@open-mercato/core 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/dist/modules/customer_accounts/emails/CustomerInvitationEmail.js

@@ -0,0 +1,26 @@
+import { jsx, jsxs } from "react/jsx-runtime";
+import { Html, Head, Preview, Body, Container, Text, Section, Link } from "@react-email/components";
+function CustomerInvitationEmail({ inviteUrl, copy }) {
+  return /* @__PURE__ */ jsxs(Html, { children: [
+    /* @__PURE__ */ jsx(Head, {}),
+    /* @__PURE__ */ jsx(Preview, { children: copy.preview }),
+    /* @__PURE__ */ jsx(Body, { style: body, children: /* @__PURE__ */ jsx(Container, { style: container, children: /* @__PURE__ */ jsxs(Section, { children: [
+      /* @__PURE__ */ jsx(Text, { style: title, children: copy.title }),
+      /* @__PURE__ */ jsx(Text, { style: paragraph, children: copy.body }),
+      /* @__PURE__ */ jsx(Text, { children: /* @__PURE__ */ jsx(Link, { href: inviteUrl, style: button, children: copy.cta }) }),
+      /* @__PURE__ */ jsx(Text, { style: hint, children: copy.hint })
+    ] }) }) })
+  ] });
+}
+const body = { backgroundColor: "#f9fafb", margin: 0, padding: "24px 0" };
+const container = { backgroundColor: "#ffffff", borderRadius: 12, padding: 24, margin: "0 auto", maxWidth: 520, boxShadow: "0 1px 4px rgba(0,0,0,0.06)" };
+const title = { fontSize: 20, fontWeight: 600, color: "#111827", margin: "0 0 12px" };
+const paragraph = { fontSize: 14, color: "#4b5563", lineHeight: "20px", margin: "0 0 16px" };
+const button = { display: "inline-block", backgroundColor: "#111827", color: "#ffffff", padding: "10px 14px", borderRadius: 8, textDecoration: "none", fontSize: 14 };
+const hint = { fontSize: 12, color: "#6b7280", marginTop: 16 };
+var CustomerInvitationEmail_default = CustomerInvitationEmail;
+export {
+  CustomerInvitationEmail,
+  CustomerInvitationEmail_default as default
+};
+//# sourceMappingURL=CustomerInvitationEmail.js.map

package/dist/modules/customer_accounts/emails/CustomerInvitationEmail.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/emails/CustomerInvitationEmail.tsx"],
+  "sourcesContent": ["import * as React from 'react'\nimport { Html, Head, Preview, Body, Container, Text, Section, Link } from '@react-email/components'\n\nexport type CustomerInvitationEmailCopy = {\n  preview: string\n  title: string\n  body: string\n  cta: string\n  hint: string\n}\n\nexport type CustomerInvitationEmailProps = {\n  inviteUrl: string\n  copy: CustomerInvitationEmailCopy\n}\n\nexport function CustomerInvitationEmail({ inviteUrl, copy }: CustomerInvitationEmailProps) {\n  return (\n    <Html>\n      <Head />\n      <Preview>{copy.preview}</Preview>\n      <Body style={body}>\n        <Container style={container}>\n          <Section>\n            <Text style={title}>{copy.title}</Text>\n            <Text style={paragraph}>{copy.body}</Text>\n            <Text>\n              <Link href={inviteUrl} style={button}>{copy.cta}</Link>\n            </Text>\n            <Text style={hint}>{copy.hint}</Text>\n          </Section>\n        </Container>\n      </Body>\n    </Html>\n  )\n}\n\nconst body: React.CSSProperties = { backgroundColor: '#f9fafb', margin: 0, padding: '24px 0' }\nconst container: React.CSSProperties = { backgroundColor: '#ffffff', borderRadius: 12, padding: 24, margin: '0 auto', maxWidth: 520, boxShadow: '0 1px 4px rgba(0,0,0,0.06)' }\nconst title: React.CSSProperties = { fontSize: 20, fontWeight: 600, color: '#111827', margin: '0 0 12px' }\nconst paragraph: React.CSSProperties = { fontSize: 14, color: '#4b5563', lineHeight: '20px', margin: '0 0 16px' }\nconst button: React.CSSProperties = { display: 'inline-block', backgroundColor: '#111827', color: '#ffffff', padding: '10px 14px', borderRadius: 8, textDecoration: 'none', fontSize: 14 }\nconst hint: React.CSSProperties = { fontSize: 12, color: '#6b7280', marginTop: 16 }\n\nexport default CustomerInvitationEmail\n"],
+  "mappings": "AAmBM,cAII,YAJJ;AAlBN,SAAS,MAAM,MAAM,SAAS,MAAM,WAAW,MAAM,SAAS,YAAY;AAenE,SAAS,wBAAwB,EAAE,WAAW,KAAK,GAAiC;AACzF,SACE,qBAAC,QACC;AAAA,wBAAC,QAAK;AAAA,IACN,oBAAC,WAAS,eAAK,SAAQ;AAAA,IACvB,oBAAC,QAAK,OAAO,MACX,8BAAC,aAAU,OAAO,WAChB,+BAAC,WACC;AAAA,0BAAC,QAAK,OAAO,OAAQ,eAAK,OAAM;AAAA,MAChC,oBAAC,QAAK,OAAO,WAAY,eAAK,MAAK;AAAA,MACnC,oBAAC,QACC,8BAAC,QAAK,MAAM,WAAW,OAAO,QAAS,eAAK,KAAI,GAClD;AAAA,MACA,oBAAC,QAAK,OAAO,MAAO,eAAK,MAAK;AAAA,OAChC,GACF,GACF;AAAA,KACF;AAEJ;AAEA,MAAM,OAA4B,EAAE,iBAAiB,WAAW,QAAQ,GAAG,SAAS,SAAS;AAC7F,MAAM,YAAiC,EAAE,iBAAiB,WAAW,cAAc,IAAI,SAAS,IAAI,QAAQ,UAAU,UAAU,KAAK,WAAW,6BAA6B;AAC7K,MAAM,QAA6B,EAAE,UAAU,IAAI,YAAY,KAAK,OAAO,WAAW,QAAQ,WAAW;AACzG,MAAM,YAAiC,EAAE,UAAU,IAAI,OAAO,WAAW,YAAY,QAAQ,QAAQ,WAAW;AAChH,MAAM,SAA8B,EAAE,SAAS,gBAAgB,iBAAiB,WAAW,OAAO,WAAW,SAAS,aAAa,cAAc,GAAG,gBAAgB,QAAQ,UAAU,GAAG;AACzL,MAAM,OAA4B,EAAE,UAAU,IAAI,OAAO,WAAW,WAAW,GAAG;AAElF,IAAO,kCAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js

@@ -1,14 +1,38 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 async function isOwnedCompanyEntity(em, customerEntityId, scope) {
+  return isOwnedEntityOfKind(em, customerEntityId, "company", scope);
+}
+async function isOwnedPersonEntity(em, personEntityId, scope) {
+  return isOwnedEntityOfKind(em, personEntityId, "person", scope);
+}
+async function resolveOwnedCompanyForPerson(em, personEntityId, scope) {
+  const { CustomerPersonProfile } = await import("@open-mercato/core/modules/customers/data/entities");
+  const profile = await em.findOne(CustomerPersonProfile, {
+    entity: personEntityId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId
+  });
+  const candidate = readCompanyEntityId(profile);
+  if (!candidate) return null;
+  return await isOwnedCompanyEntity(em, candidate, scope) ? candidate : null;
+}
+function readCompanyEntityId(profile) {
+  const company = profile?.company;
+  if (!company) return null;
+  if (typeof company === "string") return company;
+  const id = company.id;
+  return typeof id === "string" ? id : null;
+}
+async function isOwnedEntityOfKind(em, entityId, kind, scope) {
   const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
   const entity = await findOneWithDecryption(
     em,
     CustomerEntity,
     {
-      id: customerEntityId,
+      id: entityId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      kind: "company",
+      kind,
       deletedAt: null
     },
     void 0,
@@ -17,6 +41,8 @@ async function isOwnedCompanyEntity(em, customerEntityId, scope) {
   return !!entity;
 }
 export {
-  isOwnedCompanyEntity
+  isOwnedCompanyEntity,
+  isOwnedPersonEntity,
+  resolveOwnedCompanyForPerson
 };
 //# sourceMappingURL=customerEntityOwnership.js.map

package/dist/modules/customer_accounts/lib/customerEntityOwnership.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerEntityOwnership.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport type CustomerEntityScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\n/**\n * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked\n * onto a customer user) exists, is a company, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * Without this check an admin in org A could pass a company UUID from org B in\n * the same tenant and cross-link a customer user into another org's portal\n * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows\n * are created and listed.\n */\nexport async function isOwnedCompanyEntity(\n  em: EntityManager,\n  customerEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: customerEntityId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      kind: 'company',\n      deletedAt: null,\n    } as any,\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  return !!entity\n}\n"],
-  "mappings": "AACA,SAAS,6BAA6B;AAiBtC,eAAsB,qBACpB,IACA,kBACA,OACkB;AAClB,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAC5F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,MAAM;AAAA,MACN,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,SAAO,CAAC,CAAC;AACX;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport type CustomerEntityScope = {\n  tenantId: string | null | undefined\n  organizationId: string | null | undefined\n}\n\n/**\n * Confirms that a caller-supplied `customerEntityId` (the CRM company FK linked\n * onto a customer user) exists, is a company, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * Without this check an admin in org A could pass a company UUID from org B in\n * the same tenant and cross-link a customer user into another org's portal\n * context (#2693). The lookup is org-scoped to match how `CustomerEntity` rows\n * are created and listed.\n */\nexport async function isOwnedCompanyEntity(\n  em: EntityManager,\n  customerEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  return isOwnedEntityOfKind(em, customerEntityId, 'company', scope)\n}\n\n/**\n * Confirms that a caller-supplied `personEntityId` (the CRM person FK linked\n * onto a customer user) exists, is a person, is not soft-deleted, and belongs\n * to the caller's tenant and organization.\n *\n * This is the symmetric guard to {@link isOwnedCompanyEntity}: the person FK is\n * copied onto the customer user on accept and short-circuits CRM auto-linking,\n * so an unvalidated id would permanently cross-link a portal user to another\n * org's person (the #4362/#2693 class of bug, on the person side).\n */\nexport async function isOwnedPersonEntity(\n  em: EntityManager,\n  personEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  return isOwnedEntityOfKind(em, personEntityId, 'person', scope)\n}\n\n/**\n * Resolves the CRM company a person belongs to, but only when both the profile\n * lookup and the company itself stay inside the given tenant/organization scope.\n * Returns null when the person has no company or that company is out of scope.\n *\n * Both the invite route and the CRM auto-link subscriber need this answer, and\n * both write the result into `customerEntityId` \u2014 the portal company scope key \u2014\n * so they must agree on what counts as an in-scope company.\n */\nexport async function resolveOwnedCompanyForPerson(\n  em: EntityManager,\n  personEntityId: string,\n  scope: CustomerEntityScope,\n): Promise<string | null> {\n  const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')\n  const profile = await em.findOne(CustomerPersonProfile as any, {\n    entity: personEntityId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  } as any)\n  const candidate = readCompanyEntityId(profile)\n  if (!candidate) return null\n  return (await isOwnedCompanyEntity(em, candidate, scope)) ? candidate : null\n}\n\n/**\n * `CustomerPersonProfile.company` is a relation on `company_entity_id`, not a\n * scalar \u2014 MikroORM hands back either the raw id or an entity reference, never a\n * `companyEntityId` property. Reading the wrong one silently yields undefined and\n * turns every company recovery into a clear.\n */\nfunction readCompanyEntityId(profile: unknown): string | null {\n  const company = (profile as { company?: unknown } | null | undefined)?.company\n  if (!company) return null\n  if (typeof company === 'string') return company\n  const id = (company as { id?: unknown }).id\n  return typeof id === 'string' ? id : null\n}\n\nasync function isOwnedEntityOfKind(\n  em: EntityManager,\n  entityId: string,\n  kind: 'company' | 'person',\n  scope: CustomerEntityScope,\n): Promise<boolean> {\n  const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n  const entity = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: entityId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      kind,\n      deletedAt: null,\n    } as any,\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  return !!entity\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AAiBtC,eAAsB,qBACpB,IACA,kBACA,OACkB;AAClB,SAAO,oBAAoB,IAAI,kBAAkB,WAAW,KAAK;AACnE;AAYA,eAAsB,oBACpB,IACA,gBACA,OACkB;AAClB,SAAO,oBAAoB,IAAI,gBAAgB,UAAU,KAAK;AAChE;AAWA,eAAsB,6BACpB,IACA,gBACA,OACwB;AACxB,QAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,oDAAoD;AACnG,QAAM,UAAU,MAAM,GAAG,QAAQ,uBAA8B;AAAA,IAC7D,QAAQ;AAAA,IACR,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAQ;AACR,QAAM,YAAY,oBAAoB,OAAO;AAC7C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAQ,MAAM,qBAAqB,IAAI,WAAW,KAAK,IAAK,YAAY;AAC1E;AAQA,SAAS,oBAAoB,SAAiC;AAC5D,QAAM,UAAW,SAAsD;AACvE,MAAI,CAAC,QAAS,QAAO;AACrB,MAAI,OAAO,YAAY,SAAU,QAAO;AACxC,QAAM,KAAM,QAA6B;AACzC,SAAO,OAAO,OAAO,WAAW,KAAK;AACvC;AAEA,eAAe,oBACb,IACA,UACA,MACA,OACkB;AAClB,QAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAC5F,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,SAAO,CAAC,CAAC;AACX;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerUrl.js

@@ -1,4 +1,5 @@
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { Organization } from "@open-mercato/core/modules/directory/data/entities";
 function platformBaseUrl() {
   const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim();
   if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, "");
@@ -13,6 +14,23 @@ function resolveContainer(container) {
   if (container) return Promise.resolve(container);
   return createRequestContainer();
 }
+async function resolveOrgSlug(container, orgId) {
+  try {
+    const orgService = container.resolve("orgService");
+    if (orgService && typeof orgService.findById === "function") {
+      const org = await orgService.findById(orgId);
+      return org?.slug ?? null;
+    }
+  } catch {
+  }
+  try {
+    const em = container.resolve("em");
+    const org = await em.findOne(Organization, { id: orgId, deletedAt: null });
+    return org?.slug ?? null;
+  } catch {
+    return null;
+  }
+}
 async function urlForCustomerOrg(orgId, path, options) {
   const safePath = path.startsWith("/") ? path : `/${path}`;
   const container = await resolveContainer(options?.container);
@@ -28,16 +46,7 @@ async function urlForCustomerOrg(orgId, path, options) {
   if (active && active.hostname) {
     return `https://${active.hostname}${safePath}`;
   }
-  let orgSlug = null;
-  try {
-    const orgService = container.resolve("orgService");
-    if (orgService && typeof orgService.findById === "function") {
-      const org = await orgService.findById(orgId);
-      orgSlug = org?.slug ?? null;
-    }
-  } catch {
-    orgSlug = null;
-  }
+  const orgSlug = await resolveOrgSlug(container, orgId);
   const base = platformBaseUrl();
   if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`;
   return `${base}${safePath}`;

package/dist/modules/customer_accounts/lib/customerUrl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerUrl.ts"],
-  "sourcesContent": ["// Build customer-portal URLs that honor the active custom domain when present.\n// All customer-facing email senders (signup welcome, magic link, password reset,\n// notification digests) MUST construct links via this helper instead of\n// hard-coding PLATFORM_PORTAL_BASE_URL \u2014 see customer_accounts/AGENTS.md.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\n\ntype DomainMappingService = {\n  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>\n}\n\ntype OrgService = {\n  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>\n}\n\nfunction platformBaseUrl(): string {\n  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()\n  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\\/+$/, '')\n  // Outbound emails (welcome, magic link, password reset) embed this URL \u2014\n  // localhost in production silently sends broken links to real customers.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',\n    )\n  }\n  return 'http://localhost:3000'\n}\n\nfunction resolveContainer(container?: AppContainer): Promise<AppContainer> {\n  if (container) return Promise.resolve(container)\n  return createRequestContainer()\n}\n\nexport async function urlForCustomerOrg(\n  orgId: string,\n  path: string,\n  options?: { container?: AppContainer },\n): Promise<string> {\n  const safePath = path.startsWith('/') ? path : `/${path}`\n  const container = await resolveContainer(options?.container)\n\n  let active: { hostname: string } | null = null\n  try {\n    const service = container.resolve('domainMappingService') as DomainMappingService\n    if (service && typeof service.resolveActiveByOrg === 'function') {\n      active = await service.resolveActiveByOrg(orgId)\n    }\n  } catch {\n    // domainMappingService not registered yet (fresh installs, tests) \u2014 fall through to platform URL.\n    active = null\n  }\n\n  if (active && active.hostname) {\n    return `https://${active.hostname}${safePath}`\n  }\n\n  let orgSlug: string | null = null\n  try {\n    const orgService = container.resolve('orgService') as OrgService | undefined\n    if (orgService && typeof orgService.findById === 'function') {\n      const org = await orgService.findById(orgId)\n      orgSlug = org?.slug ?? null\n    }\n  } catch {\n    orgSlug = null\n  }\n\n  const base = platformBaseUrl()\n  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`\n  return `${base}${safePath}`\n}\n"],
-  "mappings": "AAMA,SAAS,8BAA8B;AAUvC,SAAS,kBAA0B;AACjC,QAAM,UAAU,QAAQ,IAAI,0BAA0B,KAAK;AAC3D,MAAI,WAAW,QAAQ,SAAS,EAAG,QAAO,QAAQ,QAAQ,QAAQ,EAAE;AAGpE,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,UAAW,QAAO,QAAQ,QAAQ,SAAS;AAC/C,SAAO,uBAAuB;AAChC;AAEA,eAAsB,kBACpB,OACA,MACA,SACiB;AACjB,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACvD,QAAM,YAAY,MAAM,iBAAiB,SAAS,SAAS;AAE3D,MAAI,SAAsC;AAC1C,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAI,WAAW,OAAO,QAAQ,uBAAuB,YAAY;AAC/D,eAAS,MAAM,QAAQ,mBAAmB,KAAK;AAAA,IACjD;AAAA,EACF,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,MAAI,UAAU,OAAO,UAAU;AAC7B,WAAO,WAAW,OAAO,QAAQ,GAAG,QAAQ;AAAA,EAC9C;AAEA,MAAI,UAAyB;AAC7B,MAAI;AACF,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAI,cAAc,OAAO,WAAW,aAAa,YAAY;AAC3D,YAAM,MAAM,MAAM,WAAW,SAAS,KAAK;AAC3C,gBAAU,KAAK,QAAQ;AAAA,IACzB;AAAA,EACF,QAAQ;AACN,cAAU;AAAA,EACZ;AAEA,QAAM,OAAO,gBAAgB;AAC7B,MAAI,QAAS,QAAO,GAAG,IAAI,IAAI,OAAO,UAAU,QAAQ;AACxD,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;",
+  "sourcesContent": ["// Build customer-portal URLs that honor the active custom domain when present.\n// All customer-facing email senders (signup welcome, magic link, password reset,\n// notification digests) MUST construct links via this helper instead of\n// hard-coding PLATFORM_PORTAL_BASE_URL \u2014 see customer_accounts/AGENTS.md.\n\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\n\ntype DomainMappingService = {\n  resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>\n}\n\ntype OrgService = {\n  findById(orgId: string): Promise<{ id: string; slug: string | null } | null>\n}\n\ntype EntityManagerResolver = {\n  resolve(name: 'em'): EntityManager\n}\n\nfunction platformBaseUrl(): string {\n  const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()\n  if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\\/+$/, '')\n  // Outbound emails (welcome, magic link, password reset) embed this URL \u2014\n  // localhost in production silently sends broken links to real customers.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error(\n      'PLATFORM_PORTAL_BASE_URL is required in production. Configure it before sending customer-portal emails.',\n    )\n  }\n  return 'http://localhost:3000'\n}\n\nfunction resolveContainer(container?: AppContainer): Promise<AppContainer> {\n  if (container) return Promise.resolve(container)\n  return createRequestContainer()\n}\n\nasync function resolveOrgSlug(container: AppContainer, orgId: string): Promise<string | null> {\n  try {\n    const orgService = container.resolve('orgService') as OrgService | undefined\n    if (orgService && typeof orgService.findById === 'function') {\n      const org = await orgService.findById(orgId)\n      return org?.slug ?? null\n    }\n  } catch {\n    // orgService is optional in standalone/runtime contexts \u2014 fall through to EntityManager.\n  }\n\n  try {\n    const em = (container as AppContainer & EntityManagerResolver).resolve('em')\n    const org = await em.findOne(Organization, { id: orgId, deletedAt: null })\n    return org?.slug ?? null\n  } catch {\n    return null\n  }\n}\n\nexport async function urlForCustomerOrg(\n  orgId: string,\n  path: string,\n  options?: { container?: AppContainer },\n): Promise<string> {\n  const safePath = path.startsWith('/') ? path : `/${path}`\n  const container = await resolveContainer(options?.container)\n\n  let active: { hostname: string } | null = null\n  try {\n    const service = container.resolve('domainMappingService') as DomainMappingService\n    if (service && typeof service.resolveActiveByOrg === 'function') {\n      active = await service.resolveActiveByOrg(orgId)\n    }\n  } catch {\n    // domainMappingService not registered yet (fresh installs, tests) \u2014 fall through to platform URL.\n    active = null\n  }\n\n  if (active && active.hostname) {\n    return `https://${active.hostname}${safePath}`\n  }\n\n  const orgSlug = await resolveOrgSlug(container, orgId)\n  const base = platformBaseUrl()\n  if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`\n  return `${base}${safePath}`\n}\n"],
+  "mappings": "AAMA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAe7B,SAAS,kBAA0B;AACjC,QAAM,UAAU,QAAQ,IAAI,0BAA0B,KAAK;AAC3D,MAAI,WAAW,QAAQ,SAAS,EAAG,QAAO,QAAQ,QAAQ,QAAQ,EAAE;AAGpE,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,WAAiD;AACzE,MAAI,UAAW,QAAO,QAAQ,QAAQ,SAAS;AAC/C,SAAO,uBAAuB;AAChC;AAEA,eAAe,eAAe,WAAyB,OAAuC;AAC5F,MAAI;AACF,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAI,cAAc,OAAO,WAAW,aAAa,YAAY;AAC3D,YAAM,MAAM,MAAM,WAAW,SAAS,KAAK;AAC3C,aAAO,KAAK,QAAQ;AAAA,IACtB;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,KAAM,UAAmD,QAAQ,IAAI;AAC3E,UAAM,MAAM,MAAM,GAAG,QAAQ,cAAc,EAAE,IAAI,OAAO,WAAW,KAAK,CAAC;AACzE,WAAO,KAAK,QAAQ;AAAA,EACtB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,kBACpB,OACA,MACA,SACiB;AACjB,QAAM,WAAW,KAAK,WAAW,GAAG,IAAI,OAAO,IAAI,IAAI;AACvD,QAAM,YAAY,MAAM,iBAAiB,SAAS,SAAS;AAE3D,MAAI,SAAsC;AAC1C,MAAI;AACF,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAI,WAAW,OAAO,QAAQ,uBAAuB,YAAY;AAC/D,eAAS,MAAM,QAAQ,mBAAmB,KAAK;AAAA,IACjD;AAAA,EACF,QAAQ;AAEN,aAAS;AAAA,EACX;AAEA,MAAI,UAAU,OAAO,UAAU;AAC7B,WAAO,WAAW,OAAO,QAAQ,GAAG,QAAQ;AAAA,EAC9C;AAEA,QAAM,UAAU,MAAM,eAAe,WAAW,KAAK;AACrD,QAAM,OAAO,gBAAgB;AAC7B,MAAI,QAAS,QAAO,GAAG,IAAI,IAAI,OAAO,UAAU,QAAQ;AACxD,SAAO,GAAG,IAAI,GAAG,QAAQ;AAC3B;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/invitationEmail.js

@@ -0,0 +1,35 @@
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { sendEmail } from "@open-mercato/shared/lib/email/send";
+import CustomerInvitationEmail from "@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail";
+import { urlForCustomerOrg } from "@open-mercato/core/modules/customer_accounts/lib/customerUrl";
+async function sendCustomerInvitationEmail(input) {
+  const { translate } = await resolveTranslations();
+  const inviteUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/invite?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container }
+  );
+  const subject = translate("customer_accounts.invitation.email.subject", "You have been invited to the customer portal");
+  const copy = {
+    preview: translate("customer_accounts.invitation.email.preview", "Accept your invitation to finish setting up portal access."),
+    title: translate("customer_accounts.invitation.email.title", "You have been invited"),
+    body: translate(
+      "customer_accounts.invitation.email.body",
+      "Use this secure invitation link to create your password and access the customer portal."
+    ),
+    cta: translate("customer_accounts.invitation.email.cta", "Accept invitation"),
+    hint: translate(
+      "customer_accounts.invitation.email.hint",
+      "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email."
+    )
+  };
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerInvitationEmail({ inviteUrl, copy })
+  });
+}
+export {
+  sendCustomerInvitationEmail
+};
+//# sourceMappingURL=invitationEmail.js.map

package/dist/modules/customer_accounts/lib/invitationEmail.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/lib/invitationEmail.ts"],
+  "sourcesContent": ["import type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport CustomerInvitationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail'\nimport { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'\n\nexport type CustomerInvitationEmailInput = {\n  container: AppContainer\n  organizationId: string\n  email: string\n  rawToken: string\n}\n\nexport async function sendCustomerInvitationEmail(input: CustomerInvitationEmailInput): Promise<void> {\n  const { translate } = await resolveTranslations()\n  const inviteUrl = await urlForCustomerOrg(\n    input.organizationId,\n    `/invite?token=${encodeURIComponent(input.rawToken)}`,\n    { container: input.container },\n  )\n\n  const subject = translate('customer_accounts.invitation.email.subject', 'You have been invited to the customer portal')\n  const copy = {\n    preview: translate('customer_accounts.invitation.email.preview', 'Accept your invitation to finish setting up portal access.'),\n    title: translate('customer_accounts.invitation.email.title', 'You have been invited'),\n    body: translate(\n      'customer_accounts.invitation.email.body',\n      'Use this secure invitation link to create your password and access the customer portal.',\n    ),\n    cta: translate('customer_accounts.invitation.email.cta', 'Accept invitation'),\n    hint: translate(\n      'customer_accounts.invitation.email.hint',\n      'This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.',\n    ),\n  }\n\n  await sendEmail({\n    to: input.email,\n    subject,\n    react: CustomerInvitationEmail({ inviteUrl, copy }),\n  })\n}\n"],
+  "mappings": "AACA,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,OAAO,6BAA6B;AACpC,SAAS,yBAAyB;AASlC,eAAsB,4BAA4B,OAAoD;AACpG,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,YAAY,MAAM;AAAA,IACtB,MAAM;AAAA,IACN,iBAAiB,mBAAmB,MAAM,QAAQ,CAAC;AAAA,IACnD,EAAE,WAAW,MAAM,UAAU;AAAA,EAC/B;AAEA,QAAM,UAAU,UAAU,8CAA8C,8CAA8C;AACtH,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,8CAA8C,4DAA4D;AAAA,IAC7H,OAAO,UAAU,4CAA4C,uBAAuB;AAAA,IACpF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,0CAA0C,mBAAmB;AAAA,IAC5E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU;AAAA,IACd,IAAI,MAAM;AAAA,IACV;AAAA,IACA,OAAO,wBAAwB,EAAE,WAAW,KAAK,CAAC;AAAA,EACpD,CAAC;AACH;",
+  "names": []
+}

package/dist/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.js

@@ -0,0 +1,13 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260723120000_customer_accounts extends Migration {
+  async up() {
+    this.addSql(`alter table "customer_user_invitations" add column "person_entity_id" uuid null;`);
+  }
+  async down() {
+    this.addSql(`alter table "customer_user_invitations" drop column "person_entity_id";`);
+  }
+}
+export {
+  Migration20260723120000_customer_accounts
+};
+//# sourceMappingURL=Migration20260723120000_customer_accounts.js.map

package/dist/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260723120000_customer_accounts extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"customer_user_invitations\" add column \"person_entity_id\" uuid null;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`alter table \"customer_user_invitations\" drop column \"person_entity_id\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,kDAAkD,UAAU;AAAA,EAEvE,MAAe,KAAoB;AACjC,SAAK,OAAO,kFAAkF;AAAA,EAChG;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,yEAAyE;AAAA,EACvF;AAEF;",
+  "names": []
+}

package/dist/modules/customer_accounts/services/customerInvitationService.js

@@ -35,16 +35,28 @@ class CustomerInvitationService {
       { tenantId: scope.tenantId, organizationId: scope.organizationId }
     );
     if (existing) {
+      const rollbackState = {
+        email: existing.email,
+        token: existing.token,
+        customerEntityId: existing.customerEntityId ?? null,
+        personEntityId: existing.personEntityId ?? null,
+        roleIdsJson: [...existing.roleIdsJson ?? []],
+        invitedByUserId: existing.invitedByUserId ?? null,
+        invitedByCustomerUserId: existing.invitedByCustomerUserId ?? null,
+        displayName: existing.displayName ?? null,
+        expiresAt: new Date(existing.expiresAt)
+      };
       existing.email = normalizedEmail;
       existing.token = tokenHashed;
       existing.customerEntityId = options.customerEntityId || null;
+      existing.personEntityId = options.personEntityId || null;
       existing.roleIdsJson = options.roleIds;
       existing.invitedByUserId = options.invitedByUserId || null;
       existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null;
       existing.displayName = options.displayName || null;
       existing.expiresAt = expiresAt;
       await this.em.flush();
-      return { invitation: existing, rawToken: token };
+      return { invitation: existing, rawToken: token, reused: true, rollbackState };
     }
     const invitation = this.em.create(CustomerUserInvitation, {
       tenantId: scope.tenantId,
@@ -53,6 +65,7 @@ class CustomerInvitationService {
       emailHash,
       token: tokenHashed,
       customerEntityId: options.customerEntityId || null,
+      personEntityId: options.personEntityId || null,
       roleIdsJson: options.roleIds,
       invitedByUserId: options.invitedByUserId || null,
       invitedByCustomerUserId: options.invitedByCustomerUserId || null,
@@ -61,7 +74,23 @@ class CustomerInvitationService {
       createdAt: /* @__PURE__ */ new Date()
     });
     await this.em.persist(invitation).flush();
-    return { invitation, rawToken: token };
+    return { invitation, rawToken: token, reused: false, rollbackState: null };
+  }
+  async rollbackInvitation(invitation, rollbackState) {
+    if (!rollbackState) {
+      await this.em.remove(invitation).flush();
+      return;
+    }
+    invitation.email = rollbackState.email;
+    invitation.token = rollbackState.token;
+    invitation.customerEntityId = rollbackState.customerEntityId;
+    invitation.personEntityId = rollbackState.personEntityId;
+    invitation.roleIdsJson = [...rollbackState.roleIdsJson];
+    invitation.invitedByUserId = rollbackState.invitedByUserId;
+    invitation.invitedByCustomerUserId = rollbackState.invitedByCustomerUserId;
+    invitation.displayName = rollbackState.displayName;
+    invitation.expiresAt = new Date(rollbackState.expiresAt);
+    await this.em.flush();
   }
   async findByToken(token) {
     const tokenHashed = hashToken(token);
@@ -89,6 +118,7 @@ class CustomerInvitationService {
       tenantId: invitation.tenantId,
       organizationId: invitation.organizationId,
       customerEntityId: invitation.customerEntityId || null,
+      personEntityId: invitation.personEntityId || null,
       isActive: true,
       emailVerifiedAt: /* @__PURE__ */ new Date(),
       // Invitation implicitly verifies email

package/dist/modules/customer_accounts/services/customerInvitationService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerInvitationService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            organizationId: invitation.organizationId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
-  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,MAAM;AAAA,IACjD;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport type CustomerInvitationRollbackState = {\n  email: string\n  token: string\n  customerEntityId: string | null\n  personEntityId: string | null\n  roleIdsJson: string[]\n  invitedByUserId: string | null\n  invitedByCustomerUserId: string | null\n  displayName: string | null\n  expiresAt: Date\n}\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      personEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{\n    invitation: CustomerUserInvitation\n    rawToken: string\n    reused: boolean\n    rollbackState: CustomerInvitationRollbackState | null\n  }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      const rollbackState: CustomerInvitationRollbackState = {\n        email: existing.email,\n        token: existing.token,\n        customerEntityId: existing.customerEntityId ?? null,\n        personEntityId: existing.personEntityId ?? null,\n        roleIdsJson: [...(existing.roleIdsJson ?? [])],\n        invitedByUserId: existing.invitedByUserId ?? null,\n        invitedByCustomerUserId: existing.invitedByCustomerUserId ?? null,\n        displayName: existing.displayName ?? null,\n        expiresAt: new Date(existing.expiresAt),\n      }\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.personEntityId = options.personEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token, reused: true, rollbackState }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      personEntityId: options.personEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token, reused: false, rollbackState: null }\n  }\n\n  async rollbackInvitation(\n    invitation: CustomerUserInvitation,\n    rollbackState: CustomerInvitationRollbackState | null,\n  ): Promise<void> {\n    if (!rollbackState) {\n      await this.em.remove(invitation).flush()\n      return\n    }\n\n    invitation.email = rollbackState.email\n    invitation.token = rollbackState.token\n    invitation.customerEntityId = rollbackState.customerEntityId\n    invitation.personEntityId = rollbackState.personEntityId\n    invitation.roleIdsJson = [...rollbackState.roleIdsJson]\n    invitation.invitedByUserId = rollbackState.invitedByUserId\n    invitation.invitedByCustomerUserId = rollbackState.invitedByCustomerUserId\n    invitation.displayName = rollbackState.displayName\n    invitation.expiresAt = new Date(rollbackState.expiresAt)\n    await this.em.flush()\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      personEntityId: invitation.personEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            organizationId: invitation.organizationId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAclC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAaC;AACD,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,YAAM,gBAAiD;AAAA,QACrD,OAAO,SAAS;AAAA,QAChB,OAAO,SAAS;AAAA,QAChB,kBAAkB,SAAS,oBAAoB;AAAA,QAC/C,gBAAgB,SAAS,kBAAkB;AAAA,QAC3C,aAAa,CAAC,GAAI,SAAS,eAAe,CAAC,CAAE;AAAA,QAC7C,iBAAiB,SAAS,mBAAmB;AAAA,QAC7C,yBAAyB,SAAS,2BAA2B;AAAA,QAC7D,aAAa,SAAS,eAAe;AAAA,QACrC,WAAW,IAAI,KAAK,SAAS,SAAS;AAAA,MACxC;AACA,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,iBAAiB,QAAQ,kBAAkB;AACpD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,OAAO,QAAQ,MAAM,cAAc;AAAA,IAC9E;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,OAAO,eAAe,KAAK;AAAA,EAC3E;AAAA,EAEA,MAAM,mBACJ,YACA,eACe;AACf,QAAI,CAAC,eAAe;AAClB,YAAM,KAAK,GAAG,OAAO,UAAU,EAAE,MAAM;AACvC;AAAA,IACF;AAEA,eAAW,QAAQ,cAAc;AACjC,eAAW,QAAQ,cAAc;AACjC,eAAW,mBAAmB,cAAc;AAC5C,eAAW,iBAAiB,cAAc;AAC1C,eAAW,cAAc,CAAC,GAAG,cAAc,WAAW;AACtD,eAAW,kBAAkB,cAAc;AAC3C,eAAW,0BAA0B,cAAc;AACnD,eAAW,cAAc,cAAc;AACvC,eAAW,YAAY,IAAI,KAAK,cAAc,SAAS;AACvD,UAAM,KAAK,GAAG,MAAM;AAAA,EACtB;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,gBAAgB,WAAW,kBAAkB;AAAA,MAC7C,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/subscribers/autoLinkCrm.js

@@ -1,5 +1,6 @@
 import { CustomerUser } from "@open-mercato/core/modules/customer_accounts/data/entities";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveOwnedCompanyForPerson } from "@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customer_accounts").child({ component: "auto-link-crm" });
 const metadata = {
@@ -17,14 +18,51 @@ async function handle(payload, ctx) {
   try {
     const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, void 0, { tenantId, organizationId });
     if (!user) return;
-    if (user.personEntityId) return;
+    const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
+    const ownScope = { tenantId, organizationId: user.organizationId };
+    if (user.customerEntityId) {
+      const linked = await findOneWithDecryption(
+        em,
+        CustomerEntity,
+        { id: user.customerEntityId, tenantId, organizationId: user.organizationId, deletedAt: null },
+        void 0,
+        { tenantId, organizationId }
+      );
+      if (!linked) {
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: null }
+        );
+        user.customerEntityId = null;
+      } else if (linked.kind === "person") {
+        const replacement = await resolveOwnedCompanyForPerson(em, user.customerEntityId, ownScope);
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: replacement }
+        );
+        user.customerEntityId = replacement;
+      }
+    }
+    if (user.personEntityId) {
+      if (user.customerEntityId) return;
+      const recovered = await resolveOwnedCompanyForPerson(em, user.personEntityId, ownScope);
+      if (recovered) {
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: recovered }
+        );
+      }
+      return;
+    }
     const email = (data?.email ? data.email : user.email)?.toLowerCase().trim();
     if (!email) return;
-    const { CustomerEntity } = await import("@open-mercato/core/modules/customers/data/entities");
     const personEntities = await findWithDecryption(
       em,
       CustomerEntity,
-      { tenantId, kind: "person", deletedAt: null },
+      { tenantId, organizationId: user.organizationId, kind: "person", deletedAt: null },
       { limit: 500 },
       { tenantId, organizationId }
     );
@@ -32,14 +70,16 @@ async function handle(payload, ctx) {
       (e) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email
     );
     if (!matchingEntity) return;
-    const { CustomerPersonProfile } = await import("@open-mercato/core/modules/customers/data/entities");
-    const profile = await em.findOne(CustomerPersonProfile, { entity: matchingEntity.id });
-    const companyEntityId = profile?.companyEntityId;
+    const companyEntityId = await resolveOwnedCompanyForPerson(em, matchingEntity.id, ownScope);
     const updates = { personEntityId: matchingEntity.id };
     if (companyEntityId) {
       updates.customerEntityId = companyEntityId;
     }
-    await em.nativeUpdate(CustomerUser, { id: userId }, updates);
+    await em.nativeUpdate(
+      CustomerUser,
+      { id: userId, tenantId, organizationId: user.organizationId },
+      updates
+    );
   } catch (err) {
     logger.error("Failed to link customer user to CRM person", { err });
   }

package/dist/modules/customer_accounts/subscribers/autoLinkCrm.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/subscribers/autoLinkCrm.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'auto-link-crm' })\n\nexport const metadata = {\n  event: 'customer_accounts.user.created',\n  persistent: true,\n  id: 'customer_accounts:auto-link-crm',\n}\n\nexport default async function handle(\n  payload: unknown,\n  ctx: { resolve: <T = unknown>(name: string) => T; eventName?: string },\n): Promise<void> {\n  const data = payload as Record<string, unknown>\n  const userId = data?.id as string\n  const tenantId = data?.tenantId as string\n  const organizationId = data?.organizationId as string | undefined\n  if (!userId || !tenantId) return\n\n  const em = ctx.resolve<EntityManager>('em')\n\n  try {\n    const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, undefined, { tenantId, organizationId })\n    if (!user) return\n    if (user.personEntityId) return\n\n    const email = (data?.email ? (data.email as string) : user.email)?.toLowerCase().trim()\n    if (!email) return\n\n    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n\n    const personEntities = await findWithDecryption(\n      em,\n      CustomerEntity,\n      { tenantId, kind: 'person', deletedAt: null } as any,\n      { limit: 500 } as any,\n      { tenantId, organizationId },\n    )\n\n    const matchingEntity = personEntities.find(\n      (e: any) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email,\n    ) as any\n\n    if (!matchingEntity) return\n\n    const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')\n    const profile = await em.findOne(CustomerPersonProfile as any, { entity: matchingEntity.id } as any) as any\n    const companyEntityId = profile?.companyEntityId as string | undefined\n\n    const updates: Record<string, unknown> = { personEntityId: matchingEntity.id }\n    if (companyEntityId) {\n      updates.customerEntityId = companyEntityId\n    }\n\n    await em.nativeUpdate(CustomerUser, { id: userId }, updates)\n  } catch (err) {\n    logger.error('Failed to link customer user to CRM person', { err })\n  }\n}\n"],
-  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,eAAO,OACL,SACA,KACe;AACf,QAAM,OAAO;AACb,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAC7B,MAAI,CAAC,UAAU,CAAC,SAAU;AAE1B,QAAM,KAAK,IAAI,QAAuB,IAAI;AAE1C,MAAI;AACF,UAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,UAAU,eAAe,CAAC;AAC7I,QAAI,CAAC,KAAM;AACX,QAAI,KAAK,eAAgB;AAEzB,UAAM,SAAS,MAAM,QAAS,KAAK,QAAmB,KAAK,QAAQ,YAAY,EAAE,KAAK;AACtF,QAAI,CAAC,MAAO;AAEZ,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAE5F,UAAM,iBAAiB,MAAM;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,WAAW,KAAK;AAAA,MAC5C,EAAE,OAAO,IAAI;AAAA,MACb,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,iBAAiB,eAAe;AAAA,MACpC,CAAC,MAAW,EAAE,gBAAgB,EAAE,aAAa,YAAY,EAAE,KAAK,MAAM;AAAA,IACxE;AAEA,QAAI,CAAC,eAAgB;AAErB,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,oDAAoD;AACnG,UAAM,UAAU,MAAM,GAAG,QAAQ,uBAA8B,EAAE,QAAQ,eAAe,GAAG,CAAQ;AACnG,UAAM,kBAAkB,SAAS;AAEjC,UAAM,UAAmC,EAAE,gBAAgB,eAAe,GAAG;AAC7E,QAAI,iBAAiB;AACnB,cAAQ,mBAAmB;AAAA,IAC7B;AAEA,UAAM,GAAG,aAAa,cAAc,EAAE,IAAI,OAAO,GAAG,OAAO;AAAA,EAC7D,SAAS,KAAK;AACZ,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'auto-link-crm' })\n\nexport const metadata = {\n  event: 'customer_accounts.user.created',\n  persistent: true,\n  id: 'customer_accounts:auto-link-crm',\n}\n\nexport default async function handle(\n  payload: unknown,\n  ctx: { resolve: <T = unknown>(name: string) => T; eventName?: string },\n): Promise<void> {\n  const data = payload as Record<string, unknown>\n  const userId = data?.id as string\n  const tenantId = data?.tenantId as string\n  const organizationId = data?.organizationId as string | undefined\n  if (!userId || !tenantId) return\n\n  const em = ctx.resolve<EntityManager>('em')\n\n  try {\n    const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, undefined, { tenantId, organizationId })\n    if (!user) return\n\n    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')\n\n    // Every lookup and write below normalizes against the user's OWN org, not just\n    // the tenant: customerEntityId is the portal's company scope key (portal user\n    // and invite routes filter on it), so adopting an entity from another org would\n    // widen the user's portal access instead of repairing it.\n    const ownScope = { tenantId, organizationId: user.organizationId }\n\n    // Defensive normalization for NEW users only \u2014 this subscriber runs on\n    // `customer_accounts.user.created`, which is never re-emitted for an existing\n    // row. customerEntityId is the CRM company FK, and earlier invite flows (#4362)\n    // could poison it with a person entity id, which then breaks every later user\n    // edit (\"Company not found\"). If the linked entity is a person (not a company)\n    // or sits outside the user's org, drop it \u2014 or recover the person's real company\n    // from their profile. Correct company links are left untouched. Rows created\n    // before this change keep their bad FK; see #4473 for the backfill.\n    if (user.customerEntityId) {\n      const linked = await findOneWithDecryption(\n        em,\n        CustomerEntity,\n        { id: user.customerEntityId, tenantId, organizationId: user.organizationId, deletedAt: null } as any,\n        undefined,\n        { tenantId, organizationId },\n      ) as any\n      if (!linked) {\n        // Not resolvable inside the user's own org \u2014 a cross-org (or deleted)\n        // entity. Clear it rather than leave it: this FK is the portal scope key.\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: null },\n        )\n        user.customerEntityId = null\n      } else if (linked.kind === 'person') {\n        // Only adopt a recovered company that is itself in the user's org.\n        const replacement = await resolveOwnedCompanyForPerson(em, user.customerEntityId, ownScope)\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: replacement },\n        )\n        user.customerEntityId = replacement\n      }\n    }\n\n    // A user invited from a CRM person card arrives with personEntityId already\n    // set, so the email-matching path below never runs for it. Derive the company\n    // FK from that person's own profile instead of leaving it null forever \u2014 the\n    // portal Users page, portal invitations, and the company detail \"Portal users\"\n    // group all key off customerEntityId (#4362).\n    if (user.personEntityId) {\n      if (user.customerEntityId) return\n      const recovered = await resolveOwnedCompanyForPerson(em, user.personEntityId, ownScope)\n      if (recovered) {\n        await em.nativeUpdate(\n          CustomerUser,\n          { id: userId, tenantId, organizationId: user.organizationId },\n          { customerEntityId: recovered },\n        )\n      }\n      return\n    }\n\n    const email = (data?.email ? (data.email as string) : user.email)?.toLowerCase().trim()\n    if (!email) return\n\n    // Scope the candidate lookup to the user's own org. The fifth argument is a\n    // decryption scope, not a filter, so without organizationId in the `where`\n    // this matches people across every org in the tenant and writes a cross-org\n    // link that the normalization block above just cleared.\n    const personEntities = await findWithDecryption(\n      em,\n      CustomerEntity,\n      { tenantId, organizationId: user.organizationId, kind: 'person', deletedAt: null } as any,\n      { limit: 500 } as any,\n      { tenantId, organizationId },\n    )\n\n    const matchingEntity = personEntities.find(\n      (e: any) => e.primaryEmail && e.primaryEmail.toLowerCase().trim() === email,\n    ) as any\n\n    if (!matchingEntity) return\n\n    const companyEntityId = await resolveOwnedCompanyForPerson(em, matchingEntity.id, ownScope)\n\n    const updates: Record<string, unknown> = { personEntityId: matchingEntity.id }\n    if (companyEntityId) {\n      updates.customerEntityId = companyEntityId\n    }\n\n    await em.nativeUpdate(\n      CustomerUser,\n      { id: userId, tenantId, organizationId: user.organizationId },\n      updates,\n    )\n  } catch (err) {\n    logger.error('Failed to link customer user to CRM person', { err })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,oBAAoB;AAC7B,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,eAAO,OACL,SACA,KACe;AACf,QAAM,OAAO;AACb,QAAM,SAAS,MAAM;AACrB,QAAM,WAAW,MAAM;AACvB,QAAM,iBAAiB,MAAM;AAC7B,MAAI,CAAC,UAAU,CAAC,SAAU;AAE1B,QAAM,KAAK,IAAI,QAAuB,IAAI;AAE1C,MAAI;AACF,UAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,QAAQ,UAAU,WAAW,KAAK,GAAG,QAAW,EAAE,UAAU,eAAe,CAAC;AAC7I,QAAI,CAAC,KAAM;AAEX,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,oDAAoD;AAM5F,UAAM,WAAW,EAAE,UAAU,gBAAgB,KAAK,eAAe;AAUjE,QAAI,KAAK,kBAAkB;AACzB,YAAM,SAAS,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,kBAAkB,UAAU,gBAAgB,KAAK,gBAAgB,WAAW,KAAK;AAAA,QAC5F;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,QAAQ;AAGX,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,KAAK;AAAA,QAC3B;AACA,aAAK,mBAAmB;AAAA,MAC1B,WAAW,OAAO,SAAS,UAAU;AAEnC,cAAM,cAAc,MAAM,6BAA6B,IAAI,KAAK,kBAAkB,QAAQ;AAC1F,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,YAAY;AAAA,QAClC;AACA,aAAK,mBAAmB;AAAA,MAC1B;AAAA,IACF;AAOA,QAAI,KAAK,gBAAgB;AACvB,UAAI,KAAK,iBAAkB;AAC3B,YAAM,YAAY,MAAM,6BAA6B,IAAI,KAAK,gBAAgB,QAAQ;AACtF,UAAI,WAAW;AACb,cAAM,GAAG;AAAA,UACP;AAAA,UACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,UAC5D,EAAE,kBAAkB,UAAU;AAAA,QAChC;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,QAAS,KAAK,QAAmB,KAAK,QAAQ,YAAY,EAAE,KAAK;AACtF,QAAI,CAAC,MAAO;AAMZ,UAAM,iBAAiB,MAAM;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,gBAAgB,KAAK,gBAAgB,MAAM,UAAU,WAAW,KAAK;AAAA,MACjF,EAAE,OAAO,IAAI;AAAA,MACb,EAAE,UAAU,eAAe;AAAA,IAC7B;AAEA,UAAM,iBAAiB,eAAe;AAAA,MACpC,CAAC,MAAW,EAAE,gBAAgB,EAAE,aAAa,YAAY,EAAE,KAAK,MAAM;AAAA,IACxE;AAEA,QAAI,CAAC,eAAgB;AAErB,UAAM,kBAAkB,MAAM,6BAA6B,IAAI,eAAe,IAAI,QAAQ;AAE1F,UAAM,UAAmC,EAAE,gBAAgB,eAAe,GAAG;AAC7E,QAAI,iBAAiB;AACnB,cAAQ,mBAAmB;AAAA,IAC7B;AAEA,UAAM,GAAG;AAAA,MACP;AAAA,MACA,EAAE,IAAI,QAAQ,UAAU,gBAAgB,KAAK,eAAe;AAAA,MAC5D;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAAA,EACpE;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/widgets/injection/account-status/widget.client.js

@@ -94,7 +94,7 @@ function InviteForm({ personEntityId, onSuccess }) {
     try {
       await runMutation({
         context: { entityType: "customer_accounts:user" },
-        mutationPayload: { customerEntityId: personEntityId, roleIds: selectedRoleIds },
+        mutationPayload: { personEntityId, roleIds: selectedRoleIds },
         operation: async () => {
           const call = await apiCall(
             "/api/customer_accounts/admin/users-invite",
@@ -105,7 +105,7 @@ function InviteForm({ personEntityId, onSuccess }) {
                 email: trimmedEmail,
                 roleIds: selectedRoleIds,
                 displayName: displayName.trim() || void 0,
-                customerEntityId: personEntityId
+                personEntityId
               })
             }
           );