@open-mercato/core 0.8.1-develop.7228.1.b7ea09d2d3 → 0.8.1-develop.7238.1.3abe669ea5

package/src/modules/entities/cli.ts

@@ -16,6 +16,7 @@ import { createKmsService, type KmsService, type TenantDek } from '@open-mercato
 import {
   decryptWithAesGcm,
   decryptWithAesGcmStrict,
+  isEncryptedPayloadShape,
   TenantDataEncryptionError,
   TenantDataEncryptionErrorCode,
 } from '@open-mercato/shared/lib/encryption/aes'
@@ -448,12 +449,6 @@ function resolveMapMeta(
   return { entityId, meta, fields, tenantId }
 }
 
-function isEncryptedPayload(value: unknown): boolean {
-  if (typeof value !== 'string') return false
-  const parts = value.split(':')
-  return parts.length === 4 && parts[3] === 'v1'
-}
-
 function formatValueForColumn(prop: any, value: unknown): unknown {
   if (value === null || value === undefined) return value
   const types = Array.isArray(prop?.columnTypes) ? prop.columnTypes : []
@@ -550,6 +545,10 @@ const rotateEncryptionKey: ModuleCli = {
     }
 
     const oldDekCache = new Map<string, TenantDek | null>()
+    // Rows this run could not rotate because their ciphertext opens under neither
+    // --old-key nor the current tenant key — surfaced in the closing summary so an
+    // operator does not have to grep console.warn output for a batch of thousands.
+    const unrecoverableRows: Array<{ entityId: string; field: string; rowId: unknown }> = []
     // A dry run must not provision key material. `encryptEntityPayload` creates and
     // persists a tenant DEK in KMS/Vault the first time it runs for a tenant, so a
     // read-only preview would silently mutate KMS state (#5950). Probe read-only
@@ -599,6 +598,8 @@ const rotateEncryptionKey: ModuleCli = {
       const list = Array.isArray(rows) ? rows : []
       if (!list.length) return 0
       const dekAvailable = dryRun ? await hasExistingDek(scope.tenantId) : true
+      // The scope pins one tenant, so the current DEK is the same for every row here.
+      const currentDek = rotate && oldKms ? await encryptionService.getDek(scope.tenantId) : null
       let updated = 0
       for (const row of list) {
         const payload: Record<string, unknown> = {}
@@ -607,7 +608,13 @@ const rotateEncryptionKey: ModuleCli = {
           const col = resolved?.columnName
           if (!col) continue
           const rawValue = row[col]
-          if (rotate && !isEncryptedPayload(rawValue)) {
+          // Rotate mode only touches values that look like an envelope (candidates to
+          // re-key); encrypt mode only touches values that do not (plaintext to seal).
+          // A shape-valid envelope encountered in encrypt mode is either already
+          // correctly encrypted or sealed under a foreign DEK — either way, handing it
+          // to encryptEntityPayload would either no-op or throw WRONG_KEY and abort the
+          // whole run (#5951); mirror the filter the update path already applies below.
+          if (isEncryptedPayloadShape(rawValue) ? !rotate : rotate) {
             continue
           }
           payload[rule.field] = rawValue
@@ -628,10 +635,24 @@ const rotateEncryptionKey: ModuleCli = {
           }
           for (const rule of fields) {
             const value = payload[rule.field]
-            if (typeof value !== 'string' || !isEncryptedPayload(value)) continue
+            if (typeof value !== 'string' || !isEncryptedPayloadShape(value)) continue
             const decrypted = decryptWithOldKey(value, oldDek)
-            if (decrypted === null) continue
-            payload[rule.field] = parseDecryptedFieldValue(decrypted)
+            if (decrypted !== null) {
+              payload[rule.field] = parseDecryptedFieldValue(decrypted)
+              continue
+            }
+            // The old key did not open it. If the current key does, the row was already
+            // rotated (a resumed run) — leave it in the payload, where the service's own
+            // already-encrypted check skips it. Otherwise no key we hold can open it, and
+            // handing it to the encrypt path would abort the whole batch (#5951). Drop the
+            // field so this row is reported and skipped instead.
+            if (currentDek && decryptWithAesGcm(value, currentDek.key) !== null) continue
+            delete payload[rule.field]
+            if (rule.hashField) delete payload[rule.hashField]
+            unrecoverableRows.push({ entityId, field: rule.field, rowId: row[pk] })
+            console.warn(
+              `Skipping ${entityId}.${rule.field} for row ${row[pk]}: its ciphertext opens under neither --old-key nor the current tenant key. Re-run with the key that sealed it.`,
+            )
           }
         }
         if (!dekAvailable) {
@@ -643,7 +664,7 @@ const rotateEncryptionKey: ModuleCli = {
             if (!col) return false
             const value = row[col]
             if (value === null || value === undefined) return false
-            return rotate ? isEncryptedPayload(value) : !isEncryptedPayload(value)
+            return rotate ? isEncryptedPayloadShape(value) : !isEncryptedPayloadShape(value)
           })
           if (wouldChange) updated += 1
           continue
@@ -662,7 +683,7 @@ const rotateEncryptionKey: ModuleCli = {
           if (!col) continue
           const nextValue = (encrypted as any)[rule.field]
           if (nextValue !== undefined && nextValue !== row[col]) {
-            if (!rotate && isEncryptedPayload(row[col])) continue
+            if (!rotate && isEncryptedPayloadShape(row[col])) continue
             updates[col] = formatValueForColumn(resolved?.prop, nextValue)
           }
           if (rule.hashField) {
@@ -709,6 +730,20 @@ const rotateEncryptionKey: ModuleCli = {
     } else {
       console.log('All mapped entity fields already encrypted for the selected scope.')
     }
+    if (unrecoverableRows.length) {
+      const maxListed = 20
+      console.log(
+        `\n⚠️  ${unrecoverableRows.length} field(s) could not be rotated — their ciphertext opens under neither `
+          + '--old-key nor the current tenant key, so they were left untouched. See '
+          + '"Key management" in apps/docs/docs/architecture/data-encryption.mdx for how to resolve these manually.',
+      )
+      for (const row of unrecoverableRows.slice(0, maxListed)) {
+        console.log(`  - ${row.entityId}.${row.field} row=${String(row.rowId)}`)
+      }
+      if (unrecoverableRows.length > maxListed) {
+        console.log(`  ... and ${unrecoverableRows.length - maxListed} more`)
+      }
+    }
   },
 }
 
@@ -1201,8 +1236,13 @@ const backfillSystemEncryption: ModuleCli = {
             const resolved = resolveProperty(meta, rule.field)
             if (!resolved.columnName) continue
             const rawValue = row[resolved.columnName]
+            // Only plaintext belongs in the payload. An already-encrypted column produced no
+            // update anyway (the service skips what decrypts under the current key), but if the
+            // system key ever changed, passing its ciphertext through would abort the whole
+            // backfill rather than let the row's genuinely-plaintext fields through (#5951).
+            if (rawValue !== null && rawValue !== undefined && isEncryptedPayloadShape(rawValue)) continue
             payload[rule.field] = rawValue
-            if (rawValue !== null && rawValue !== undefined && !isEncryptedPayload(rawValue)) hasPlaintext = true
+            if (rawValue !== null && rawValue !== undefined) hasPlaintext = true
             if (rule.hashField) {
               const resolvedHash = resolveProperty(meta, rule.hashField)
               if (resolvedHash.columnName) payload[rule.hashField] = row[resolvedHash.columnName]

package/src/modules/inbox_ops/api/settings/route.ts

@@ -1,12 +1,11 @@
 import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { runWithCacheTenant } from '@open-mercato/cache'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { InboxSettings } from '../../data/entities'
 import { updateSettingsSchema } from '../../data/validators'
 import { resolveRequestContext, handleRouteError } from '../routeHelpers'
+import { ensureInboxSettings } from '../../lib/ensure-settings'
 import {
   resolveCache,
   createSettingsCacheKey,
@@ -36,20 +35,10 @@ export async function GET(req: Request) {
       }
     }
 
-    const settings = await findOneWithDecryption(
-      ctx.em,
-      InboxSettings,
-      {
-        organizationId: ctx.organizationId,
-        tenantId: ctx.tenantId,
-        deletedAt: null,
-      },
-      undefined,
-      ctx.scope,
-    )
+    const { settings } = await ensureInboxSettings(ctx.em, ctx.scope)
 
     const responseBody = {
-      settings: settings ? {
+      settings: {
         id: settings.id,
         inboxAddress: settings.inboxAddress,
         isActive: settings.isActive,
@@ -57,7 +46,7 @@ export async function GET(req: Request) {
         // Surface only whether a per-tenant secret exists — never the value.
         webhookSecretSet: Boolean(settings.webhookSecret),
         updatedAt: settings.updatedAt instanceof Date ? settings.updatedAt.toISOString() : (settings.updatedAt ?? null),
-      } : null,
+      },
     }
 
     if (cache) {
@@ -88,21 +77,7 @@ export async function PATCH(req: Request) {
       return NextResponse.json({ error: 'Invalid request', details: parsed.error.issues }, { status: 400 })
     }
 
-    const settings = await findOneWithDecryption(
-      ctx.em,
-      InboxSettings,
-      {
-        organizationId: ctx.organizationId,
-        tenantId: ctx.tenantId,
-        deletedAt: null,
-      },
-      undefined,
-      ctx.scope,
-    )
-
-    if (!settings) {
-      return NextResponse.json({ error: 'Settings not found' }, { status: 404 })
-    }
+    const { em: settingsEm, settings } = await ensureInboxSettings(ctx.em, ctx.scope)
 
     // Optimistic lock: refuse a stale overwrite when two tabs edit the same inbox
     // settings record. Strictly additive — a no-op without the expected-version header.
@@ -129,7 +104,10 @@ export async function PATCH(req: Request) {
       settings.webhookSecret = parsed.data.webhookSecret ? parsed.data.webhookSecret : null
     }
 
-    await ctx.em.flush()
+    // Flush through `settingsEm` — after a concurrent-bootstrap recovery this
+    // is a clean fork, not `ctx.em`, whose unit of work would otherwise retry
+    // the losing insert.
+    await settingsEm.flush()
 
     const cache = resolveCache(ctx.container)
     await runWithCacheTenant(ctx.tenantId, () => invalidateSettingsCache(cache, ctx.tenantId))
@@ -166,7 +144,6 @@ export const openApi: OpenApiRouteDoc = {
       description: 'Updates working language and/or active status',
       responses: [
         { status: 200, description: 'Updated settings' },
-        { status: 404, description: 'Settings not found' },
       ],
     },
   },

package/src/modules/inbox_ops/backend/inbox-ops/settings/page.tsx

@@ -46,8 +46,8 @@ export default function InboxSettingsPage() {
       try {
         const result = await apiCall<{ settings: { inboxAddress?: string; isActive?: boolean; workingLanguage?: string; updatedAt?: string | null } | null }>('/api/inbox_ops/settings')
         if (!cancelled) {
-          if (result?.ok && result.result?.settings) {
-            setSettings(result.result.settings)
+          if (result?.ok) {
+            setSettings(result.result?.settings ?? null)
           } else {
             setError(t('inbox_ops.settings.load_failed', 'Failed to load settings'))
           }

package/src/modules/inbox_ops/components/proposals/ActionCard.tsx

@@ -31,7 +31,7 @@ export function useDiscrepancyDescriptions(): (description: string, foundValue?:
   const t = useT()
   const translations: Record<string, string> = {
     'inbox_ops.discrepancy.desc.no_channel': t('inbox_ops.discrepancy.desc.no_channel', 'No sales channel available. Create a channel in Sales settings before accepting this order.'),
-    'inbox_ops.discrepancy.desc.no_currency': t('inbox_ops.discrepancy.desc.no_currency', 'No currency could be resolved for this order. Set a currency code or configure a sales channel with a default currency.'),
+    'inbox_ops.discrepancy.desc.no_currency': t('inbox_ops.discrepancy.desc.no_currency', 'No currency could be resolved for this order. Set a currency code on the order.'),
     'inbox_ops.discrepancy.desc.product_not_matched': t('inbox_ops.discrepancy.desc.product_not_matched', 'Product could not be matched to any catalog product'),
     'inbox_ops.discrepancy.desc.no_matching_contact': t('inbox_ops.discrepancy.desc.no_matching_contact', 'No matching contact found'),
     'inbox_ops.discrepancy.desc.draft_reply_no_contact': t('inbox_ops.discrepancy.desc.draft_reply_no_contact', 'Draft reply target has no matching contact. Create the contact first.'),

package/src/modules/inbox_ops/i18n/de.json

@@ -52,7 +52,7 @@
   "inbox_ops.discrepancy.desc.draft_reply_no_contact": "Der Empf\u00e4nger des Antwortentwurfs hat keinen passenden Kontakt. Erstellen Sie zuerst den Kontakt.",
   "inbox_ops.discrepancy.desc.duplicate_order_reference": "Eine Bestellung mit dieser Kundenreferenz existiert bereits",
   "inbox_ops.discrepancy.desc.no_channel": "Kein Vertriebskanal verf\u00fcgbar. Erstellen Sie einen Kanal in den Vertriebseinstellungen, bevor Sie diese Bestellung akzeptieren.",
-  "inbox_ops.discrepancy.desc.no_currency": "F\u00fcr diese Bestellung konnte keine W\u00e4hrung ermittelt werden. Legen Sie einen W\u00e4hrungscode fest oder konfigurieren Sie einen Vertriebskanal mit einer Standardw\u00e4hrung.",
+  "inbox_ops.discrepancy.desc.no_currency": "F\u00fcr diese Bestellung konnte keine W\u00e4hrung ermittelt werden. Legen Sie einen W\u00e4hrungscode f\u00fcr die Bestellung fest.",
   "inbox_ops.discrepancy.desc.no_matching_contact": "Kein passender Kontakt gefunden",
   "inbox_ops.discrepancy.desc.product_not_matched": "Produkt konnte keinem Katalogprodukt zugeordnet werden",
   "inbox_ops.discrepancy.expected": "Erwartet",

package/src/modules/inbox_ops/i18n/en.json

@@ -52,7 +52,7 @@
   "inbox_ops.discrepancy.desc.draft_reply_no_contact": "Draft reply target has no matching contact. Create the contact first.",
   "inbox_ops.discrepancy.desc.duplicate_order_reference": "An order with this customer reference already exists",
   "inbox_ops.discrepancy.desc.no_channel": "No sales channel available. Create a channel in Sales settings before accepting this order.",
-  "inbox_ops.discrepancy.desc.no_currency": "No currency could be resolved for this order. Set a currency code or configure a sales channel with a default currency.",
+  "inbox_ops.discrepancy.desc.no_currency": "No currency could be resolved for this order. Set a currency code on the order.",
   "inbox_ops.discrepancy.desc.no_matching_contact": "No matching contact found",
   "inbox_ops.discrepancy.desc.product_not_matched": "Product could not be matched to any catalog product",
   "inbox_ops.discrepancy.expected": "Expected",

package/src/modules/inbox_ops/i18n/es.json

@@ -52,7 +52,7 @@
   "inbox_ops.discrepancy.desc.draft_reply_no_contact": "El destinatario del borrador no tiene un contacto coincidente. Cree el contacto primero.",
   "inbox_ops.discrepancy.desc.duplicate_order_reference": "Ya existe un pedido con esta referencia de cliente",
   "inbox_ops.discrepancy.desc.no_channel": "No hay canal de ventas disponible. Cree un canal en la configuraci\u00f3n de ventas antes de aceptar este pedido.",
-  "inbox_ops.discrepancy.desc.no_currency": "No se pudo determinar la moneda para este pedido. Establezca un c\u00f3digo de moneda o configure un canal de ventas con una moneda predeterminada.",
+  "inbox_ops.discrepancy.desc.no_currency": "No se pudo determinar la moneda para este pedido. Establezca un c\u00f3digo de moneda para el pedido.",
   "inbox_ops.discrepancy.desc.no_matching_contact": "No se encontr\u00f3 un contacto coincidente",
   "inbox_ops.discrepancy.desc.product_not_matched": "El producto no pudo vincularse a ning\u00fan producto del cat\u00e1logo",
   "inbox_ops.discrepancy.expected": "Esperado",

package/src/modules/inbox_ops/i18n/ko.json

@@ -52,7 +52,7 @@
   "inbox_ops.discrepancy.desc.draft_reply_no_contact": "답장 초안의 대상에 일치하는 연락처가 없습니다. 먼저 연락처를 생성하세요.",
   "inbox_ops.discrepancy.desc.duplicate_order_reference": "이 고객 참조 번호로 등록된 주문이 이미 존재합니다",
   "inbox_ops.discrepancy.desc.no_channel": "사용 가능한 판매 채널이 없습니다. 이 주문을 수락하기 전에 판매 설정에서 채널을 생성하세요.",
-  "inbox_ops.discrepancy.desc.no_currency": "이 주문의 통화를 확인할 수 없습니다. 통화 코드를 설정하거나 기본 통화가 지정된 판매 채널을 구성하세요.",
+  "inbox_ops.discrepancy.desc.no_currency": "이 주문의 통화를 확인할 수 없습니다. 주문에 통화 코드를 설정하세요.",
   "inbox_ops.discrepancy.desc.no_matching_contact": "일치하는 연락처를 찾을 수 없습니다",
   "inbox_ops.discrepancy.desc.product_not_matched": "상품을 카탈로그 상품과 일치시킬 수 없습니다",
   "inbox_ops.discrepancy.expected": "예상",

package/src/modules/inbox_ops/i18n/pl.json

@@ -52,7 +52,7 @@
   "inbox_ops.discrepancy.desc.draft_reply_no_contact": "Odbiorca szkicu odpowiedzi nie ma pasuj\u0105cego kontaktu. Najpierw utw\u00f3rz kontakt.",
   "inbox_ops.discrepancy.desc.duplicate_order_reference": "Zam\u00f3wienie z t\u0105 referencj\u0105 klienta ju\u017c istnieje",
   "inbox_ops.discrepancy.desc.no_channel": "Brak dost\u0119pnego kana\u0142u sprzeda\u017cy. Utw\u00f3rz kana\u0142 w ustawieniach sprzeda\u017cy przed akceptacj\u0105 tego zam\u00f3wienia.",
-  "inbox_ops.discrepancy.desc.no_currency": "Nie mo\u017cna ustali\u0107 waluty dla tego zam\u00f3wienia. Ustaw kod waluty lub skonfiguruj kana\u0142 sprzeda\u017cy z domy\u015bln\u0105 walut\u0105.",
+  "inbox_ops.discrepancy.desc.no_currency": "Nie mo\u017cna ustali\u0107 waluty dla tego zam\u00f3wienia. Ustaw kod waluty dla zam\u00f3wienia.",
   "inbox_ops.discrepancy.desc.no_matching_contact": "Nie znaleziono pasuj\u0105cego kontaktu",
   "inbox_ops.discrepancy.desc.product_not_matched": "Nie uda\u0142o si\u0119 dopasowa\u0107 produktu do katalogu",
   "inbox_ops.discrepancy.expected": "Oczekiwano",

package/src/modules/inbox_ops/lib/ensure-settings.ts

@@ -0,0 +1,77 @@
+import { UniqueConstraintViolationException } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { InboxSettings } from '../data/entities'
+
+export interface EnsureInboxSettingsScope {
+  tenantId: string
+  organizationId: string
+}
+
+export interface EnsureInboxSettingsResult {
+  // The manager the returned `settings` row is actually managed by — a
+  // concurrent-bootstrap recovery returns a clean fork, never the manager
+  // whose insert just failed, so callers must flush further writes through
+  // this manager rather than the one they passed in.
+  em: EntityManager
+  settings: InboxSettings
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  if (error instanceof UniqueConstraintViolationException) return true
+  if (!error || typeof error !== 'object') return false
+  if ((error as { code?: string }).code === '23505') return true
+  const message = (error as { message?: string }).message
+  return typeof message === 'string' && message.includes('duplicate key')
+}
+
+async function findExisting(em: EntityManager, scope: EnsureInboxSettingsScope) {
+  return findOneWithDecryption(
+    em,
+    InboxSettings,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },
+    undefined,
+    scope,
+  )
+}
+
+// Lazily bootstraps the tenant's InboxSettings row when missing — e.g. a
+// tenant provisioned before this module existed and never ran setup.ts's
+// onTenantCreated hook. Idempotent: a second call finds the row just created.
+export async function ensureInboxSettings(
+  em: EntityManager,
+  scope: EnsureInboxSettingsScope,
+): Promise<EnsureInboxSettingsResult> {
+  const existing = await findExisting(em, scope)
+  if (existing) return { em, settings: existing }
+
+  const domain = process.env.INBOX_OPS_DOMAIN || 'inbox.mercato.local'
+  const slug = scope.organizationId.slice(0, 8)
+  const inboxAddress = `ops-${slug}@${domain}`
+  const settings = em.create(InboxSettings, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    inboxAddress,
+    isActive: true,
+  })
+  em.persist(settings)
+
+  try {
+    await em.flush()
+  } catch (error) {
+    // Two concurrent bootstraps (e.g. two tabs) race to insert the same
+    // deterministic inboxAddress; the loser refetches the winner's row
+    // instead of surfacing a raw unique-constraint error to the caller.
+    // Recover on a clean fork: `em`'s unit of work still owns the
+    // half-persisted `settings` entity scheduled for the failed insert, so
+    // flushing `em` again later (e.g. after a caller-side PATCH mutation)
+    // would retry that same rejected insert.
+    if (!isUniqueViolation(error)) throw error
+    const recoveryEm = em.fork()
+    const winner = await findExisting(recoveryEm, scope)
+    if (!winner) throw error
+    return { em: recoveryEm, settings: winner }
+  }
+
+  return { em, settings }
+}

package/src/modules/inbox_ops/lib/executionEngine.ts

@@ -27,7 +27,7 @@ export interface CrossModuleEntities {
   CustomerEntity: EntityClass<CommonEntityFields & { id: string; kind: string; displayName: string; primaryEmail?: string | null }>
   SalesOrder: EntityClass<CommonEntityFields & { id: string; orderNumber: string; currencyCode: string; comments?: string | null; customerReference?: string | null }>
   SalesShipment: EntityClass<CommonEntityFields & { id: string; order: unknown }>
-  SalesChannel: EntityClass<CommonEntityFields & { id: string; name: string; currencyCode?: string; metadata?: Record<string, unknown> | null }>
+  SalesChannel: EntityClass<CommonEntityFields & { id: string; name: string; metadata?: Record<string, unknown> | null }>
   Dictionary: EntityClass<CommonEntityFields & { id: string; key: string }>
   DictionaryEntry: EntityClass<CommonEntityFields & { id: string; label: string; value: string; normalizedValue?: string | null; dictionary: unknown }>
 }

package/src/modules/inbox_ops/lib/executionHelpers.ts

@@ -246,33 +246,6 @@ export async function resolveFirstChannelId(ctx: ExecutionHelperContext): Promis
   }
 }
 
-export async function resolveChannelCurrency(
-  ctx: ExecutionHelperContext,
-  channelId: string | null,
-): Promise<string | null> {
-  const SalesChannelClass = resolveEntityClass(ctx, 'SalesChannel')
-  if (!SalesChannelClass) return null
-
-  try {
-    const where: Record<string, unknown> = {
-      tenantId: ctx.tenantId,
-      organizationId: ctx.organizationId,
-      deletedAt: null,
-    }
-    if (channelId) where.id = channelId
-    const channel = await findOneWithDecryption(
-      ctx.em,
-      SalesChannelClass,
-      where,
-      channelId ? undefined : { orderBy: { name: 'ASC' } },
-      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },
-    )
-    return channel?.currencyCode ?? null
-  } catch {
-    return null
-  }
-}
-
 export async function resolveEffectiveDocumentKind(
   ctx: ExecutionHelperContext,
   channelId: string,

package/src/modules/inbox_ops/lib/payloadEnrichment.ts

@@ -17,7 +17,6 @@ interface CatalogProduct {
 interface SalesChannelLike {
   id: string
   name: string
-  currencyCode?: string
   tenantId?: string
   organizationId?: string
   deletedAt?: Date | null
@@ -54,7 +53,7 @@ export async function enrichOrderPayload(
   const enriched = { ...payload }
   const warnings: string[] = []
 
-  // 1. Resolve channelId if missing, and resolve currencyCode from channel
+  // 1. Resolve channelId if missing
   if (ctx.salesChannelClass) {
     try {
       const channelWhere: Record<string, unknown> = {
@@ -74,9 +73,6 @@ export async function enrichOrderPayload(
       )
       if (channel) {
         if (!enriched.channelId) enriched.channelId = channel.id
-        if (!enriched.currencyCode && channel.currencyCode) {
-          enriched.currencyCode = channel.currencyCode
-        }
       } else {
         warnings.push('no_channel_resolved')
       }

package/src/modules/inbox_ops/setup.ts

@@ -1,6 +1,5 @@
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { InboxSettings } from './data/entities'
+import { ensureInboxSettings } from './lib/ensure-settings'
 
 export const setup: ModuleSetupConfig = {
   defaultRoleFeatures: {
@@ -20,25 +19,7 @@ export const setup: ModuleSetupConfig = {
   },
 
   async onTenantCreated({ em, tenantId, organizationId }) {
-    const exists = await findOneWithDecryption(
-      em,
-      InboxSettings,
-      { tenantId, organizationId, deletedAt: null },
-      undefined,
-      { tenantId, organizationId },
-    )
-    if (!exists) {
-      const domain = process.env.INBOX_OPS_DOMAIN || 'inbox.mercato.local'
-      const slug = organizationId.slice(0, 8)
-      const inboxAddress = `ops-${slug}@${domain}`
-      em.persist(em.create(InboxSettings, {
-        tenantId,
-        organizationId,
-        inboxAddress,
-        isActive: true,
-      }))
-    }
-    await em.flush()
+    await ensureInboxSettings(em, { tenantId, organizationId })
   },
 
   async seedDefaults() {},

package/src/modules/inbox_ops/subscribers/extractionWorker.ts

@@ -48,7 +48,7 @@ interface ExtractionEntityClasses {
   catalogProduct?: EntityClass<{ id: string; name: string; sku?: string | null; tenantId?: string; organizationId?: string; deletedAt?: Date | null }>
   catalogProductPrice?: EntityClass<{ product?: unknown; unitPriceNet?: string | null; unitPriceGross?: string | null; currencyCode?: string | null; tenantId?: string; organizationId?: string; deletedAt?: Date | null; createdAt?: Date }>
   salesOrder?: EntityClass<{ id: string; orderNumber: string; customerReference?: string | null; tenantId?: string; organizationId?: string; deletedAt?: Date | null }>
-  salesChannel?: EntityClass<{ id: string; name: string; currencyCode?: string; tenantId?: string; organizationId?: string; deletedAt?: Date | null }>
+  salesChannel?: EntityClass<{ id: string; name: string; tenantId?: string; organizationId?: string; deletedAt?: Date | null }>
   customerAddress?: EntityClass<{ id: string; isPrimary: boolean; tenantId?: string; organizationId?: string; entity?: { id: string } | string; createdAt?: Date }>
 }
 

package/src/modules/sales/components/documents/SalesDocumentForm.tsx

@@ -57,6 +57,8 @@ import {
   type AddressValue,
 } from '@open-mercato/core/modules/customers/utils/addressFormat'
 import { AddressEditor, type AddressEditorDraft } from '@open-mercato/core/modules/customers/components/AddressEditor'
+import { extensionPoints as customersExtensionPoints } from '@open-mercato/core/modules/customers/extension-points'
+import { crudFormExtensionSpotId } from '@open-mercato/shared/modules/widgets/extension-points'
 import { useSalesChannelsEnabled } from '../useSalesChannelsEnabled'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { SalesOrderDraftLines, createSalesOrderLineDraft, type SalesOrderLineDraft } from './SalesOrderDraftLines'
@@ -64,6 +66,13 @@ import { normalizeAddressDraft } from './normalizeAddressDraft'
 
 const logger = createLogger('sales')
 
+// Before this change, `CrudForm` auto-derived its injection spot id from
+// `entityIds[0]` (`E.customers.customer_entity`), which resolves to this id.
+// Declaring `injectionSpotId` below on the two quick-create dialogs replaces
+// that auto-derived id with the customers module's declared host — bridge the
+// legacy one for one minor version per BACKWARD_COMPATIBILITY.md §6.
+const CUSTOMER_QUICK_CREATE_LEGACY_INJECTION_SPOT_ID = crudFormExtensionSpotId('customers.customer_entity')
+
 type DocumentKind = 'quote' | 'order'
 
 type AddressDraft = AddressEditorDraft
@@ -370,6 +379,8 @@ function CustomerQuickCreate({ t, onCreated }: CustomerQuickCreateProps) {
                 submitLabel={t('common.save', 'Save')}
                 cancelHref={undefined}
                 onSubmit={(values) => handlePersonCreate(values)}
+                injectionSpotId={customersExtensionPoints.hosts.personForm.spotId}
+                legacyInjectionSpotId={CUSTOMER_QUICK_CREATE_LEGACY_INJECTION_SPOT_ID}
                 entityIds={[E.customers.customer_entity, E.customers.customer_person_profile]}
               />
             </div>
@@ -404,6 +415,8 @@ function CustomerQuickCreate({ t, onCreated }: CustomerQuickCreateProps) {
                 submitLabel={t('common.save', 'Save')}
                 cancelHref={undefined}
                 onSubmit={(values) => handleCompanyCreate(values)}
+                injectionSpotId={customersExtensionPoints.hosts.companyForm.spotId}
+                legacyInjectionSpotId={CUSTOMER_QUICK_CREATE_LEGACY_INJECTION_SPOT_ID}
                 entityIds={[E.customers.customer_entity, E.customers.customer_company_profile]}
               />
             </div>

package/src/modules/sales/data/entities.ts

@@ -1759,6 +1759,8 @@ export class SalesPayment {
 
 @Entity({ tableName: 'sales_payment_allocations' })
 @Index({ name: 'sales_payment_allocations_scope_idx', properties: ['payment', 'organizationId', 'tenantId'] })
+@Index({ name: 'sales_payment_allocations_order_idx', properties: ['order'] })
+@Index({ name: 'sales_payment_allocations_invoice_idx', properties: ['invoice'] })
 export class SalesPaymentAllocation {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string

package/src/modules/sales/inbox-actions.ts

@@ -8,7 +8,6 @@ import {
   buildSourceMetadata,
   resolveOrderByReference,
   resolveFirstChannelId,
-  resolveChannelCurrency,
   resolveEffectiveDocumentKind,
   resolveShipmentStatusEntryId,
   resolveCustomerEntityIdByEmail,
@@ -288,23 +287,6 @@ async function executeUpdateShipmentAction(
   return { createdEntityId: shipment.id, createdEntityType: 'sales_shipment' }
 }
 
-// ---------------------------------------------------------------------------
-// Normalization helper for order/quote payloads
-// ---------------------------------------------------------------------------
-
-async function normalizeOrderPayload(
-  payload: Record<string, unknown>,
-  ctx: InboxActionExecutionContext,
-): Promise<Record<string, unknown>> {
-  if (!payload.currencyCode) {
-    const hCtx = asHelperContext(ctx)
-    const channelId = typeof payload.channelId === 'string' ? payload.channelId : null
-    const resolved = await resolveChannelCurrency(hCtx, channelId)
-    if (resolved) payload.currencyCode = resolved
-  }
-  return payload
-}
-
 // ---------------------------------------------------------------------------
 // Exported action definitions
 // ---------------------------------------------------------------------------
@@ -323,7 +305,6 @@ export const inboxActions: InboxActionDefinition[] = [
       'For create_order / create_quote: each line item MUST have "productName" (the product name goes here, NOT in "description"). Include currencyCode and customerName.',
       'For create_order / create_quote: extract shippingAddress and billingAddress as structured objects when addresses are mentioned. Parse street, city, postal code, country from the text. Do NOT put address data in notes.',
     ],
-    normalizePayload: normalizeOrderPayload,
     execute: (action, ctx) => executeCreateDocumentAction(action, ctx, 'order'),
   },
   {
@@ -332,7 +313,6 @@ export const inboxActions: InboxActionDefinition[] = [
     payloadSchema: orderPayloadSchema,
     label: 'Create Quote',
     promptSchema: '(shared with create_order)',
-    normalizePayload: normalizeOrderPayload,
     execute: (action, ctx) => executeCreateDocumentAction(action, ctx, 'quote'),
   },
   {

package/src/modules/sales/migrations/.snapshot-open-mercato.json

@@ -6232,6 +6232,26 @@
           "keyName": "sales_payment_allocations_scope_idx",
           "primary": false,
           "unique": false
+        },
+        {
+          "columnNames": [
+            "order_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "keyName": "sales_payment_allocations_order_idx",
+          "primary": false,
+          "unique": false
+        },
+        {
+          "columnNames": [
+            "invoice_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "keyName": "sales_payment_allocations_invoice_idx",
+          "primary": false,
+          "unique": false
         }
       ],
       "checks": [],