@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/customer_accounts/lib/portalUrl.ts

@@ -0,0 +1,112 @@
+// Resolve the browser-visible origin on the server so the admin portal-address
+// hints are already correct in the first server-rendered paint. Deriving the
+// origin from `window.location.origin` during render made the server HTML and
+// the hydrated client output disagree, which React reported as a hydration
+// error and repaired with a visible flicker of the portal address (#5457).
+//
+// `resolvePortalRequestOrigin` is deliberately named apart from the shared
+// `resolveRequestOrigin` in `@open-mercato/shared/lib/url`: that one takes a
+// `Request` and reads the protocol off `req.url`, which a server component does
+// not have — it only has `headers()`. This one also validates the untrusted host
+// header before the value reaches rendered text or a link href, and infers the
+// protocol when the proxy stays quiet, so the two are not interchangeable.
+
+export type RequestHeaderReader = {
+  get(name: string): string | null | undefined
+}
+
+const FORWARDED_HOST_HEADER = 'x-forwarded-host'
+const HOST_HEADER = 'host'
+const FORWARDED_PROTO_HEADER = 'x-forwarded-proto'
+
+// Host headers are client-controlled, so only a plain `host[:port]` or bracketed
+// IPv6 literal is accepted before it reaches rendered text and link hrefs.
+const HOST_PATTERN = /^(?:[a-z0-9.-]+|\[[0-9a-f:.]+\])(?::\d{1,5})?$/i
+const PROTOCOL_PATTERN = /^https?$/i
+// Bracketed, because HOST_PATTERN only accepts a colon-bearing host in that form.
+const LOOPBACK_HOSTS = new Set(['localhost', '127.0.0.1', '[::1]'])
+
+export const PORTAL_ORG_SLUG_PLACEHOLDER = '[org-slug]'
+
+function firstHeaderValue(raw: string | null | undefined): string | null {
+  if (typeof raw !== 'string') return null
+  // Proxy chains append values, so the client-facing hop is the first entry.
+  const value = raw.split(',')[0]?.trim() ?? ''
+  return value.length > 0 ? value : null
+}
+
+function readHost(headers: RequestHeaderReader): string | null {
+  const forwarded = firstHeaderValue(headers.get(FORWARDED_HOST_HEADER))
+  const host = forwarded ?? firstHeaderValue(headers.get(HOST_HEADER))
+  if (!host) return null
+  return HOST_PATTERN.test(host) ? host.toLowerCase() : null
+}
+
+function readProtocol(headers: RequestHeaderReader, host: string): string {
+  const forwarded = firstHeaderValue(headers.get(FORWARDED_PROTO_HEADER))
+  if (forwarded && PROTOCOL_PATTERN.test(forwarded)) return forwarded.toLowerCase()
+  // An operator who configured APP_URL has named the canonical origin explicitly;
+  // when it points at this very host, trust it over any inference below. Without
+  // this, a plain-HTTP deployment behind a proxy that omits x-forwarded-proto
+  // would render https:// links that do not work.
+  const configured = configuredOrigin()
+  if (configured) {
+    try {
+      const parsed = new URL(configured)
+      if (parsed.host.toLowerCase() === host) return parsed.protocol.replace(':', '')
+    } catch {
+      // configuredOrigin() already parsed this successfully; ignore defensively.
+    }
+  }
+  // Otherwise a terminating proxy that omits the header is serving a public
+  // hostname over TLS far more often than not; only loopback hosts default to http.
+  const hostname = host.replace(/:\d{1,5}$/, '')
+  return LOOPBACK_HOSTS.has(hostname) ? 'http' : 'https'
+}
+
+function configuredOrigin(): string {
+  const candidates = [process.env.APP_URL, process.env.NEXT_PUBLIC_APP_URL]
+  for (const candidate of candidates) {
+    const value = candidate?.trim()
+    if (!value) continue
+    try {
+      const parsed = new URL(value)
+      if (PROTOCOL_PATTERN.test(parsed.protocol.replace(':', ''))) return parsed.origin
+    } catch {
+      // A malformed APP_URL must not break the page — fall through to the next candidate.
+    }
+  }
+  return ''
+}
+
+/**
+ * Resolve the origin the current request was made to, mirroring the value
+ * `window.location.origin` reports in the browser. Falls back to the configured
+ * app URL, then to an empty string so callers render a root-relative path that
+ * is identical on the server and the client.
+ *
+ * Named apart from `resolveRequestOrigin` in `@open-mercato/shared/lib/url` —
+ * see the note at the top of this file for why the two cannot be merged.
+ */
+export function resolvePortalRequestOrigin(headers: RequestHeaderReader | null | undefined): string {
+  if (headers && typeof headers.get === 'function') {
+    const host = readHost(headers)
+    if (host) return `${readProtocol(headers, host)}://${host}`
+  }
+  return configuredOrigin()
+}
+
+function normalizeOrigin(origin: string | null | undefined): string {
+  if (typeof origin !== 'string') return ''
+  return origin.trim().replace(/\/+$/, '')
+}
+
+/** Display pattern for a tenant portal address, e.g. `https://app.example.com/[org-slug]/portal`. */
+export function buildPortalUrlPattern(origin: string | null | undefined): string {
+  return `${normalizeOrigin(origin)}/${PORTAL_ORG_SLUG_PLACEHOLDER}/portal`
+}
+
+/** Portal entry point used by the "Open Portal" action on admin pages. */
+export function buildPortalRootUrl(origin: string | null | undefined): string {
+  return `${normalizeOrigin(origin)}/portal`
+}

package/src/modules/customer_accounts/services/domainMappingService.ts

@@ -9,17 +9,9 @@ import {
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
-import { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'
 import { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'
 import { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'
 
-export class DomainMappingOrgScopeError extends Error {
-  constructor(organizationId: string) {
-    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`)
-    this.name = 'DomainMappingOrgScopeError'
-  }
-}
-
 const DOMAIN_ROUTING_TAG = 'domain_routing'
 const RESOLVE_KEY_PREFIX = 'domain_routing:resolve'
 const ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'
@@ -277,8 +269,6 @@ export class DomainMappingService {
 
   async register(input: RegisterInput): Promise<DomainMapping> {
     const hostname = normalizeHostname(input.hostname)
-    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId)
-    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId)
 
     let replacesDomain: DomainMapping | null = null
     if (input.replacesDomainId) {

package/src/modules/customers/ai-tools/companies-pack.ts

@@ -85,7 +85,7 @@ const listCompaniesTool = defineApiBackedAiTool<
   name: 'customers.list_companies',
   displayName: 'List companies',
   description:
-    'Search / list companies for the caller tenant + organization. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor ("at least N", render it as "N+"), and pagination is exhausted only when a page returns fewer than limit items — never when offset reaches total.',
+    'Search / list companies for the caller tenant + organization. Returns { items, total, limit, offset }.',
   inputSchema: listCompaniesInput,
   requiredFeatures: ['customers.companies.view'],
   toOperation: (input, ctx) => {
@@ -122,9 +122,6 @@ const listCompaniesTool = defineApiBackedAiTool<
         sizeBucket: row.size_bucket ?? row.sizeBucket ?? null,
       })),
       total: typeof data.total === 'number' ? data.total : 0,
-      // A capped count reports a floor: phrase the total as "at least N" and
-      // never treat it as proof that pagination is exhausted.
-      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,
       limit,
       offset,
     }

package/src/modules/customers/ai-tools/deal-analyzer-pack.ts

@@ -192,29 +192,14 @@ const analyzeDealsToolDefinition: CustomersAiToolDefinition<AnalyzeDealsInput, A
     // has no encrypted columns, but the linked CustomerEntity.display_name is
     // encrypted, so resolve names via findWithDecryption rather than
     // populating the relation through raw em.find.
-    // Defense-in-depth: `customer_deal_people` carries no tenant/org columns,
-    // so DB-level scoping is via the tenant-filtered `dealIds` set. Filter the
-    // returned rows against the caller-scoped deals map so a future refactor
-    // that widens `dealIds` cannot surface cross-tenant links.
-    const dealById = new Map<string, CustomerDeal>(deals.map((deal) => [deal.id, deal]))
-    const scopedDealIds = Array.from(dealById.keys())
     const personLinkWhere: Record<string, unknown> = {
-      deal: { $in: scopedDealIds },
+      deal: { $in: dealIds },
     }
-    const personLinksRaw = await em.find(
+    const personLinks = await em.find(
       CustomerDealPersonLink,
       personLinkWhere as any,
       { limit: 500 },
     )
-    const personLinks = personLinksRaw.filter((link) => {
-      const dealRefId = refIdOf((link as { deal?: unknown }).deal)
-      if (!dealRefId) return false
-      const scopedDeal = dealById.get(dealRefId)
-      if (!scopedDeal) return false
-      if (scopedDeal.tenantId !== tenantId) return false
-      if (ctx.organizationId && scopedDeal.organizationId !== ctx.organizationId) return false
-      return true
-    })
 
     const linksByDeal = new Map<string, string>() // dealId → personId (first link wins)
     for (const link of personLinks) {

package/src/modules/customers/ai-tools/deals-pack.ts

@@ -27,11 +27,6 @@ import {
   CustomerDeal,
   CustomerPipelineStage,
 } from '../data/entities'
-import {
-  dealClosureOutcomeFromStatus,
-  loadClosurePipelineStageSnapshot,
-} from '../lib/closureStage'
-import { canonicalDealStatus, isClosedDealStatus } from '../lib/dealStatus'
 import {
   assertTenantScope,
   type CustomersAiToolDefinition,
@@ -104,7 +99,7 @@ const listDealsTool = defineApiBackedAiTool<ListDealsInput, ListDealsApiResponse
   name: 'customers.list_deals',
   displayName: 'List deals',
   description:
-    'Search / list deals for the caller tenant + organization. Optional filters include linked person / company / pipeline stage. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor ("at least N", render it as "N+"), and pagination is exhausted only when a page returns fewer than limit items — never when offset reaches total.',
+    'Search / list deals for the caller tenant + organization. Optional filters include linked person / company / pipeline stage.',
   inputSchema: listDealsInput,
   requiredFeatures: ['customers.deals.view'],
   toOperation: (input, ctx) => {
@@ -160,9 +155,6 @@ const listDealsTool = defineApiBackedAiTool<ListDealsInput, ListDealsApiResponse
         }
       }),
       total: typeof data.total === 'number' ? data.total : 0,
-      // A capped count reports a floor: phrase the total as "at least N" and
-      // never treat it as proof that pagination is exhausted.
-      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,
       limit,
       offset,
     }
@@ -474,48 +466,10 @@ const updateDealStageTool: CustomersAiToolDefinition = {
       afterPipelineStageLabel = stage?.label ?? input.toPipelineStageId
     } else if (input.toStage) {
       afterStatus = input.toStage
-      // The update command derives a closure outcome from terminal status spellings and
-      // relocates the deal to the pipeline's terminal stage (#5107) — preview that same
-      // projection so the approval card states the full blast radius.
-      const organizationId = deal.organizationId ?? ctx.organizationId ?? null
-      const outcome = dealClosureOutcomeFromStatus(input.toStage)
-      if (outcome && organizationId) {
-        const terminalStage = await loadClosurePipelineStageSnapshot(em, {
-          pipelineId: deal.pipelineId ?? null,
-          closureOutcome: outcome,
-          tenantId,
-          organizationId,
-        })
-        if (terminalStage) {
-          afterPipelineStageId = terminalStage.id
-          afterPipelineStageLabel = terminalStage.label
-        }
-      }
     }
     const beforeStatus = deal.status ?? null
     const beforePipelineStageId = deal.pipelineStageId ?? null
     const beforePipelineStageLabel = deal.pipelineStage ?? beforePipelineStageId
-    const beforeClosureOutcome = deal.closureOutcome ?? null
-    const beforeLossReasonId = deal.lossReasonId ?? null
-    const beforeLossNotes = deal.lossNotes ?? null
-    // Mirror the update command exactly (#5107): a status-only write derives the closure
-    // outcome for terminal spellings, clears outcome plus loss columns for non-closed
-    // non-terminal ones (reopen), and leaves `closed` and stage-only writes untouched.
-    // `toStage` is free-form model text, so canonicalize before the `closed` check — the
-    // command does the same, and the two must stay in lockstep or the approval card would
-    // preview a different write than the one that lands.
-    const requestedOutcome = dealClosureOutcomeFromStatus(input.toStage)
-    const clearsClosure =
-      input.toPipelineStageId === undefined &&
-      input.toStage !== undefined &&
-      !requestedOutcome &&
-      !isClosedDealStatus(canonicalDealStatus(input.toStage))
-    const afterClosureOutcome = clearsClosure
-      ? null
-      : requestedOutcome ?? beforeClosureOutcome
-    const closureOutcomeCleared = beforeClosureOutcome !== null && afterClosureOutcome === null
-    const afterLossReasonId = closureOutcomeCleared ? null : beforeLossReasonId
-    const afterLossNotes = closureOutcomeCleared ? null : beforeLossNotes
     return {
       recordId: deal.id,
       entityType: 'customers.deal',
@@ -523,42 +477,23 @@ const updateDealStageTool: CustomersAiToolDefinition = {
       before: {
         status: beforeStatus,
         pipelineStageId: beforePipelineStageId,
-        closureOutcome: beforeClosureOutcome,
-        lossReasonId: beforeLossReasonId,
-        lossNotes: beforeLossNotes,
       },
       after: {
         status: afterStatus,
         pipelineStageId: afterPipelineStageId,
-        closureOutcome: afterClosureOutcome,
-        lossReasonId: afterLossReasonId,
-        lossNotes: afterLossNotes,
       },
       display: {
         fieldLabels: {
           status: 'Status',
           pipelineStageId: 'Pipeline stage',
-          closureOutcome: 'Closure outcome',
-          lossReasonId: 'Loss reason',
-          lossNotes: 'Loss notes',
         },
         before: {
           ...(beforeStatus ? { status: titleStatus(beforeStatus) } : {}),
           ...(beforePipelineStageLabel ? { pipelineStageId: beforePipelineStageLabel } : {}),
-          ...(beforeClosureOutcome ? { closureOutcome: titleStatus(beforeClosureOutcome) } : {}),
-          ...(beforeLossReasonId ? { lossReasonId: beforeLossReasonId } : {}),
-          ...(beforeLossNotes ? { lossNotes: beforeLossNotes } : {}),
         },
         after: {
           ...(afterStatus ? { status: titleStatus(afterStatus) } : {}),
           ...(afterPipelineStageLabel ? { pipelineStageId: afterPipelineStageLabel } : {}),
-          ...(afterClosureOutcome
-            ? { closureOutcome: titleStatus(afterClosureOutcome) }
-            : closureOutcomeCleared
-              ? { closureOutcome: '—' }
-              : {}),
-          ...(afterLossReasonId ? { lossReasonId: afterLossReasonId } : {}),
-          ...(afterLossNotes ? { lossNotes: afterLossNotes } : {}),
         },
       },
     }

package/src/modules/customers/ai-tools/people-pack.ts

@@ -90,7 +90,7 @@ const listPeopleTool = defineApiBackedAiTool<ListPeopleInput, ListPeopleApiRespo
   name: 'customers.list_people',
   displayName: 'List people',
   description:
-    'Search / list people (CRM persons) for the caller tenant + organization. Returns { items, total, totalIsCapped, limit, offset }. When totalIsCapped is true, total is a floor ("at least N", render it as "N+"), and pagination is exhausted only when a page returns fewer than limit items — never when offset reaches total.',
+    'Search / list people (CRM persons) for the caller tenant + organization. Returns { items, total, limit, offset }.',
   inputSchema: listPeopleInput,
   requiredFeatures: ['customers.people.view'],
   toOperation: async (input, ctx) => {
@@ -144,9 +144,6 @@ const listPeopleTool = defineApiBackedAiTool<ListPeopleInput, ListPeopleApiRespo
     return {
       items: rawItems.map((row) => toCustomerListSummary(row)),
       total: typeof data.total === 'number' ? data.total : 0,
-      // A capped count reports a floor: phrase the total as "at least N" and
-      // never treat it as proof that pagination is exhausted.
-      totalIsCapped: (data as { totalIsCapped?: boolean }).totalIsCapped === true,
       limit,
       offset,
     }

package/src/modules/customers/api/activities/route.ts

@@ -284,22 +284,7 @@ async function listCanonicalActivities(
   organizationIds: string[] | null,
   query: z.infer<typeof listSchema>,
   options?: { includeDeleted?: boolean; source?: string | string[] | null; paginate?: boolean },
-  isUnrestricted?: boolean,
 ): Promise<CanonicalActivityListResult> {
-  if (organizationIds && organizationIds.length === 0 && !isUnrestricted) {
-    return {
-      items: [],
-      total: 0,
-      bridgeIds: new Set(),
-    }
-  }
-  if (organizationIds === null && !isUnrestricted) {
-    return {
-      items: [],
-      total: 0,
-      bridgeIds: new Set(),
-    }
-  }
   const where: Record<string, unknown> = {
     tenantId,
     interactionType: { $ne: 'task' },
@@ -376,14 +361,7 @@ async function listLegacyActivities(
   query: z.infer<typeof listSchema>,
   options?: { paginate?: boolean },
   selectedOrganizationId?: string | null,
-  isUnrestricted?: boolean,
 ): Promise<{ items: ActivityItem[]; total: number }> {
-  if (organizationIds && organizationIds.length === 0 && !isUnrestricted) {
-    return { items: [], total: 0 }
-  }
-  if (organizationIds === null && !isUnrestricted) {
-    return { items: [], total: 0 }
-  }
   const where: Record<string, unknown> = { tenantId }
   if (organizationIds && organizationIds.length > 0) {
     where.organizationId = { $in: organizationIds }
@@ -432,31 +410,12 @@ export async function GET(request: Request): Promise<Response> {
       organizationIds,
       container,
       selectedOrganizationId,
-      scope,
     } = await resolveCustomersRequestContext(request)
     const flags = await resolveCustomerInteractionFeatureFlags(container, auth.tenantId)
     if (!flags.legacyAdapters) {
       return await legacyAdaptersDisabledResponse()
     }
 
-    const isUnrestricted = auth.isSuperAdmin === true || scope?.allowedIds === null
-    if (!isUnrestricted && (!organizationIds || organizationIds.length === 0)) {
-      logger.warn('activities.list collapsed organization scope — returning empty page', {
-        tenantId: auth.tenantId,
-        organizationIds,
-        scope,
-      })
-      return withAdapterHeaders(
-        NextResponse.json({
-          items: [],
-          total: 0,
-          page: query.page,
-          pageSize: query.pageSize,
-          totalPages: 1,
-        }),
-      )
-    }
-
     const sortDir = query.sortDir ?? 'desc'
 
     const result = flags.unified
@@ -468,8 +427,6 @@ export async function GET(request: Request): Promise<Response> {
           auth.tenantId,
           organizationIds,
           query,
-          undefined,
-          isUnrestricted,
         )
       : await (async () => {
         const windowSize = Math.min(
@@ -485,7 +442,6 @@ export async function GET(request: Request): Promise<Response> {
             windowedQuery,
             { paginate: true },
             selectedOrganizationId,
-            isUnrestricted,
           ),
           listCanonicalActivities(
             em,
@@ -500,7 +456,6 @@ export async function GET(request: Request): Promise<Response> {
               paginate: true,
               source: CUSTOMER_INTERACTION_ACTIVITY_ADAPTER_SOURCE,
             },
-            isUnrestricted,
           ),
         ])
         const merged = sortActivityItems(

package/src/modules/customers/api/companies/[id]/people/route.ts

@@ -7,10 +7,17 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
-import { CustomerEntity } from '../../../../data/entities'
-import { loadCompanyPeopleUnion } from '../../../../lib/personCompanies'
+import {
+  CustomerEntity,
+  CustomerPersonCompanyLink,
+  CustomerPersonProfile,
+} from '../../../../data/entities'
+import {
+  filterActivePersonCompanyLinks,
+  withActiveCustomerPersonCompanyLinkFilter,
+} from '../../../../lib/personCompanyLinkTable'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customers')
@@ -112,31 +119,73 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       throw notFound(translate('customers.errors.company_not_found', 'Company not found'))
     }
 
-    // Existence oracle (#5504): deny a cross-org read as not-found — identical to
-    // the parent-not-found above — so it cannot reveal that a company exists in an
-    // organization the caller cannot see.
     if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: company.organizationId })) {
-      throw notFound(translate('customers.errors.company_not_found', 'Company not found'))
+      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
     }
 
     const entityScope = { tenantId: auth.tenantId, organizationId: company.organizationId }
-    const union = await loadCompanyPeopleUnion(em, company, entityScope)
-
-    const items = union.map(({ entity: person, profile, linkedAt }) => ({
-      id: person.id,
-      displayName: person.displayName ?? person.primaryEmail ?? person.id,
-      primaryEmail: person.primaryEmail ?? null,
-      primaryPhone: person.primaryPhone ?? null,
-      status: person.status ?? null,
-      lifecycleStage: person.lifecycleStage ?? null,
-      jobTitle: profile?.jobTitle ?? null,
-      department: profile?.department ?? null,
-      createdAt: person.createdAt.toISOString(),
-      organizationId: person.organizationId,
-      temperature: person.temperature ?? null,
-      source: person.source ?? null,
-      linkedAt,
-    } satisfies CompanyPersonItem))
+    const linkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+      em,
+      {
+        company: company.id,
+        tenantId: company.tenantId,
+        organizationId: company.organizationId,
+      },
+      'customers.companies.people.GET',
+    )
+    const links = filterActivePersonCompanyLinks(
+      await findWithDecryption(
+        em,
+        CustomerPersonCompanyLink,
+        linkWhere,
+        { populate: ['person'] },
+        entityScope,
+      ),
+    )
+
+    const personIds = links
+      .map((link) => link.person?.id)
+      .filter((personId): personId is string => typeof personId === 'string' && personId.length > 0)
+
+    const profiles = personIds.length > 0
+      ? await findWithDecryption(
+          em,
+          CustomerPersonProfile,
+          {
+            entity: { $in: personIds },
+            tenantId: company.tenantId,
+            organizationId: company.organizationId,
+          },
+          {},
+          entityScope,
+        )
+      : []
+    const profileByPersonId = new Map(
+      profiles.map((profile) => [(profile.entity as { id: string }).id, profile]),
+    )
+
+    const items = links
+      .map((link) => {
+        const person = link.person
+        if (!person?.id) return null
+        const profile = profileByPersonId.get(person.id) ?? null
+        return {
+          id: person.id,
+          displayName: person.displayName ?? person.primaryEmail ?? person.id,
+          primaryEmail: person.primaryEmail ?? null,
+          primaryPhone: person.primaryPhone ?? null,
+          status: person.status ?? null,
+          lifecycleStage: person.lifecycleStage ?? null,
+          jobTitle: profile?.jobTitle ?? null,
+          department: profile?.department ?? null,
+          createdAt: person.createdAt.toISOString(),
+          organizationId: person.organizationId,
+          temperature: person.temperature ?? null,
+          source: person.source ?? null,
+          linkedAt: link.createdAt ? link.createdAt.toISOString() : null,
+        } satisfies CompanyPersonItem
+      })
+      .filter((item): item is CompanyPersonItem => item !== null)
 
     const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items
     const sorted = sortItems(filtered, query.sort)