@open-mercato/core 0.6.7-develop.6653.1.b5bc7194a0 → 0.6.7-develop.6661.1.0043ed1d03

package/src/modules/query_index/lib/subscriber-scope.ts

@@ -1,11 +1,28 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
+import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
+import { resolveRegisteredEntityTableName } from '@open-mercato/shared/lib/query/engine'
 
 export type QueryIndexScope = {
   tenantId: string | null
   organizationId: string | null
 }
 
+export type QueryIndexSourceMetadata = {
+  table: string
+  organizationColumn: string | null
+  tenantColumn: string | null
+}
+
+export type QueryIndexSourceScope =
+  | { kind: 'global' }
+  | { kind: 'missing' }
+  | { kind: 'row'; scope: QueryIndexScope }
+
+type QueryIndexEntityMetadata = {
+  tableName?: unknown
+  properties?: Record<string, { fieldNames?: unknown }>
+}
+
 export class QueryIndexScopeError extends Error {
   constructor(message: string) {
     super(message)
@@ -18,7 +35,7 @@ type ResolveRecordScopeInput = {
   payloadOrganizationId: string | null | undefined
   hasPayloadTenantId: boolean
   hasPayloadOrganizationId: boolean
-  rowScope: QueryIndexScope | null
+  sourceScope: QueryIndexSourceScope
 }
 
 type ResolveReindexScopeInput = {
@@ -27,26 +44,66 @@ type ResolveReindexScopeInput = {
   allowAllTenants?: boolean
 }
 
-export async function loadQueryIndexRowScope(
+export function resolveQueryIndexSourceMetadata(
   em: EntityManager,
   entityType: string,
-  recordId: string
-): Promise<QueryIndexScope | null> {
+): QueryIndexSourceMetadata {
+  const registeredEntityIds = Object.values(getEntityIds(false)).flatMap((moduleEntities) => Object.values(moduleEntities ?? {}))
+  if (!registeredEntityIds.includes(entityType)) {
+    throw new QueryIndexScopeError(`Query index entity type is not registered: ${entityType}`)
+  }
+
+  const table = resolveRegisteredEntityTableName(em, entityType as never)
+  if (!table) {
+    throw new QueryIndexScopeError(`Query index entity type has no registered ORM table: ${entityType}`)
+  }
+
+  const registry = em.getMetadata?.()
+  const allMetadataRaw = typeof registry?.getAll === 'function' ? registry.getAll() : null
+  const allMetadata: QueryIndexEntityMetadata[] = Array.isArray(allMetadataRaw)
+    ? allMetadataRaw as QueryIndexEntityMetadata[]
+    : allMetadataRaw instanceof Map
+      ? Array.from(allMetadataRaw.values()) as QueryIndexEntityMetadata[]
+      : Object.values(allMetadataRaw ?? {}) as QueryIndexEntityMetadata[]
+  const metadata = allMetadata.find((candidate) => String(candidate.tableName ?? '') === table)
+  if (!metadata) {
+    throw new QueryIndexScopeError(`Query index entity metadata was not found for table: ${table}`)
+  }
+
+  return {
+    table,
+    organizationColumn: resolveScopeColumn(metadata, 'organizationId', table),
+    tenantColumn: resolveScopeColumn(metadata, 'tenantId', table),
+  }
+}
+
+export async function loadQueryIndexRowScope(
+  em: EntityManager,
+  source: QueryIndexSourceMetadata,
+  recordId: string,
+): Promise<QueryIndexSourceScope> {
+  if (!source.organizationColumn && !source.tenantColumn) {
+    return { kind: 'global' }
+  }
+
   const db = em.getKysely<any>()
-  const table = resolveEntityTableName(em, entityType)
+  const columns = [source.organizationColumn, source.tenantColumn].filter((column): column is string => column !== null)
   const row = await db
-    .selectFrom(table as any)
-    .select(['organization_id' as any, 'tenant_id' as any])
+    .selectFrom(source.table as any)
+    .select(columns as any)
     .where('id' as any, '=', recordId)
-    .executeTakeFirst() as { organization_id: string | null; tenant_id: string | null } | undefined
+    .executeTakeFirst() as Record<string, string | null | undefined> | undefined
 
   if (!row) {
-    return null
+    return { kind: 'missing' }
   }
 
   return {
-    organizationId: row.organization_id ?? null,
-    tenantId: row.tenant_id ?? null,
+    kind: 'row',
+    scope: {
+      organizationId: source.organizationColumn ? row[source.organizationColumn] ?? null : null,
+      tenantId: source.tenantColumn ? row[source.tenantColumn] ?? null : null,
+    },
   }
 }
 
@@ -56,10 +113,23 @@ export function resolveQueryIndexRecordScope(input: ResolveRecordScopeInput): Qu
     payloadOrganizationId,
     hasPayloadTenantId,
     hasPayloadOrganizationId,
-    rowScope,
+    sourceScope,
   } = input
 
-  if (!rowScope) {
+  if (sourceScope.kind === 'global') {
+    if (!hasPayloadTenantId || !hasPayloadOrganizationId || payloadTenantId !== null || payloadOrganizationId !== null) {
+      throw new QueryIndexScopeError(
+        'Query index event for a global entity must explicitly provide tenantId and organizationId as null'
+      )
+    }
+
+    return {
+      tenantId: null,
+      organizationId: null,
+    }
+  }
+
+  if (sourceScope.kind === 'missing') {
     if (!hasPayloadTenantId || !hasPayloadOrganizationId) {
       throw new QueryIndexScopeError(
         'Query index event is missing tenantId/organizationId and source row scope could not be resolved'
@@ -72,6 +142,8 @@ export function resolveQueryIndexRecordScope(input: ResolveRecordScopeInput): Qu
     }
   }
 
+  const rowScope = sourceScope.scope
+
   if (hasPayloadTenantId && !isSameScopeValue(payloadTenantId, rowScope.tenantId)) {
     throw new QueryIndexScopeError(
       `Query index event tenantId does not match source row scope (payload=${String(payloadTenantId ?? null)}, row=${String(rowScope.tenantId)})`
@@ -109,3 +181,15 @@ export function resolveQueryIndexReindexScope(input: ResolveReindexScopeInput):
 function isSameScopeValue(left: string | null | undefined, right: string | null): boolean {
   return (left ?? null) === right
 }
+
+function resolveScopeColumn(metadata: QueryIndexEntityMetadata, property: string, table: string): string | null {
+  const scopeProperty = metadata.properties?.[property]
+  if (!scopeProperty) return null
+  const fieldNames = scopeProperty.fieldNames
+  if (!Array.isArray(fieldNames) || fieldNames.length !== 1 || typeof fieldNames[0] !== 'string' || !fieldNames[0]) {
+    throw new QueryIndexScopeError(
+      `Query index ${property} metadata must map exactly one physical column for table: ${table}`
+    )
+  }
+  return fieldNames[0]
+}

package/src/modules/query_index/subscribers/delete_one.ts

@@ -1,9 +1,12 @@
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
-import { resolveEntityTableName } from '@open-mercato/shared/lib/query/engine'
 import { sql } from 'kysely'
 import { markDeleted } from '../lib/indexer'
 import { applyCoverageAdjustments, createCoverageAdjustments } from '../lib/coverage'
-import { loadQueryIndexRowScope, resolveQueryIndexRecordScope } from '../lib/subscriber-scope'
+import {
+  loadQueryIndexRowScope,
+  resolveQueryIndexRecordScope,
+  resolveQueryIndexSourceMetadata,
+} from '../lib/subscriber-scope'
 
 export const metadata = { event: 'query_index.delete_one', persistent: false }
 
@@ -40,13 +43,14 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
   try {
     const hasPayloadOrganizationId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'organizationId')
     const hasPayloadTenantId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'tenantId')
-    const rowScope = await loadQueryIndexRowScope(em, entityType, recordId).catch(() => null)
+    const source = resolveQueryIndexSourceMetadata(em, entityType)
+    const sourceScope = await loadQueryIndexRowScope(em, source, recordId)
     const resolvedScope = resolveQueryIndexRecordScope({
       payloadOrganizationId: payload?.organizationId,
       payloadTenantId: payload?.tenantId,
       hasPayloadOrganizationId,
       hasPayloadTenantId,
-      rowScope,
+      sourceScope,
     })
     organizationId = resolvedScope.organizationId
     tenantId = resolvedScope.tenantId
@@ -57,14 +61,21 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
     let baseCheckSucceeded = false
     try {
       const db = (em as any).getKysely()
-      const table = resolveEntityTableName(em, entityType)
-      const row = await db
-        .selectFrom(table as any)
+      let baseQuery = db
+        .selectFrom(source.table as any)
         .select(['deleted_at' as any])
         .where('id' as any, '=', recordId)
-        .where('organization_id' as any, organizationId === null ? 'is' : '=', organizationId as any)
-        .where(sql`tenant_id is not distinct from ${tenantId}`)
-        .executeTakeFirst() as { deleted_at: Date | null } | undefined
+      if (source.organizationColumn) {
+        baseQuery = baseQuery.where(
+          source.organizationColumn as any,
+          organizationId === null ? 'is' : '=',
+          organizationId as any,
+        )
+      }
+      if (source.tenantColumn) {
+        baseQuery = baseQuery.where(sql`${sql.ref(source.tenantColumn)} is not distinct from ${tenantId}`)
+      }
+      const row = await baseQuery.executeTakeFirst() as { deleted_at: Date | null } | undefined
       const baseMissing = !row
       const baseDeleted = baseMissing || (row && row.deleted_at != null)
       baseCheckSucceeded = true

package/src/modules/query_index/subscribers/upsert_one.ts

@@ -1,7 +1,11 @@
 import { recordIndexerError } from '@open-mercato/shared/lib/indexers/error-log'
 import { upsertIndexRow, reindexSearchTokensForRecord } from '../lib/indexer'
 import { applyCoverageAdjustments, createCoverageAdjustments } from '../lib/coverage'
-import { loadQueryIndexRowScope, resolveQueryIndexRecordScope } from '../lib/subscriber-scope'
+import {
+  loadQueryIndexRowScope,
+  resolveQueryIndexRecordScope,
+  resolveQueryIndexSourceMetadata,
+} from '../lib/subscriber-scope'
 
 export const metadata = { event: 'query_index.upsert_one', persistent: false }
 
@@ -25,13 +29,14 @@ export default async function handle(payload: any, ctx: { resolve: <T=any>(name:
   try {
     const hasPayloadOrganizationId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'organizationId')
     const hasPayloadTenantId = Object.prototype.hasOwnProperty.call(payload ?? {}, 'tenantId')
-    const rowScope = await loadQueryIndexRowScope(em, entityType, recordId).catch(() => null)
+    const source = resolveQueryIndexSourceMetadata(em, entityType)
+    const sourceScope = await loadQueryIndexRowScope(em, source, recordId)
     const resolvedScope = resolveQueryIndexRecordScope({
       payloadOrganizationId: payload?.organizationId,
       payloadTenantId: payload?.tenantId,
       hasPayloadOrganizationId,
       hasPayloadTenantId,
-      rowScope,
+      sourceScope,
     })
     organizationId = resolvedScope.organizationId
     tenantId = resolvedScope.tenantId

package/src/modules/workflows/AGENTS.md

@@ -142,6 +142,28 @@ Configure automatic workflow starts from domain events:
 5. Configure `contextMapping` to extract event payload into workflow context
 6. Use `debounceMs` and `maxConcurrentInstances` to prevent trigger storms
 
+### Trigger Sources And Precedence
+
+`loadTriggersForTenant()` (`lib/event-trigger-service.ts`) merges three sources into `UnifiedTrigger`s, each tagged with a `source` discriminator:
+
+| `source` | Origin | Notes |
+|----------|--------|-------|
+| `legacy` | `workflow_event_triggers` rows | Backward compatibility with triggers created before triggers were embedded in definitions |
+| `embedded` | `triggers[]` inside a `workflow_definitions` row's `definition` JSONB | What the visual editor and the definitions API write |
+| `code` | `triggers[]` on a code-defined workflow in the in-memory registry (`defineWorkflow`) | Projected by `loadCodeTriggers()`; no DB row required (#4425) |
+
+Precedence: **a DB-backed definition wins over its code counterpart.** Any non-deleted `workflow_definitions` row shadows the code projection for the same `workflowId` — including a disabled row, and including a customization whose `triggers[]` was emptied. This preserves `customize` semantics: once an operator materializes a code workflow, the DB row alone decides which triggers are live.
+
+MUST invalidate the trigger cache after any write that changes which source owns a workflow's triggers — `loadTriggersForTenant()` caches per tenant/organization for `TRIGGER_CACHE_TTL` (5 min), so without invalidation the wildcard subscriber keeps matching a stale snapshot:
+
+```typescript
+import { invalidateTriggerCache } from '../lib/event-trigger-service'
+
+if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)
+```
+
+This covers definition create/update/delete **and** `POST .../[id]/customize` (code projection → embedded row) and `POST .../[id]/reset-to-code` (embedded row → code projection). Invalidate for the **written row's own** tenant/organization rather than the caller's — `customize` looks an override up by `(workflowId, tenantId)`, so it can revive a row owned by a sibling organization. Omitting `organizationId` clears every organization under the tenant.
+
 ## Widget Injection
 
 The module injects an order-approval widget into the sales module:

package/src/modules/workflows/api/definitions/[id]/customize/route.ts

@@ -17,6 +17,7 @@ import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@op
 import { WorkflowDefinition } from '../../../../data/entities'
 import { serializeWorkflowDefinition } from '../../serialize'
 import { getCodeWorkflow } from '../../../../lib/code-registry'
+import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -115,6 +116,14 @@ export async function POST(request: NextRequest, context: RouteContext) {
       saved = override
     }
 
+    // Materializing the override moves trigger ownership from the code registry
+    // to the new `workflow_definitions` row, so the cached snapshot the wildcard
+    // subscriber reads is stale until TRIGGER_CACHE_TTL expires (#4425). Scope
+    // the invalidation to the saved row's own organization: reviving an existing
+    // override belonging to a sibling organization changes triggers for THAT
+    // organization, not for the caller's.
+    if (saved.tenantId) invalidateTriggerCache(saved.tenantId, saved.organizationId ?? undefined)
+
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId: tenantId ?? '',

package/src/modules/workflows/api/definitions/[id]/reset-to-code/route.ts

@@ -16,6 +16,7 @@ import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@op
 import { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'
 import { serializeCodeWorkflowDefinition } from '../../serialize'
 import { getCodeWorkflow } from '../../../../lib/code-registry'
+import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('workflows')
@@ -140,6 +141,12 @@ export async function POST(
     em.remove(definition)
     await em.flush()
 
+    // Trigger ownership falls back to the code registry, so the cached snapshot
+    // still holds the embedded triggers of a row that no longer exists (#4425).
+    if (removedSnapshot.tenantId) {
+      invalidateTriggerCache(removedSnapshot.tenantId, removedSnapshot.organizationId ?? undefined)
+    }
+
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId: tenantId ?? '',