@open-mercato/core 0.7.1-develop.7150.1.c1941e0c22 → 0.7.1-develop.7151.1.00d0391847

package/src/modules/communication_channels/lib/test-seed.ts

@@ -1,3 +1,7 @@
+import { appendFile, mkdir, readFile, rm, writeFile } from 'node:fs/promises'
+import { timingSafeEqual } from 'node:crypto'
+import path from 'node:path'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type {
   ChannelAdapter,
   ChannelCapabilities,
@@ -15,6 +19,7 @@ import type {
 } from './adapter'
 import { baseEmailCapabilities } from './email-capabilities'
 import { hasChannelAdapter, registerChannelAdapter } from './adapter-registry-singleton'
+import { registerSystemEmailProviderConfigResolver } from './system-email-provider-config'
 
 /**
  * Test-only channel seeding support.
@@ -56,6 +61,18 @@ export const TEST_SEED_CHAT_PROVIDER_KEY = '__test_seed_chat__'
 
 /** Env flag that unlocks test-only channel seeding. Off in production. */
 export const TEST_CHANNEL_SEEDING_ENV = 'OM_ENABLE_TEST_CHANNEL_SEEDING'
+export const TEST_EMAIL_CAPTURE_ACCESS_TOKEN_ENV = 'OM_TEST_EMAIL_CAPTURE_ACCESS_TOKEN'
+export const TEST_EMAIL_CAPTURE_CORRELATION_TOKEN_ENV = 'OM_TEST_EMAIL_CAPTURE_CORRELATION_TOKEN'
+/**
+ * Where the Hub's tenant-scoped capture is written.
+ *
+ * Deliberately not `OM_TEST_EMAIL_CAPTURE_PATH`: that one belongs to the unscoped capture in
+ * `@open-mercato/shared/lib/email/send`, which writes a different record shape to a path the repo
+ * also ships a committed fixture for. Pointing both mechanisms at one file made this module parse
+ * foreign records and let `clear-capture` rewrite the other mechanism's fixtures. Two mechanisms,
+ * two files.
+ */
+export const TEST_SYSTEM_EMAIL_CAPTURE_PATH_ENV = 'OM_TEST_SYSTEM_EMAIL_CAPTURE_PATH'
 
 /**
  * True only when the test-seeding env flag is explicitly enabled. Accepts the
@@ -68,6 +85,173 @@ export function isTestChannelSeedingEnabled(): boolean {
   return ['1', 'true', 'yes', 'on'].includes(raw.trim().toLowerCase())
 }
 
+export type TestSeedCapturedMessage = {
+  capturedAt: string
+  externalMessageId: string
+  conversationId?: string
+  content: SendMessageInput['content']
+  scope: SendMessageInput['scope']
+  metadata?: SendMessageInput['metadata']
+  captureCorrelationToken?: string
+}
+
+type TestSeedCaptureScope = {
+  tenantId: string
+  organizationId: string | null
+}
+
+export type TestSeedCaptureOptions = {
+  systemRecipient?: string
+  captureCorrelationToken?: string
+}
+
+export async function createTestSeedPlatformMessage(
+  em: EntityManager,
+  input: {
+    providerKey: string
+    threadId?: string
+    senderUserId: string
+    subject?: string
+    bodyText?: string
+    channelId: string
+    tenantId: string
+    organizationId: string | null
+  },
+): Promise<string | null> {
+  const rows = (await em.getConnection().execute(
+    `INSERT INTO messages
+       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,
+        is_draft, sent_at, visibility, source_entity_type, source_entity_id,
+        tenant_id, organization_id, created_at, updated_at)
+     VALUES
+       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',
+        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,
+        ?, ?, now(), now())
+     RETURNING id`,
+    [
+      `channel.${input.providerKey}`,
+      input.threadId ?? null,
+      input.senderUserId,
+      input.subject ?? '(no subject)',
+      input.bodyText ?? '',
+      input.channelId,
+      input.tenantId,
+      input.organizationId,
+    ],
+  )) as Array<{ id: string }>
+  return rows[0]?.id ?? null
+}
+
+function normalizeToken(value: string | null | undefined): string | null {
+  if (typeof value !== 'string') return null
+  const normalized = value.trim()
+  return normalized.length >= 32 ? normalized : null
+}
+
+export function isTestEmailCaptureAccessAuthorized(providedToken: string | null): boolean {
+  const expectedToken = normalizeToken(process.env[TEST_EMAIL_CAPTURE_ACCESS_TOKEN_ENV])
+  const normalizedProvidedToken = normalizeToken(providedToken)
+  if (!expectedToken || !normalizedProvidedToken) return false
+  const expected = Buffer.from(expectedToken)
+  const provided = Buffer.from(normalizedProvidedToken)
+  return expected.length === provided.length && timingSafeEqual(expected, provided)
+}
+
+export function resolveTestEmailCaptureCorrelationToken(): string | null {
+  return normalizeToken(process.env[TEST_EMAIL_CAPTURE_CORRELATION_TOKEN_ENV])
+}
+
+function resolveCapturePath(): string {
+  const explicit = process.env[TEST_SYSTEM_EMAIL_CAPTURE_PATH_ENV]?.trim()
+  if (explicit) return path.resolve(explicit)
+  const queueBaseDir = process.env.QUEUE_BASE_DIR?.trim()
+  if (queueBaseDir) return path.resolve(queueBaseDir, '..', 'test-email-capture.jsonl')
+  return path.resolve(process.cwd(), '.mercato', 'test-email-capture.jsonl')
+}
+
+function matchesCaptureScope(
+  message: TestSeedCapturedMessage,
+  scope: TestSeedCaptureScope,
+  options: TestSeedCaptureOptions = {},
+): boolean {
+  if (message.scope.tenantId === scope.tenantId) {
+    const messageOrganizationId = message.scope.organizationId ?? null
+    return messageOrganizationId === scope.organizationId || messageOrganizationId === scope.tenantId
+  }
+
+  if (
+    message.scope.tenantId !== 'system' ||
+    message.scope.organizationId !== 'system' ||
+    !options.systemRecipient ||
+    !options.captureCorrelationToken ||
+    message.captureCorrelationToken !== options.captureCorrelationToken
+  ) {
+    return false
+  }
+
+  const expectedRecipient = options.systemRecipient.trim().toLowerCase()
+  const matchesRecipient = (value: unknown): boolean => {
+    if (typeof value === 'string') return value.trim().toLowerCase() === expectedRecipient
+    if (Array.isArray(value)) return value.some(matchesRecipient)
+    if (!value || typeof value !== 'object') return false
+    return matchesRecipient((value as Record<string, unknown>).address)
+  }
+
+  return matchesRecipient(message.metadata?.to)
+}
+
+async function readTestSeedCapturedMessages(): Promise<TestSeedCapturedMessage[]> {
+  const capturePath = resolveCapturePath()
+  const text = await readFile(capturePath, 'utf8').catch(() => '')
+  return text
+    .split(/\r?\n/)
+    .map((line) => line.trim())
+    .filter((line) => line.length > 0)
+    .map((line) => {
+      try {
+        return JSON.parse(line) as TestSeedCapturedMessage
+      } catch {
+        return null
+      }
+    })
+    // A record without a scope is not ours. Skipping instead of throwing keeps a stray or
+    // foreign-shaped line from turning every capture read into a 500.
+    .filter((message): message is TestSeedCapturedMessage => Boolean(message?.scope))
+}
+
+export async function clearTestSeedCapturedMessages(
+  scope: TestSeedCaptureScope,
+  options: TestSeedCaptureOptions = {},
+): Promise<void> {
+  const capturePath = resolveCapturePath()
+  const retained = (await readTestSeedCapturedMessages())
+    .filter((message) => !matchesCaptureScope(message, scope, options))
+  if (retained.length === 0) {
+    await rm(capturePath, { force: true })
+    return
+  }
+  await writeFile(
+    capturePath,
+    `${retained.map((message) => JSON.stringify(message)).join('\n')}\n`,
+    'utf8',
+  )
+}
+
+export async function listTestSeedCapturedMessages(
+  scope: TestSeedCaptureScope,
+  options: TestSeedCaptureOptions = {},
+): Promise<TestSeedCapturedMessage[]> {
+  return (await readTestSeedCapturedMessages()).filter((message) =>
+    matchesCaptureScope(message, scope, options),
+  )
+}
+
+async function captureTestSeedMessage(record: TestSeedCapturedMessage): Promise<void> {
+  const capturePath = resolveCapturePath()
+  await mkdir(path.dirname(capturePath), { recursive: true })
+  await appendFile(capturePath, `${JSON.stringify(record)}\n`, 'utf8')
+}
+
 /**
  * Capabilities for the stub: an email channel that supports neither reactions,
  * edit/delete, nor conversation history — so the strict registry validator
@@ -95,6 +279,15 @@ class TestSeedChannelAdapter implements ChannelAdapter {
     // Synthesize a deterministic-looking RFC2822-style message id; never touches
     // the network. The delivery worker persists this as the external message id.
     const externalMessageId = `test-seed-${Date.now()}-${Math.random().toString(16).slice(2, 10)}@test-seed.local`
+    await captureTestSeedMessage({
+      capturedAt: new Date().toISOString(),
+      externalMessageId,
+      conversationId: input.conversationId,
+      content: input.content,
+      scope: input.scope,
+      metadata: input.metadata,
+      captureCorrelationToken: resolveTestEmailCaptureCorrelationToken() ?? undefined,
+    })
     return {
       externalMessageId,
       conversationId: input.conversationId,
@@ -210,6 +403,11 @@ function getTestSeedChatChannelAdapter(): TestSeedChatChannelAdapter {
  */
 export function ensureTestSeedAdapterRegistered(): void {
   if (!isTestChannelSeedingEnabled()) return
+  registerSystemEmailProviderConfigResolver({
+    providerKey: TEST_SEED_PROVIDER_KEY,
+    isConfigured: isTestChannelSeedingEnabled,
+    resolveCredentials: ({ fromAddress }) => ({ testSeed: true, fromAddress }),
+  })
   if (!hasChannelAdapter(TEST_SEED_PROVIDER_KEY)) {
     registerChannelAdapter(getTestSeedChannelAdapter())
   }

package/src/modules/communication_channels/setup.ts

@@ -1,7 +1,11 @@
 import { createHash } from 'node:crypto'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import { CommunicationChannel } from './data/entities'
 import { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'
-import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isTestChannelSeedingEnabled, TEST_SEED_PROVIDER_KEY } from './lib/test-seed'
 
 const logger = createLogger('communication_channels')
 
@@ -25,6 +29,24 @@ type SchedulerServiceLike = {
   }) => Promise<void>
 }
 
+type CredentialsServiceLike = {
+  resolve: (
+    integrationId: string,
+    scope: { organizationId: string; tenantId: string; userId?: string | null },
+  ) => Promise<Record<string, unknown> | null>
+  save: (
+    integrationId: string,
+    credentials: Record<string, unknown>,
+    scope: { organizationId: string; tenantId: string; userId?: string | null },
+  ) => Promise<void>
+}
+
+/**
+ * Sender the test-seed channel presents. Shared by the channel row's
+ * `externalIdentifier` and its seeded credentials so both describe one address.
+ */
+const TEST_SEED_FROM_ADDRESS = 'system@test-seed.local'
+
 /**
  * Tick interval in seconds. Default 60s per email integration spec
  * § Hub Deltas → Delta 6 (scheduler mechanism).
@@ -88,6 +110,74 @@ export const setup: ModuleSetupConfig = {
   },
 
   async seedDefaults({ container, organizationId, tenantId }) {
+    if (isTestChannelSeedingEnabled() && process.env.SYSTEM_EMAIL_PROVIDER === TEST_SEED_PROVIDER_KEY) {
+      const em = (container.resolve('em') as EntityManager).fork()
+      const existing = await findOneWithDecryption(
+        em,
+        CommunicationChannel,
+        {
+          providerKey: TEST_SEED_PROVIDER_KEY,
+          channelType: 'email',
+          tenantId,
+          organizationId,
+          userId: null,
+          deletedAt: null,
+        },
+        undefined,
+        { tenantId, organizationId },
+      )
+      if (!existing) {
+        em.persist(em.create(CommunicationChannel, {
+          providerKey: TEST_SEED_PROVIDER_KEY,
+          channelType: 'email',
+          displayName: 'Test Seed System Email',
+          externalIdentifier: TEST_SEED_FROM_ADDRESS,
+          userId: null,
+          isPrimary: false,
+          isActive: true,
+          status: 'connected',
+          tenantId,
+          organizationId,
+        }))
+        await em.flush()
+      }
+
+      /**
+       * Seeding the channel row without credentials is not a neutral state — it is a
+       * fail-closed one. Once a tenant owns a Hub channel, `resolveTenantCredentials`
+       * deliberately refuses to fall back to instance-wide env credentials, so every
+       * tenant-scoped send throws `SYSTEM_EMAIL_CREDENTIALS_NOT_CONFIGURED`. Callers that
+       * treat a failed send as a failed write (customer invitations roll back and return
+       * 502) then fail outright rather than merely losing the email.
+       *
+       * Seeding credentials alongside the row makes the harness model a tenant that
+       * finished configuring its provider, which is also the only one of the three
+       * credential cases the integration suite would otherwise never exercise.
+       */
+      // Best-effort, like the scheduler registration below: credential storage needs the
+      // integrations module and a usable encryption key, and neither is guaranteed in every
+      // harness. A failure here must not abort tenant initialization for every other module.
+      try {
+        const credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike
+        const testSeedIntegrationId = `channel_${TEST_SEED_PROVIDER_KEY}`
+        const credentialScope = { tenantId, organizationId, userId: null }
+        const existingCredentials = await credentialsService.resolve(testSeedIntegrationId, credentialScope)
+        if (!existingCredentials) {
+          await credentialsService.save(
+            testSeedIntegrationId,
+            { testSeed: true, fromAddress: TEST_SEED_FROM_ADDRESS },
+            credentialScope,
+          )
+        }
+      } catch (error) {
+        logger.warn('Test-seed email credentials could not be stored; tenant-scoped sends will fail closed', {
+          err: error,
+          tenantId,
+          organizationId,
+        })
+      }
+    }
+
     /**
      * Register the per-channel polling tick with `@open-mercato/scheduler`.
      *

package/src/modules/customer_accounts/api/admin/users-invite.ts

@@ -208,6 +208,7 @@ export async function POST(req: Request) {
   try {
     await sendCustomerInvitationEmail({
       container,
+      tenantId: auth.tenantId!,
       organizationId: auth.orgId!,
       email: invitation.email,
       rawToken,

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -108,6 +108,7 @@ export async function POST(req: Request) {
   try {
     await sendCustomerInvitationEmail({
       container,
+      tenantId: auth.tenantId,
       organizationId: auth.orgId,
       email: invitation.email,
       rawToken,

package/src/modules/customer_accounts/api/signup.ts

@@ -140,10 +140,12 @@ export async function POST(req: Request) {
       ),
     }
 
-    void sendEmail({
+    await sendEmail({
       to: existing.email,
       subject,
       react: CustomerExistingAccountEmail({ loginUrl, copy }),
+      tenantId,
+      organizationId,
     }).catch((error) => {
       logger.error('Existing-account email failed', { err: error })
     })
@@ -193,10 +195,12 @@ export async function POST(req: Request) {
     ),
   }
 
-  void sendEmail({
+  await sendEmail({
     to: user.email,
     subject,
     react: CustomerSignupVerificationEmail({ verifyUrl, copy }),
+    tenantId,
+    organizationId,
   }).catch((error) => {
     logger.error('Verification email failed', { err: error })
   })

package/src/modules/customer_accounts/lib/invitationEmail.ts

@@ -6,6 +6,7 @@ import { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/
 
 export type CustomerInvitationEmailInput = {
   container: AppContainer
+  tenantId?: string
   organizationId: string
   email: string
   rawToken: string
@@ -38,5 +39,7 @@ export async function sendCustomerInvitationEmail(input: CustomerInvitationEmail
     to: input.email,
     subject,
     react: CustomerInvitationEmail({ inviteUrl, copy }),
+    tenantId: input.tenantId,
+    organizationId: input.organizationId,
   })
 }

package/src/modules/customers/api/interactions/route.ts

@@ -172,6 +172,7 @@ type InteractionListRow = {
   priority: number | null
   author_user_id: string | null
   owner_user_id: string | null
+  external_message_id: string | null
   appearance_icon: string | null
   appearance_color: string | null
   source: string | null
@@ -304,6 +305,7 @@ const INTERACTION_LIST_COLUMNS = [
   'priority',
   'author_user_id',
   'owner_user_id',
+  'external_message_id',
   'appearance_icon',
   'appearance_color',
   'source',
@@ -654,6 +656,7 @@ export async function GET(req: Request) {
       priority: row.priority ?? null,
       authorUserId: row.author_user_id ?? null,
       ownerUserId: row.owner_user_id ?? null,
+      externalMessageId: row.external_message_id ?? null,
       appearanceIcon: row.appearance_icon ?? null,
       appearanceColor: row.appearance_color ?? null,
       source: row.source ?? null,
@@ -733,6 +736,7 @@ const interactionListItemSchema = z
     priority: z.number().nullable(),
     authorUserId: z.string().uuid().nullable(),
     ownerUserId: z.string().uuid().nullable(),
+    externalMessageId: z.string().uuid().nullable().optional(),
     appearanceIcon: z.string().nullable().optional(),
     appearanceColor: z.string().nullable().optional(),
     source: z.string().nullable().optional(),

package/src/modules/messages/lib/email-sender.ts

@@ -47,7 +47,7 @@ function resolveObjectLabels(objects: MessageObject[]): string[] {
   return objects.map((item) => `${item.entityModule}.${item.entityType} (${item.entityId})`)
 }
 
-type ResendAttachment = {
+type EmailAttachment = {
   filename: string
   content: string
   contentType?: string
@@ -56,8 +56,8 @@ type ResendAttachment = {
 async function mapAttachmentsForEmail(
   messageId: string,
   attachments: MessageEmailAttachment[],
-): Promise<ResendAttachment[]> {
-  const resendAttachments: ResendAttachment[] = []
+): Promise<EmailAttachment[]> {
+  const emailAttachments: EmailAttachment[] = []
   let totalBytes = 0
 
   for (const attachment of attachments.slice(0, MAX_EMAIL_ATTACHMENTS)) {
@@ -89,14 +89,14 @@ async function mapAttachmentsForEmail(
     }
 
     totalBytes += buffer.length
-    resendAttachments.push({
+    emailAttachments.push({
       filename: attachment.fileName,
       content: buffer.toString('base64'),
       contentType: attachment.mimeType || undefined,
     })
   }
 
-  return resendAttachments
+  return emailAttachments
 }
 
 async function renderMarkdownEmailBody(body: string) {
@@ -178,14 +178,13 @@ export async function sendMessageEmailToRecipient(params: {
   }
   const copy = await buildEmailCopy(message.sentAt ?? new Date())
   const bodyHtml = await buildEmailBodyHtml(message)
-  const resendAttachments = await mapAttachmentsForEmail(message.id, attachments)
-  logDebug('Sending recipient email via Resend', {
+  const emailAttachments = await mapAttachmentsForEmail(message.id, attachments)
+  logDebug('Sending recipient email', {
     messageId: message.id,
     recipientUserId,
     recipientEmail,
     hasViewUrl: Boolean(viewUrl),
-    attachmentsCount: resendAttachments.length,
-    hasApiKey: Boolean(process.env.RESEND_API_KEY),
+    attachmentsCount: emailAttachments.length,
     from: resolveDefaultEmailFromAddress() ?? null,
   })
 
@@ -203,7 +202,9 @@ export async function sendMessageEmailToRecipient(params: {
       attachmentNames: attachments.map((item) => item.fileName),
       objectLabels: resolveObjectLabels(objects),
     }),
-    attachments: resendAttachments,
+    attachments: emailAttachments,
+    tenantId: message.tenantId,
+    organizationId: message.organizationId ?? null,
   })
 }
 
@@ -217,12 +218,11 @@ export async function sendMessageEmailToExternal(params: {
   const { message, email, sender, objects, attachments } = params
   const copy = await buildEmailCopy(message.sentAt ?? new Date())
   const bodyHtml = await buildEmailBodyHtml(message)
-  const resendAttachments = await mapAttachmentsForEmail(message.id, attachments)
-  logDebug('Sending external email via Resend', {
+  const emailAttachments = await mapAttachmentsForEmail(message.id, attachments)
+  logDebug('Sending external email', {
     messageId: message.id,
     email,
-    attachmentsCount: resendAttachments.length,
-    hasApiKey: Boolean(process.env.RESEND_API_KEY),
+    attachmentsCount: emailAttachments.length,
     from: resolveDefaultEmailFromAddress() ?? null,
   })
 
@@ -240,9 +240,11 @@ export async function sendMessageEmailToExternal(params: {
       attachmentNames: attachments.map((item) => item.fileName),
       objectLabels: resolveObjectLabels(objects),
     }),
-    attachments: resendAttachments,
+    attachments: emailAttachments,
+    tenantId: message.tenantId,
+    organizationId: message.organizationId ?? null,
   })
-  logDebug('External email sent via Resend', {
+  logDebug('External email sent', {
     messageId: message.id,
     email,
   })

package/src/modules/notifications/lib/strategies/email-delivery-strategy.ts

@@ -24,7 +24,7 @@ export const emailDeliveryStrategy: NotificationDeliveryStrategy = {
   defaultEnabled: true,
   isConfigured: (ctx: NotificationDeliveryContext) => ctx.deliveryConfig.strategies.email.enabled === true,
   async deliver(ctx: NotificationDeliveryContext) {
-    const { recipient, panelLink, title, body, actionLinks, deliveryConfig, t } = ctx
+    const { notification, recipient, panelLink, title, body, actionLinks, deliveryConfig, t } = ctx
     if (!recipient?.email || !panelLink) {
       debug('email skipped: missing recipient email or panelLink')
       return
@@ -48,6 +48,8 @@ export const emailDeliveryStrategy: NotificationDeliveryStrategy = {
         subject,
         from: deliveryConfig.strategies.email.from,
         replyTo: deliveryConfig.strategies.email.replyTo,
+        tenantId: notification.tenantId,
+        organizationId: notification.organizationId ?? null,
         react: NotificationEmail({
           title,
           body,

package/src/modules/sales/api/quotes/accept/route.ts

@@ -169,6 +169,8 @@ export async function POST(req: Request) {
             orderNumber,
           }),
           react: QuoteAcceptedAdminEmail({ orderUrl, copy }),
+          tenantId: quote.tenantId,
+          organizationId: quote.organizationId,
         })
       } catch (err) {
         logger.error('sales.quotes.accept.adminEmail failed', { err })

package/src/modules/sales/api/quotes/send/route.ts

@@ -18,6 +18,7 @@ import crypto from 'node:crypto'
 import { withScopedPayload } from '../../utils'
 import { hashAuthToken } from '../../../../auth/lib/tokenHash'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { SalesQuote } from '../../../data/entities'
 import { quoteSendSchema } from '../../../data/validators'
 import { sendEmail } from '@open-mercato/shared/lib/email/send'
@@ -112,8 +113,16 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
 }
 
 function resolveQuoteEmail(quote: SalesQuote): string | null {
-  const snapshot = quote.customerSnapshot && typeof quote.customerSnapshot === 'object' ? (quote.customerSnapshot as Record<string, unknown>) : null
-  const metadata = quote.metadata && typeof quote.metadata === 'object' ? (quote.metadata as Record<string, unknown>) : null
+  const normalizeRecord = (value: unknown): Record<string, unknown> | null => {
+    if (value && typeof value === 'object' && !Array.isArray(value)) return value as Record<string, unknown>
+    if (typeof value !== 'string') return null
+    const parsed = parseDecryptedFieldValue(value)
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed)
+      ? parsed as Record<string, unknown>
+      : null
+  }
+  const snapshot = normalizeRecord(quote.customerSnapshot)
+  const metadata = normalizeRecord(quote.metadata)
   const contact = snapshot?.contact as Record<string, unknown> | undefined
   const customer = snapshot?.customer as Record<string, unknown> | undefined
   const candidate =
@@ -148,7 +157,9 @@ export async function POST(req: Request) {
     }
 
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const tenantScope = ctx.auth?.tenantId ? { tenantId: ctx.auth.tenantId } : undefined
+    const tenantScope = ctx.auth?.tenantId
+      ? { tenantId: ctx.auth.tenantId, organizationId: ctx.selectedOrganizationId ?? ctx.auth.orgId ?? null }
+      : undefined
     const quote = await findOneWithDecryption(em, SalesQuote, { id: input.quoteId, deletedAt: null }, {}, tenantScope)
     if (!quote) {
       throw notFound(translate('sales.documents.detail.error', 'Document not found or inaccessible.'))
@@ -216,6 +227,8 @@ export async function POST(req: Request) {
       to: email,
       subject: translate('sales.quotes.email.subject', 'Quote {quoteNumber}', { quoteNumber: quote.quoteNumber }),
       react: QuoteSentEmail({ url, copy }),
+      tenantId: quote.tenantId,
+      organizationId: quote.organizationId,
     })
 
     if (guardResult.afterSuccessCallbacks.length) {