@open-mercato/core 0.6.8-develop.6944.1.eef6a0ee1d → 0.6.8-develop.6948.1.8369fc4c97

package/dist/modules/customers/components/calendar/useCalendarItems.js

@@ -9,7 +9,7 @@ import {
 } from "./types.js";
 const PAGE_LIMIT = 100;
 const MAX_WINDOW_ITEMS = 500;
-async function fetchInteractionWindow(window, signal) {
+async function fetchInteractionWindow(window, signal, options = {}) {
   const collected = [];
   let cursor;
   let truncated = false;
@@ -19,6 +19,7 @@ async function fetchInteractionWindow(window, signal) {
       to: window.to.toISOString(),
       limit: String(PAGE_LIMIT)
     });
+    if (options.recurrenceMasters) params.set("recurrenceMasters", "true");
     if (cursor) params.set("cursor", cursor);
     const call = await apiCall(
       `/api/customers/interactions?${params.toString()}`,
@@ -38,6 +39,32 @@ async function fetchInteractionWindow(window, signal) {
   } while (cursor);
   return { payloads: collected.slice(0, MAX_WINDOW_ITEMS), truncated };
 }
+function mergeInteractionPayloads(windowPayloads, recurringPayloads) {
+  const windowById = new Map(windowPayloads.map((payload) => [payload.id, payload]));
+  const byId = /* @__PURE__ */ new Map();
+  for (const payload of recurringPayloads) {
+    byId.set(payload.id, windowById.get(payload.id) ?? payload);
+  }
+  for (const payload of windowPayloads) {
+    if (!byId.has(payload.id)) byId.set(payload.id, payload);
+  }
+  const payloads = Array.from(byId.values());
+  return {
+    payloads: payloads.slice(0, MAX_WINDOW_ITEMS),
+    truncated: payloads.length > MAX_WINDOW_ITEMS
+  };
+}
+async function fetchCalendarCandidates(window, signal) {
+  const [windowResult, recurringResult] = await Promise.all([
+    fetchInteractionWindow(window, signal),
+    fetchInteractionWindow(window, signal, { recurrenceMasters: true })
+  ]);
+  const merged = mergeInteractionPayloads(windowResult.payloads, recurringResult.payloads);
+  return {
+    payloads: merged.payloads,
+    truncated: windowResult.truncated || recurringResult.truncated || merged.truncated
+  };
+}
 function useCalendarItems(range) {
   const [payloads, setPayloads] = React.useState([]);
   const [isLoading, setIsLoading] = React.useState(true);
@@ -91,13 +118,10 @@ function useCalendarItems(range) {
       setError(null);
       try {
         const fetchWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) });
-        const { payloads: collected, truncated: windowTruncated } = await fetchInteractionWindow(
-          fetchWindow,
-          controller.signal
-        );
+        const result = await fetchCalendarCandidates(fetchWindow, controller.signal);
         if (cancelled) return;
-        setPayloads(collected);
-        setTruncated(windowTruncated);
+        setPayloads(result.payloads);
+        setTruncated(result.truncated);
       } catch (err) {
         if (cancelled || controller.signal.aborted) return;
         setPayloads([]);
@@ -130,7 +154,9 @@ function useCalendarItems(range) {
 }
 export {
   MAX_WINDOW_ITEMS,
+  fetchCalendarCandidates,
   fetchInteractionWindow,
+  mergeInteractionPayloads,
   useCalendarItems
 };
 //# sourceMappingURL=useCalendarItems.js.map

package/dist/modules/customers/components/calendar/useCalendarItems.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customers/components/calendar/useCalendarItems.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { expandOccurrences } from '../../lib/calendar/recurrence'\nimport { getFetchWindow } from '../../lib/calendar/range'\nimport { mapInteractionToCalendarItem } from '../../lib/calendar/mapItem'\nimport {\n  calendarInteractionPayloadSchema,\n  type CalendarInteractionPayload,\n  type CalendarItem,\n  type CalendarRange,\n} from './types'\n\nconst PAGE_LIMIT = 100\nexport const MAX_WINDOW_ITEMS = 500\n\n/**\n * Cursor-follows `/api/customers/interactions` across the given window (already\n * padded by the caller) up to `MAX_WINDOW_ITEMS`. Shared by the grid data hook\n * and the editor's conflict probe so both see the exact same candidate set.\n */\nexport async function fetchInteractionWindow(\n  window: CalendarRange,\n  signal?: AbortSignal,\n): Promise<{ payloads: CalendarInteractionPayload[]; truncated: boolean }> {\n  const collected: CalendarInteractionPayload[] = []\n  let cursor: string | undefined\n  let truncated = false\n  do {\n    const params = new URLSearchParams({\n      from: window.from.toISOString(),\n      to: window.to.toISOString(),\n      limit: String(PAGE_LIMIT),\n    })\n    if (cursor) params.set('cursor', cursor)\n    const call = await apiCall<{ items?: unknown[]; nextCursor?: string }>(\n      `/api/customers/interactions?${params.toString()}`,\n      { signal },\n    )\n    if (!call.ok) throw new Error(`[internal] calendar interactions fetch failed (${call.status})`)\n    const pageItems = Array.isArray(call.result?.items) ? call.result.items : []\n    for (const rawItem of pageItems) {\n      const parsed = calendarInteractionPayloadSchema.safeParse(rawItem)\n      if (parsed.success) collected.push(parsed.data)\n    }\n    cursor = typeof call.result?.nextCursor === 'string' ? call.result.nextCursor : undefined\n    if (cursor && collected.length >= MAX_WINDOW_ITEMS) {\n      truncated = true\n      cursor = undefined\n    }\n  } while (cursor)\n  return { payloads: collected.slice(0, MAX_WINDOW_ITEMS), truncated }\n}\n\ntype ActivityTypeDictionaryEntry = {\n  value?: unknown\n  label?: unknown\n  color?: unknown\n  icon?: unknown\n}\n\nexport type UseCalendarItemsResult = {\n  items: CalendarItem[]\n  isLoading: boolean\n  error: string | null\n  truncated: boolean\n  typeLabels: Record<string, string>\n  typeColors: Record<string, string | null>\n  typeIcons: Record<string, string | null>\n  refetch: () => void\n}\n\nexport function useCalendarItems(range: CalendarRange): UseCalendarItemsResult {\n  const [payloads, setPayloads] = React.useState<CalendarInteractionPayload[]>([])\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [truncated, setTruncated] = React.useState(false)\n  const [typeLabels, setTypeLabels] = React.useState<Record<string, string>>({})\n  const [typeColors, setTypeColors] = React.useState<Record<string, string | null>>({})\n  const [typeIcons, setTypeIcons] = React.useState<Record<string, string | null>>({})\n  const [reloadToken, setReloadToken] = React.useState(0)\n\n  const fromTime = range.from.getTime()\n  const toTime = range.to.getTime()\n\n  React.useEffect(() => {\n    const controller = new AbortController()\n    let cancelled = false\n    async function loadActivityTypes() {\n      const call = await apiCall<{ items?: ActivityTypeDictionaryEntry[] }>(\n        '/api/customers/dictionaries/activity-types',\n        { signal: controller.signal },\n      )\n      if (cancelled || !call.ok) return\n      const entries = Array.isArray(call.result?.items) ? call.result.items : []\n      const labels: Record<string, string> = {}\n      const colors: Record<string, string | null> = {}\n      const icons: Record<string, string | null> = {}\n      for (const entry of entries) {\n        if (typeof entry?.value !== 'string' || entry.value.length === 0) continue\n        labels[entry.value] = typeof entry.label === 'string' && entry.label.length > 0 ? entry.label : entry.value\n        colors[entry.value] = typeof entry.color === 'string' && entry.color.length > 0 ? entry.color : null\n        icons[entry.value] = typeof entry.icon === 'string' && entry.icon.length > 0 ? entry.icon : null\n      }\n      setTypeLabels(labels)\n      setTypeColors(colors)\n      setTypeIcons(icons)\n    }\n    loadActivityTypes().catch(() => {\n      if (cancelled || controller.signal.aborted) return\n      setTypeLabels({})\n      setTypeColors({})\n      setTypeIcons({})\n    })\n    return () => {\n      cancelled = true\n      controller.abort()\n    }\n  }, [])\n\n  React.useEffect(() => {\n    const controller = new AbortController()\n    let cancelled = false\n    async function loadInteractions() {\n      setIsLoading(true)\n      setError(null)\n      try {\n        const fetchWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) })\n        const { payloads: collected, truncated: windowTruncated } = await fetchInteractionWindow(\n          fetchWindow,\n          controller.signal,\n        )\n        if (cancelled) return\n        setPayloads(collected)\n        setTruncated(windowTruncated)\n      } catch (err) {\n        if (cancelled || controller.signal.aborted) return\n        setPayloads([])\n        setTruncated(false)\n        setError(err instanceof Error ? err.message : '[internal] calendar interactions fetch failed')\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    void loadInteractions()\n    return () => {\n      cancelled = true\n      controller.abort()\n    }\n  }, [fromTime, toTime, reloadToken])\n\n  const items = React.useMemo(() => {\n    const expansionWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) })\n    const mapped: CalendarItem[] = []\n    for (const payload of payloads) {\n      const item = mapInteractionToCalendarItem(payload, typeColors)\n      if (!item) continue\n      mapped.push(...expandOccurrences(item, expansionWindow))\n    }\n    return mapped\n  }, [payloads, typeColors, fromTime, toTime])\n\n  const refetch = React.useCallback(() => {\n    setReloadToken((token) => token + 1)\n  }, [])\n\n  return { items, isLoading, error, truncated, typeLabels, typeColors, typeIcons, refetch }\n}\n"],
-  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,eAAe;AACxB,SAAS,yBAAyB;AAClC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,OAIK;AAEP,MAAM,aAAa;AACZ,MAAM,mBAAmB;AAOhC,eAAsB,uBACpB,QACA,QACyE;AACzE,QAAM,YAA0C,CAAC;AACjD,MAAI;AACJ,MAAI,YAAY;AAChB,KAAG;AACD,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,MAAM,OAAO,KAAK,YAAY;AAAA,MAC9B,IAAI,OAAO,GAAG,YAAY;AAAA,MAC1B,OAAO,OAAO,UAAU;AAAA,IAC1B,CAAC;AACD,QAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,UAAM,OAAO,MAAM;AAAA,MACjB,+BAA+B,OAAO,SAAS,CAAC;AAAA,MAChD,EAAE,OAAO;AAAA,IACX;AACA,QAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,kDAAkD,KAAK,MAAM,GAAG;AAC9F,UAAM,YAAY,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AAC3E,eAAW,WAAW,WAAW;AAC/B,YAAM,SAAS,iCAAiC,UAAU,OAAO;AACjE,UAAI,OAAO,QAAS,WAAU,KAAK,OAAO,IAAI;AAAA,IAChD;AACA,aAAS,OAAO,KAAK,QAAQ,eAAe,WAAW,KAAK,OAAO,aAAa;AAChF,QAAI,UAAU,UAAU,UAAU,kBAAkB;AAClD,kBAAY;AACZ,eAAS;AAAA,IACX;AAAA,EACF,SAAS;AACT,SAAO,EAAE,UAAU,UAAU,MAAM,GAAG,gBAAgB,GAAG,UAAU;AACrE;AAoBO,SAAS,iBAAiB,OAA8C;AAC7E,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAuC,CAAC,CAAC;AAC/E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAiC,CAAC,CAAC;AAC7E,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAwC,CAAC,CAAC;AACpF,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwC,CAAC,CAAC;AAClF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AAEtD,QAAM,WAAW,MAAM,KAAK,QAAQ;AACpC,QAAM,SAAS,MAAM,GAAG,QAAQ;AAEhC,QAAM,UAAU,MAAM;AACpB,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI,YAAY;AAChB,mBAAe,oBAAoB;AACjC,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA,EAAE,QAAQ,WAAW,OAAO;AAAA,MAC9B;AACA,UAAI,aAAa,CAAC,KAAK,GAAI;AAC3B,YAAM,UAAU,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACzE,YAAM,SAAiC,CAAC;AACxC,YAAM,SAAwC,CAAC;AAC/C,YAAM,QAAuC,CAAC;AAC9C,iBAAW,SAAS,SAAS;AAC3B,YAAI,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,WAAW,EAAG;AAClE,eAAO,MAAM,KAAK,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ,MAAM;AACtG,eAAO,MAAM,KAAK,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ;AAChG,cAAM,MAAM,KAAK,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,IAAI,MAAM,OAAO;AAAA,MAC9F;AACA,oBAAc,MAAM;AACpB,oBAAc,MAAM;AACpB,mBAAa,KAAK;AAAA,IACpB;AACA,sBAAkB,EAAE,MAAM,MAAM;AAC9B,UAAI,aAAa,WAAW,OAAO,QAAS;AAC5C,oBAAc,CAAC,CAAC;AAChB,oBAAc,CAAC,CAAC;AAChB,mBAAa,CAAC,CAAC;AAAA,IACjB,CAAC;AACD,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,UAAI;AACF,cAAM,cAAc,eAAe,EAAE,MAAM,IAAI,KAAK,QAAQ,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;AACrF,cAAM,EAAE,UAAU,WAAW,WAAW,gBAAgB,IAAI,MAAM;AAAA,UAChE;AAAA,UACA,WAAW;AAAA,QACb;AACA,YAAI,UAAW;AACf,oBAAY,SAAS;AACrB,qBAAa,eAAe;AAAA,MAC9B,SAAS,KAAK;AACZ,YAAI,aAAa,WAAW,OAAO,QAAS;AAC5C,oBAAY,CAAC,CAAC;AACd,qBAAa,KAAK;AAClB,iBAAS,eAAe,QAAQ,IAAI,UAAU,+CAA+C;AAAA,MAC/F,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK,iBAAiB;AACtB,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,WAAW,CAAC;AAElC,QAAM,QAAQ,MAAM,QAAQ,MAAM;AAChC,UAAM,kBAAkB,eAAe,EAAE,MAAM,IAAI,KAAK,QAAQ,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;AACzF,UAAM,SAAyB,CAAC;AAChC,eAAW,WAAW,UAAU;AAC9B,YAAM,OAAO,6BAA6B,SAAS,UAAU;AAC7D,UAAI,CAAC,KAAM;AACX,aAAO,KAAK,GAAG,kBAAkB,MAAM,eAAe,CAAC;AAAA,IACzD;AACA,WAAO;AAAA,EACT,GAAG,CAAC,UAAU,YAAY,UAAU,MAAM,CAAC;AAE3C,QAAM,UAAU,MAAM,YAAY,MAAM;AACtC,mBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,OAAO,WAAW,OAAO,WAAW,YAAY,YAAY,WAAW,QAAQ;AAC1F;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { expandOccurrences } from '../../lib/calendar/recurrence'\nimport { getFetchWindow } from '../../lib/calendar/range'\nimport { mapInteractionToCalendarItem } from '../../lib/calendar/mapItem'\nimport {\n  calendarInteractionPayloadSchema,\n  type CalendarInteractionPayload,\n  type CalendarItem,\n  type CalendarRange,\n} from './types'\n\nconst PAGE_LIMIT = 100\nexport const MAX_WINDOW_ITEMS = 500\n\ntype FetchInteractionWindowOptions = {\n  recurrenceMasters?: boolean\n}\n\n/**\n * Cursor-follows `/api/customers/interactions` across the given window (already\n * padded by the caller) up to `MAX_WINDOW_ITEMS`. Shared by the grid data hook\n * and the editor's conflict probe so both see the exact same candidate set.\n */\nexport async function fetchInteractionWindow(\n  window: CalendarRange,\n  signal?: AbortSignal,\n  options: FetchInteractionWindowOptions = {},\n): Promise<{ payloads: CalendarInteractionPayload[]; truncated: boolean }> {\n  const collected: CalendarInteractionPayload[] = []\n  let cursor: string | undefined\n  let truncated = false\n  do {\n    const params = new URLSearchParams({\n      from: window.from.toISOString(),\n      to: window.to.toISOString(),\n      limit: String(PAGE_LIMIT),\n    })\n    if (options.recurrenceMasters) params.set('recurrenceMasters', 'true')\n    if (cursor) params.set('cursor', cursor)\n    const call = await apiCall<{ items?: unknown[]; nextCursor?: string }>(\n      `/api/customers/interactions?${params.toString()}`,\n      { signal },\n    )\n    if (!call.ok) throw new Error(`[internal] calendar interactions fetch failed (${call.status})`)\n    const pageItems = Array.isArray(call.result?.items) ? call.result.items : []\n    for (const rawItem of pageItems) {\n      const parsed = calendarInteractionPayloadSchema.safeParse(rawItem)\n      if (parsed.success) collected.push(parsed.data)\n    }\n    cursor = typeof call.result?.nextCursor === 'string' ? call.result.nextCursor : undefined\n    if (cursor && collected.length >= MAX_WINDOW_ITEMS) {\n      truncated = true\n      cursor = undefined\n    }\n  } while (cursor)\n  return { payloads: collected.slice(0, MAX_WINDOW_ITEMS), truncated }\n}\n\nexport function mergeInteractionPayloads(\n  windowPayloads: CalendarInteractionPayload[],\n  recurringPayloads: CalendarInteractionPayload[],\n): { payloads: CalendarInteractionPayload[]; truncated: boolean } {\n  const windowById = new Map(windowPayloads.map((payload) => [payload.id, payload]))\n  const byId = new Map<string, CalendarInteractionPayload>()\n  for (const payload of recurringPayloads) {\n    byId.set(payload.id, windowById.get(payload.id) ?? payload)\n  }\n  for (const payload of windowPayloads) {\n    if (!byId.has(payload.id)) byId.set(payload.id, payload)\n  }\n  const payloads = Array.from(byId.values())\n  return {\n    payloads: payloads.slice(0, MAX_WINDOW_ITEMS),\n    truncated: payloads.length > MAX_WINDOW_ITEMS,\n  }\n}\n\nexport async function fetchCalendarCandidates(\n  window: CalendarRange,\n  signal?: AbortSignal,\n): Promise<{ payloads: CalendarInteractionPayload[]; truncated: boolean }> {\n  const [windowResult, recurringResult] = await Promise.all([\n    fetchInteractionWindow(window, signal),\n    fetchInteractionWindow(window, signal, { recurrenceMasters: true }),\n  ])\n  const merged = mergeInteractionPayloads(windowResult.payloads, recurringResult.payloads)\n  return {\n    payloads: merged.payloads,\n    truncated: windowResult.truncated || recurringResult.truncated || merged.truncated,\n  }\n}\n\ntype ActivityTypeDictionaryEntry = {\n  value?: unknown\n  label?: unknown\n  color?: unknown\n  icon?: unknown\n}\n\nexport type UseCalendarItemsResult = {\n  items: CalendarItem[]\n  isLoading: boolean\n  error: string | null\n  truncated: boolean\n  typeLabels: Record<string, string>\n  typeColors: Record<string, string | null>\n  typeIcons: Record<string, string | null>\n  refetch: () => void\n}\n\nexport function useCalendarItems(range: CalendarRange): UseCalendarItemsResult {\n  const [payloads, setPayloads] = React.useState<CalendarInteractionPayload[]>([])\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [truncated, setTruncated] = React.useState(false)\n  const [typeLabels, setTypeLabels] = React.useState<Record<string, string>>({})\n  const [typeColors, setTypeColors] = React.useState<Record<string, string | null>>({})\n  const [typeIcons, setTypeIcons] = React.useState<Record<string, string | null>>({})\n  const [reloadToken, setReloadToken] = React.useState(0)\n\n  const fromTime = range.from.getTime()\n  const toTime = range.to.getTime()\n\n  React.useEffect(() => {\n    const controller = new AbortController()\n    let cancelled = false\n    async function loadActivityTypes() {\n      const call = await apiCall<{ items?: ActivityTypeDictionaryEntry[] }>(\n        '/api/customers/dictionaries/activity-types',\n        { signal: controller.signal },\n      )\n      if (cancelled || !call.ok) return\n      const entries = Array.isArray(call.result?.items) ? call.result.items : []\n      const labels: Record<string, string> = {}\n      const colors: Record<string, string | null> = {}\n      const icons: Record<string, string | null> = {}\n      for (const entry of entries) {\n        if (typeof entry?.value !== 'string' || entry.value.length === 0) continue\n        labels[entry.value] = typeof entry.label === 'string' && entry.label.length > 0 ? entry.label : entry.value\n        colors[entry.value] = typeof entry.color === 'string' && entry.color.length > 0 ? entry.color : null\n        icons[entry.value] = typeof entry.icon === 'string' && entry.icon.length > 0 ? entry.icon : null\n      }\n      setTypeLabels(labels)\n      setTypeColors(colors)\n      setTypeIcons(icons)\n    }\n    loadActivityTypes().catch(() => {\n      if (cancelled || controller.signal.aborted) return\n      setTypeLabels({})\n      setTypeColors({})\n      setTypeIcons({})\n    })\n    return () => {\n      cancelled = true\n      controller.abort()\n    }\n  }, [])\n\n  React.useEffect(() => {\n    const controller = new AbortController()\n    let cancelled = false\n    async function loadInteractions() {\n      setIsLoading(true)\n      setError(null)\n      try {\n        const fetchWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) })\n        const result = await fetchCalendarCandidates(fetchWindow, controller.signal)\n        if (cancelled) return\n        setPayloads(result.payloads)\n        setTruncated(result.truncated)\n      } catch (err) {\n        if (cancelled || controller.signal.aborted) return\n        setPayloads([])\n        setTruncated(false)\n        setError(err instanceof Error ? err.message : '[internal] calendar interactions fetch failed')\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    void loadInteractions()\n    return () => {\n      cancelled = true\n      controller.abort()\n    }\n  }, [fromTime, toTime, reloadToken])\n\n  const items = React.useMemo(() => {\n    const expansionWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) })\n    const mapped: CalendarItem[] = []\n    for (const payload of payloads) {\n      const item = mapInteractionToCalendarItem(payload, typeColors)\n      if (!item) continue\n      mapped.push(...expandOccurrences(item, expansionWindow))\n    }\n    return mapped\n  }, [payloads, typeColors, fromTime, toTime])\n\n  const refetch = React.useCallback(() => {\n    setReloadToken((token) => token + 1)\n  }, [])\n\n  return { items, isLoading, error, truncated, typeLabels, typeColors, typeIcons, refetch }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,eAAe;AACxB,SAAS,yBAAyB;AAClC,SAAS,sBAAsB;AAC/B,SAAS,oCAAoC;AAC7C;AAAA,EACE;AAAA,OAIK;AAEP,MAAM,aAAa;AACZ,MAAM,mBAAmB;AAWhC,eAAsB,uBACpB,QACA,QACA,UAAyC,CAAC,GAC+B;AACzE,QAAM,YAA0C,CAAC;AACjD,MAAI;AACJ,MAAI,YAAY;AAChB,KAAG;AACD,UAAM,SAAS,IAAI,gBAAgB;AAAA,MACjC,MAAM,OAAO,KAAK,YAAY;AAAA,MAC9B,IAAI,OAAO,GAAG,YAAY;AAAA,MAC1B,OAAO,OAAO,UAAU;AAAA,IAC1B,CAAC;AACD,QAAI,QAAQ,kBAAmB,QAAO,IAAI,qBAAqB,MAAM;AACrE,QAAI,OAAQ,QAAO,IAAI,UAAU,MAAM;AACvC,UAAM,OAAO,MAAM;AAAA,MACjB,+BAA+B,OAAO,SAAS,CAAC;AAAA,MAChD,EAAE,OAAO;AAAA,IACX;AACA,QAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,kDAAkD,KAAK,MAAM,GAAG;AAC9F,UAAM,YAAY,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AAC3E,eAAW,WAAW,WAAW;AAC/B,YAAM,SAAS,iCAAiC,UAAU,OAAO;AACjE,UAAI,OAAO,QAAS,WAAU,KAAK,OAAO,IAAI;AAAA,IAChD;AACA,aAAS,OAAO,KAAK,QAAQ,eAAe,WAAW,KAAK,OAAO,aAAa;AAChF,QAAI,UAAU,UAAU,UAAU,kBAAkB;AAClD,kBAAY;AACZ,eAAS;AAAA,IACX;AAAA,EACF,SAAS;AACT,SAAO,EAAE,UAAU,UAAU,MAAM,GAAG,gBAAgB,GAAG,UAAU;AACrE;AAEO,SAAS,yBACd,gBACA,mBACgE;AAChE,QAAM,aAAa,IAAI,IAAI,eAAe,IAAI,CAAC,YAAY,CAAC,QAAQ,IAAI,OAAO,CAAC,CAAC;AACjF,QAAM,OAAO,oBAAI,IAAwC;AACzD,aAAW,WAAW,mBAAmB;AACvC,SAAK,IAAI,QAAQ,IAAI,WAAW,IAAI,QAAQ,EAAE,KAAK,OAAO;AAAA,EAC5D;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,EAAG,MAAK,IAAI,QAAQ,IAAI,OAAO;AAAA,EACzD;AACA,QAAM,WAAW,MAAM,KAAK,KAAK,OAAO,CAAC;AACzC,SAAO;AAAA,IACL,UAAU,SAAS,MAAM,GAAG,gBAAgB;AAAA,IAC5C,WAAW,SAAS,SAAS;AAAA,EAC/B;AACF;AAEA,eAAsB,wBACpB,QACA,QACyE;AACzE,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,QAAQ,IAAI;AAAA,IACxD,uBAAuB,QAAQ,MAAM;AAAA,IACrC,uBAAuB,QAAQ,QAAQ,EAAE,mBAAmB,KAAK,CAAC;AAAA,EACpE,CAAC;AACD,QAAM,SAAS,yBAAyB,aAAa,UAAU,gBAAgB,QAAQ;AACvF,SAAO;AAAA,IACL,UAAU,OAAO;AAAA,IACjB,WAAW,aAAa,aAAa,gBAAgB,aAAa,OAAO;AAAA,EAC3E;AACF;AAoBO,SAAS,iBAAiB,OAA8C;AAC7E,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAuC,CAAC,CAAC;AAC/E,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,KAAK;AACtD,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAiC,CAAC,CAAC;AAC7E,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAwC,CAAC,CAAC;AACpF,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAwC,CAAC,CAAC;AAClF,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AAEtD,QAAM,WAAW,MAAM,KAAK,QAAQ;AACpC,QAAM,SAAS,MAAM,GAAG,QAAQ;AAEhC,QAAM,UAAU,MAAM;AACpB,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI,YAAY;AAChB,mBAAe,oBAAoB;AACjC,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA,EAAE,QAAQ,WAAW,OAAO;AAAA,MAC9B;AACA,UAAI,aAAa,CAAC,KAAK,GAAI;AAC3B,YAAM,UAAU,MAAM,QAAQ,KAAK,QAAQ,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACzE,YAAM,SAAiC,CAAC;AACxC,YAAM,SAAwC,CAAC;AAC/C,YAAM,QAAuC,CAAC;AAC9C,iBAAW,SAAS,SAAS;AAC3B,YAAI,OAAO,OAAO,UAAU,YAAY,MAAM,MAAM,WAAW,EAAG;AAClE,eAAO,MAAM,KAAK,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ,MAAM;AACtG,eAAO,MAAM,KAAK,IAAI,OAAO,MAAM,UAAU,YAAY,MAAM,MAAM,SAAS,IAAI,MAAM,QAAQ;AAChG,cAAM,MAAM,KAAK,IAAI,OAAO,MAAM,SAAS,YAAY,MAAM,KAAK,SAAS,IAAI,MAAM,OAAO;AAAA,MAC9F;AACA,oBAAc,MAAM;AACpB,oBAAc,MAAM;AACpB,mBAAa,KAAK;AAAA,IACpB;AACA,sBAAkB,EAAE,MAAM,MAAM;AAC9B,UAAI,aAAa,WAAW,OAAO,QAAS;AAC5C,oBAAc,CAAC,CAAC;AAChB,oBAAc,CAAC,CAAC;AAChB,mBAAa,CAAC,CAAC;AAAA,IACjB,CAAC;AACD,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,UAAU,MAAM;AACpB,UAAM,aAAa,IAAI,gBAAgB;AACvC,QAAI,YAAY;AAChB,mBAAe,mBAAmB;AAChC,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,UAAI;AACF,cAAM,cAAc,eAAe,EAAE,MAAM,IAAI,KAAK,QAAQ,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;AACrF,cAAM,SAAS,MAAM,wBAAwB,aAAa,WAAW,MAAM;AAC3E,YAAI,UAAW;AACf,oBAAY,OAAO,QAAQ;AAC3B,qBAAa,OAAO,SAAS;AAAA,MAC/B,SAAS,KAAK;AACZ,YAAI,aAAa,WAAW,OAAO,QAAS;AAC5C,oBAAY,CAAC,CAAC;AACd,qBAAa,KAAK;AAClB,iBAAS,eAAe,QAAQ,IAAI,UAAU,+CAA+C;AAAA,MAC/F,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK,iBAAiB;AACtB,WAAO,MAAM;AACX,kBAAY;AACZ,iBAAW,MAAM;AAAA,IACnB;AAAA,EACF,GAAG,CAAC,UAAU,QAAQ,WAAW,CAAC;AAElC,QAAM,QAAQ,MAAM,QAAQ,MAAM;AAChC,UAAM,kBAAkB,eAAe,EAAE,MAAM,IAAI,KAAK,QAAQ,GAAG,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;AACzF,UAAM,SAAyB,CAAC;AAChC,eAAW,WAAW,UAAU;AAC9B,YAAM,OAAO,6BAA6B,SAAS,UAAU;AAC7D,UAAI,CAAC,KAAM;AACX,aAAO,KAAK,GAAG,kBAAkB,MAAM,eAAe,CAAC;AAAA,IACzD;AACA,WAAO;AAAA,EACT,GAAG,CAAC,UAAU,YAAY,UAAU,MAAM,CAAC;AAE3C,QAAM,UAAU,MAAM,YAAY,MAAM;AACtC,mBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,EACrC,GAAG,CAAC,CAAC;AAEL,SAAO,EAAE,OAAO,WAAW,OAAO,WAAW,YAAY,YAAY,WAAW,QAAQ;AAC1F;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6944.1.eef6a0ee1d",
+  "version": "0.6.8-develop.6948.1.8369fc4c97",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6944.1.eef6a0ee1d",
-    "@open-mercato/shared": "0.6.8-develop.6944.1.eef6a0ee1d",
-    "@open-mercato/ui": "0.6.8-develop.6944.1.eef6a0ee1d",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6948.1.8369fc4c97",
+    "@open-mercato/shared": "0.6.8-develop.6948.1.8369fc4c97",
+    "@open-mercato/ui": "0.6.8-develop.6948.1.8369fc4c97",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6944.1.eef6a0ee1d",
-    "@open-mercato/shared": "0.6.8-develop.6944.1.eef6a0ee1d",
-    "@open-mercato/ui": "0.6.8-develop.6944.1.eef6a0ee1d",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6948.1.8369fc4c97",
+    "@open-mercato/shared": "0.6.8-develop.6948.1.8369fc4c97",
+    "@open-mercato/ui": "0.6.8-develop.6948.1.8369fc4c97",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/authFixtures.ts

@@ -86,12 +86,15 @@ export async function deleteUserIfExists(
 export async function createOrganizationFixture(
   request: APIRequestContext,
   token: string,
-  input: { name: string; tenantId?: string },
+  input: { name: string; tenantId?: string; parentId?: string },
 ): Promise<string> {
-  const payload: { name: string; tenantId?: string } = { name: input.name };
+  const payload: { name: string; tenantId?: string; parentId?: string } = { name: input.name };
   if (typeof input.tenantId === 'string' && input.tenantId.length > 0) {
     payload.tenantId = input.tenantId;
   }
+  if (typeof input.parentId === 'string' && input.parentId.length > 0) {
+    payload.parentId = input.parentId;
+  }
   const response = await apiRequest(request, 'POST', '/api/directory/organizations', {
     token,
     data: payload,

package/src/modules/auth/api/users/acl/route.ts

@@ -16,6 +16,7 @@ import {
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 
 const getSchema = z.object({ userId: z.string().uuid() })
 const putSchema = z.object({
@@ -76,6 +77,12 @@ export async function GET(req: Request) {
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
+        organizationScope: await resolveOrganizationScopeForRequest({
+          container,
+          auth,
+          request: req,
+          tenantId: auth.tenantId ?? null,
+        }),
       })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
@@ -143,6 +150,12 @@ export async function PUT(req: Request) {
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.userId,
         actorIsSuperAdmin: false,
+        organizationScope: await resolveOrganizationScopeForRequest({
+          container,
+          auth,
+          request: req,
+          tenantId: auth.tenantId ?? null,
+        }),
       })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })

package/src/modules/auth/api/users/consents/route.ts

@@ -11,6 +11,7 @@ import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { ConsentItem } from '@open-mercato/core/modules/auth/lib/consentTypes'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 
 export const metadata = {
   path: '/auth/users/consents',
@@ -50,6 +51,12 @@ export async function GET(req: Request) {
         tenantId,
         organizationId,
         targetUserId: parsed.data.userId,
+        organizationScope: await resolveOrganizationScopeForRequest({
+          container,
+          auth,
+          request: req,
+          tenantId,
+        }),
       })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })

package/src/modules/auth/api/users/resend-invite/route.ts

@@ -17,6 +17,7 @@ import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
 import { assertActorCanAccessUserTarget } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -96,6 +97,12 @@ export async function POST(req: Request) {
         organizationId: auth.orgId ?? null,
         targetUserId: parsed.data.id,
         actorIsSuperAdmin: isSuperAdmin,
+        organizationScope: await resolveOrganizationScopeForRequest({
+          container,
+          auth,
+          request: req,
+          tenantId: auth.tenantId ?? null,
+        }),
       })
     } catch (err) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })

package/src/modules/auth/api/users/route.ts

@@ -15,9 +15,12 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { userCrudEvents, userCrudIndexer } from '@open-mercato/core/modules/auth/commands/users'
 import {
   assertActorCanAccessUserTarget,
+  assertActorCanAssignUserDestination,
   assertActorCanGrantRoleTokens,
   assertActorCanModifySuperAdminUserTarget,
   listSuperAdminUserIds,
+  resolveUserDestinationRoles,
+  throwUserDestinationOrganizationNotFound,
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
@@ -168,7 +171,14 @@ const crud = makeCrudRoute<CrudInput, CrudInput, Record<string, unknown>>({
             await assertCanModifySuperAdminTarget(ctx.request, parsed.id)
             await assertCanAccessUserTarget(ctx.request, parsed.id)
           }
-          await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
+          if (typeof parsed.organizationId === 'string' && parsed.organizationId.length) {
+            const destinationChanged = await assertCanAssignUserDestination(ctx.request, parsed)
+            if (!destinationChanged) {
+              await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
+            }
+          } else {
+            await assertCanAssignRoles(ctx.request, parsed.roles, parsed)
+          }
         }
         return parsed
       },
@@ -559,6 +569,12 @@ async function assertCanAccessUserTarget(req: Request, targetUserId: string) {
   if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
+  const organizationScope = await resolveOrganizationScopeForRequest({
+    container,
+    auth,
+    request: req,
+    tenantId: auth.tenantId ?? null,
+  })
   await assertActorCanAccessUserTarget({
     em,
     rbacService: container.resolve('rbacService') as RbacService,
@@ -566,6 +582,7 @@ async function assertCanAccessUserTarget(req: Request, targetUserId: string) {
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
     targetUserId,
+    organizationScope,
   })
 }
 
@@ -598,6 +615,65 @@ async function assertCanAssignRoles(req: Request, roles: unknown, payload: Recor
   })
 }
 
+async function assertCanAssignUserDestination(req: Request, payload: Record<string, unknown>): Promise<boolean> {
+  const organizationId = typeof payload.organizationId === 'string' ? payload.organizationId : null
+  const targetUserId = typeof payload.id === 'string' ? payload.id : null
+  if (!organizationId || !targetUserId) return false
+
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub) throw new CrudHttpError(401, { error: 'Unauthorized' })
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const targetUser = await findOneWithDecryption(
+    em,
+    User,
+    { id: targetUserId, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!targetUser) return false
+  const organization = await findOneWithDecryption(
+    em,
+    Organization,
+    { id: organizationId },
+    { populate: ['tenant'] },
+    { tenantId: null, organizationId },
+  )
+  if (!organization) return throwUserDestinationOrganizationNotFound(400)
+  const destinationTenantId = organization.tenant?.id ? String(organization.tenant.id) : null
+  if (!destinationTenantId) return throwUserDestinationOrganizationNotFound(400)
+  const currentOrganizationId = targetUser.organizationId ? String(targetUser.organizationId) : null
+  const currentTenantId = targetUser.tenantId ? String(targetUser.tenantId) : null
+  if (currentOrganizationId === organizationId && currentTenantId === destinationTenantId) {
+    return false
+  }
+  const roles = await resolveUserDestinationRoles({
+    em,
+    targetUserId,
+    destinationTenantId,
+    roleTokens: payload.roles,
+  })
+  const organizationScope = await resolveOrganizationScopeForRequest({
+    container,
+    auth,
+    request: req,
+    tenantId: destinationTenantId,
+  })
+  await assertActorCanAssignUserDestination({
+    em,
+    rbacService: container.resolve('rbacService') as RbacService,
+    actorUserId: auth.sub,
+    actorIsSuperAdmin: auth.isSuperAdmin === true,
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+    allowedOrganizationIds: organizationScope.allowedIds,
+    destinationTenantId,
+    destinationOrganizationId: organizationId,
+    roles,
+  })
+  return true
+}
+
 async function resolveTargetTenantIdForRoleGrant(
   em: EntityManager,
   payload: Record<string, unknown>,
@@ -666,7 +742,7 @@ export const openApi: OpenApiRouteDoc = {
     PUT: {
       summary: 'Update user',
       description:
-        'Updates profile fields including display name, organization assignment, credentials, or role memberships. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',
+        'Updates profile fields including display name, organization assignment, credentials, or role memberships. A destination organization must be within the caller\'s descendant-expanded organization scope. Retained and newly assigned roles must belong to the destination tenant and be grantable by the caller. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',
       requestBody: {
         contentType: 'application/json',
         schema: userUpdateSchema,
@@ -677,8 +753,8 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid payload, duplicate email, or the update would remove the last active holder of a protected role', schema: errorResponseSchema },
         { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
-        { status: 403, description: 'Attempted to assign privileged roles', schema: errorResponseSchema },
-        { status: 404, description: 'User not found', schema: errorResponseSchema },
+        { status: 403, description: 'Destination organization is outside caller scope, or a retained or assigned role is not grantable', schema: errorResponseSchema },
+        { status: 404, description: 'User or destination organization not found in the caller tenant scope', schema: errorResponseSchema },
       ],
     },
     DELETE: {

package/src/modules/auth/commands/users.ts

@@ -17,6 +17,7 @@ import { UniqueConstraintViolationException, LockMode } from '@mikro-orm/core'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { User, UserRole, Role, UserAcl, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import { resolveOrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { E } from '#generated/entities.ids.generated'
 import { z } from 'zod'
 import {
@@ -41,6 +42,12 @@ import { getSecurityEmailBaseUrl } from '@open-mercato/shared/lib/url'
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  assertActorCanAssignUserDestination,
+  resolveUserDestinationRoles,
+  throwUserDestinationOrganizationNotFound,
+} from '@open-mercato/core/modules/auth/lib/grantChecks'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 const logger = createLogger('auth').child({ component: 'users-commands' })
 
@@ -548,6 +555,7 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       : null
 
     let tenantId: string | null | undefined
+    let destinationChanged = false
     if (parsed.organizationId !== undefined) {
       const organization = await findOneWithDecryption(
         em,
@@ -556,8 +564,52 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
         { populate: ['tenant'] },
         { tenantId: null, organizationId: parsed.organizationId ?? null },
       )
-      if (!organization) throw new CrudHttpError(400, { error: 'Organization not found' })
+      if (!organization) return throwUserDestinationOrganizationNotFound(400)
       tenantId = organization.tenant?.id ? String(organization.tenant.id) : null
+      if (!tenantId) return throwUserDestinationOrganizationNotFound(400)
+      const currentUser = await findOneWithDecryption(
+        em,
+        User,
+        { id: parsed.id, deletedAt: null },
+        {},
+        { tenantId: null, organizationId: null },
+      )
+      if (!currentUser) throw new CrudHttpError(404, { error: 'User not found' })
+      const currentOrganizationId = currentUser.organizationId ? String(currentUser.organizationId) : null
+      const currentTenantId = currentUser.tenantId ? String(currentUser.tenantId) : null
+      destinationChanged = currentOrganizationId !== parsed.organizationId || currentTenantId !== tenantId
+      if (destinationChanged) {
+        const rbacService = ctx.container.resolve('rbacService') as RbacService
+        const destinationRoles = await resolveUserDestinationRoles({
+          em,
+          targetUserId: parsed.id,
+          destinationTenantId: tenantId,
+          roleTokens: parsed.roles,
+        })
+        const actorIsSuperAdmin = ctx.systemActor === true || ctx.auth?.isSuperAdmin === true
+        const organizationScope = ctx.organizationScope?.tenantId === tenantId
+          ? ctx.organizationScope
+          : !actorIsSuperAdmin && ctx.auth?.sub
+            ? await resolveOrganizationScope({
+                em,
+                rbac: rbacService,
+                auth: ctx.auth,
+                tenantId,
+              })
+            : null
+        await assertActorCanAssignUserDestination({
+          em,
+          rbacService,
+          actorUserId: ctx.auth?.sub,
+          actorIsSuperAdmin,
+          tenantId: ctx.auth?.tenantId ?? null,
+          organizationId: ctx.auth?.orgId ?? null,
+          allowedOrganizationIds: organizationScope?.allowedIds,
+          destinationTenantId: tenantId,
+          destinationOrganizationId: parsed.organizationId,
+          roles: destinationRoles,
+        })
+      }
     }
 
     const userTenantId = existing.tenantId ? String(existing.tenantId) : null
@@ -655,7 +707,7 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
           values: custom,
         })
       }
-    ], { transaction: true })
+    ], { transaction: true, label: destinationChanged ? 'auth.users.update.destination' : 'auth.users.update' })
 
     const identifiers = {
       id: String(user.id),

package/src/modules/auth/i18n/de.json

@@ -161,8 +161,12 @@
   "auth.users.consents.loadError": "Einwilligungen konnten nicht geladen werden",
   "auth.users.consents.loading": "Einwilligungen werden geladen...",
   "auth.users.consents.withdrawn": "Widerrufen",
+  "auth.users.errors.destinationOrganizationOutsideScope": "Der Benutzer kann keiner Zielorganisation außerhalb Ihres Zugriffsbereichs zugewiesen werden.",
   "auth.users.errors.emailExists": "E-Mail-Adresse wird bereits verwendet",
+  "auth.users.errors.invalidRoleAssignment": "Der Benutzer hat eine ungültige Rollenzuweisung.",
   "auth.users.errors.lastHolderOfCriticalRole": "Der letzte aktive Inhaber der Rolle \"{roleName}\" kann nicht entfernt werden",
+  "auth.users.errors.organizationNotFound": "Organisation nicht gefunden",
+  "auth.users.errors.roleOutsideDestinationTenant": "Eine Rolle außerhalb des Zielmandanten kann weder beibehalten noch zugewiesen werden.",
   "auth.users.flash.created": "Benutzer erstellt",
   "auth.users.flash.createdEmailFailed": "Benutzer erstellt, aber die Einladungs-E-Mail konnte nicht gesendet werden. Sie können sie über die Benutzerseite erneut senden.",
   "auth.users.flash.createdWithInvite": "Benutzer erstellt und Einladung gesendet",

package/src/modules/auth/i18n/en.json

@@ -161,8 +161,12 @@
   "auth.users.consents.loadError": "Failed to load consents",
   "auth.users.consents.loading": "Loading consents...",
   "auth.users.consents.withdrawn": "Withdrawn",
+  "auth.users.errors.destinationOrganizationOutsideScope": "Cannot assign user to a destination organization outside actor scope.",
   "auth.users.errors.emailExists": "Email already in use",
+  "auth.users.errors.invalidRoleAssignment": "User has an invalid role assignment",
   "auth.users.errors.lastHolderOfCriticalRole": "Cannot remove the last active holder of role \"{roleName}\"",
+  "auth.users.errors.organizationNotFound": "Organization not found",
+  "auth.users.errors.roleOutsideDestinationTenant": "Cannot retain or assign a role outside the destination tenant.",
   "auth.users.flash.created": "User created",
   "auth.users.flash.createdEmailFailed": "User created but invitation email could not be sent. You can resend it from the user page.",
   "auth.users.flash.createdWithInvite": "User created and invitation sent",

package/src/modules/auth/i18n/es.json

@@ -161,8 +161,12 @@
   "auth.users.consents.loadError": "No se pudieron cargar los consentimientos",
   "auth.users.consents.loading": "Cargando consentimientos...",
   "auth.users.consents.withdrawn": "Retirado",
+  "auth.users.errors.destinationOrganizationOutsideScope": "No se puede asignar el usuario a una organización de destino fuera de su ámbito de acceso.",
   "auth.users.errors.emailExists": "El correo ya está en uso",
+  "auth.users.errors.invalidRoleAssignment": "El usuario tiene una asignación de rol no válida.",
   "auth.users.errors.lastHolderOfCriticalRole": "No se puede eliminar al último titular activo del rol \"{roleName}\"",
+  "auth.users.errors.organizationNotFound": "Organización no encontrada",
+  "auth.users.errors.roleOutsideDestinationTenant": "No se puede conservar ni asignar un rol fuera del tenant de destino.",
   "auth.users.flash.created": "Usuario creado",
   "auth.users.flash.createdEmailFailed": "Usuario creado pero no se pudo enviar el correo de invitación. Puede reenviarlo desde la página del usuario.",
   "auth.users.flash.createdWithInvite": "Usuario creado e invitación enviada",

package/src/modules/auth/i18n/ko.json

@@ -161,8 +161,12 @@
   "auth.users.consents.loadError": "동의 정보를 불러오지 못했습니다",
   "auth.users.consents.loading": "동의 정보를 불러오는 중...",
   "auth.users.consents.withdrawn": "철회함",
+  "auth.users.errors.destinationOrganizationOutsideScope": "접근 범위를 벗어난 대상 조직에 사용자를 할당할 수 없습니다.",
   "auth.users.errors.emailExists": "이미 사용 중인 이메일입니다",
+  "auth.users.errors.invalidRoleAssignment": "사용자에게 잘못된 역할이 할당되어 있습니다.",
   "auth.users.errors.lastHolderOfCriticalRole": "\"{roleName}\" 역할의 마지막 활성 보유자는 제거할 수 없습니다",
+  "auth.users.errors.organizationNotFound": "조직을 찾을 수 없습니다",
+  "auth.users.errors.roleOutsideDestinationTenant": "대상 테넌트 외부의 역할을 유지하거나 할당할 수 없습니다.",
   "auth.users.flash.created": "사용자가 생성되었습니다",
   "auth.users.flash.createdEmailFailed": "사용자가 생성되었지만 초대 이메일을 보낼 수 없었습니다. 사용자 페이지에서 다시 보낼 수 있습니다.",
   "auth.users.flash.createdWithInvite": "사용자가 생성되고 초대가 전송되었습니다",

package/src/modules/auth/i18n/pl.json

@@ -161,8 +161,12 @@
   "auth.users.consents.loadError": "Nie udało się wczytać zgód",
   "auth.users.consents.loading": "Ładowanie zgód...",
   "auth.users.consents.withdrawn": "Wycofana",
+  "auth.users.errors.destinationOrganizationOutsideScope": "Nie można przypisać użytkownika do organizacji docelowej poza zakresem dostępu.",
   "auth.users.errors.emailExists": "Adres e-mail jest już używany",
+  "auth.users.errors.invalidRoleAssignment": "Użytkownik ma nieprawidłowo przypisaną rolę.",
   "auth.users.errors.lastHolderOfCriticalRole": "Nie można usunąć ostatniego aktywnego posiadacza roli \"{roleName}\"",
+  "auth.users.errors.organizationNotFound": "Nie znaleziono organizacji",
+  "auth.users.errors.roleOutsideDestinationTenant": "Nie można zachować ani przypisać roli spoza docelowego tenantu.",
   "auth.users.flash.created": "Użytkownik utworzony",
   "auth.users.flash.createdEmailFailed": "Użytkownik utworzony, ale nie udało się wysłać e-maila z zaproszeniem. Możesz wysłać go ponownie ze strony użytkownika.",
   "auth.users.flash.createdWithInvite": "Użytkownik utworzony i zaproszenie wysłane",