@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/customers/lib/visibilityFilter.js

@@ -1,8 +1,10 @@
-import { hasFeature } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 const EMAIL_VIEW_PRIVATE_FEATURE = "customers.email.view_private";
 function callerHasEmailViewPrivate(userFeatures) {
   if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false;
-  return hasFeature(userFeatures, EMAIL_VIEW_PRIVATE_FEATURE);
+  return authorizeFeatures([EMAIL_VIEW_PRIVATE_FEATURE], {
+    grantedFeatures: userFeatures
+  });
 }
 function canChangeEmailVisibility(opts) {
   if (opts.interactionType !== "email") return true;
@@ -24,8 +26,8 @@ async function resolveCallerEmailFeatures(container, userId, tenantId, organizat
   if (!userId) return void 0;
   try {
     const rbac = container.resolve("rbacService");
-    if (!rbac?.getGrantedFeatures) return void 0;
-    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId });
+    if (!rbac?.getEffectiveFeatures) return void 0;
+    return await rbac.getEffectiveFeatures(userId, { tenantId, organizationId });
   } catch {
     return void 0;
   }

package/dist/modules/customers/lib/visibilityFilter.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/lib/visibilityFilter.ts"],
-  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/postgresql'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { CustomerInteraction } from '../data/entities'\n\n/**\n * The ACL feature that grants admins the right to see private emails authored\n * by other users. Declared in `acl.ts` but granted to NO role in v1 (reserved\n * for the v2 oversight feature \u2014 see `callerHasEmailViewPrivate`).\n */\nexport const EMAIL_VIEW_PRIVATE_FEATURE = 'customers.email.view_private'\n\n/**\n * Returns true when the caller holds the admin override to see ALL private email\n * interactions. Honours wildcards (`customers.*`, `*`).\n *\n * RESERVED FOR v2 \u2014 NOT wired in v1. The v1 model is strict owner-only with no\n * admin bypass: the visibility filters and `canChangeEmailVisibility` ignore\n * caller features, and `customers.email.view_private` is granted to no role.\n * Kept (with {@link EMAIL_VIEW_PRIVATE_FEATURE}) so v2 oversight can opt back in\n * without re-introducing the helper. Do NOT wire this into a read path without\n * an explicit v2 spec.\n */\nexport function callerHasEmailViewPrivate(userFeatures: string[] | null | undefined): boolean {\n  if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false\n  return hasFeature(userFeatures, EMAIL_VIEW_PRIVATE_FEATURE)\n}\n\n/**\n * Authorization predicate for CHANGING an email interaction's visibility.\n *\n * Personal mailbox privacy (v1: strict owner-only): ONLY the interaction's\n * author may flip their own email between private/shared \u2014 there is no admin\n * bypass. Non-email rows and no-op changes are always allowed. Mirrors the gate\n * in the dedicated `PATCH .../visibility` route so the generic interaction-update\n * path cannot bypass the privacy control. `userFeatures` is reserved for v2.\n */\nexport function canChangeEmailVisibility(opts: {\n  interactionType: string\n  currentVisibility: string | null | undefined\n  nextVisibility: string | null | undefined\n  authorUserId: string | null | undefined\n  actorUserId: string | null | undefined\n  userFeatures: string[] | null | undefined\n}): boolean {\n  if (opts.interactionType !== 'email') return true\n  if ((opts.nextVisibility ?? null) === (opts.currentVisibility ?? null)) return true\n  return Boolean(opts.actorUserId) && opts.authorUserId === opts.actorUserId\n}\n\nexport interface ApplyEmailVisibilityFilterOptions {\n  currentUserId: string | null\n  userFeatures: string[] | null | undefined\n}\n\n/**\n * Adds a `WHERE` predicate to a kysely query so that:\n *   - Non-email interactions (calls, meetings, tasks) pass through unchanged.\n *   - Email interactions with `visibility = 'shared'` are visible to all.\n *   - Email interactions with `visibility = 'private'` are visible ONLY to the\n *     `authorUserId` (channel owner).\n *\n * Personal mailbox privacy (v1: strict owner-only) \u2014 there is NO admin bypass:\n * a private email is hidden from everyone except its author, including\n * admins/superadmins. `opts.userFeatures` is retained for signature stability\n * and reserved for the v2 admin-oversight feature.\n *\n * The function expects a kysely-style builder whose `.where()` accepts an\n * expression-builder callback. Returns the same builder for chaining.\n */\nexport function applyEmailVisibilityFilter<T extends { where: (...args: any[]) => T }>(\n  query: T,\n  opts: ApplyEmailVisibilityFilterOptions,\n): T {\n  const currentUserId = opts.currentUserId\n  // A row is hidden ONLY when it is an email explicitly marked `private` and the\n  // caller is not its author. Everything else stays visible, including:\n  //   - non-email interactions (calls, meetings, tasks),\n  //   - emails marked `shared`,\n  //   - legacy/unset rows where `visibility IS NULL` (e.g. email-log entries\n  //     created before per-email visibility shipped) \u2014 these must remain\n  //     visible to avoid silently hiding pre-existing CRM history.\n  return query.where((eb: any) =>\n    eb.or([\n      eb('interaction_type', '!=', 'email'),\n      eb('visibility', 'is', null),\n      eb('visibility', '!=', 'private'),\n      currentUserId\n        ? eb('author_user_id', '=', currentUserId)\n        : eb.val(false),\n    ]),\n  )\n}\n\ntype RbacServiceLike = {\n  getGrantedFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[] | undefined>\n}\n\n/**\n * Resolve the caller's granted features (wildcard-aware downstream) so a v2\n * visibility filter could honour the `customers.email.view_private` admin\n * override. Returns `undefined` when there is no user or the RBAC service is\n * unavailable \u2014 callers MUST treat `undefined` as \"no bypass\" (fail closed).\n *\n * RESERVED FOR v2 \u2014 NOT called by any v1 read path. v1 is strict owner-only, so\n * the read routes pass `userFeatures: undefined` to the filters rather than\n * resolving features here (which would be a wasted RBAC round-trip). Re-wire\n * only under an explicit v2 oversight spec.\n */\nexport async function resolveCallerEmailFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  if (!userId) return undefined\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getGrantedFeatures) return undefined\n    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * MikroORM equivalent of {@link applyEmailVisibilityFilter}. Returns a\n * `FilterQuery` fragment to merge (implicit AND) into a `CustomerInteraction`\n * where-clause so private email rows are excluded for non-owner, non-admin\n * callers on MikroORM read paths (`findWithDecryption`/`em.find`/`em.count`).\n *\n * Mirrors the kysely predicate exactly, including the legacy `visibility IS NULL`\n * passthrough so pre-existing CRM history is never hidden. Personal mailbox\n * privacy (v1: strict owner-only): no admin bypass \u2014 a private email is hidden\n * from everyone except its author. `opts.userFeatures` is reserved for v2.\n */\nexport type EmailVisibilityMikroFilter = { $or?: FilterQuery<CustomerInteraction>[] }\n\nexport function buildEmailVisibilityMikroFilter(\n  opts: ApplyEmailVisibilityFilterOptions,\n): EmailVisibilityMikroFilter {\n  return {\n    $or: [\n      { interactionType: { $ne: 'email' } },\n      { visibility: null },\n      { visibility: { $ne: 'private' } },\n      ...(opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : []),\n    ],\n  }\n}\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAQpB,MAAM,6BAA6B;AAanC,SAAS,0BAA0B,cAAoD;AAC5F,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,EAAG,QAAO;AACtE,SAAO,WAAW,cAAc,0BAA0B;AAC5D;AAWO,SAAS,yBAAyB,MAO7B;AACV,MAAI,KAAK,oBAAoB,QAAS,QAAO;AAC7C,OAAK,KAAK,kBAAkB,WAAW,KAAK,qBAAqB,MAAO,QAAO;AAC/E,SAAO,QAAQ,KAAK,WAAW,KAAK,KAAK,iBAAiB,KAAK;AACjE;AAsBO,SAAS,2BACd,OACA,MACG;AACH,QAAM,gBAAgB,KAAK;AAQ3B,SAAO,MAAM;AAAA,IAAM,CAAC,OAClB,GAAG,GAAG;AAAA,MACJ,GAAG,oBAAoB,MAAM,OAAO;AAAA,MACpC,GAAG,cAAc,MAAM,IAAI;AAAA,MAC3B,GAAG,cAAc,MAAM,SAAS;AAAA,MAChC,gBACI,GAAG,kBAAkB,KAAK,aAAa,IACvC,GAAG,IAAI,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoBA,eAAsB,2BACpB,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,mBAAoB,QAAO;AACtC,WAAO,MAAM,KAAK,mBAAmB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,SAAS,gCACd,MAC4B;AAC5B,SAAO;AAAA,IACL,KAAK;AAAA,MACH,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE;AAAA,MACpC,EAAE,YAAY,KAAK;AAAA,MACnB,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE;AAAA,MACjC,GAAI,KAAK,gBAAgB,CAAC,EAAE,cAAc,KAAK,cAAc,CAAC,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { FilterQuery } from '@mikro-orm/postgresql'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { CustomerInteraction } from '../data/entities'\n\n/**\n * The ACL feature that grants admins the right to see private emails authored\n * by other users. Declared in `acl.ts` but granted to NO role in v1 (reserved\n * for the v2 oversight feature \u2014 see `callerHasEmailViewPrivate`).\n */\nexport const EMAIL_VIEW_PRIVATE_FEATURE = 'customers.email.view_private'\n\n/**\n * Returns true when the caller holds the admin override to see ALL private email\n * interactions. Honours wildcards (`customers.*`, `*`).\n *\n * RESERVED FOR v2 \u2014 NOT wired in v1. The v1 model is strict owner-only with no\n * admin bypass: the visibility filters and `canChangeEmailVisibility` ignore\n * caller features, and `customers.email.view_private` is granted to no role.\n * Kept (with {@link EMAIL_VIEW_PRIVATE_FEATURE}) so v2 oversight can opt back in\n * without re-introducing the helper. Do NOT wire this into a read path without\n * an explicit v2 spec.\n */\nexport function callerHasEmailViewPrivate(userFeatures: string[] | null | undefined): boolean {\n  if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false\n  return authorizeFeatures([EMAIL_VIEW_PRIVATE_FEATURE], {\n    grantedFeatures: userFeatures,\n  })\n}\n\n/**\n * Authorization predicate for CHANGING an email interaction's visibility.\n *\n * Personal mailbox privacy (v1: strict owner-only): ONLY the interaction's\n * author may flip their own email between private/shared \u2014 there is no admin\n * bypass. Non-email rows and no-op changes are always allowed. Mirrors the gate\n * in the dedicated `PATCH .../visibility` route so the generic interaction-update\n * path cannot bypass the privacy control. `userFeatures` is reserved for v2.\n */\nexport function canChangeEmailVisibility(opts: {\n  interactionType: string\n  currentVisibility: string | null | undefined\n  nextVisibility: string | null | undefined\n  authorUserId: string | null | undefined\n  actorUserId: string | null | undefined\n  userFeatures: string[] | null | undefined\n}): boolean {\n  if (opts.interactionType !== 'email') return true\n  if ((opts.nextVisibility ?? null) === (opts.currentVisibility ?? null)) return true\n  return Boolean(opts.actorUserId) && opts.authorUserId === opts.actorUserId\n}\n\nexport interface ApplyEmailVisibilityFilterOptions {\n  currentUserId: string | null\n  userFeatures: string[] | null | undefined\n}\n\n/**\n * Adds a `WHERE` predicate to a kysely query so that:\n *   - Non-email interactions (calls, meetings, tasks) pass through unchanged.\n *   - Email interactions with `visibility = 'shared'` are visible to all.\n *   - Email interactions with `visibility = 'private'` are visible ONLY to the\n *     `authorUserId` (channel owner).\n *\n * Personal mailbox privacy (v1: strict owner-only) \u2014 there is NO admin bypass:\n * a private email is hidden from everyone except its author, including\n * admins/superadmins. `opts.userFeatures` is retained for signature stability\n * and reserved for the v2 admin-oversight feature.\n *\n * The function expects a kysely-style builder whose `.where()` accepts an\n * expression-builder callback. Returns the same builder for chaining.\n */\nexport function applyEmailVisibilityFilter<T extends { where: (...args: any[]) => T }>(\n  query: T,\n  opts: ApplyEmailVisibilityFilterOptions,\n): T {\n  const currentUserId = opts.currentUserId\n  // A row is hidden ONLY when it is an email explicitly marked `private` and the\n  // caller is not its author. Everything else stays visible, including:\n  //   - non-email interactions (calls, meetings, tasks),\n  //   - emails marked `shared`,\n  //   - legacy/unset rows where `visibility IS NULL` (e.g. email-log entries\n  //     created before per-email visibility shipped) \u2014 these must remain\n  //     visible to avoid silently hiding pre-existing CRM history.\n  return query.where((eb: any) =>\n    eb.or([\n      eb('interaction_type', '!=', 'email'),\n      eb('visibility', 'is', null),\n      eb('visibility', '!=', 'private'),\n      currentUserId\n        ? eb('author_user_id', '=', currentUserId)\n        : eb.val(false),\n    ]),\n  )\n}\n\ntype RbacServiceLike = {\n  getEffectiveFeatures?: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<string[] | undefined>\n}\n\n/**\n * Resolve the caller's granted features (wildcard-aware downstream) so a v2\n * visibility filter could honour the `customers.email.view_private` admin\n * override. Returns `undefined` when there is no user or the RBAC service is\n * unavailable \u2014 callers MUST treat `undefined` as \"no bypass\" (fail closed).\n *\n * RESERVED FOR v2 \u2014 NOT called by any v1 read path. v1 is strict owner-only, so\n * the read routes pass `userFeatures: undefined` to the filters rather than\n * resolving features here (which would be a wasted RBAC round-trip). Re-wire\n * only under an explicit v2 oversight spec.\n */\nexport async function resolveCallerEmailFeatures(\n  container: { resolve: (name: string) => unknown },\n  userId: string | null,\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<string[] | undefined> {\n  if (!userId) return undefined\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike | undefined\n    if (!rbac?.getEffectiveFeatures) return undefined\n    return await rbac.getEffectiveFeatures(userId, { tenantId, organizationId })\n  } catch {\n    return undefined\n  }\n}\n\n/**\n * MikroORM equivalent of {@link applyEmailVisibilityFilter}. Returns a\n * `FilterQuery` fragment to merge (implicit AND) into a `CustomerInteraction`\n * where-clause so private email rows are excluded for non-owner, non-admin\n * callers on MikroORM read paths (`findWithDecryption`/`em.find`/`em.count`).\n *\n * Mirrors the kysely predicate exactly, including the legacy `visibility IS NULL`\n * passthrough so pre-existing CRM history is never hidden. Personal mailbox\n * privacy (v1: strict owner-only): no admin bypass \u2014 a private email is hidden\n * from everyone except its author. `opts.userFeatures` is reserved for v2.\n */\nexport type EmailVisibilityMikroFilter = { $or?: FilterQuery<CustomerInteraction>[] }\n\nexport function buildEmailVisibilityMikroFilter(\n  opts: ApplyEmailVisibilityFilterOptions,\n): EmailVisibilityMikroFilter {\n  return {\n    $or: [\n      { interactionType: { $ne: 'email' } },\n      { visibility: null },\n      { visibility: { $ne: 'private' } },\n      ...(opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : []),\n    ],\n  }\n}\n"],
+  "mappings": "AACA,SAAS,yBAAyB;AAQ3B,MAAM,6BAA6B;AAanC,SAAS,0BAA0B,cAAoD;AAC5F,MAAI,CAAC,MAAM,QAAQ,YAAY,KAAK,aAAa,WAAW,EAAG,QAAO;AACtE,SAAO,kBAAkB,CAAC,0BAA0B,GAAG;AAAA,IACrD,iBAAiB;AAAA,EACnB,CAAC;AACH;AAWO,SAAS,yBAAyB,MAO7B;AACV,MAAI,KAAK,oBAAoB,QAAS,QAAO;AAC7C,OAAK,KAAK,kBAAkB,WAAW,KAAK,qBAAqB,MAAO,QAAO;AAC/E,SAAO,QAAQ,KAAK,WAAW,KAAK,KAAK,iBAAiB,KAAK;AACjE;AAsBO,SAAS,2BACd,OACA,MACG;AACH,QAAM,gBAAgB,KAAK;AAQ3B,SAAO,MAAM;AAAA,IAAM,CAAC,OAClB,GAAG,GAAG;AAAA,MACJ,GAAG,oBAAoB,MAAM,OAAO;AAAA,MACpC,GAAG,cAAc,MAAM,IAAI;AAAA,MAC3B,GAAG,cAAc,MAAM,SAAS;AAAA,MAChC,gBACI,GAAG,kBAAkB,KAAK,aAAa,IACvC,GAAG,IAAI,KAAK;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAoBA,eAAsB,2BACpB,WACA,QACA,UACA,gBAC+B;AAC/B,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,CAAC,MAAM,qBAAsB,QAAO;AACxC,WAAO,MAAM,KAAK,qBAAqB,QAAQ,EAAE,UAAU,eAAe,CAAC;AAAA,EAC7E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAeO,SAAS,gCACd,MAC4B;AAC5B,SAAO;AAAA,IACL,KAAK;AAAA,MACH,EAAE,iBAAiB,EAAE,KAAK,QAAQ,EAAE;AAAA,MACpC,EAAE,YAAY,KAAK;AAAA,MACnB,EAAE,YAAY,EAAE,KAAK,UAAU,EAAE;AAAA,MACjC,GAAI,KAAK,gBAAgB,CAAC,EAAE,cAAc,KAAK,cAAc,CAAC,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/migrations/Migration20260723210000_customers.js

@@ -0,0 +1,15 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260723210000_customers extends Migration {
+  up() {
+    this.addSql(`alter table "customer_deal_people" add "is_primary" boolean not null default false;`);
+    this.addSql(`create unique index "customer_deal_people_primary_uq" on "customer_deal_people" ("deal_id") where "is_primary";`);
+  }
+  down() {
+    this.addSql(`drop index "customer_deal_people_primary_uq";`);
+    this.addSql(`alter table "customer_deal_people" drop column "is_primary";`);
+  }
+}
+export {
+  Migration20260723210000_customers
+};
+//# sourceMappingURL=Migration20260723210000_customers.js.map

package/dist/modules/customers/migrations/Migration20260723210000_customers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/migrations/Migration20260723210000_customers.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260723210000_customers extends Migration {\n\n  override up(): void | Promise<void> {\n    this.addSql(`alter table \"customer_deal_people\" add \"is_primary\" boolean not null default false;`);\n    this.addSql(`create unique index \"customer_deal_people_primary_uq\" on \"customer_deal_people\" (\"deal_id\") where \"is_primary\";`);\n  }\n\n  override down(): void | Promise<void> {\n    this.addSql(`drop index \"customer_deal_people_primary_uq\";`);\n    this.addSql(`alter table \"customer_deal_people\" drop column \"is_primary\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,0CAA0C,UAAU;AAAA,EAEtD,KAA2B;AAClC,SAAK,OAAO,qFAAqF;AACjG,SAAK,OAAO,iHAAiH;AAAA,EAC/H;AAAA,EAES,OAA6B;AACpC,SAAK,OAAO,+CAA+C;AAC3D,SAAK,OAAO,8DAA8D;AAAA,EAC5E;AAEF;",
+  "names": []
+}

package/dist/modules/customers/search.js

@@ -1,3 +1,4 @@
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CUSTOMER_INTERACTION_TASK_SOURCE, EXAMPLE_TODO_SOURCE } from "./lib/interactionCompatibility.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customers");
@@ -357,12 +358,12 @@ function ensureFallbackLines(lines, record, options = {}) {
     }
   }
 }
-function resolvePersonPresenter(record, entity, customFields) {
+function resolvePersonPresenter(translate, record, entity, customFields) {
   const fallbackEntityId = resolveCustomerEntityId(record);
   const firstName = record.first_name ?? record.firstName ?? customFields.first_name ?? customFields.firstName ?? "";
   const lastName = record.last_name ?? record.lastName ?? customFields.last_name ?? customFields.lastName ?? "";
   const nameParts = [firstName, lastName].filter(Boolean).join(" ");
-  const title = pickValue(entity, "display_name", "displayName") ?? record.preferred_name ?? record.preferredName ?? (nameParts.length ? nameParts : void 0) ?? fallbackEntityId ?? record.id ?? "Person";
+  const title = pickValue(entity, "display_name", "displayName") ?? record.preferred_name ?? record.preferredName ?? (nameParts.length ? nameParts : void 0) ?? fallbackEntityId ?? record.id ?? translate("customers.search.fallback.person", "Person");
   const subtitlePieces = [];
   const jobTitle = record.job_title ?? record.jobTitle ?? customFields.job_title ?? customFields.jobTitle;
   if (jobTitle) subtitlePieces.push(String(jobTitle));
@@ -380,12 +381,12 @@ function resolvePersonPresenter(record, entity, customFields) {
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(" \xB7 ") : void 0,
     icon: "user",
-    badge: pickValue(entity, "display_name", "displayName") ? "Person" : void 0
+    badge: pickValue(entity, "display_name", "displayName") ? translate("customers.search.badge.person", "Person") : void 0
   };
 }
-function resolveCompanyPresenter(record, entity, customFields) {
+function resolveCompanyPresenter(translate, record, entity, customFields) {
   const fallbackEntityId = resolveCustomerEntityId(record);
-  const title = pickValue(entity, "display_name", "displayName") ?? customFields.display_name ?? customFields.displayName ?? record.brand_name ?? record.legal_name ?? record.domain ?? record.brandName ?? record.legalName ?? (entity?.id && entity?.display_name ? entity.display_name : void 0) ?? fallbackEntityId ?? record.id ?? "Company";
+  const title = pickValue(entity, "display_name", "displayName") ?? customFields.display_name ?? customFields.displayName ?? record.brand_name ?? record.legal_name ?? record.domain ?? record.brandName ?? record.legalName ?? (entity?.id && entity?.display_name ? entity.display_name : void 0) ?? fallbackEntityId ?? record.id ?? translate("customers.search.fallback.company", "Company");
   const subtitlePieces = [];
   const industry = record.industry;
   if (industry) subtitlePieces.push(String(industry));
@@ -411,7 +412,7 @@ function resolveCompanyPresenter(record, entity, customFields) {
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(" \xB7 ") : void 0,
     icon: "building",
-    badge: pickValue(entity, "display_name", "displayName") ? "Company" : void 0
+    badge: pickValue(entity, "display_name", "displayName") ? translate("customers.search.badge.company", "Company") : void 0
   };
 }
 function logMissingPresenterTitle(kind, record, entity, presenter) {
@@ -437,6 +438,7 @@ const searchConfig = {
       priority: 10,
       buildSource: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const lines = [];
         const record = ctx.record;
         appendLine(lines, "Preferred name", record.preferred_name ?? record.preferredName ?? ctx.customFields.preferred_name);
@@ -471,9 +473,9 @@ const searchConfig = {
             recordKeys: Object.keys(record)
           });
         }
-        const presenter = resolvePersonPresenter(record, entity, ctx.customFields);
+        const presenter = resolvePersonPresenter(t, record, entity, ctx.customFields);
         logMissingPresenterTitle("person", record, entity, presenter);
-        const presenterLabel = pickLabel(presenter.title) ?? "Open person";
+        const presenterLabel = pickLabel(presenter.title) ?? t("customers.search.link.openPerson", "Open person");
         const links = [];
         if (entityId) {
           const href = buildCustomerUrl("person", entityId);
@@ -495,19 +497,21 @@ const searchConfig = {
       },
       formatResult: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record));
-        return resolvePersonPresenter(ctx.record, entity, ctx.customFields);
+        return resolvePersonPresenter(t, ctx.record, entity, ctx.customFields);
       },
       resolveUrl: async (ctx) => {
         const entityId = resolveCustomerEntityId(ctx.record);
         return buildCustomerUrl("person", entityId);
       },
       resolveLinks: async (ctx) => {
+        const { t } = await resolveTranslations();
         const entityId = resolveCustomerEntityId(ctx.record);
         if (!entityId) return null;
         const href = buildCustomerUrl("person", entityId);
         if (!href) return null;
-        return [{ href: `${href}/edit`, label: "Edit", kind: "secondary" }];
+        return [{ href: `${href}/edit`, label: t("customers.search.link.edit", "Edit"), kind: "secondary" }];
       },
       fieldPolicy: {
         searchable: [
@@ -535,6 +539,7 @@ const searchConfig = {
       priority: 10,
       buildSource: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const lines = [];
         const record = ctx.record;
         appendLine(lines, "Legal name", record.legal_name ?? record.legalName ?? ctx.customFields.legal_name);
@@ -552,9 +557,9 @@ const searchConfig = {
         appendCustomerEntityLines(lines, entity, "Primary");
         ensureFallbackLines(lines, record);
         if (!lines.length) return null;
-        const presenter = resolveCompanyPresenter(record, entity, ctx.customFields);
+        const presenter = resolveCompanyPresenter(t, record, entity, ctx.customFields);
         logMissingPresenterTitle("company", record, entity, presenter);
-        const primaryLabel = pickLabel(presenter.title) ?? "Open company";
+        const primaryLabel = pickLabel(presenter.title) ?? t("customers.search.link.openCompany", "Open company");
         const links = [];
         if (entityId) {
           const href = buildCustomerUrl("company", entityId);
@@ -576,19 +581,21 @@ const searchConfig = {
       },
       formatResult: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record));
-        return resolveCompanyPresenter(ctx.record, entity, ctx.customFields);
+        return resolveCompanyPresenter(t, ctx.record, entity, ctx.customFields);
       },
       resolveUrl: async (ctx) => {
         const entityId = resolveCustomerEntityId(ctx.record);
         return buildCustomerUrl("company", entityId);
       },
       resolveLinks: async (ctx) => {
+        const { t } = await resolveTranslations();
         const entityId = resolveCustomerEntityId(ctx.record);
         if (!entityId) return null;
         const href = buildCustomerUrl("company", entityId);
         if (!href) return null;
-        return [{ href: `${href}/edit`, label: "Edit", kind: "secondary" }];
+        return [{ href: `${href}/edit`, label: t("customers.search.link.edit", "Edit"), kind: "secondary" }];
       },
       fieldPolicy: {
         searchable: [
@@ -638,8 +645,9 @@ const searchConfig = {
       },
       formatResult: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id ?? ctx.record.entityId);
-        const title = parent?.display_name ?? "Customer note";
+        const title = parent?.display_name ?? t("customers.search.fallback.customerNote", "Customer note");
         return {
           title,
           subtitle: snippet(ctx.record.body),
@@ -654,15 +662,16 @@ const searchConfig = {
       },
       resolveLinks: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const links = [];
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id ?? ctx.record.entityId);
         const parentUrl = buildCustomerUrl(parent?.kind ?? null, parent?.id ?? ctx.record.entity_id ?? ctx.record.entityId);
         if (parentUrl) {
-          links.push({ href: parentUrl, label: parent?.display_name ?? "View customer", kind: "primary" });
+          links.push({ href: parentUrl, label: parent?.display_name ?? t("customers.search.link.viewCustomer", "View customer"), kind: "primary" });
         }
         if (ctx.record.deal_id) {
           const dealUrl = `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id)}`;
-          links.push({ href: dealUrl, label: "Open deal", kind: "secondary" });
+          links.push({ href: dealUrl, label: t("customers.search.link.openDeal", "Open deal"), kind: "secondary" });
         }
         return links.length ? links : null;
       },
@@ -681,6 +690,7 @@ const searchConfig = {
       enabled: true,
       priority: 8,
       buildSource: async (ctx) => {
+        const { t } = await resolveTranslations();
         const lines = [];
         const record = ctx.record;
         appendLine(lines, "Title", record.title);
@@ -697,10 +707,10 @@ const searchConfig = {
         return {
           text: lines,
           presenter: {
-            title: String(record.title ?? "Deal"),
+            title: String(record.title ?? t("customers.search.fallback.deal", "Deal")),
             subtitle: subtitleParts.join(" \xB7 ") || void 0,
             icon: "briefcase",
-            badge: "Deal"
+            badge: t("customers.search.badge.deal", "Deal")
           },
           checksumSource: {
             title: record.title,
@@ -711,8 +721,9 @@ const searchConfig = {
         };
       },
       formatResult: async (ctx) => {
+        const { t } = await resolveTranslations();
         const { record } = ctx;
-        const title = pickString(record.title, "Deal");
+        const title = pickString(record.title, t("customers.search.fallback.deal", "Deal"));
         const subtitleParts = [];
         if (record.pipeline_stage) subtitleParts.push(String(record.pipeline_stage));
         if (record.status) subtitleParts.push(String(record.status));
@@ -722,10 +733,10 @@ const searchConfig = {
           subtitleParts.push(currency ? `${amount} ${currency}` : String(amount));
         }
         return {
-          title: title ?? "Deal",
+          title: title ?? t("customers.search.fallback.deal", "Deal"),
           subtitle: subtitleParts.length ? subtitleParts.join(" \xB7 ") : void 0,
           icon: "briefcase",
-          badge: "Deal"
+          badge: t("customers.search.badge.deal", "Deal")
         };
       },
       resolveUrl: async (ctx) => {
@@ -734,12 +745,13 @@ const searchConfig = {
         return `/backend/customers/deals/${encodeURIComponent(String(id))}`;
       },
       resolveLinks: async (ctx) => {
+        const { t } = await resolveTranslations();
         const id = ctx.record.id;
         if (!id) return null;
         return [
           {
             href: `/backend/customers/deals/${encodeURIComponent(String(id))}/edit`,
-            label: "Edit",
+            label: t("customers.search.link.edit", "Edit"),
             kind: "secondary"
           }
         ];
@@ -760,6 +772,7 @@ const searchConfig = {
       priority: 5,
       buildSource: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id ?? ctx.record.entityId);
         const lines = [];
         if (parent?.display_name) lines.push(`Customer: ${parent.display_name}`);
@@ -767,7 +780,9 @@ const searchConfig = {
         if (ctx.record.subject) lines.push(`Subject: ${ctx.record.subject}`);
         if (ctx.record.body) lines.push(`Body: ${ctx.record.body}`);
         const presenter = {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? "update"}`,
+          title: ctx.record.subject ? String(ctx.record.subject) : t("customers.search.fallback.activity", "Activity: {{type}}", {
+            type: String(ctx.record.activity_type ?? t("customers.search.fallback.activityUpdate", "update"))
+          }),
           subtitle: parent?.display_name ?? snippet(ctx.record.body),
           icon: "bolt"
         };
@@ -784,12 +799,15 @@ const searchConfig = {
       },
       formatResult: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id ?? ctx.record.entityId);
         return {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? "update"}`,
+          title: ctx.record.subject ? String(ctx.record.subject) : t("customers.search.fallback.activity", "Activity: {{type}}", {
+            type: String(ctx.record.activity_type ?? t("customers.search.fallback.activityUpdate", "update"))
+          }),
           subtitle: parent?.display_name ?? snippet(ctx.record.body),
           icon: "bolt",
-          badge: "Activity"
+          badge: t("customers.search.badge.activity", "Activity")
         };
       },
       resolveUrl: async (ctx) => {
@@ -799,11 +817,12 @@ const searchConfig = {
         return base ? `${base}#activity-${ctx.record.id ?? ctx.record.activity_id ?? ""}` : null;
       },
       resolveLinks: async (ctx) => {
+        const { t } = await resolveTranslations();
         const links = [];
         if (ctx.record.deal_id) {
           links.push({
             href: `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id)}`,
-            label: "Open deal",
+            label: t("customers.search.link.openDeal", "Open deal"),
             kind: "secondary"
           });
         }
@@ -844,10 +863,11 @@ const searchConfig = {
       },
       formatResult: async (ctx) => {
         assertTenantContext(ctx);
+        const { t } = await resolveTranslations();
         const todo = await getLinkedTodo(ctx);
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id ?? ctx.record.entityId);
         return {
-          title: todo?.title ?? "Customer task",
+          title: todo?.title ?? t("customers.search.fallback.customerTask", "Customer task"),
           subtitle: parent?.display_name,
           icon: "check-square"
         };
@@ -859,11 +879,12 @@ const searchConfig = {
         return base ? `${base}#tasks` : null;
       },
       resolveLinks: async (ctx) => {
+        const { t } = await resolveTranslations();
         const todoId = ctx.record.todo_id ?? ctx.record.todoId;
         if (!todoId) return null;
         return [{
           href: `/backend/todos/${encodeURIComponent(todoId)}/edit`,
-          label: "Open todo",
+          label: t("customers.search.link.openTodo", "Open todo"),
           kind: "secondary"
         }];
       },