@open-mercato/core 0.6.7-develop.6842.1.8cd8a8883c → 0.6.7-develop.6859.1.e4727b568a

package/src/modules/entities/cli.ts

@@ -23,6 +23,7 @@ import {
   parseDecryptedFieldValue,
 } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { resolveEntityIdFromMetadata } from '@open-mercato/shared/lib/encryption/entityIds'
+import { listEntityMetadata } from '@open-mercato/shared/lib/db/entityMetadata'
 import { Organization } from '../directory/data/entities'
 import crypto from 'node:crypto'
 
@@ -263,8 +264,28 @@ function resolveEncryptionMapModules(): Module[] {
   }
 }
 
+/**
+ * Entity ids whose encryption map is declared in module code with `keyScope: 'system'`.
+ *
+ * Their ciphertext is sealed under a `system:<entityId>` DEK that has no tenant, so every
+ * tenant-scoped command here MUST leave them alone: re-wrapping such a value under a tenant
+ * DEK produces a payload runtime decryption can never read again. `backfill-system-encryption`
+ * is the one command that handles them.
+ */
+function getSystemScopedEntityIds(): Set<string> {
+  return new Set(
+    getDefaultEncryptionMaps(resolveEncryptionMapModules())
+      .filter((map) => map.keyScope === 'system')
+      .map((map) => map.entityId),
+  )
+}
+
 async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
   for (const spec of getDefaultEncryptionMaps(resolveEncryptionMapModules())) {
+    if (spec.keyScope === 'system') {
+      logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)
+      continue
+    }
     const existing = await em.findOne(EncryptionMap, {
       entityId: spec.entityId,
       tenantId,
@@ -378,9 +399,7 @@ function resolveProperty(meta: any, field: string): { columnName: string | null;
 }
 
 function buildEntityMetaRegistry(em: any): Map<string, any> {
-  const registry = em?.getMetadata?.()
-  const allMetaRaw = typeof registry?.getAll === 'function' ? registry.getAll() : []
-  const allMeta = Array.isArray(allMetaRaw) ? allMetaRaw : Object.values(allMetaRaw ?? {})
+  const allMeta = listEntityMetadata(em)
   const metaByEntityId = new Map<string, any>()
   for (const meta of allMeta) {
     const resolved = resolveEntityIdFromMetadata(meta)
@@ -414,6 +433,21 @@ function resolveMapMeta(
   return { entityId, meta, fields, tenantId }
 }
 
+function isEncryptedPayload(value: unknown): boolean {
+  if (typeof value !== 'string') return false
+  const parts = value.split(':')
+  return parts.length === 4 && parts[3] === 'v1'
+}
+
+function formatValueForColumn(prop: any, value: unknown): unknown {
+  if (value === null || value === undefined) return value
+  const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
+  const type = String(prop?.type ?? '').toLowerCase()
+  const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
+  if (!isJson) return value
+  return JSON.stringify(value)
+}
+
 const rotateEncryptionKey: ModuleCli = {
   command: 'rotate-encryption-key',
   async run(rest) {
@@ -470,32 +504,25 @@ const rotateEncryptionKey: ModuleCli = {
       }
     }
 
-    const isEncryptedPayload = (value: unknown): boolean => {
-      if (typeof value !== 'string') return false
-      const parts = value.split(':')
-      return parts.length === 4 && parts[3] === 'v1'
-    }
-
     const metaByEntityId = buildEntityMetaRegistry(em)
 
     const where: any = { deletedAt: null }
     if (tenantIdArg) where.tenantId = tenantIdArg
     if (organizationIdArg) where.organizationId = organizationIdArg
-    const maps = await em.find(EncryptionMap, where)
+    const allMaps = await em.find(EncryptionMap, where)
+    const systemScopedEntityIds = getSystemScopedEntityIds()
+    const maps = allMaps.filter((map: EncryptionMap) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key and cannot be rotated with a tenant key — use "mercato entities backfill-system-encryption" instead.`,
+      )
+      return false
+    })
     if (!maps.length) {
       console.log('No encryption maps found for the selected scope.')
       return
     }
 
-    const formatValueForColumn = (prop: any, value: unknown): unknown => {
-      if (value === null || value === undefined) return value
-      const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
-      const type = String(prop?.type ?? '').toLowerCase()
-      const isJson = types.some((entry: string) => entry.toLowerCase().includes('json')) || type === 'json' || type === 'jsonb'
-      if (!isJson) return value
-      return JSON.stringify(value)
-    }
-
     const resolveScopes = async (tenantId: string, organizationId: string | null) => {
       if (organizationId) return [{ tenantId, organizationId }]
       const orgs = await em.find(Organization, { tenant: tenantId })
@@ -699,7 +726,15 @@ const decryptDatabase: ModuleCli = {
     const mapWhere: any = { tenantId: tenantIdArg, deletedAt: null, isActive: true }
     if (organizationIdArg) mapWhere.organizationId = organizationIdArg
     if (entityIdArg) mapWhere.entityId = entityIdArg
-    const maps = await em.find(EncryptionMap, mapWhere)
+    const allMaps = await em.find(EncryptionMap, mapWhere)
+    const systemScopedEntityIds = getSystemScopedEntityIds()
+    const maps = allMaps.filter((map: EncryptionMap) => {
+      if (!systemScopedEntityIds.has(String(map.entityId))) return true
+      console.warn(
+        `Skipping ${map.entityId}: system-scoped entity. Its ciphertext is sealed under a system key that the tenant DEK cannot open, so this command leaves it untouched.`,
+      )
+      return false
+    })
 
     if (!maps.length) {
       console.log('No active encryption maps found for the selected scope.')
@@ -986,5 +1021,187 @@ const decryptDatabase: ModuleCli = {
   },
 }
 
+/**
+ * Encrypt rows that a **system-scoped** encryption map covers but that were written
+ * before the map existed.
+ *
+ * `rotate-encryption-key` cannot reach them: it walks the `encryption_maps` table and
+ * skips every row without a `tenant_id`, while system-scoped maps are declared in module
+ * code (`defaultEncryptionMaps` with `keyScope: 'system'`) and cover pre-tenant records
+ * that have no tenant at all — onboarding requests being the first such entity. Without a
+ * backfill those historical rows stay plaintext forever, since only the write path
+ * encrypts.
+ *
+ * The command is forward-only (plaintext → ciphertext), never accepts an old key and never
+ * decrypts, so it cannot re-encrypt data under the wrong key. It is idempotent: values that
+ * already decrypt under the current system DEK are left untouched by
+ * `encryptEntityPayload`, so a partial run can simply be repeated.
+ */
+const backfillSystemEncryption: ModuleCli = {
+  command: 'backfill-system-encryption',
+  async run(rest) {
+    const args = parseArgs(rest)
+    const entityIdArg = (args.entity as string) || null
+    const dryRun = Boolean(args['dry-run'] || args.dry)
+    const batchSize = Math.max(1, parseInt(String(args['batch-size'] || args.batchSize || '500'), 10) || 500)
+    const debug = Boolean(args.debug)
+
+    if (!isTenantDataEncryptionEnabled()) {
+      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Enable encryption before backfilling.')
+      return
+    }
+
+    const systemMaps = getDefaultEncryptionMaps(resolveEncryptionMapModules()).filter((map) => map.keyScope === 'system')
+    if (!systemMaps.length) {
+      console.log('No system-scoped encryption maps are declared by the installed modules. Nothing to backfill.')
+      return
+    }
+    const selectedMaps = entityIdArg ? systemMaps.filter((map) => map.entityId === entityIdArg) : systemMaps
+    if (!selectedMaps.length) {
+      console.error(`No system-scoped encryption map declared for entity "${entityIdArg}".`)
+      console.error(`Known system-scoped entities: ${systemMaps.map((map) => map.entityId).join(', ')}`)
+      return
+    }
+
+    const { resolve } = await createRequestContainer()
+    const em = resolve('em') as any
+    const conn: any = em?.getConnection?.()
+    if (!conn || typeof conn.execute !== 'function') {
+      console.error('Unable to access raw database connection; aborting.')
+      return
+    }
+
+    const encryptionService = new TenantDataEncryptionService(em as any, {
+      kms: createKmsService(),
+      defaultEncryptionMaps: systemMaps,
+    })
+    if (!encryptionService.isEnabled()) {
+      console.error('Encryption service is not enabled (KMS unhealthy). Aborting without touching any row.')
+      return
+    }
+
+    const metaByEntityId = buildEntityMetaRegistry(em)
+    const prefix = dryRun ? '[dry-run] ' : ''
+    let totalRowsScanned = 0
+    let totalRowsUpdated = 0
+    let totalRowsUnchanged = 0
+
+    for (const map of selectedMaps) {
+      const entityId = map.entityId
+      const meta = metaByEntityId.get(entityId)
+      if (!meta) {
+        console.warn(`Skipping ${entityId}: entity metadata not found (is the owning module enabled?).`)
+        continue
+      }
+      const tableName = meta?.tableName
+      if (!tableName) {
+        console.warn(`Skipping ${entityId}: entity has no table name.`)
+        continue
+      }
+      const primaryKey = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'
+      const { columnName: primaryKeyColumn } = resolveProperty(meta, primaryKey)
+      const pkColumn = primaryKeyColumn ?? primaryKey
+      const qualifiedTable = meta?.schema ? `"${meta.schema}"."${tableName}"` : `"${tableName}"`
+
+      const columns = new Set<string>([pkColumn])
+      for (const rule of map.fields) {
+        const resolved = resolveProperty(meta, rule.field)
+        if (resolved.columnName) columns.add(resolved.columnName)
+        if (rule.hashField) {
+          const resolvedHash = resolveProperty(meta, rule.hashField)
+          if (resolvedHash.columnName) columns.add(resolvedHash.columnName)
+        }
+      }
+      const columnList = Array.from(columns)
+      const selectList = columnList.map((column) => `"${column}"`).join(', ')
+
+      let cursor: unknown = null
+      let entityRowsScanned = 0
+      let entityRowsUpdated = 0
+      let entityRowsUnchanged = 0
+
+      for (;;) {
+        const selectSql = cursor === null
+          ? `select ${selectList} from ${qualifiedTable} order by "${pkColumn}" asc limit ?`
+          : `select ${selectList} from ${qualifiedTable} where "${pkColumn}" > ? order by "${pkColumn}" asc limit ?`
+        const params = cursor === null ? [batchSize] : [cursor, batchSize]
+        const rows = await conn.execute(selectSql, params)
+        const list = Array.isArray(rows) ? rows : []
+        if (!list.length) break
+
+        for (const row of list) {
+          entityRowsScanned += 1
+          cursor = row[pkColumn]
+          const payload: Record<string, unknown> = {}
+          let hasPlaintext = false
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field)
+            if (!resolved.columnName) continue
+            const rawValue = row[resolved.columnName]
+            payload[rule.field] = rawValue
+            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField)
+              if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]
+            }
+          }
+          if (!hasPlaintext) continue
+
+          const encrypted = await encryptionService.encryptEntityPayload(entityId, payload, null, null)
+          const updates: Record<string, unknown> = {}
+          for (const rule of map.fields) {
+            const resolved = resolveProperty(meta, rule.field)
+            if (resolved.columnName) {
+              const nextValue = encrypted[rule.field]
+              if (nextValue !== undefined && nextValue !== row[resolved.columnName]) {
+                updates[resolved.columnName] = formatValueForColumn(resolved.prop, nextValue)
+              }
+            }
+            if (rule.hashField) {
+              const resolvedHash = resolveProperty(meta, rule.hashField)
+              const nextHash = encrypted[rule.hashField]
+              if (resolvedHash.columnName && nextHash !== undefined && nextHash !== row[resolvedHash.columnName]) {
+                updates[resolvedHash.columnName] = formatValueForColumn(resolvedHash.prop, nextHash)
+              }
+            }
+          }
+          if (!Object.keys(updates).length) {
+            entityRowsUnchanged += 1
+            if (debug) console.warn(`[backfill-system-encryption] ${entityId} ${String(row[pkColumn])}: plaintext left unchanged`)
+            continue
+          }
+          if (!dryRun) {
+            const setSql = Object.keys(updates).map((column) => `"${column}" = ?`).join(', ')
+            await conn.execute(
+              `update ${qualifiedTable} set ${setSql} where "${pkColumn}" = ?`,
+              [...Object.values(updates), row[pkColumn]],
+            )
+          }
+          entityRowsUpdated += 1
+        }
+
+        if (list.length < batchSize) break
+      }
+
+      totalRowsScanned += entityRowsScanned
+      totalRowsUpdated += entityRowsUpdated
+      totalRowsUnchanged += entityRowsUnchanged
+      console.log(`${prefix}${entityId}: scanned ${entityRowsScanned}, encrypted ${entityRowsUpdated}`)
+    }
+
+    console.log(`\n${prefix}Backfill summary:`)
+    console.log(`  Rows scanned:   ${totalRowsScanned}`)
+    console.log(`  Rows encrypted: ${totalRowsUpdated}`)
+    if (totalRowsUnchanged > 0) {
+      console.warn(
+        `  ⚠ ${totalRowsUnchanged} row(s) held plaintext that could not be encrypted — the system DEK was unavailable. Verify the KMS/fallback key, then re-run (use --debug to list the rows).`,
+      )
+    }
+    if (!dryRun && totalRowsUpdated > 0) {
+      console.log('\n✅ Backfill complete. Re-run with --dry-run to confirm no plaintext rows remain.')
+    }
+  },
+}
+
 // Keep default export stable (install first for help listing)
-export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase]
+export default [seedDefs, reinstallDefs, addField, seedEncryptionMaps, rotateEncryptionKey, decryptDatabase, backfillSystemEncryption]

package/src/modules/entities/components/RecordListRelationCell.tsx

@@ -0,0 +1,90 @@
+"use client"
+import * as React from 'react'
+import Link from 'next/link'
+import type { CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'
+import {
+  getRecordListRelationDisplays,
+  resolveRecordListRelationDisplays,
+  type RelationDisplaysByField,
+} from './recordListRelationDisplays'
+
+const RelationDisplaysContext = React.createContext<RelationDisplaysByField>({})
+
+export function RelationDisplaysProvider({
+  displaysByField,
+  children,
+}: {
+  displaysByField: RelationDisplaysByField
+  children: React.ReactNode
+}) {
+  return (
+    <RelationDisplaysContext.Provider value={displaysByField}>
+      {children}
+    </RelationDisplaysContext.Provider>
+  )
+}
+
+export function useRecordListRelationDisplays(
+  definitions: CustomFieldDefDto[],
+  records: Array<Record<string, unknown>>,
+): RelationDisplaysByField {
+  const [displaysByField, setDisplaysByField] = React.useState<RelationDisplaysByField>({})
+
+  React.useEffect(() => {
+    const abortController = new AbortController()
+    setDisplaysByField((current) => (Object.keys(current).length ? {} : current))
+    if (!definitions.length || !records.length) {
+      return () => abortController.abort()
+    }
+
+    void resolveRecordListRelationDisplays(definitions, records, abortController.signal)
+      .then((resolvedDisplays) => {
+        if (!abortController.signal.aborted) setDisplaysByField(resolvedDisplays)
+      })
+      .catch(() => {
+        if (!abortController.signal.aborted) setDisplaysByField({})
+      })
+
+    return () => abortController.abort()
+  }, [definitions, records])
+
+  return displaysByField
+}
+
+export function RelationCell({
+  fieldKey,
+  value,
+  fallbackText,
+}: {
+  fieldKey: string
+  value: unknown
+  fallbackText: string
+}) {
+  const displaysByField = React.useContext(RelationDisplaysContext)
+  const resolvedDisplays = getRecordListRelationDisplays(value, displaysByField[fieldKey])
+  const rawValue = resolvedDisplays.map((display) => display.id).join(', ') || fallbackText
+
+  if (!resolvedDisplays.length) {
+    return <span className="inline-block max-w-60 truncate align-top" title={rawValue}>{rawValue}</span>
+  }
+
+  return (
+    <span className="inline-block max-w-60 truncate align-top" title={rawValue}>
+      {resolvedDisplays.map((display, index) => (
+        <React.Fragment key={`${display.id}-${index}`}>
+          {index > 0 ? ', ' : null}
+          {display.href ? (
+            <Link
+              href={display.href}
+              className="font-medium text-primary underline-offset-2 hover:underline focus-visible:underline"
+              onClick={(event) => event.stopPropagation()}
+              onKeyDown={(event) => event.stopPropagation()}
+            >
+              {display.label}
+            </Link>
+          ) : display.label}
+        </React.Fragment>
+      ))}
+    </span>
+  )
+}

package/src/modules/entities/components/recordListRelationDisplays.ts

@@ -0,0 +1,109 @@
+import type { CustomFieldDefDto } from '@open-mercato/ui/backend/utils/customFieldDefs'
+import {
+  buildRelationHref,
+  collectRelationValueIds,
+  fetchRelationRecordDisplays,
+  parseRelationOptionsMetadata,
+  type RelationOptionsMetadata,
+  type ResolvedValueDisplay,
+} from '@open-mercato/ui/backend/utils/customFieldRelationDisplay'
+
+export type RelationDisplaysByField = Record<string, Record<string, ResolvedValueDisplay>>
+
+type RelationLookup = {
+  optionsUrl: string
+  relation: RelationOptionsMetadata
+  recordIds: Set<string>
+  recordIdsByField: Map<string, Set<string>>
+}
+
+export function resolveRelationOptionsUrl(definition: CustomFieldDefDto): string | null {
+  if (definition.kind !== 'relation') return null
+
+  const configuredUrl = definition.optionsUrl?.trim()
+  if (configuredUrl && parseRelationOptionsMetadata(configuredUrl)) return configuredUrl
+
+  const relatedEntityId = definition.relatedEntityId?.trim()
+  if (!relatedEntityId) return null
+  return `/api/entities/relations/options?entityId=${encodeURIComponent(relatedEntityId)}`
+}
+
+function collectRelationLookups(
+  definitions: CustomFieldDefDto[],
+  records: Array<Record<string, unknown>>,
+): RelationLookup[] {
+  const lookups = new Map<string, RelationLookup>()
+
+  definitions.forEach((definition) => {
+    const optionsUrl = resolveRelationOptionsUrl(definition)
+    if (!optionsUrl) return
+    const relation = parseRelationOptionsMetadata(optionsUrl)
+    if (!relation) return
+
+    const recordIds = new Set(
+      records.flatMap((record) => collectRelationValueIds(record[definition.key])),
+    )
+    if (!recordIds.size) return
+
+    const lookupKey = JSON.stringify([relation.entityId, optionsUrl])
+    const lookup = lookups.get(lookupKey) ?? {
+      optionsUrl,
+      relation,
+      recordIds: new Set<string>(),
+      recordIdsByField: new Map<string, Set<string>>(),
+    }
+    recordIds.forEach((recordId) => lookup.recordIds.add(recordId))
+    lookup.recordIdsByField.set(definition.key, recordIds)
+    lookups.set(lookupKey, lookup)
+  })
+
+  return Array.from(lookups.values())
+}
+
+export async function resolveRecordListRelationDisplays(
+  definitions: CustomFieldDefDto[],
+  records: Array<Record<string, unknown>>,
+  signal?: AbortSignal,
+): Promise<RelationDisplaysByField> {
+  const displaysByField: RelationDisplaysByField = {}
+  const lookups = collectRelationLookups(definitions, records)
+
+  await Promise.all(lookups.map(async (lookup) => {
+    let fetchedDisplays: Record<string, ResolvedValueDisplay> = {}
+    try {
+      fetchedDisplays = await fetchRelationRecordDisplays(
+        lookup.optionsUrl,
+        lookup.relation,
+        Array.from(lookup.recordIds),
+        signal,
+      )
+    } catch {
+      fetchedDisplays = {}
+    }
+
+    if (signal?.aborted) return
+    lookup.recordIdsByField.forEach((recordIds, fieldKey) => {
+      const fieldDisplays: Record<string, ResolvedValueDisplay> = {}
+      recordIds.forEach((recordId) => {
+        fieldDisplays[recordId] = fetchedDisplays[recordId] ?? {
+          label: recordId,
+          href: buildRelationHref(lookup.relation.entityId, recordId),
+        }
+      })
+      displaysByField[fieldKey] = fieldDisplays
+    })
+  }))
+
+  return displaysByField
+}
+
+export function getRecordListRelationDisplays(
+  value: unknown,
+  displays: Record<string, ResolvedValueDisplay> | undefined,
+): Array<{ id: string; label: string; href?: string }> {
+  return collectRelationValueIds(value).map((recordId) => ({
+    id: recordId,
+    label: displays?.[recordId]?.label ?? recordId,
+    href: displays?.[recordId]?.href,
+  }))
+}

package/src/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.ts

@@ -1,6 +1,8 @@
 import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { runWithCacheTenant } from '@open-mercato/cache'
+import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -40,6 +42,20 @@ export async function PATCH(req: Request) {
       return NextResponse.json({ error: 'Action already processed' }, { status: 409 })
     }
 
+    // Optimistic lock: refuse a stale overwrite when two tabs edit the same action
+    // payload. Strictly additive — a no-op without the expected-version header.
+    try {
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
+        resourceKind: 'inbox_ops.action',
+        resourceId: action.id,
+        current: action.updatedAt ?? null,
+        request: req,
+      })
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+      throw err
+    }
+
     const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }
     const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)
     if (!payloadValidation.success) {
@@ -108,7 +124,7 @@ export const openApi: OpenApiRouteDoc = {
       responses: [
         { status: 200, description: 'Action updated' },
         { status: 404, description: 'Action not found' },
-        { status: 409, description: 'Action already processed' },
+        { status: 409, description: 'Action already processed or stale (optimistic-lock conflict)' },
       ],
     },
   },

package/src/modules/inbox_ops/components/proposals/EditActionDialog.tsx

@@ -9,8 +9,8 @@ import {
   SelectTrigger,
   SelectValue,
 } from '@open-mercato/ui/primitives/select'
-import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
-import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { apiCallOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -461,25 +461,30 @@ export function EditActionDialog({
     }
 
     setIsSaving(true)
-    const result = await runMutation({
-      // TODO(#2373-D): thread updatedAt — ActionDetail type lives outside this file's edit scope
-      operation: () => withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(undefined),
-        () => apiCall<{ ok: boolean; error?: string }>(
-          `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
-          { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+    try {
+      await runMutation({
+        operation: () => withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(action.updatedAt),
+          () => apiCallOrThrow<{ ok: boolean; error?: string }>(
+            `/api/inbox_ops/proposals/${action.proposalId}/actions/${action.id}`,
+            { method: 'PATCH', body: JSON.stringify({ payload: finalPayload }) },
+          ),
         ),
-      ),
-      context: {},
-    })
-    if (result?.ok && result.result?.ok) {
+        context: {},
+      })
       flash(t('inbox_ops.edit_dialog.saved', 'Action updated successfully'), 'success')
       onSaved()
       onClose()
-    } else {
-      flash(result?.result?.error || t('inbox_ops.flash.save_failed', 'Failed to save'), 'error')
+    } catch (error) {
+      if (extractOptimisticLockConflict(error)) {
+        onClose()
+        return
+      }
+      const message = error instanceof Error ? error.message.trim() : ''
+      flash(message || t('inbox_ops.flash.save_failed', 'Failed to save'), 'error')
+    } finally {
+      setIsSaving(false)
     }
-    setIsSaving(false)
   }, [action, payload, jsonMode, jsonText, t, onSaved, onClose, runMutation])
 
   React.useEffect(() => {

package/src/modules/inbox_ops/components/proposals/types.ts

@@ -27,6 +27,7 @@ export type ActionDetail = {
   createdEntityType?: string
   executionError?: string
   executedAt?: string
+  updatedAt?: string
 }
 
 export type DiscrepancyDetail = {

package/src/modules/messages/api/[id]/route.ts

@@ -402,6 +402,27 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
+  const isSender = message.senderUserId === scope.userId
+  // Only look the recipient row up when the actor is not the sender: deleting one's own
+  // message is the common path, and the lookup is a decryption-aware query.
+  const isRecipient = isSender
+    ? false
+    : Boolean(await findOneWithDecryption(
+      em,
+      MessageRecipient,
+      {
+        messageId: params.id,
+        recipientUserId: scope.userId,
+        deletedAt: null,
+      },
+      undefined,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId },
+    ))
+
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {

package/src/modules/query_index/api/reindex.ts

@@ -85,6 +85,21 @@ export async function POST(req: Request) {
       },
     },
   ).catch(() => undefined)
+  // Queued once here rather than from a partition: the purge deletes every vector for the
+  // scope, so emitting it from inside the fan-out would race the per-record vectorize jobs
+  // its siblings are already queueing and drop vectors this run had just rebuilt.
+  if (force && partitions.length > 1) {
+    try {
+      await bus.emitEvent(
+        'query_index.vectorize_purge',
+        { entityType, tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
+        { persistent: true, deliverInline: false },
+      )
+    } catch {
+      // Best effort: a failed purge leaves stale vectors, which the orphan sweep still prunes.
+    }
+  }
+
   try {
     await Promise.all(
       partitions.map((part) => {