-4" />,
+        badge: <CountBadge count={dealsCount} />,
       },
-      ...(canViewDeals
-        ? [
-            {
-              id: 'deals' as CompanyTabId,
-              label: t('customers.companies.detail.tabs.deals', 'Deals'),
-              icon: <Handshake className="size-4" />,
-              count: formatTabCount(dealsCount),
-            },
-          ]
-        : []),
       {
         id: 'activity-log',
         label: t('customers.companies.detail.tabs.activityLog', 'Activity log'),
         icon: <Clock className="size-4" />,
-        count: formatTabCount(activitiesCount),
+        badge: <CountBadge count={activitiesCount} />,
       },
       {
         id: 'changelog',
         label: t('customers.companies.detail.tabs.changelog', 'Changelog'),
         icon: <History className="size-4" />,
-        count: 'NEW',
+        badge: <NewBadge />,
       },
       {
         id: 'files',
         label: t('customers.companies.detail.tabs.files', 'Files'),
         icon: <Paperclip className="size-4" />,
-        count: formatTabCount(filesCount),
+        badge: <CountBadge count={filesCount} />,
       },
     ],
-    [t, canViewDeals, peopleCount, dealsCount, activitiesCount, filesCount],
+    [t, peopleCount, dealsCount, activitiesCount, filesCount],
   )
 
   const allTabs: TabDef[] = React.useMemo(
@@ -131,24 +138,33 @@ export function CompanyDetailTabs({
   return (
     <div>
       {/* Tab navigation */}
-      <div className="flex items-end justify-between gap-2 border-b">
-        <Tabs
-          value={activeTab}
-          onValueChange={(value) => onTabChange(value as CompanyTabId)}
-          variant="underline"
-          className="min-w-0 flex-1"
-        >
-          <TabsList
-            aria-label={t('customers.companies.detail.tabs.label', 'Company detail sections')}
-            className="-mb-px w-full overflow-x-auto border-b-0 px-1"
-          >
-            {allTabs.map((tab) => (
-              <TabsTrigger key={tab.id} value={tab.id} leading={tab.icon} count={tab.count}>
+      <div className="flex items-end justify-between gap-2 border-b" role="tablist" aria-label={t('customers.companies.detail.tabs.label', 'Company detail sections')}>
+        <nav className="-mb-px flex flex-1 gap-1 overflow-x-auto px-1">
+          {allTabs.map((tab) => {
+            const isActive = activeTab === tab.id
+            return (
+              <Button
+                key={tab.id}
+                type="button"
+                variant="ghost"
+                size="sm"
+                role="tab"
+                aria-selected={isActive}
+                onClick={() => onTabChange(tab.id)}
+                className={cn(
+                  'h-auto shrink-0 rounded-none border-b-2 px-3 py-2.5 hover:bg-transparent',
+                  isActive
+                    ? 'border-foreground text-foreground font-semibold'
+                    : 'border-transparent text-muted-foreground hover:text-foreground',
+                )}
+              >
+                {tab.icon && <span className="mr-1.5">{tab.icon}</span>}
                 {tab.label}
-              </TabsTrigger>
-            ))}
-          </TabsList>
-        </Tabs>
+                {tab.badge}
+              </Button>
+            )
+          })}
+        </nav>
         {sectionAction ? (
           <Button
             type="button"