@open-mercato/core 0.7.1-develop.7130.1.fef2396fd8 → 0.7.1-develop.7135.1.19bf969756

package/src/modules/communication_channels/api/post/test-seed/route.ts

@@ -43,7 +43,9 @@ import {
  *     (delegates to the real connect-credential command so the channel persists
  *     credentials + lands in `status='connected'`). Enables the outbound
  *     compose → deliver → `.sent` chain to complete in CI. `providerFlavor: 'chat'`
- *     connects the non-email stub instead, for tests about sender identity.
+ *     connects the non-email stub instead, for tests about sender identity, and
+ *     `labelAsProviderKey` relabels the connected row so a provider-scoped
+ *     listing has something to list without a live credential probe.
  *   - `ingest-inbound`: run the REAL `ingest_inbound_message` command over an
  *     adapter-normalized chat frame, so the platform compose path — and every
  *     validation rule on it — actually executes. Use this for anything that
@@ -88,6 +90,27 @@ const connectChannelSchema = z.object({
    * without inventing one (#4975).
    */
   providerFlavor: z.enum(['email', 'chat']).optional(),
+  /**
+   * TEST-ONLY: rewrite the connected stub channel's `provider_key` to this value.
+   *
+   * Routes that a provider package owns filter on their own `provider_key`, and
+   * a real channel for those providers cannot be connected in CI — the Discord
+   * adapter's `validateCredentials` performs a live API call against a bot token
+   * no test environment has. Without this, a provider-scoped listing has nothing
+   * to list and can only be asserted against an empty result, which is exactly
+   * the assertion that would have stayed green through #5602.
+   *
+   * It relabels a row; it registers nothing. The stub adapter is still the only
+   * adapter present, so the channel remains network-free — but no test should
+   * drive an outbound send through a relabelled channel, because delivery would
+   * then resolve the real provider's adapter.
+   */
+  labelAsProviderKey: z
+    .string()
+    .min(1)
+    .max(64)
+    .regex(/^[a-z0-9_-]+$/)
+    .optional(),
 })
 
 /**
@@ -224,8 +247,30 @@ export async function POST(req: Request): Promise<Response> {
         { status: 500 },
       )
     }
+    if (body.labelAsProviderKey && body.labelAsProviderKey !== input.providerKey) {
+      const seedEm = (container.resolve('em') as EntityManager).fork()
+      const connected = await findOneWithDecryption(
+        seedEm,
+        CommunicationChannel,
+        { id: result.channelId, tenantId },
+        undefined,
+        { tenantId, organizationId },
+      )
+      if (!connected) {
+        return NextResponse.json(
+          { error: '[internal] test-seed could not reload the channel it just connected' },
+          { status: 500 },
+        )
+      }
+      connected.providerKey = body.labelAsProviderKey
+      await seedEm.flush()
+    }
     return NextResponse.json(
-      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },
+      {
+        channelId: result.channelId,
+        externalIdentifier: result.externalIdentifier,
+        providerKey: body.labelAsProviderKey ?? input.providerKey,
+      },
       { status: 201 },
     )
   }

package/src/modules/communication_channels/lib/access-control.ts

@@ -59,6 +59,34 @@ export function channelOrgScopeWhereFromFilter(
   return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }
 }
 
+/**
+ * Ownership fragment for LISTING channels — the SQL-layer twin of
+ * {@link assertCanAccessChannel}.
+ *
+ * Routes have historically hardcoded one of the two halves of the rule: the
+ * admin channel list narrows to `user_id IS NULL`, the profile list narrows to
+ * `user_id = <caller>`. A provider-scoped listing needs both, because which half
+ * a channel falls into is decided by the connect flow the provider offers, not
+ * by the listing. Hardcoding `userId: null` is what made the Discord AI
+ * auto-reply panel structurally empty (#5602): every route the product exposes
+ * for connecting a Discord bot writes `user_id = auth.sub`, so the filter
+ * excluded the only channels that can exist.
+ *
+ * The clause admits exactly what the assert allows and nothing more — shared
+ * channels, plus the caller's own personal ones. It grants no admin bypass, in
+ * line with v1 strict owner-only: a personal mailbox stays invisible to everyone
+ * but its owner. An anonymous caller (no user id) sees shared channels only.
+ *
+ * Spread into a MikroORM `where`, or nest under `$and` when another fragment in
+ * the same query already claims `$or` (`channelOrgScopeWhereFromFilter` does).
+ */
+export function channelOwnerScopeWhere(
+  currentUserId: string | null | undefined,
+): Record<string, unknown> {
+  if (!currentUserId) return { userId: null }
+  return { $or: [{ userId: null }, { userId: currentUserId }] }
+}
+
 /**
  * Throws when the caller may not access a specific channel. Returns silently
  * when access is allowed.

package/src/modules/communication_channels/lib/system-user.ts

@@ -1,4 +1,5 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 
 /**
  * Sentinel UUID — used as a last-resort `senderUserId` for inbound channel
@@ -31,6 +32,12 @@ export function systemUserEmail(tenantId: string): string {
  * sentinel. The inbound-processor must never refuse to ingest a message
  * because the channel-bot user doesn't exist.
  *
+ * That fail-soft design is also what hid #5599 for as long as it did — a broken
+ * lookup and an absent user produce the identical outcome — so the two
+ * properties the lookup depends on (the column it matches and the table it
+ * names) are pinned by `__tests__/system-user.test.ts` rather than left to the
+ * next reader to notice.
+ *
  * @param em            EntityManager scoped to the tenant.
  * @param tenantId      Tenant id for which to resolve the system user.
  * @param fallbackId    Optional caller-supplied fallback (e.g., the channel's
@@ -43,28 +50,39 @@ export async function resolveCommunicationChannelsSystemUserId(
 ): Promise<string> {
   try {
     const expectedEmail = systemUserEmail(tenantId)
-    // Untyped QB by design — the helper is intentionally cross-module
-    // (resolving an `auth.user` from the hub) and must not pull the User
-    // entity class. MikroORM v7's typed builder requires an entity ref;
-    // we keep the lookup table-name-driven so the helper compiles without
-    // a cross-module import. The mocks in `__tests__/system-user.test.ts`
-    // exercise this code path through a duck-typed `createQueryBuilder` stub.
-    type RawQueryBuilder = {
-      select: (fields: string[]) => RawQueryBuilder
-      where: (cond: Record<string, unknown>) => RawQueryBuilder
-      limit: (count: number) => RawQueryBuilder
-      execute: (mode: string) => Promise<unknown>
-    }
-    const qb = (
-      em as unknown as { createQueryBuilder: (table: string, alias: string) => RawQueryBuilder }
-    ).createQueryBuilder('auth.users', 'u')
-    const row = await qb
-      .select(['u.id'])
-      .where({ email: expectedEmail, tenant_id: tenantId })
-      .limit(1)
-      .execute('get')
-      .catch(() => null)
-    const id = (row as { id?: string } | null)?.id
+    // Match on `email_hash`, never on `email` (#5599). `users.email` is
+    // encrypted at rest with a per-row IV, so its ciphertext is
+    // non-deterministic and an equality filter against the plaintext can never
+    // hit — which is exactly why the tenant uniqueness index keys on
+    // `email_hash` instead (see `auth/data/entities.ts`). The candidate list
+    // covers both the keyed `v2:` digest and the legacy unkeyed one, so a
+    // deployment that has not yet backfilled still matches.
+    //
+    // The digests must be computed the same way `auth` writes them
+    // (`auth/lib/emailHash.ts` → `hashForLookup(email)`), i.e. with NO hash
+    // context. Reusing the shared primitive rather than importing the auth
+    // helper keeps this module free of a cross-module code dependency; the two
+    // must stay aligned if `auth` ever adopts a context.
+    const emailHashes = lookupHashCandidates(expectedEmail)
+
+    // Raw SQL against the table, not `createQueryBuilder('auth.users')`. That
+    // call names no registered entity — entities are discovered under their
+    // class names — so MikroORM reads the dot as a schema qualifier and looks
+    // for `users` in a schema named `auth`, which this project never creates
+    // (`Migration20251030150038` puts `users` in the default schema). The helper
+    // swallows every error by design, so the miss was indistinguishable from
+    // "no channel-bot user exists" and hid behind the same fallback as the
+    // plaintext-vs-ciphertext defect above. A parameterized statement names the
+    // table unambiguously and still pulls in no cross-module entity class,
+    // keeping the decoupling this helper was written for.
+    const placeholders = emailHashes.map(() => '?').join(', ')
+    const rows = await em
+      .getConnection()
+      .execute<Array<{ id?: string }>>(
+        `SELECT id FROM users WHERE email_hash IN (${placeholders}) AND tenant_id = ? AND deleted_at IS NULL LIMIT 1`,
+        [...emailHashes, tenantId],
+      )
+    const id = Array.isArray(rows) ? rows[0]?.id : undefined
     if (typeof id === 'string' && id.length > 0) return id
   } catch {
     // ignore — fall through to fallback

package/src/modules/customers/api/activities/route.ts

@@ -31,6 +31,7 @@ import { hydrateCanonicalInteractions } from '../../lib/interactionReadModel'
 import { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'
 import { buildEmailVisibilityMikroFilter } from '../../lib/visibilityFilter'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -620,6 +621,10 @@ export async function POST(request: Request): Promise<Response> {
     if (isCrudHttpError(err)) {
       return withAdapterHeaders(NextResponse.json(err.body, { status: err.status }))
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return withAdapterHeaders(NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status }))
+    }
     if (err instanceof z.ZodError) {
       return withAdapterHeaders(
         NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 }),
@@ -703,6 +708,10 @@ export async function PUT(request: Request): Promise<Response> {
     if (isCrudHttpError(err)) {
       return withAdapterHeaders(NextResponse.json(err.body, { status: err.status }))
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return withAdapterHeaders(NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status }))
+    }
     if (err instanceof z.ZodError) {
       return withAdapterHeaders(
         NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 }),
@@ -771,6 +780,10 @@ export async function DELETE(request: Request): Promise<Response> {
     if (isCrudHttpError(err)) {
       return withAdapterHeaders(NextResponse.json(err.body, { status: err.status }))
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return withAdapterHeaders(NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status }))
+    }
     if (err instanceof z.ZodError) {
       return withAdapterHeaders(
         NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 }),

package/src/modules/customers/api/dictionaries/[kind]/[id]/route.ts

@@ -16,6 +16,7 @@ import {
   validateCrudMutationGuard,
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -175,6 +176,10 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.dictionaries.update failed', { err })
     return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') }, { status: 400 })
@@ -276,6 +281,10 @@ export async function DELETE(req: Request, ctx: { params?: { kind?: string; id?:
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.dictionaries.delete failed', { err })
     return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to delete dictionary entry') }, { status: 400 })

package/src/modules/customers/api/dictionaries/[kind]/route.ts

@@ -23,6 +23,7 @@ import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { CUSTOMER_DICTIONARY_ORGANIZATION_REQUIRED_CODE } from '../../../lib/dictionaries'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -271,6 +272,10 @@ export async function POST(req: Request, ctx: { params?: { kind?: string } }) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.dictionaries.create failed', { err })
     return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') }, { status: 400 })

package/src/modules/customers/api/dictionaries/kind-settings/route.ts

@@ -20,6 +20,7 @@ import {
   type CustomerKindSettingsUpsertInput,
 } from '../../../data/validators'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -186,6 +187,10 @@ export async function PATCH(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers/dictionaries/kind-settings.PATCH', { err })
     return NextResponse.json({ error: 'Failed to update kind setting' }, { status: 500 })
   }

package/src/modules/customers/api/interactions/cancel/route.ts

@@ -16,6 +16,7 @@ import {
 import { resolveAuthActorId } from '../../../lib/interactionRequestContext'
 import { withOperationMetadata } from '../../../lib/operationMetadata'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -86,6 +87,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })
     }

package/src/modules/customers/api/interactions/complete/route.ts

@@ -16,6 +16,7 @@ import {
 import { resolveAuthActorId } from '../../../lib/interactionRequestContext'
 import { withOperationMetadata } from '../../../lib/operationMetadata'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -86,6 +87,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: 'Validation failed', details: err.issues }, { status: 400 })
     }

package/src/modules/customers/api/labels/assign/route.ts

@@ -24,6 +24,7 @@ import {
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -174,6 +175,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers/labels/assign.POST', { err })
     const { translate: fallbackTranslate } = await resolveTranslations()
     return NextResponse.json(

package/src/modules/customers/api/labels/route.ts

@@ -27,6 +27,7 @@ import {
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -287,6 +288,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers/labels.POST', { err })
     return NextResponse.json({ error: 'Failed to create label' }, { status: 500 })
   }

package/src/modules/customers/api/labels/unassign/route.ts

@@ -24,6 +24,7 @@ import {
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -174,6 +175,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers/labels/unassign.POST', { err })
     return NextResponse.json({ error: 'Failed to unassign label' }, { status: 500 })
   }

package/src/modules/customers/api/people/[id]/companies/[linkId]/route.ts

@@ -21,6 +21,7 @@ import {
 import { loadPersonContext } from '../context'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
@@ -226,6 +227,10 @@ export async function PATCH(req: Request, ctx: { params?: { id?: string; linkId?
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     return NextResponse.json({ error: translate('customers.errors.internal', 'Internal server error') }, { status: 500 })
   }
 }
@@ -330,6 +335,10 @@ export async function DELETE(req: Request, ctx: { params?: { id?: string; linkId
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     return NextResponse.json({ error: translate('customers.errors.internal', 'Internal server error') }, { status: 500 })
   }
 }

package/src/modules/customers/api/people/[id]/companies/route.ts

@@ -26,6 +26,7 @@ import {
 import { loadPersonContext } from './context'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
@@ -210,6 +211,10 @@ export async function POST(req: Request, ctx: { params?: { id?: string } }) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     return NextResponse.json({ error: translate('customers.errors.internal', 'Internal server error') }, { status: 500 })
   }
 }

package/src/modules/customers/api/pipeline-stages/reorder/route.ts

@@ -14,6 +14,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -86,6 +87,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipeline-stages.reorder failed', { err })
     return NextResponse.json({ error: 'Failed to reorder pipeline stages' }, { status: 400 })
   }

package/src/modules/customers/api/pipeline-stages/route.ts

@@ -25,6 +25,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -174,6 +175,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipeline-stages POST failed', { err })
     return NextResponse.json({ error: 'Failed to create pipeline stage' }, { status: 400 })
   }
@@ -242,6 +247,10 @@ export async function PUT(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipeline-stages PUT failed', { err })
     return NextResponse.json({ error: 'Failed to update pipeline stage' }, { status: 400 })
   }
@@ -295,6 +304,10 @@ export async function DELETE(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipeline-stages DELETE failed', { err })
     return NextResponse.json({ error: 'Failed to delete pipeline stage' }, { status: 400 })
   }

package/src/modules/customers/api/pipelines/route.ts

@@ -25,6 +25,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -156,6 +157,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipelines POST failed', { err })
     return NextResponse.json({ error: 'Failed to create pipeline' }, { status: 400 })
   }
@@ -224,6 +229,10 @@ export async function PUT(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipelines PUT failed', { err })
     return NextResponse.json({ error: 'Failed to update pipeline' }, { status: 400 })
   }
@@ -277,6 +286,10 @@ export async function DELETE(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     logger.error('customers.pipelines DELETE failed', { err })
     return NextResponse.json({ error: 'Failed to delete pipeline' }, { status: 400 })
   }

package/src/modules/customers/api/settings/address-format/route.ts

@@ -17,6 +17,7 @@ import type { CustomerAddressFormat } from '../../../data/entities'
 import { withScopedPayload } from '../../utils'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -134,6 +135,10 @@ export async function PUT(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.settings.address-format.put failed', { err })
     return NextResponse.json({ error: translate('customers.errors.save_failed', 'Failed to save settings') }, { status: 400 })

package/src/modules/customers/api/settings/dictionary-sort-modes/route.ts

@@ -31,6 +31,7 @@ import {
 import { invalidateDictionaryCache } from '../../dictionaries/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -222,6 +223,10 @@ export async function PATCH(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.settings.dictionary-sort-modes.patch failed', { err })
     return NextResponse.json(

package/src/modules/customers/api/settings/stuck-threshold/route.ts

@@ -20,6 +20,7 @@ import { loadCustomerSettings } from '../../../commands/settings'
 import { withScopedPayload } from '../../utils'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -151,6 +152,10 @@ export async function PUT(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.settings.stuck-threshold.put failed', { err })
     return NextResponse.json(

package/src/modules/customers/api/tags/assign/route.ts

@@ -15,6 +15,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('customers')
 
@@ -108,6 +109,10 @@ export async function POST(req: Request) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status })
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     logger.error('customers.tags.assign failed', { err })
     return NextResponse.json({ error: translate('customers.errors.assign_failed', 'Failed to assign tag') }, { status: 400 })