@open-mercato/core 0.7.0 → 0.7.1-develop.7102.1.b41f7e3e51

package/src/modules/communication_channels/di.ts

@@ -11,6 +11,7 @@ import {
 import { getChannelAdapterRegistry } from './lib/adapter-registry-singleton'
 import { ensureTestSeedAdapterRegistered } from './lib/test-seed'
 import { sendAsUser } from './lib/send-as-user'
+import { resolveChannelTypeSafely } from './lib/resolve-channel-type'
 
 export function register(container: AppContainer) {
   // Test-only: register the network-free stub channel adapter when
@@ -36,5 +37,11 @@ export function register(container: AppContainer) {
     // In-process send-as-user facade. Cross-module callers (e.g. the customers
     // compose route) resolve this instead of making an HTTP self-call.
     communicationChannelsSendAsUser: asValue(sendAsUser),
+
+    // Cross-module channel-type lookup. The messages compose route resolves this
+    // to decide whether an external correspondent must carry an email address
+    // (#4975); absent module or failed lookup reads as "unknown", which the
+    // messages validator handles fail-closed.
+    communicationChannelsResolveChannelType: asValue(resolveChannelTypeSafely),
   })
 }

package/src/modules/communication_channels/lib/adapter.ts

@@ -48,6 +48,20 @@ export interface ChannelCapabilities {
    * Optional; existing chat providers (Slack, WhatsApp) omit and are treated as `true`.
    */
   realtimePush?: boolean
+
+  /**
+   * Shape of the outbound recipient this provider's `sendMessage` accepts as
+   * `metadata.to`. Optional; when absent the hub validates recipients as email
+   * addresses, so every provider that predates this field keeps its exact
+   * behavior.
+   *
+   * Declare `'provider-native'` when recipients are provider-issued identifiers
+   * rather than email addresses (e.g. a Discord channel snowflake). The hub then
+   * applies transport-safety checks only (see `validateOutboundRecipient`) and
+   * the adapter owns the provider-specific format — it MUST treat the value as
+   * untrusted input.
+   */
+  recipientFormat?: 'email' | 'provider-native'
 }
 
 // ── Send / status / sender listing ────────────────────────────

package/src/modules/communication_channels/lib/email-capabilities.ts

@@ -57,4 +57,8 @@ export const baseEmailCapabilities: ChannelCapabilities = {
 
   // Polling (real-time push deferred to v2 for all email providers)
   realtimePush: false,
+
+  // Stated rather than left to the default so the email baseline reads as an
+  // explicit choice: outbound recipients here are addresses, not provider ids.
+  recipientFormat: 'email',
 }

package/src/modules/communication_channels/lib/outbound-recipient.ts

@@ -0,0 +1,71 @@
+import { z } from 'zod'
+import type { ChannelCapabilities } from './adapter'
+
+/**
+ * Upper bound shared by both recipient shapes. 320 is the RFC 5321 maximum for
+ * an email address (64 local + `@` + 255 domain); provider-native identifiers
+ * are far shorter, so one ceiling covers both.
+ */
+export const MAX_OUTBOUND_RECIPIENT_LENGTH = 320
+
+const emailRecipientSchema = z.string().email()
+
+/**
+ * Characters a provider-native recipient may contain. This is an allowlist, not a
+ * denylist, because the recipient reaches adapters that interpolate it into a REST
+ * path (Discord posts to `/channels/{recipient}/messages`), and a denylist fails
+ * open on every character nobody thought of — percent-encoded separators
+ * (`%2F`, `%2e%2e%2f`) and control bytes (NUL, DEL) all walked through the
+ * previous `[\r\n\s/\\?#]` class. An allowlist fails closed instead: the worst
+ * case is a provider whose identifier alphabet needs widening, which is a
+ * reviewable one-line change rather than a silent path-steering primitive.
+ *
+ * The set covers every provider-native identifier shape the hub has to carry
+ * today — Discord snowflakes (digits), Slack-style ids (alphanumerics), and email
+ * addresses, since `'provider-native'` must never narrow what `'email'` accepts.
+ */
+const PROVIDER_NATIVE_ALLOWED = /^[A-Za-z0-9._:@+-]+$/
+
+export type OutboundRecipientCheck = { ok: true } | { ok: false; error: string }
+
+/**
+ * Validate an outbound recipient against the provider's declared recipient
+ * shape.
+ *
+ * The hub used to hard-wire `z.string().email()` on every outbound endpoint,
+ * which left providers whose recipients are not email addresses with no product
+ * path to send at all (#4976). Validation now follows the adapter's
+ * `capabilities.recipientFormat`, defaulting to `'email'` so every existing
+ * provider keeps byte-identical behavior.
+ */
+export function validateOutboundRecipient(
+  recipient: unknown,
+  capabilities: Pick<ChannelCapabilities, 'recipientFormat'> | null | undefined,
+): OutboundRecipientCheck {
+  if (typeof recipient !== 'string' || recipient.length === 0) {
+    return { ok: false, error: 'Recipient is required' }
+  }
+  if (recipient.length > MAX_OUTBOUND_RECIPIENT_LENGTH) {
+    return {
+      ok: false,
+      error: `Recipient must be at most ${MAX_OUTBOUND_RECIPIENT_LENGTH} characters`,
+    }
+  }
+  if (capabilities?.recipientFormat !== 'provider-native') {
+    return emailRecipientSchema.safeParse(recipient).success
+      ? { ok: true }
+      : { ok: false, error: 'Recipient must be a valid email address' }
+  }
+  if (!PROVIDER_NATIVE_ALLOWED.test(recipient)) {
+    return {
+      ok: false,
+      error: 'Recipient may only contain letters, digits, and the characters . _ : @ + -',
+    }
+  }
+  // `.` is allowed (email addresses need it), so traversal still has to be
+  // rejected explicitly even though the separators it would need are not.
+  if (recipient.includes('..')) {
+    return { ok: false, error: 'Recipient must not contain ".."' }
+  }
+  return { ok: true }
+}

package/src/modules/communication_channels/lib/resolve-channel-type.ts

@@ -0,0 +1,99 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { CommunicationChannel, ExternalConversation, MessageChannelLink } from '../data/entities'
+
+const logger = createLogger('communication_channels').child({ component: 'resolve-channel-type' })
+
+export type ChannelTypeScope = {
+  tenantId: string
+  organizationId: string | null
+}
+
+export type ChannelTypeReference = {
+  /** `ExternalConversation.id`, as carried by a message's `sourceEntityId`. */
+  externalConversationId?: string | null
+  /** A platform `messages.message` id that may be linked to a channel. */
+  messageId?: string | null
+}
+
+/**
+ * Resolve the channel type behind a platform message or conversation (#4975).
+ *
+ * Cross-module callers (the `messages` compose route) need to know whether an
+ * external correspondent is reachable by email before validating a compose
+ * payload, but `messages` may not reach into this module's entities. They
+ * resolve this facade from DI instead — mirroring `communicationChannelsSendAsUser`
+ * — and treat a `null` result as "unknown", which the messages validator
+ * handles fail-closed.
+ *
+ * Always tenant/organization scoped: a reference that does not resolve inside
+ * the caller's scope is reported as unknown rather than looked up globally.
+ */
+export async function resolveChannelType(
+  container: AppContainer,
+  scope: ChannelTypeScope,
+  reference: ChannelTypeReference,
+): Promise<string | null> {
+  const em = (container.resolve('em') as EntityManager).fork()
+  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
+  const baseFilter = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
+
+  let externalConversationId = reference.externalConversationId ?? null
+
+  if (!externalConversationId && reference.messageId) {
+    // The message is linked to a channel directly — `MessageChannelLink` carries
+    // a denormalized channel type, so this is the cheapest hop when it exists.
+    const link = await findOneWithDecryption(
+      em,
+      MessageChannelLink,
+      { messageId: reference.messageId, ...baseFilter },
+      undefined,
+      dscope,
+    )
+    if (link?.channelType) return link.channelType
+    externalConversationId = link?.externalConversationId ?? null
+  }
+
+  if (!externalConversationId) return null
+
+  const conversation = await findOneWithDecryption(
+    em,
+    ExternalConversation,
+    { id: externalConversationId, ...baseFilter },
+    undefined,
+    dscope,
+  )
+  if (!conversation?.channelId) return null
+
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    { id: conversation.channelId, ...baseFilter, deletedAt: null },
+    undefined,
+    dscope,
+  )
+  return channel?.channelType ?? null
+}
+
+/**
+ * Same contract, but never throws: a lookup failure degrades to "unknown" so a
+ * transient database error cannot turn into a 500 on an otherwise valid compose.
+ * Unknown is the safe answer — the messages validator fails closed on it.
+ */
+export async function resolveChannelTypeSafely(
+  container: AppContainer,
+  scope: ChannelTypeScope,
+  reference: ChannelTypeReference,
+): Promise<string | null> {
+  try {
+    return await resolveChannelType(container, scope, reference)
+  } catch (err) {
+    logger.warn('channel type resolution failed, treating the channel as unknown', { err })
+    return null
+  }
+}
+
+/** DI service type for cross-module callers (resolve `communicationChannelsResolveChannelType`). */
+export type ResolveChannelTypeService = typeof resolveChannelTypeSafely

package/src/modules/communication_channels/lib/test-seed.ts

@@ -41,6 +41,19 @@ import { hasChannelAdapter, registerChannelAdapter } from './adapter-registry-si
 /** Provider key for the network-free test stub adapter. */
 export const TEST_SEED_PROVIDER_KEY = '__test_seed__'
 
+/**
+ * Provider key for the network-free stub adapter that stands in for a CHAT
+ * provider — one whose senders are identified by an opaque handle and have no
+ * email address at all (Discord, Slack, Telegram…).
+ *
+ * It exists because the email-shaped stub above can only ever prove the hub
+ * accepts email-shaped data. That is precisely how CI stayed green while every
+ * real inbound Discord message was rejected (#4975): the fixture invented an
+ * address the provider can never produce. Tests that need to prove the hub's
+ * non-email identity contract MUST drive this provider instead.
+ */
+export const TEST_SEED_CHAT_PROVIDER_KEY = '__test_seed_chat__'
+
 /** Env flag that unlocks test-only channel seeding. Off in production. */
 export const TEST_CHANNEL_SEEDING_ENV = 'OM_ENABLE_TEST_CHANNEL_SEEDING'
 
@@ -72,8 +85,10 @@ const testSeedCapabilities: ChannelCapabilities = {
  * delivery worker reach its success path and emit `communication_channels.message.sent`.
  */
 class TestSeedChannelAdapter implements ChannelAdapter {
-  readonly providerKey = TEST_SEED_PROVIDER_KEY
-  readonly channelType = 'email'
+  // Widened to `string` rather than inferred as a literal so the chat-flavoured
+  // subclass below can override both with its own provider key / channel type.
+  readonly providerKey: string = TEST_SEED_PROVIDER_KEY
+  readonly channelType: string = 'email'
   readonly capabilities = testSeedCapabilities
 
   async sendMessage(input: SendMessageInput): Promise<SendMessageResult> {
@@ -121,13 +136,54 @@ class TestSeedChannelAdapter implements ChannelAdapter {
   }
 }
 
+/**
+ * Chat-flavoured twin of {@link TestSeedChannelAdapter}: same network-free
+ * behaviour, but it declares a non-email `channelType`, so a channel connected
+ * through it is shaped like a real chat channel — including an
+ * `externalIdentifier` of NULL when no email-ish credential key is supplied.
+ */
+class TestSeedChatChannelAdapter extends TestSeedChannelAdapter {
+  readonly providerKey: string = TEST_SEED_CHAT_PROVIDER_KEY
+  readonly channelType: string = 'discord'
+
+  async normalizeInbound(raw: InboundMessage): Promise<NormalizedInboundMessage> {
+    // Unlike the email stub, this one is reachable: the test-seed ingest action
+    // feeds it a chat-shaped frame so the message travels the real ingest path
+    // (and therefore the real compose validation) rather than a SQL shortcut.
+    const frame = (raw.raw ?? {}) as Record<string, unknown>
+    const senderIdentifier = String(frame.senderIdentifier ?? '')
+    if (!senderIdentifier) {
+      throw new Error('[internal] TestSeedChatChannelAdapter requires a senderIdentifier')
+    }
+    return {
+      externalMessageId: String(frame.externalMessageId ?? ''),
+      externalConversationId: String(frame.externalConversationId ?? ''),
+      senderIdentifier,
+      senderDisplayName:
+        typeof frame.senderDisplayName === 'string' ? frame.senderDisplayName : undefined,
+      body: typeof frame.body === 'string' ? frame.body : '',
+      bodyFormat: 'text',
+      timestamp: new Date(),
+      channelPayload: {},
+      channelContentType: 'text/plain',
+      channelMetadata: {},
+    }
+  }
+}
+
 let cachedTestSeedAdapter: TestSeedChannelAdapter | null = null
+let cachedTestSeedChatAdapter: TestSeedChatChannelAdapter | null = null
 
 function getTestSeedChannelAdapter(): TestSeedChannelAdapter {
   if (!cachedTestSeedAdapter) cachedTestSeedAdapter = new TestSeedChannelAdapter()
   return cachedTestSeedAdapter
 }
 
+function getTestSeedChatChannelAdapter(): TestSeedChatChannelAdapter {
+  if (!cachedTestSeedChatAdapter) cachedTestSeedChatAdapter = new TestSeedChatChannelAdapter()
+  return cachedTestSeedChatAdapter
+}
+
 /**
  * Register the test-seed adapter exactly once, but ONLY when the env flag is set.
  * Idempotent and safe to call from every container creation (`di.register`) — a
@@ -135,6 +191,10 @@ function getTestSeedChannelAdapter(): TestSeedChannelAdapter {
  */
 export function ensureTestSeedAdapterRegistered(): void {
   if (!isTestChannelSeedingEnabled()) return
-  if (hasChannelAdapter(TEST_SEED_PROVIDER_KEY)) return
-  registerChannelAdapter(getTestSeedChannelAdapter())
+  if (!hasChannelAdapter(TEST_SEED_PROVIDER_KEY)) {
+    registerChannelAdapter(getTestSeedChannelAdapter())
+  }
+  if (!hasChannelAdapter(TEST_SEED_CHAT_PROVIDER_KEY)) {
+    registerChannelAdapter(getTestSeedChatChannelAdapter())
+  }
 }

package/src/modules/configs/i18n/de.json

@@ -155,6 +155,8 @@
   "configs.systemStatus.variables.entitiesBackcompatEav.label": "Legacy-EAV-Schreibvorgänge",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.description": "Query-Index-Ergebnisse auch bei unvollständiger Abdeckung bereitstellen.",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.label": "Teilindex-Nutzung erzwingen",
+  "configs.systemStatus.variables.listCountCap.description": "Maximal gemeldete Gesamtzahl einer Liste; die Zählung stoppt an der Obergrenze und begrenzte Summen werden z. B. als „10 000+“ angezeigt. 0 deaktiviert die Begrenzung.",
+  "configs.systemStatus.variables.listCountCap.label": "Obergrenze für Listenzählung",
   "configs.systemStatus.variables.logLevel.description": "Fallback-Log-Level, wenn die Verbosität nicht gesetzt ist.",
   "configs.systemStatus.variables.logLevel.label": "Log-Level",
   "configs.systemStatus.variables.logVerbosity.description": "Überschreibt die strukturierte Log-Verbosität wie Debug oder Trace.",

package/src/modules/configs/i18n/en.json

@@ -155,6 +155,8 @@
   "configs.systemStatus.variables.entitiesBackcompatEav.label": "Legacy EAV writes",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.description": "Serve query index results even when coverage is partial.",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.label": "Force partial index usage",
+  "configs.systemStatus.variables.listCountCap.description": "Maximum reported list total; counting stops at the cap and capped totals render as e.g. “10 000+”. 0 disables capping.",
+  "configs.systemStatus.variables.listCountCap.label": "List count cap",
   "configs.systemStatus.variables.logLevel.description": "Fallback log level applied when verbosity is not set.",
   "configs.systemStatus.variables.logLevel.label": "Log level",
   "configs.systemStatus.variables.logVerbosity.description": "Overrides structured log verbosity such as debug or trace.",

package/src/modules/configs/i18n/es.json

@@ -155,6 +155,8 @@
   "configs.systemStatus.variables.entitiesBackcompatEav.label": "Escrituras EAV heredadas",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.description": "Servir resultados del índice de consultas incluso cuando la cobertura es parcial.",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.label": "Forzar uso de índice parcial",
+  "configs.systemStatus.variables.listCountCap.description": "Total máximo informado en listas; el conteo se detiene en el límite y los totales limitados se muestran p. ej. como «10 000+». 0 desactiva el límite.",
+  "configs.systemStatus.variables.listCountCap.label": "Límite del conteo de listas",
   "configs.systemStatus.variables.logLevel.description": "Nivel de registro de respaldo cuando la verbosidad no está configurada.",
   "configs.systemStatus.variables.logLevel.label": "Nivel de registro",
   "configs.systemStatus.variables.logVerbosity.description": "Anula la verbosidad del registro estructurado, como debug o trace.",

package/src/modules/configs/i18n/ko.json

@@ -155,6 +155,8 @@
   "configs.systemStatus.variables.entitiesBackcompatEav.label": "레거시 EAV 쓰기",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.description": "커버리지가 부분적이어도 쿼리 인덱스 결과를 제공합니다.",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.label": "부분 인덱스 사용 강제",
+  "configs.systemStatus.variables.listCountCap.description": "목록 총계의 최대 보고 값입니다. 카운트는 상한에서 멈추며 제한된 총계는 예를 들어 “10 000+”로 표시됩니다. 0이면 상한이 비활성화됩니다.",
+  "configs.systemStatus.variables.listCountCap.label": "목록 카운트 상한",
   "configs.systemStatus.variables.logLevel.description": "상세 수준이 설정되지 않았을 때 적용되는 대체 로그 레벨입니다.",
   "configs.systemStatus.variables.logLevel.label": "로그 레벨",
   "configs.systemStatus.variables.logVerbosity.description": "debug나 trace와 같은 구조화된 로그 상세 수준을 재정의합니다.",

package/src/modules/configs/i18n/pl.json

@@ -155,6 +155,8 @@
   "configs.systemStatus.variables.entitiesBackcompatEav.label": "Zapis do legacy EAV",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.description": "Pozwala korzystać z wyników indeksu zapytań nawet przy częściowym pokryciu.",
   "configs.systemStatus.variables.forceQueryIndexOnPartialIndexes.label": "Wymuś użycie częściowego indeksu",
+  "configs.systemStatus.variables.listCountCap.description": "Maksymalna raportowana liczba wyników listy; zliczanie zatrzymuje się na limicie, a ograniczone sumy są pokazywane np. jako „10 000+”. 0 wyłącza limit.",
+  "configs.systemStatus.variables.listCountCap.label": "Limit licznika list",
   "configs.systemStatus.variables.logLevel.description": "Domyślny poziom logowania używany, gdy nie ustawiono szczegółowości.",
   "configs.systemStatus.variables.logLevel.label": "Poziom logowania",
   "configs.systemStatus.variables.logVerbosity.description": "Nadpisuje poziom szczegółowości logów, np. debug lub trace.",

package/src/modules/configs/lib/system-status.ts

@@ -267,6 +267,15 @@ export const SYSTEM_STATUS_VARIABLES: SystemStatusVariableDefinition[] = [
     docUrl: `${SYSTEM_STATUS_DOC_BASE}#optimize_index_coverage_stats`,
     defaultValue: 'false',
   },
+  {
+    key: 'OM_LIST_COUNT_CAP',
+    category: 'query_index',
+    kind: 'string',
+    labelKey: 'configs.systemStatus.variables.listCountCap.label',
+    descriptionKey: 'configs.systemStatus.variables.listCountCap.description',
+    docUrl: `${SYSTEM_STATUS_DOC_BASE}#om_list_count_cap`,
+    defaultValue: '10000',
+  },
   {
     key: 'FORCE_QUERY_INDEX_ON_PARTIAL_INDEXES',
     category: 'query_index',

package/src/modules/currencies/AGENTS.md

@@ -9,6 +9,9 @@ Use the currencies module for multi-currency support, exchange rates, and curren
 3. **MUST record both transaction currency and base currency amounts** — dual recording is mandatory for reporting
 4. **MUST calculate realized gains/losses** on payment: `(payment rate - invoice rate) × foreign amount`
 5. **MUST keep financial postings atomic** — full transaction rollback on error
+6. **MUST NOT filter rate fetching by `isActive`** — that flag decides whether a currency can be
+   picked for something new, not whether it still needs a live rate. Rates are fetched for every
+   currency in scope that is not soft-deleted. See `services/README.md` → "Which Currencies Get Rates"
 
 ## Ask First
 

package/src/modules/currencies/backend/currencies/page.tsx

@@ -41,6 +41,7 @@ type ResponsePayload = {
   total: number
   page: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 export default function CurrenciesPage() {
@@ -50,6 +51,7 @@ export default function CurrenciesPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [filters, setFilters] = React.useState<FilterValues>({})
   const [isLoading, setIsLoading] = React.useState(true)
@@ -96,6 +98,7 @@ export default function CurrenciesPage() {
           setRows(Array.isArray(payload.items) ? payload.items : [])
           setTotal(payload.total || 0)
           setTotalPages(payload.totalPages || 1)
+          setTotalIsCapped(payload?.totalIsCapped === true)
         }
       } catch (error) {
         if (!cancelled) {
@@ -342,7 +345,7 @@ export default function CurrenciesPage() {
               createLabel={t('currencies.list.actions.create')}
             />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
           isLoading={isLoading}
           perspective={{ tableId: extensionPoints.hosts.currenciesTable.tableId }}
         />

package/src/modules/currencies/backend/exchange-rates/page.tsx

@@ -42,6 +42,7 @@ type ResponsePayload = {
   total: number
   page: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 export default function ExchangeRatesPage() {
@@ -51,6 +52,7 @@ export default function ExchangeRatesPage() {
   const [page, setPage] = React.useState(1)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [filters, setFilters] = React.useState<FilterValues>({})
   const [isLoading, setIsLoading] = React.useState(true)
@@ -100,6 +102,7 @@ export default function ExchangeRatesPage() {
           setRows(Array.isArray(payload.items) ? payload.items : [])
           setTotal(payload.total || 0)
           setTotalPages(payload.totalPages || 1)
+          setTotalIsCapped(payload?.totalIsCapped === true)
         }
       } catch (error) {
         if (!cancelled) {
@@ -332,7 +335,7 @@ export default function ExchangeRatesPage() {
               createLabel={t('exchangeRates.list.actions.create')}
             />
           )}
-          pagination={{ page, pageSize: 50, total, totalPages, onPageChange: setPage }}
+          pagination={{ page, pageSize: 50, total, totalPages, totalIsCapped, onPageChange: setPage }}
           isLoading={isLoading}
           perspective={{ tableId: extensionPoints.hosts.exchangeRatesTable.tableId }}
         />

package/src/modules/currencies/services/README.md

@@ -282,6 +282,51 @@ console.log(`By provider:`, result.byProvider)
 console.log(`Errors:`, result.errors)
 ```
 
+### Which Currencies Get Rates
+
+`fetchRatesForDate` first resolves the set of currency codes worth storing rates for, then filters
+every provider response against it — a rate is kept only when **both** legs of its pair are in the
+set. The set is every currency in the tenant/organization scope that is not soft-deleted.
+
+`isActive` deliberately plays no part here. That flag answers whether a currency may be **selected**
+for something new (it gates `api/currencies/options`, the `?isActive` list filter and the
+exchange-rate form's currency select), which says nothing about whether records already denominated
+in it must stay convertible. Deactivating a currency while existing records still reference it is
+the normal way to grandfather it, and those records keep needing a rate — otherwise conversions out
+of the currency start failing once the stored rates fall outside the consumer's lookback window.
+`ExchangeRateService` defaults to `maxDaysBack: 30`, but consumers override it — the deal-value
+conversions in `customers/api/deals/{aggregate,summary}` pass `maxDaysBack: 60`, so a currency that
+stopped accruing rates drops out of pipeline totals (`convertedAll: false`, no error surfaced)
+roughly 60 days later.
+
+**Soft delete is the only thing that stops a currency from accruing rates.** `deletedAt` excludes it
+from the set; nothing else does, `isActive` included.
+
+Reaching `deletedAt` takes two steps, in this order, because `deleteCurrencyCommand` refuses the
+delete while the currency still has live rates — the very rates fetching keeps writing
+(`storeRates` stores each one with `isActive: true`):
+
+1. Delete or deactivate every `exchange_rates` row whose `fromCurrencyCode` or `toCurrencyCode` is
+   the currency, otherwise `DELETE /api/currencies/currencies` answers
+   `400 Cannot delete currency XXX because it has N active exchange rate(s)`.
+2. Soft-delete the currency, with no fetch in between. Any fetch in that window — the "Fetch rates"
+   button, `mercato currencies fetch-rates`, or `ExchangeRateService`'s `autoFetch` (which defaults
+   to `true`) — recreates the rates and re-blocks the delete.
+
+There is deliberately **no reversible way to pause rate accrual for a single currency**. An earlier
+draft of this change added a `Currency.fetchRatesWhenInactive` opt-in column for exactly that and it
+was dropped: an extra column to express "grandfathered but still convertible" is the state
+`isActive: false` already describes, and the cost of keeping a currency in the set is bounded (see
+below). Soft delete is the terminal off-switch, not a pause.
+
+Note that both bundled providers (NBP, Raiffeisen) return `[]` outright when `PLN` is missing from
+the set, so a `PLN` that fell out of it silenced the entire provider rather than just `PLN`'s own
+pairs — another reason the set is not narrowed by selectability.
+
+Keeping the set wide costs no extra provider calls: both providers fetch a full table in a single
+request per date and the set is applied locally. The only cost is additional `exchange_rates` rows,
+bounded by what the provider returns anyway.
+
 ### When to Use RateFetchingService Directly
 
 - Scheduled/batch fetching of rates

package/src/modules/currencies/services/rateFetchingService.ts

@@ -131,6 +131,12 @@ export class RateFetchingService {
     }
   }
 
+  /**
+   * Currencies whose rates are worth storing. Deliberately not filtered by `isActive`: that flag
+   * answers whether a currency may be picked for something new, which says nothing about whether
+   * records already denominated in it must stay convertible. Soft delete is what takes a currency
+   * out of rate fetching.
+   */
   private async getExistingCurrencies(scope: {
     tenantId: string
     organizationId: string
@@ -138,7 +144,6 @@ export class RateFetchingService {
     return this.em.find(Currency, {
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      isActive: true,
       deletedAt: null,
     })
   }

package/src/modules/customer_accounts/api/admin/domain-mappings.ts

@@ -14,6 +14,7 @@ import {
 import { registerDomainSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import {
   DomainMappingService,
+  DomainMappingOrgScopeError,
   type ResolveResult,
 } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
 import { DomainMapping } from '@open-mercato/core/modules/customer_accounts/data/entities'
@@ -142,6 +143,12 @@ export async function POST(req: Request) {
         { status: 409 },
       )
     }
+    if (err instanceof DomainMappingOrgScopeError) {
+      return NextResponse.json(
+        { ok: false, error: 'Organization was not found in the current tenant.' },
+        { status: 400 },
+      )
+    }
     const message = err instanceof Error ? err.message : 'Failed to register domain'
     return NextResponse.json({ ok: false, error: message }, { status: 500 })
   }

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -34,6 +34,7 @@ type RolesResponse = {
   items?: RoleRow[]
   total?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 export default function CustomerRolesPage() {
@@ -45,6 +46,7 @@ export default function CustomerRolesPage() {
   const [pageSize] = React.useState(50)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [isLoading, setIsLoading] = React.useState(true)
   const [reloadToken, setReloadToken] = React.useState(0)
@@ -88,6 +90,7 @@ export default function CustomerRolesPage() {
         setRows(items)
         setTotal(typeof payload?.total === 'number' ? payload.total : items.length)
         setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch (err) {
         if (!cancelled) {
           const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.load', 'Failed to load roles')
@@ -240,7 +243,7 @@ export default function CustomerRolesPage() {
               ]}
             />
           )}
-          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+          pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}
           isLoading={isLoading}
         />
       </PageBody>

package/src/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.tsx

@@ -41,6 +41,7 @@ type UsersResponse = {
   items?: UserRow[]
   total?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 function formatDate(value: string | null | undefined, fallback: string): string {
@@ -239,6 +240,7 @@ export function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientPro
   const [pageSize] = React.useState(50)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [filterValues, setFilterValues] = React.useState<FilterValues>({})
   const [isLoading, setIsLoading] = React.useState(true)
@@ -318,6 +320,7 @@ export function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientPro
         setRows(items)
         setTotal(typeof payload?.total === 'number' ? payload.total : items.length)
         setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch (err) {
         if (!cancelled) {
           const message = err instanceof Error ? err.message : t('customer_accounts.admin.error.loadUsers', 'Failed to load customer users')
@@ -582,7 +585,7 @@ export function PortalUsersPageClient({ portalOrigin }: PortalUsersPageClientPro
             ]}
           />
         )}
-        pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+        pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}
         isLoading={isLoading}
       />
       <CreateUserDialog