@open-mercato/core 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/directory/services/organizationHierarchyService.ts

@@ -0,0 +1,34 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Organization } from '../data/entities'
+
+function normalizeIds(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  return Array.from(new Set(values
+    .map((value) => typeof value === 'string' ? value.trim() : '')
+    .filter(Boolean)))
+}
+
+export class DefaultOrganizationHierarchyService implements OrganizationHierarchyService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveAncestorIds(input: {
+    tenantId: string
+    organizationId: string
+  }): Promise<string[] | null> {
+    const organization = await findOneWithDecryption(
+      this.em,
+      Organization,
+      {
+        id: input.organizationId,
+        tenant: input.tenantId,
+        deletedAt: null,
+      } as FilterQuery<Organization>,
+      { fields: ['id', 'ancestorIds'] },
+      { tenantId: input.tenantId, organizationId: input.organizationId },
+    )
+    return organization ? normalizeIds(organization.ancestorIds) : null
+  }
+}

package/src/modules/directory/services/organizationScopeService.ts

@@ -0,0 +1,85 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import type {
+  OrganizationScopeService,
+  OrganizationScopeRequest,
+} from '@open-mercato/shared/lib/auth/principal-service'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScope, resolveOrganizationScopeForRequest } from '../utils/organizationScope'
+
+type OrganizationScopeRbac = {
+  invalidateUserCache(userId: string): Promise<void>
+  loadAcl(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
+}
+
+export class DefaultOrganizationScopeService implements OrganizationScopeService {
+  constructor(
+    private readonly em: EntityManager,
+    private readonly rbac: OrganizationScopeRbac,
+    private readonly container: AwilixContainer,
+  ) {}
+
+  resolve(input: {
+    auth: AuthContext | null | undefined
+    selectedId?: string | null
+    tenantId?: string | null
+    freshAcl?: boolean
+  }) {
+    const auth = input.auth
+    if (input.freshAcl && auth?.sub) {
+      return this.resolveFresh({
+        auth,
+        selectedId: input.selectedId,
+        tenantId: input.tenantId,
+      }).then((result) => result.scope)
+    }
+    return resolveOrganizationScope({
+      em: this.em,
+      rbac: this.rbac as Parameters<typeof resolveOrganizationScope>[0]['rbac'],
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+
+  async resolveFresh(input: {
+    auth: NonNullable<AuthContext>
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    await this.rbac.invalidateUserCache(input.auth.sub)
+    const acl = await this.rbac.loadAcl(input.auth.sub, {
+      tenantId: input.tenantId ?? input.auth.tenantId ?? null,
+      organizationId: input.selectedId ?? input.auth.orgId ?? null,
+    })
+    const freshRbac: Parameters<typeof resolveOrganizationScope>[0]['rbac'] = {
+      loadAcl: async () => acl,
+    }
+    const scope = await resolveOrganizationScope({
+      em: this.em,
+      rbac: freshRbac,
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+    return { scope, acl }
+  }
+
+  resolveForRequest(input: {
+    auth: AuthContext | null | undefined
+    request?: OrganizationScopeRequest
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    return resolveOrganizationScopeForRequest({
+      container: this.container,
+      auth: input.auth,
+      request: input.request,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+}

package/src/modules/directory/utils/organizationScope.ts

@@ -5,6 +5,7 @@ import { Organization } from '@open-mercato/core/modules/directory/data/entities
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import { getCurrentCacheTenant, runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -13,19 +14,7 @@ const logger = createLogger('directory').child({ component: 'org-scope-cache' })
 
 export { parseSelectedOrganizationCookie, parseSelectedTenantCookie }
 
-export type OrganizationScope = {
-  selectedId: string | null
-  filterIds: string[] | null
-  allowedIds: string[] | null
-  tenantId: string | null
-  // True when the caller explicitly selected a concrete organization (cookie /
-  // selectedId param) that could not be honored — it does not exist for the
-  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
-  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
-  // this so a record never lands under an org the caller did not intend. Absent
-  // (undefined) means the selection — if any — was honored.
-  selectionRejected?: boolean
-}
+export type { OrganizationScope }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
 // OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,
@@ -249,8 +238,8 @@ export async function resolveOrganizationScope({
   tenantId: tenantIdOverride,
 }: {
   em: EntityManager
-  rbac: RbacService
-  auth: AuthContext
+  rbac: Pick<RbacService, 'loadAcl'>
+  auth: AuthContext | null | undefined
   selectedId?: string | null
   tenantId?: string | null
 }): Promise<OrganizationScope> {

package/src/modules/entities/api/records.ts

@@ -148,6 +148,7 @@ const listRecordsResponseSchema = z.object({
   page: z.number(),
   pageSize: z.number(),
   totalPages: z.number(),
+  totalIsCapped: z.boolean().optional(),
 })
 
 export async function GET(req: Request) {
@@ -328,6 +329,7 @@ export async function GET(req: Request) {
       page: res.page || page,
       pageSize: effectivePageSize,
       totalPages: Math.ceil(total / (effectivePageSize || 1)),
+      ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),
     }
 
     if (requestedExport) {

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -36,6 +36,7 @@ type RecordsResponse = {
   page: number
   pageSize: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 function toCsvUrl(base: string, params: URLSearchParams) {
@@ -87,6 +88,7 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
   const [rawData, setRawData] = React.useState<any[]>([])
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [loading, setLoading] = React.useState(false)
   const scopeVersion = useOrganizationScopeVersion()
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
@@ -170,6 +172,7 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
           setRawData(j.items || [])
           setTotal(j.total)
           setTotalPages(j.totalPages)
+          setTotalIsCapped(j?.totalIsCapped === true)
         }
       } catch (e) {
         if (!cancelled) {
@@ -467,7 +470,7 @@ export RECORD_ID="<record uuid>"`}</code></pre>
             onSearchChange={(v) => { setSearch(v); setPage(1) }}
             onFiltersApply={(vals) => { setFilterValues(vals); setPage(1) }}
             onFiltersClear={() => { setFilterValues({}); setPage(1) }}
-            pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}
+            pagination={{ page, pageSize, total, totalPages, totalIsCapped, onPageChange: setPage }}
             isLoading={loading}
           />
         </RelationDisplaysProvider>

package/src/modules/eudr/api/plots/route.ts

@@ -159,6 +159,10 @@ const crud = makeCrudRoute({
       name: 'name',
       area_ha: 'area_ha',
       areaHa: 'area_ha',
+      origin_country: 'origin_country',
+      originCountry: 'origin_country',
+      plot_type: 'plot_type',
+      plotType: 'plot_type',
     },
     buildFilters,
     transformItem: transformPlotItem,

package/src/modules/eudr/backend/eudr/evidence-submissions/page.tsx

@@ -54,6 +54,7 @@ type EvidenceSubmissionsResponse = {
   items: EvidenceSubmissionRow[]
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 function formatDateTime(value: string | null | undefined, emptyLabel: string, locale: string): string {
@@ -92,6 +93,7 @@ export default function EudrEvidenceSubmissionsPage() {
   const [pageSize, setPageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [sorting, setSorting] = React.useState<SortingState>([])
   const [filters, setFilters] = React.useState<FilterValues>({})
@@ -147,6 +149,7 @@ export default function EudrEvidenceSubmissionsPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(typeof payload.total === 'number' ? payload.total : 0)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch {
         if (!cancelled) flash(translate('eudr.evidenceSubmissions.list.loadError'), 'error')
       } finally {
@@ -361,6 +364,7 @@ export default function EudrEvidenceSubmissionsPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
             pageSizeOptions: [20, 50, 100],
             onPageSizeChange: (nextPageSize) => {

package/src/modules/eudr/backend/eudr/plots/page.tsx

@@ -44,6 +44,7 @@ type PlotListResponse = {
   items: PlotRow[]
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 type CompanyOptionResponse = {
@@ -102,6 +103,7 @@ export default function EudrPlotsPage() {
   const [pageSize, setPageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [sorting, setSorting] = React.useState<SortingState>([])
   const [filters, setFilters] = React.useState<FilterValues>({})
@@ -164,6 +166,7 @@ export default function EudrPlotsPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(typeof payload.total === 'number' ? payload.total : 0)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch {
         if (!cancelled) flash(translate('eudr.plots.list.loadError'), 'error')
       } finally {
@@ -419,6 +422,7 @@ export default function EudrPlotsPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
             pageSizeOptions: [20, 50, 100],
             onPageSizeChange: (nextPageSize) => {

package/src/modules/eudr/backend/eudr/product-mappings/page.tsx

@@ -40,6 +40,7 @@ type ProductMappingsResponse = {
   items: ProductMappingRow[]
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 function formatDateTime(value: string | null | undefined, emptyLabel: string, locale: string): string {
@@ -71,6 +72,7 @@ export default function EudrProductMappingsPage() {
   const [pageSize, setPageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [sorting, setSorting] = React.useState<SortingState>([])
   const [filters, setFilters] = React.useState<FilterValues>({})
@@ -127,6 +129,7 @@ export default function EudrProductMappingsPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(typeof payload.total === 'number' ? payload.total : 0)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch {
         if (!cancelled) flash(translate('eudr.productMappings.list.loadError'), 'error')
       } finally {
@@ -321,6 +324,7 @@ export default function EudrProductMappingsPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
             pageSizeOptions: [20, 50, 100],
             onPageSizeChange: (nextPageSize) => {

package/src/modules/eudr/backend/eudr/risk-assessments/page.tsx

@@ -47,6 +47,7 @@ type RiskAssessmentsResponse = {
   items: RiskAssessmentRow[]
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 type MutationContext = {
@@ -105,6 +106,7 @@ export default function EudrRiskAssessmentsPage() {
   const [pageSize, setPageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [sorting, setSorting] = React.useState<SortingState>([{ id: 'assessedAt', desc: true }])
   const [filters, setFilters] = React.useState<FilterValues>({})
   const [search, setSearch] = React.useState('')
@@ -158,6 +160,7 @@ export default function EudrRiskAssessmentsPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(typeof payload.total === 'number' ? payload.total : 0)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch {
         if (!cancelled) flash(translate('eudr.riskAssessments.list.loadError'), 'error')
       } finally {
@@ -365,6 +368,7 @@ export default function EudrRiskAssessmentsPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
             pageSizeOptions: [20, 50, 100],
             onPageSizeChange: (nextPageSize) => {

package/src/modules/eudr/backend/eudr/statements/page.tsx

@@ -53,6 +53,7 @@ type StatementsResponse = {
   items: StatementRow[]
   total: number
   totalPages: number
+  totalIsCapped?: boolean
 }
 
 function formatDateTime(value: string | null | undefined, emptyLabel: string, locale: string): string {
@@ -79,6 +80,7 @@ export default function EudrStatementsPage() {
   const [pageSize, setPageSize] = React.useState(20)
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [search, setSearch] = React.useState('')
   const [sorting, setSorting] = React.useState<SortingState>([])
   const [filters, setFilters] = React.useState<FilterValues>({})
@@ -134,6 +136,7 @@ export default function EudrStatementsPage() {
         setRows(Array.isArray(payload.items) ? payload.items : [])
         setTotal(typeof payload.total === 'number' ? payload.total : 0)
         setTotalPages(typeof payload.totalPages === 'number' ? payload.totalPages : 1)
+        setTotalIsCapped(payload?.totalIsCapped === true)
       } catch {
         if (!cancelled) flash(translate('eudr.statements.list.loadError'), 'error')
       } finally {
@@ -360,6 +363,7 @@ export default function EudrStatementsPage() {
             pageSize,
             total,
             totalPages,
+            totalIsCapped,
             onPageChange: setPage,
             pageSizeOptions: [20, 50, 100],
             onPageSizeChange: (nextPageSize) => {

package/src/modules/eudr/commands/statements.ts

@@ -582,9 +582,6 @@ const createStatementCommand: CommandHandler<ScopedStatementCreateInput, Stateme
     if (parsed.status !== undefined && parsed.status !== 'draft') {
       throw new CrudHttpError(400, { error: 'eudr.errors.invalidTransition' })
     }
-    if (parsed.referenceIssuedAt !== undefined) {
-      throw new CrudHttpError(400, { error: 'eudr.errors.referenceIssuedAtImmutable' })
-    }
 
     const entityManager = (ctx.container.resolve('em') as EntityManager).fork()
     let record!: EudrDueDiligenceStatement

package/src/modules/eudr/data/validators.ts

@@ -46,6 +46,11 @@ export const GEOJSON_TYPES = ['Feature', 'FeatureCollection', 'Point', 'Polygon'
 
 const uuid = () => z.string().uuid()
 const geoJsonSizeLimit = 1_048_576
+// Two conventions for server-managed fields on these entities: fields listed below
+// are never advertised as create inputs, so a client sending a real value is rejected
+// (`rejectServerComputedFields` tolerates a null/undefined no-op echo). A field that
+// WAS advertised in the create schema — statements' `referenceIssuedAt` — is instead
+// dropped from the create schema, so it is stripped rather than rejected (#5508).
 const serverComputedSubmissionFields = ['completenessScore', 'missingFields'] as const
 const serverComputedPlotFields = ['validationWarnings', 'computedArea'] as const
 const serverComputedRiskAssessmentFields = ['countryRisks', 'overallTier', 'isSimplified', 'assessedByName'] as const
@@ -64,12 +69,16 @@ const orderSnapshotSchema = z.object({
   orderNumber: z.string().max(255).optional().nullable(),
 })
 
+// A whole-object POST echoes server-computed fields back with their no-op value
+// (a fresh draft's `submittedAt` is null), so tolerate a null/undefined echo and
+// reject only a meaningful attempt to set server-owned state (#5508).
 function rejectServerComputedFields(fields: readonly string[]): z.ZodType<unknown> {
   return z.unknown().superRefine((input, context) => {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) return
     const record = input as Record<string, unknown>
     for (const field of fields) {
       if (!(field in record)) continue
+      if (record[field] === null || record[field] === undefined) continue
       context.addIssue({
         code: z.ZodIssueCode.custom,
         path: [field],
@@ -333,7 +342,13 @@ const statementBaseSchema = z.object({
   notes: z.string().max(5000).optional().nullable(),
 })
 
-export const statementCreateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(statementBaseSchema)
+// referenceIssuedAt is server-managed (only set at the submitted->available
+// transition) and is never a create input, so it is dropped from the create
+// schema. A whole-object POST that echoes it (null or a value) is accepted and
+// the field ignored, instead of a self-contradictory 400 (#5508).
+export const statementCreateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(
+  statementBaseSchema.omit({ referenceIssuedAt: true }),
+)
 
 export const statementUpdateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(
   z

package/src/modules/feature_toggles/components/FeatureTogglesTable.tsx

@@ -81,7 +81,7 @@ export function FeatureTogglesTable() {
   const { data: featureTogglesData, isLoading } = useQuery({
     queryKey: ['feature_toggles', queryParams],
     queryFn: async () => {
-      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; page: number; pageSize: number; isSuperAdmin?: boolean }>(
+      const call = await apiCall<{ items: Row[]; total: number; totalPages: number; totalIsCapped?: boolean; page: number; pageSize: number; isSuperAdmin?: boolean }>(
         `/api/feature_toggles/global${queryParams ? `?${queryParams}` : ''}`,
       )
       if (!call.ok) {
@@ -222,6 +222,7 @@ export function FeatureTogglesTable() {
         pageSize: featureTogglesData?.pageSize ?? 25,
         total: featureTogglesData?.total ?? 0,
         totalPages: featureTogglesData?.totalPages ?? 0,
+        totalIsCapped: featureTogglesData?.totalIsCapped === true,
         onPageChange: handlePageChange,
       }}
       rowActions={(row) => (

package/src/modules/feature_toggles/components/OverridesTable.tsx

@@ -45,7 +45,7 @@ export default function OverridesTable() {
             const call = await apiCall<{
                 items: OverrideListResponse[];
                 total: number;
-                totalPages: number;
+                totalPages: number; totalIsCapped?: boolean;
                 page: number;
                 pageSize: number;
                 isSuperAdmin?: boolean
@@ -153,6 +153,7 @@ export default function OverridesTable() {
                 pageSize: featureTogglesData?.pageSize ?? 25,
                 total: featureTogglesData?.total ?? 0,
                 totalPages: featureTogglesData?.totalPages ?? 0,
+                totalIsCapped: featureTogglesData?.totalIsCapped === true,
                 onPageChange: handlePageChange,
             }}
             refreshButton={{

package/src/modules/feature_toggles/defaults.json

@@ -16,14 +16,6 @@
       "type": "string",
       "defaultValue": "Free shipping on orders over $50"
     },
-    {
-      "identifier": "sales_channels_enabled",
-      "name": "Sales Channels",
-      "description": "Show sales channel pickers, filters, and management UI. Disable for tenants that do not use sales channels.",
-      "category": "sales",
-      "type": "boolean",
-      "defaultValue": true
-    },
     {
       "identifier": "order_review_threshold",
       "name": "Order Review Threshold",

package/src/modules/inbox_ops/backend/inbox-ops/log/page.tsx

@@ -28,6 +28,7 @@ type EmailListResponse = {
   total?: number
   page?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 const STATUS_COLORS: Record<string, string> = {
@@ -42,6 +43,7 @@ export default function ProcessingLogPage() {
   const t = useT()
   const [items, setItems] = React.useState<EmailRow[]>([])
   const [total, setTotal] = React.useState(0)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [page, setPage] = React.useState(1)
   const [pageSize] = React.useState(25)
   const [statusFilter, setStatusFilter] = React.useState<string | undefined>()
@@ -65,6 +67,7 @@ export default function ProcessingLogPage() {
       if (result?.ok && result.result?.items) {
         setItems(result.result.items)
         setTotal(result.result.total || 0)
+        setTotalIsCapped(result.result.totalIsCapped === true)
       } else {
         setError(t('inbox_ops.log.load_failed', 'Failed to load processing log'))
       }
@@ -220,6 +223,7 @@ export default function ProcessingLogPage() {
                 pageSize,
                 total,
                 totalPages: Math.ceil(total / pageSize),
+                totalIsCapped,
                 onPageChange: setPage,
               }}
             />

package/src/modules/inbox_ops/backend/inbox-ops/page.tsx

@@ -41,6 +41,7 @@ type ProposalListResponse = {
   total?: number
   page?: number
   totalPages?: number
+  totalIsCapped?: boolean
 }
 
 type StatusCounts = {
@@ -90,6 +91,7 @@ export default function InboxOpsProposalsPage() {
 
   const [items, setItems] = React.useState<ProposalRow[]>([])
   const [total, setTotal] = React.useState(0)
+  const [totalIsCapped, setTotalIsCapped] = React.useState(false)
   const [page, setPage] = React.useState(1)
   const [pageSize] = React.useState(25)
   const [filterValues, setFilterValues] = React.useState<FilterValues>({})
@@ -119,6 +121,7 @@ export default function InboxOpsProposalsPage() {
       if (result?.ok && result.result?.items) {
         setItems(result.result.items)
         setTotal(result.result.total || 0)
+        setTotalIsCapped(result.result.totalIsCapped === true)
       } else {
         setError(t('inbox_ops.flash.load_failed', 'Failed to load proposals'))
       }
@@ -384,6 +387,7 @@ export default function InboxOpsProposalsPage() {
             pageSize,
             total,
             totalPages: Math.ceil(total / pageSize),
+            totalIsCapped,
             onPageChange: setPage,
           }}
           isLoading={isLoading}

package/src/modules/inbox_ops/lib/htmlToPlainText.ts

@@ -1,17 +1 @@
-import { convert } from 'html-to-text'
-
-export function htmlToPlainText(html: string): string {
-  if (!html) return ''
-  return convert(html, {
-    wordwrap: false,
-    preserveNewlines: true,
-    selectors: [
-      { selector: 'script', format: 'skip' },
-      { selector: 'style', format: 'skip' },
-    ],
-  })
-    .replace(/\r\n/g, '\n')
-    .replace(/\r/g, '\n')
-    .replace(/\n{3,}/g, '\n\n')
-    .trim()
-}
+export { htmlToPlainText } from '@open-mercato/shared/lib/html/htmlToPlainText'

package/src/modules/integrations/api/[id]/credentials/route.ts

@@ -183,11 +183,13 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
   }
 
   try {
-    // Secret fields are returned masked on GET; when the client round-trips the
-    // mask sentinel it means "unchanged", so restore the existing stored secret
-    // instead of overwriting it with the placeholder.
     const existing = await credentialsService.resolve(integration.id, scope)
-    const credentialsToSave = mergeMaskedSecretCredentials(schema, payloadData.credentials, existing ?? {})
+    const credentialsToSave = mergeMaskedSecretCredentials(
+      schema,
+      payloadData.credentials,
+      existing ?? {},
+      payloadData.unchangedSecretFields,
+    )
     await credentialsService.save(integration.id, credentialsToSave, scope)
   } catch (error) {
     if (isCredentialsEncryptionUnavailableError(error)) {