@open-mercato/core 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6814.1.0627c7e9f1

package/src/modules/payment_gateways/workers/session-initialization-prune.ts

@@ -0,0 +1,63 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createModuleQueue, type JobContext, type Queue, type QueuedJob, type WorkerMeta } from '@open-mercato/queue'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
+  PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE,
+  pruneCompletedPaymentSessionInitializations,
+} from '../lib/session-idempotency'
+
+type PrunePayload = {
+  tenantId?: string
+  organizationId?: string
+}
+
+type HandlerContext = JobContext & {
+  resolve: <T = unknown>(name: string) => T
+}
+
+const logger = createLogger('payment_gateways')
+let continuationQueue: Queue<PrunePayload> | null = null
+
+function getContinuationQueue(): Queue<PrunePayload> {
+  continuationQueue ??= createModuleQueue<PrunePayload>(
+    PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
+    { concurrency: 1 },
+  )
+  return continuationQueue
+}
+
+export const metadata: WorkerMeta = {
+  queue: PAYMENT_SESSION_INITIALIZATION_PRUNE_QUEUE,
+  id: 'payment_gateways:session-initialization-prune',
+  concurrency: 1,
+}
+
+export default async function handle(
+  job: QueuedJob<PrunePayload>,
+  ctx: HandlerContext,
+): Promise<void> {
+  const tenantId = job.payload?.tenantId
+  const organizationId = job.payload?.organizationId
+  if (!tenantId || !organizationId) {
+    logger.warn('Skipping payment-session initialization prune without tenant scope')
+    return
+  }
+
+  const em = ctx.resolve<EntityManager>('em').fork()
+  const deleted = await pruneCompletedPaymentSessionInitializations(
+    em,
+    { tenantId, organizationId },
+    { batchSize: PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE },
+  )
+  if (deleted > 0) {
+    logger.info('Pruned completed payment-session initialization claims', {
+      deleted,
+      tenantId,
+      organizationId,
+    })
+  }
+  if (deleted >= PAYMENT_SESSION_INITIALIZATION_PRUNE_BATCH_SIZE) {
+    await getContinuationQueue().enqueue({ tenantId, organizationId }, { delayMs: 1_000 })
+  }
+}

package/src/modules/portal/frontend/[orgSlug]/portal/invite/page.meta.ts

@@ -0,0 +1,9 @@
+import type { PageMetadata } from '@open-mercato/shared/modules/registry'
+
+export const metadata: PageMetadata = {
+  titleKey: 'portal.nav.invite',
+  title: 'Accept Invitation',
+  navHidden: true,
+}
+
+export default metadata

package/src/modules/portal/frontend/[orgSlug]/portal/invite/page.tsx

@@ -0,0 +1,164 @@
+"use client"
+import { useCallback, useMemo, useState, useEffect } from 'react'
+import { useSearchParams } from 'next/navigation'
+import Link from 'next/link'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
+import { Input } from '@open-mercato/ui/primitives/input'
+import { Label } from '@open-mercato/ui/primitives/label'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
+import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
+import { SearchX } from 'lucide-react'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { PortalInjectionSpots } from '@open-mercato/ui/backend/injection/spotIds'
+import { navigateWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
+
+type Props = { params: { orgSlug: string } }
+
+export default function PortalInvitePage({ params }: Props) {
+  const t = useT()
+  const orgSlug = params.orgSlug
+  const { tenant } = usePortalContext()
+  const searchParams = useSearchParams()
+
+  const [displayName, setDisplayName] = useState('')
+  const [password, setPassword] = useState('')
+  const [confirmPassword, setConfirmPassword] = useState('')
+  const [error, setError] = useState<string | null>(null)
+  const [submitting, setSubmitting] = useState(false)
+  const [token, setToken] = useState<string | null>(null)
+
+  useEffect(() => {
+    const tokenParam = searchParams.get('token')
+    if (!tokenParam) {
+      setError(t('portal.invite.error.noToken', 'Invalid or missing invitation token.'))
+    } else {
+      setToken(tokenParam)
+    }
+  }, [searchParams, t])
+
+  const handleSubmit = useCallback(
+    async (event: React.FormEvent) => {
+      event.preventDefault()
+      setError(null)
+
+      if (!token) {
+        setError(t('portal.invite.error.noToken', 'Invalid or missing invitation token.'))
+        return
+      }
+
+      if (!displayName.trim()) {
+        setError(t('portal.invite.error.displayNameRequired', 'Display name is required.'))
+        return
+      }
+
+      if (password !== confirmPassword) {
+        setError(t('portal.invite.error.passwordMismatch', 'Passwords do not match.'))
+        return
+      }
+
+      if (password.length < 8) {
+        setError(t('portal.invite.error.passwordTooShort', 'Password must be at least 8 characters long.'))
+        return
+      }
+
+      setSubmitting(true)
+      try {
+        const result = await apiCall<{ ok: boolean; error?: string }>('/api/customer_accounts/invitations/accept', {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ token, password, displayName: displayName.trim() }),
+        })
+
+        if (result.ok && result.result?.ok) {
+          navigateWithPageReload(`/${orgSlug}/portal/dashboard`)
+          return
+        }
+
+        if (result.status === 400) {
+          setError(t('portal.invite.error.invalidToken', 'Invalid or expired invitation.'))
+        } else {
+          setError(result.result?.error || t('portal.invite.error.generic', 'Invitation acceptance failed. Please try again.'))
+        }
+      } catch {
+        setError(t('portal.invite.error.generic', 'Invitation acceptance failed. Please try again.'))
+      } finally {
+        setSubmitting(false)
+      }
+    },
+    [token, password, confirmPassword, displayName, orgSlug, t],
+  )
+
+  const injectionContext = useMemo(
+    () => ({ orgSlug }),
+    [orgSlug],
+  )
+
+  if (tenant.loading) {
+    return <div className="flex items-center justify-center py-20"><Spinner /></div>
+  }
+
+  if (tenant.error) {
+    return (
+      <div className="mx-auto w-full max-w-md py-12">
+        <EmptyState
+          variant="subtle"
+          size="lg"
+          icon={<SearchX className="h-6 w-6" aria-hidden />}
+          title={t('portal.org.invalid', 'Organization not found.')}
+        />
+      </div>
+    )
+  }
+
+  return (
+    <div className="mx-auto w-full max-w-sm">
+      <div className="mb-8 text-center">
+        <h1 className="text-2xl font-bold tracking-tight">{t('portal.invite.title', 'Accept Invitation')}</h1>
+        <p className="mt-1.5 text-sm text-muted-foreground">{t('portal.invite.description', 'Create your portal account to accept this invitation.')}</p>
+      </div>
+
+      <InjectionSpot spotId={PortalInjectionSpots.pageBefore('invite')} context={injectionContext} />
+
+      <form onSubmit={handleSubmit} className="flex flex-col gap-4">
+        {error ? (
+          <Alert variant="destructive">
+            <AlertDescription>{error}</AlertDescription>
+          </Alert>
+        ) : null}
+
+        <div className="flex flex-col gap-1.5">
+          <Label htmlFor="invite-display-name" className="text-overline font-semibold uppercase tracking-wider text-muted-foreground/70">{t('portal.invite.displayName', 'Display Name')}</Label>
+          <Input id="invite-display-name" autoComplete="name" required value={displayName} onChange={(e) => setDisplayName(e.target.value)} disabled={submitting || !token} className="rounded-lg" />
+        </div>
+
+        <div className="flex flex-col gap-1.5">
+          <Label htmlFor="invite-password" className="text-overline font-semibold uppercase tracking-wider text-muted-foreground/70">{t('portal.invite.password', 'Password')}</Label>
+          <PasswordInput id="invite-password" autoComplete="new-password" required placeholder={t('portal.invite.password.placeholder', '••••••••')} value={password} onChange={(e) => setPassword(e.target.value)} disabled={submitting || !token} className="rounded-lg" />
+        </div>
+
+        <div className="flex flex-col gap-1.5">
+          <Label htmlFor="invite-confirm-password" className="text-overline font-semibold uppercase tracking-wider text-muted-foreground/70">{t('portal.invite.confirmPassword', 'Confirm Password')}</Label>
+          <PasswordInput id="invite-confirm-password" autoComplete="new-password" required placeholder={t('portal.invite.confirmPassword.placeholder', '••••••••')} value={confirmPassword} onChange={(e) => setConfirmPassword(e.target.value)} disabled={submitting || !token} className="rounded-lg" />
+        </div>
+
+        <Button type="submit" disabled={submitting || !token} className="mt-1 w-full rounded-lg">
+          {submitting ? t('portal.invite.submitting', 'Accepting invitation...') : t('portal.invite.submit', 'Accept Invitation')}
+        </Button>
+
+        <p className="text-center text-sm text-muted-foreground">
+          {t('portal.invite.backToLogin', 'Already have an account?')}{' '}
+          <Link href={`/${orgSlug}/portal/login`} className="font-medium text-foreground underline underline-offset-4 hover:opacity-80">
+            {t('portal.invite.loginLink', 'Sign in')}
+          </Link>
+        </p>
+      </form>
+
+      <InjectionSpot spotId={PortalInjectionSpots.pageAfter('invite')} context={injectionContext} />
+    </div>
+  )
+}

package/src/modules/portal/i18n/de.json

@@ -22,6 +22,23 @@
   "portal.disabled.title": "Portal nicht verfügbar",
   "portal.footer.copyright": "© {year} Alle Rechte vorbehalten.",
   "portal.info.instructions": "Um auf das Portal Ihrer Organisation zuzugreifen, navigieren Sie zur eindeutigen URL Ihrer Organisation. Kontaktieren Sie Ihren Administrator, wenn Sie den Portal-Link nicht kennen.",
+  "portal.invite.backToLogin": "Already have an account?",
+  "portal.invite.confirmPassword": "Confirm Password",
+  "portal.invite.confirmPassword.placeholder": "••••••••",
+  "portal.invite.description": "Create your portal account to accept this invitation.",
+  "portal.invite.displayName": "Display Name",
+  "portal.invite.error.displayNameRequired": "Display name is required.",
+  "portal.invite.error.generic": "Invitation acceptance failed. Please try again.",
+  "portal.invite.error.invalidToken": "Invalid or expired invitation.",
+  "portal.invite.error.noToken": "Invalid or missing invitation token.",
+  "portal.invite.error.passwordMismatch": "Passwords do not match.",
+  "portal.invite.error.passwordTooShort": "Password must be at least 8 characters long.",
+  "portal.invite.loginLink": "Sign in",
+  "portal.invite.password": "Password",
+  "portal.invite.password.placeholder": "••••••••",
+  "portal.invite.submit": "Accept Invitation",
+  "portal.invite.submitting": "Accepting invitation…",
+  "portal.invite.title": "Accept Invitation",
   "portal.landing.cta.login": "Anmelden",
   "portal.landing.cta.signup": "Konto erstellen",
   "portal.landing.feature.account": "Account Management",
@@ -49,6 +66,7 @@
   "portal.nav.account": "Konto",
   "portal.nav.dashboard": "Dashboard",
   "portal.nav.home": "Portal",
+  "portal.nav.invite": "Accept Invitation",
   "portal.nav.login": "Anmelden",
   "portal.nav.logout": "Abmelden",
   "portal.nav.profile": "Profil",

package/src/modules/portal/i18n/en.json

@@ -22,6 +22,23 @@
   "portal.disabled.title": "Portal Not Available",
   "portal.footer.copyright": "© {year} All rights reserved.",
   "portal.info.instructions": "To access your organization's portal, navigate to your organization's unique URL. Contact your administrator if you don't know your portal link.",
+  "portal.invite.backToLogin": "Already have an account?",
+  "portal.invite.confirmPassword": "Confirm Password",
+  "portal.invite.confirmPassword.placeholder": "••••••••",
+  "portal.invite.description": "Create your portal account to accept this invitation.",
+  "portal.invite.displayName": "Display Name",
+  "portal.invite.error.displayNameRequired": "Display name is required.",
+  "portal.invite.error.generic": "Invitation acceptance failed. Please try again.",
+  "portal.invite.error.invalidToken": "Invalid or expired invitation.",
+  "portal.invite.error.noToken": "Invalid or missing invitation token.",
+  "portal.invite.error.passwordMismatch": "Passwords do not match.",
+  "portal.invite.error.passwordTooShort": "Password must be at least 8 characters long.",
+  "portal.invite.loginLink": "Sign in",
+  "portal.invite.password": "Password",
+  "portal.invite.password.placeholder": "••••••••",
+  "portal.invite.submit": "Accept Invitation",
+  "portal.invite.submitting": "Accepting invitation…",
+  "portal.invite.title": "Accept Invitation",
   "portal.landing.cta.login": "Log In",
   "portal.landing.cta.signup": "Create Account",
   "portal.landing.feature.account": "Account Management",
@@ -49,6 +66,7 @@
   "portal.nav.account": "Account",
   "portal.nav.dashboard": "Dashboard",
   "portal.nav.home": "Portal",
+  "portal.nav.invite": "Accept Invitation",
   "portal.nav.login": "Log In",
   "portal.nav.logout": "Log Out",
   "portal.nav.profile": "Profile",

package/src/modules/portal/i18n/es.json

@@ -22,6 +22,23 @@
   "portal.disabled.title": "Portal no disponible",
   "portal.footer.copyright": "© {year} Todos los derechos reservados.",
   "portal.info.instructions": "Para acceder al portal de su organización, navegue a la URL única de su organización. Contacte a su administrador si no conoce el enlace del portal.",
+  "portal.invite.backToLogin": "Already have an account?",
+  "portal.invite.confirmPassword": "Confirm Password",
+  "portal.invite.confirmPassword.placeholder": "••••••••",
+  "portal.invite.description": "Create your portal account to accept this invitation.",
+  "portal.invite.displayName": "Display Name",
+  "portal.invite.error.displayNameRequired": "Display name is required.",
+  "portal.invite.error.generic": "Invitation acceptance failed. Please try again.",
+  "portal.invite.error.invalidToken": "Invalid or expired invitation.",
+  "portal.invite.error.noToken": "Invalid or missing invitation token.",
+  "portal.invite.error.passwordMismatch": "Passwords do not match.",
+  "portal.invite.error.passwordTooShort": "Password must be at least 8 characters long.",
+  "portal.invite.loginLink": "Sign in",
+  "portal.invite.password": "Password",
+  "portal.invite.password.placeholder": "••••••••",
+  "portal.invite.submit": "Accept Invitation",
+  "portal.invite.submitting": "Accepting invitation…",
+  "portal.invite.title": "Accept Invitation",
   "portal.landing.cta.login": "Iniciar sesión",
   "portal.landing.cta.signup": "Crear cuenta",
   "portal.landing.feature.account": "Account Management",
@@ -49,6 +66,7 @@
   "portal.nav.account": "Cuenta",
   "portal.nav.dashboard": "Panel",
   "portal.nav.home": "Portal",
+  "portal.nav.invite": "Accept Invitation",
   "portal.nav.login": "Iniciar sesión",
   "portal.nav.logout": "Cerrar sesión",
   "portal.nav.profile": "Perfil",

package/src/modules/portal/i18n/pl.json

@@ -22,6 +22,23 @@
   "portal.disabled.title": "Portal niedostępny",
   "portal.footer.copyright": "© {year} Wszelkie prawa zastrzeżone.",
   "portal.info.instructions": "Aby uzyskać dostęp do portalu organizacji, przejdź do unikalnego adresu URL swojej organizacji. Skontaktuj się z administratorem, jeśli nie znasz linku do portalu.",
+  "portal.invite.backToLogin": "Masz już konto?",
+  "portal.invite.confirmPassword": "Potwierdź hasło",
+  "portal.invite.confirmPassword.placeholder": "••••••••",
+  "portal.invite.description": "Utwórz konto w portalu, aby przyjąć to zaproszenie.",
+  "portal.invite.displayName": "Nazwa wyświetlana",
+  "portal.invite.error.displayNameRequired": "Nazwa wyświetlana jest wymagana.",
+  "portal.invite.error.generic": "Nie udało się przyjąć zaproszenia. Spróbuj ponownie.",
+  "portal.invite.error.invalidToken": "Nieprawidłowe lub wygasłe zaproszenie.",
+  "portal.invite.error.noToken": "Nieprawidłowy lub brakujący token zaproszenia.",
+  "portal.invite.error.passwordMismatch": "Hasła nie pasują do siebie.",
+  "portal.invite.error.passwordTooShort": "Hasło musi mieć co najmniej 8 znaków.",
+  "portal.invite.loginLink": "Zaloguj się",
+  "portal.invite.password": "Hasło",
+  "portal.invite.password.placeholder": "••••••••",
+  "portal.invite.submit": "Przyjmij zaproszenie",
+  "portal.invite.submitting": "Przyjmowanie zaproszenia…",
+  "portal.invite.title": "Przyjmij zaproszenie",
   "portal.landing.cta.login": "Zaloguj się",
   "portal.landing.cta.signup": "Utwórz konto",
   "portal.landing.feature.account": "Account Management",
@@ -49,6 +66,7 @@
   "portal.nav.account": "Konto",
   "portal.nav.dashboard": "Panel",
   "portal.nav.home": "Portal",
+  "portal.nav.invite": "Przyjmij zaproszenie",
   "portal.nav.login": "Zaloguj się",
   "portal.nav.logout": "Wyloguj się",
   "portal.nav.profile": "Profil",

package/src/modules/portal/lib/navigation.ts

@@ -0,0 +1,3 @@
+export function navigateWithPageReload(path: string): void {
+  window.location.assign(path)
+}

package/src/modules/query_index/lib/engine.ts

@@ -34,10 +34,46 @@ import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/cip
 import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
 
 const logger = createLogger('query_index').child({ component: 'engine' })
 
 const DECRYPT_CONCURRENCY = 8
+const AUTO_REINDEX_DEBOUNCE_DEFAULT_MS = 30_000
+const AUTO_REINDEX_DEBOUNCE_MAX_SCOPES = 10_000
+const AUTO_REINDEX_SCHEDULED_AT_KEY = Symbol.for('@open-mercato/query-index/auto-reindex-scheduled-at')
+
+type GlobalWithAutoReindexSchedule = typeof globalThis & {
+  [AUTO_REINDEX_SCHEDULED_AT_KEY]?: Map<string, number>
+}
+
+function getAutoReindexScheduledAt(): Map<string, number> {
+  const globalScope = globalThis as GlobalWithAutoReindexSchedule
+  if (!globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY]) {
+    globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY] = new Map<string, number>()
+  }
+  return globalScope[AUTO_REINDEX_SCHEDULED_AT_KEY]
+}
+
+function markAutoReindexScheduled(key: string, debounceMs: number, now: number): boolean {
+  const autoReindexScheduledAt = getAutoReindexScheduledAt()
+  const previous = autoReindexScheduledAt.get(key)
+  if (previous !== undefined && now - previous < debounceMs) return false
+
+  if (autoReindexScheduledAt.size >= AUTO_REINDEX_DEBOUNCE_MAX_SCOPES) {
+    for (const [scopeKey, scheduledAt] of autoReindexScheduledAt) {
+      if (now - scheduledAt >= debounceMs) autoReindexScheduledAt.delete(scopeKey)
+    }
+    if (autoReindexScheduledAt.size >= AUTO_REINDEX_DEBOUNCE_MAX_SCOPES) {
+      const oldestKey = autoReindexScheduledAt.keys().next().value
+      if (oldestKey !== undefined) autoReindexScheduledAt.delete(oldestKey)
+    }
+  }
+
+  autoReindexScheduledAt.delete(key)
+  autoReindexScheduledAt.set(key, now)
+  return true
+}
 
 function buildFilterableCustomFieldJoins(
   sources: QueryCustomFieldSource[] | undefined,
@@ -152,6 +188,7 @@ export class HybridQueryEngine implements QueryEngine {
   private sqlDebugEnabled: boolean | null = null
   private forcePartialIndexEnabled: boolean | null = null
   private autoReindexEnabled: boolean | null = null
+  private autoReindexDebounceMs: number | null = null
   private coverageOptimizationEnabled: boolean | null = null
   private pendingCoverageRefreshKeys = new Set<string>()
   private searchAvailabilityInstance: SearchTokenAvailability | null = null
@@ -1998,6 +2035,11 @@ export class HybridQueryEngine implements QueryEngine {
       organizationId: organizationIdOverride ?? opts.organizationId ?? null,
       force: false,
     }
+    const debounceMs = this.getAutoReindexDebounceMs()
+    if (debounceMs > 0) {
+      const key = [payload.entityType, payload.tenantId ?? '__tenant__', payload.organizationId ?? '__org__'].join('|')
+      if (!markAutoReindexScheduled(key, debounceMs, Date.now())) return
+    }
     const context = stats
       ? { entity, tenantId: payload.tenantId, organizationId: payload.organizationId, baseCount: stats.baseCount, indexedCount: stats.indexedCount }
       : { entity, tenantId: payload.tenantId, organizationId: payload.organizationId }
@@ -2067,6 +2109,16 @@ export class HybridQueryEngine implements QueryEngine {
     return this.autoReindexEnabled
   }
 
+  private getAutoReindexDebounceMs(): number {
+    if (this.autoReindexDebounceMs != null) return this.autoReindexDebounceMs
+    this.autoReindexDebounceMs = parseNumberWithDefault(
+      process.env.OM_QUERY_INDEX_AUTO_REINDEX_DEBOUNCE_MS,
+      AUTO_REINDEX_DEBOUNCE_DEFAULT_MS,
+      { integer: true, min: 0 },
+    )
+    return this.autoReindexDebounceMs
+  }
+
   private isCoverageOptimizationEnabled(): boolean {
     if (this.coverageOptimizationEnabled != null) return this.coverageOptimizationEnabled
     const raw = (process.env.OPTIMIZE_INDEX_COVERAGE_STATS ?? '').trim().toLowerCase()

package/src/modules/query_index/lib/search-tokens.ts

@@ -2,6 +2,7 @@ import { type Kysely, type Transaction, sql } from 'kysely'
 import {
   isSearchFieldBlocklisted,
   resolveSearchConfig,
+  resolveSearchTokenLimits,
   type SearchConfig,
 } from '@open-mercato/shared/lib/search/config'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
@@ -79,9 +80,7 @@ function shouldIndexField(
   if (lower.endsWith('_at')) return false
   if (['created_at', 'updated_at', 'deleted_at', 'tenant_id', 'organization_id'].includes(lower)) return false
   if (isSearchFieldBlocklisted(field, entityType, config)) return false
-  const values = collectTextValues(value)
-  if (!values.length) return false
-  return values.some((text) => tokenizeText(text, config).tokens.length > 0)
+  return collectTextValues(value).some((text) => text.length > 0)
 }
 
 export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[] {
@@ -95,19 +94,32 @@ export function buildSearchTokenRows(params: BuildTokenOptions): SearchTokenRow[
     organizationId: params.organizationId ?? DEFAULT_SCOPE.organizationId,
     tenantId: params.tenantId ?? DEFAULT_SCOPE.tenantId,
   }
+  const limits = resolveSearchTokenLimits(config)
+  const recordLimit = limits.maxTokensPerRecord > 0 ? limits.maxTokensPerRecord : Number.POSITIVE_INFINITY
+  const fieldLimit = limits.maxTokensPerField > 0 ? limits.maxTokensPerField : Number.POSITIVE_INFINITY
 
   for (const [field, rawValue] of Object.entries(params.doc)) {
+    if (tokens.length >= recordLimit) break
     if (!shouldIndexField(field, rawValue, config, params.entityType)) continue
     const values = collectTextValues(rawValue)
     const seen = new Set<string>()
+    let fieldTokenCount = 0
     for (const text of values) {
-      const { tokens: textTokens, hashes } = tokenizeText(text, config)
+      if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break
+      const remainingLimit = Math.min(recordLimit - tokens.length, fieldLimit - fieldTokenCount)
+      const candidateLimit = fieldTokenCount + remainingLimit
+      const tokenConfig = Number.isFinite(candidateLimit)
+        ? { ...config, maxTokensPerField: candidateLimit }
+        : config
+      const { tokens: textTokens, hashes } = tokenizeText(text, tokenConfig)
       for (let i = 0; i < textTokens.length; i += 1) {
+        if (tokens.length >= recordLimit || fieldTokenCount >= fieldLimit) break
         const token = textTokens[i]
         const hash = hashes[i]
         const dedupeKey = `${field}|${hash}`
         if (seen.has(dedupeKey)) continue
         seen.add(dedupeKey)
+        fieldTokenCount += 1
         debug('token.generated', { entityType: params.entityType, recordId: params.recordId, field, hash })
         tokens.push({
           entity_type: params.entityType,

package/src/modules/shipping_carriers/api/webhook/[provider]/route.ts

@@ -11,6 +11,7 @@ import { getShippingAdapter } from '../../../lib/adapter-registry'
 import { getShippingCarrierQueue } from '../../../lib/queue'
 import { shippingCarriersTag } from '../../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
 
 const logger = createLogger('shipping_carriers').child({ component: 'webhook' })
 
@@ -51,7 +52,15 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
   const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)
   if (rateLimitResponse) return rateLimitResponse
 
-  const rawBody = await req.text()
+  let rawBody: string
+  try {
+    rawBody = await readBoundedRequestBody(req)
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) {
+      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })
+    }
+    throw error
+  }
   const headers: Record<string, string> = {}
   req.headers.forEach((value, key) => {
     headers[key] = value
@@ -156,6 +165,7 @@ export const openApi = {
       responses: [
         { status: 202, description: 'Webhook accepted for async processing' },
         { status: 401, description: 'Signature verification failed' },
+        { status: 413, description: 'Webhook payload too large' },
         { status: 404, description: 'Unknown provider' },
       ],
     },