@open-mercato/core 0.8.1-develop.7275.1.f772b944d4 → 0.8.1-develop.7295.1.d0e0e33014

package/src/modules/data_sync/i18n/ko.json

@@ -31,6 +31,8 @@
   "data_sync.dashboard.schedule.interval": "간격",
   "data_sync.dashboard.schedule.intervalHelp": "예: 반복 간격으로 `1h`, `6h`, `24h`를 사용하세요.",
   "data_sync.dashboard.schedule.intervalValue": "간격",
+  "data_sync.dashboard.schedule.invalidCron": "스케줄러가 해석할 수 있는 cron 표현식을 입력하세요. 예: `0 * * * *`.",
+  "data_sync.dashboard.schedule.invalidInterval": "`15m`, `1h`, `24h`처럼 정수 뒤에 s, m, h 또는 d를 붙여 1분 이상으로 입력하세요.",
   "data_sync.dashboard.schedule.invalidValue": "저장하기 전에 일정 값을 입력하세요.",
   "data_sync.dashboard.schedule.lastRun": "마지막 예약 실행: {value}",
   "data_sync.dashboard.schedule.neverRun": "저장되었지만 아직 완료된 예약 실행이 없습니다.",

package/src/modules/data_sync/i18n/pl.json

@@ -31,6 +31,8 @@
   "data_sync.dashboard.schedule.interval": "Interwał",
   "data_sync.dashboard.schedule.intervalHelp": "Przykład: `1h`, `6h` lub `24h` dla powtarzalnych interwałów.",
   "data_sync.dashboard.schedule.intervalValue": "Interwał",
+  "data_sync.dashboard.schedule.invalidCron": "Podaj wyrażenie cron, które scheduler potrafi przetworzyć, na przykład `0 * * * *`.",
+  "data_sync.dashboard.schedule.invalidInterval": "Podaj liczbę całkowitą z jednostką s, m, h lub d (na przykład `15m`, `1h` lub `24h`), o długości co najmniej jednej minuty.",
   "data_sync.dashboard.schedule.invalidValue": "Podaj wartość harmonogramu przed zapisaniem.",
   "data_sync.dashboard.schedule.lastRun": "Ostatni zaplanowany przebieg: {value}",
   "data_sync.dashboard.schedule.neverRun": "Zapisano, ale żadne zaplanowane wykonanie jeszcze się nie zakończyło.",

package/src/modules/data_sync/lib/schedule-value.ts

@@ -0,0 +1,45 @@
+import type { ScheduleValueKind } from '@open-mercato/shared/lib/schedule/invalidScheduleValue'
+
+export const SCHEDULE_VALUE_FIELD = 'scheduleValue'
+
+export const SCHEDULE_VALUE_FORMAT_MESSAGES: Record<ScheduleValueKind, string> = {
+  interval: 'Interval must be a whole number followed by s, m, h or d (for example 15m, 1h or 24h) and cover at least one minute.',
+  cron: 'Cron expression could not be parsed. Use the five-field format, for example "0 * * * *".',
+}
+
+export type ScheduleValueErrorBody = {
+  error: string
+  details: {
+    formErrors: string[]
+    fieldErrors: Record<string, string[]>
+  }
+}
+
+/**
+ * Mirrors zod's `flatten()` shape so a scheduler-reported format failure and a
+ * schema-reported one reach the client as the same structured field error
+ * instead of an internal scheduler message.
+ */
+export function buildScheduleValueErrorBody(scheduleType: ScheduleValueKind): ScheduleValueErrorBody {
+  return {
+    error: 'Invalid payload',
+    details: {
+      formErrors: [],
+      fieldErrors: { [SCHEDULE_VALUE_FIELD]: [SCHEDULE_VALUE_FORMAT_MESSAGES[scheduleType]] },
+    },
+  }
+}
+
+/**
+ * Lets a form render its own translated hint next to the field instead of
+ * flashing the API's English message as a toast.
+ */
+export function hasScheduleValueFieldError(payload: unknown): boolean {
+  if (typeof payload !== 'object' || payload === null) return false
+  const details = (payload as { details?: unknown }).details
+  if (typeof details !== 'object' || details === null) return false
+  const fieldErrors = (details as { fieldErrors?: unknown }).fieldErrors
+  if (typeof fieldErrors !== 'object' || fieldErrors === null) return false
+  const messages = (fieldErrors as Record<string, unknown>)[SCHEDULE_VALUE_FIELD]
+  return Array.isArray(messages) && messages.length > 0
+}

package/src/modules/eudr/data/validators.ts

@@ -127,10 +127,9 @@ const pastOrNowIsoDateTimeSchema = () => isoDateTimeSchema().refine((value) => v
 const isoDateOrDateTimeSchema = () => z.union([isoDateSchema(), isoDateTimeSchema()])
 
 // Country codes are validated through ICU rather than the shared country helper.
-// That helper imports language-subtag-registry's JSON, and the build strips the
-// import attribute Node's ESM loader requires, so importing it from server-side
-// code (CLI, workers) fails with ERR_IMPORT_ATTRIBUTE_MISSING. UI components can
-// keep using the helper because bundlers resolve the JSON themselves.
+// ICU keeps this schema self-contained (no dependency on the generated country
+// list) and accepts any region code Node's DisplayNames can resolve, including
+// codes the shared helper supplements separately (e.g. XK).
 const countryDisplayNames = typeof Intl !== 'undefined' && typeof Intl.DisplayNames !== 'undefined'
   ? new Intl.DisplayNames(['en'], { type: 'region' })
   : null

package/src/modules/portal/frontend/[orgSlug]/portal/dashboard/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 import React, { useEffect, useMemo, useState, useCallback } from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/portal/extension-points'
-import { useRouter } from 'next/navigation'
+import { replaceWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
@@ -29,7 +29,6 @@ function WidgetIcon({ className }: { className?: string }) {
 
 export default function PortalDashboardPage({ params }: Props) {
   const t = useT()
-  const router = useRouter()
   const { auth } = usePortalContext()
   const { user, loading } = auth
 
@@ -47,11 +46,13 @@ export default function PortalDashboardPage({ params }: Props) {
     setHiddenWidgets(user ? loadHiddenWidgets(params.orgSlug, user.id) : new Set())
   }
 
+  // Leaving an authenticated page for the login page crosses the public/authenticated
+  // boundary, so it must be a full page load — see `replaceWithPageReload`.
   useEffect(() => {
     if (!loading && !user) {
-      router.replace(`/${params.orgSlug}/portal/login`)
+      replaceWithPageReload(`/${params.orgSlug}/portal/login`)
     }
-  }, [loading, user, router, params.orgSlug])
+  }, [loading, user, params.orgSlug])
 
   useEffect(() => {
     clearLegacyHiddenWidgetsKey()

package/src/modules/portal/frontend/[orgSlug]/portal/invite/page.tsx

@@ -79,7 +79,9 @@ export default function PortalInvitePage({ params }: Props) {
           return
         }
 
-        if (result.status === 400) {
+        if (result.status === 409) {
+          setError(t('portal.invite.error.accountExists', 'This email address already has a portal account. Sign in below instead of accepting the invitation.'))
+        } else if (result.status === 400) {
           setError(t('portal.invite.error.invalidToken', 'Invalid or expired invitation.'))
         } else {
           setError(result.result?.error || t('portal.invite.error.generic', 'Invitation acceptance failed. Please try again.'))

package/src/modules/portal/frontend/[orgSlug]/portal/login/page.tsx

@@ -12,6 +12,7 @@ import { EmptyState } from '@open-mercato/ui/primitives/empty-state'
 import { SearchX } from 'lucide-react'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { navigateWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
 import { usePortalContext } from '@open-mercato/ui/portal/PortalContext'
 import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
 
@@ -47,7 +48,7 @@ export default function PortalLoginPage({ params }: Props) {
         })
 
         if (result.ok && result.result?.ok) {
-          window.location.assign(`/${orgSlug}/portal/dashboard`)
+          navigateWithPageReload(`/${orgSlug}/portal/dashboard`)
           return
         }
 

package/src/modules/portal/frontend/[orgSlug]/portal/page.tsx

@@ -2,7 +2,7 @@
 import { useEffect, useMemo } from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/portal/extension-points'
 import Link from 'next/link'
-import { useRouter } from 'next/navigation'
+import { replaceWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
@@ -16,16 +16,16 @@ type Props = { params: { orgSlug: string } }
 
 export default function PortalLandingPage({ params }: Props) {
   const t = useT()
-  const router = useRouter()
   const orgSlug = params.orgSlug
   const { auth, tenant } = usePortalContext()
 
-  // Redirect authenticated users to dashboard
+  // Redirect authenticated users to dashboard. This crosses the public/authenticated
+  // boundary, so it must be a full page load — see `replaceWithPageReload`.
   useEffect(() => {
     if (!auth.loading && auth.user) {
-      router.replace(`/${orgSlug}/portal/dashboard`)
+      replaceWithPageReload(`/${orgSlug}/portal/dashboard`)
     }
-  }, [auth.loading, auth.user, router, orgSlug])
+  }, [auth.loading, auth.user, orgSlug])
 
   const injectionContext = useMemo(
     () => ({ orgSlug }),

package/src/modules/portal/frontend/[orgSlug]/portal/profile/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 import { useEffect, useMemo } from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/portal/extension-points'
-import { useRouter } from 'next/navigation'
+import { replaceWithPageReload } from '@open-mercato/core/modules/portal/lib/navigation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Badge } from '@open-mercato/ui/primitives/badge'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
@@ -14,15 +14,16 @@ type Props = { params: { orgSlug: string } }
 
 export default function PortalProfilePage({ params }: Props) {
   const t = useT()
-  const router = useRouter()
   const { auth } = usePortalContext()
   const { user, roles, resolvedFeatures, isPortalAdmin, loading } = auth
 
+  // Leaving an authenticated page for the login page crosses the public/authenticated
+  // boundary, so it must be a full page load — see `replaceWithPageReload`.
   useEffect(() => {
     if (!loading && !user) {
-      router.replace(`/${params.orgSlug}/portal/login`)
+      replaceWithPageReload(`/${params.orgSlug}/portal/login`)
     }
-  }, [loading, user, router, params.orgSlug])
+  }, [loading, user, params.orgSlug])
 
   const injectionContext = useMemo(
     () => ({ orgSlug: params.orgSlug, user, roles, resolvedFeatures, isPortalAdmin }),

package/src/modules/portal/i18n/de.json

@@ -27,6 +27,7 @@
   "portal.invite.confirmPassword.placeholder": "••••••••",
   "portal.invite.description": "Erstellen Sie Ihr Portalkonto, um diese Einladung anzunehmen.",
   "portal.invite.displayName": "Anzeigename",
+  "portal.invite.error.accountExists": "Diese E-Mail-Adresse hat bereits ein Portalkonto. Melden Sie sich unten an, anstatt die Einladung anzunehmen.",
   "portal.invite.error.displayNameRequired": "Der Anzeigename ist erforderlich.",
   "portal.invite.error.generic": "Annahme der Einladung fehlgeschlagen. Bitte versuchen Sie es erneut.",
   "portal.invite.error.invalidToken": "Ungültige oder abgelaufene Einladung.",

package/src/modules/portal/i18n/en.json

@@ -27,6 +27,7 @@
   "portal.invite.confirmPassword.placeholder": "••••••••",
   "portal.invite.description": "Create your portal account to accept this invitation.",
   "portal.invite.displayName": "Display Name",
+  "portal.invite.error.accountExists": "This email address already has a portal account. Sign in below instead of accepting the invitation.",
   "portal.invite.error.displayNameRequired": "Display name is required.",
   "portal.invite.error.generic": "Invitation acceptance failed. Please try again.",
   "portal.invite.error.invalidToken": "Invalid or expired invitation.",

package/src/modules/portal/i18n/es.json

@@ -27,6 +27,7 @@
   "portal.invite.confirmPassword.placeholder": "••••••••",
   "portal.invite.description": "Crea tu cuenta del portal para aceptar esta invitación.",
   "portal.invite.displayName": "Nombre para mostrar",
+  "portal.invite.error.accountExists": "Esta dirección de correo electrónico ya tiene una cuenta del portal. Inicia sesión abajo en lugar de aceptar la invitación.",
   "portal.invite.error.displayNameRequired": "El nombre para mostrar es obligatorio.",
   "portal.invite.error.generic": "Error al aceptar la invitación. Inténtalo de nuevo.",
   "portal.invite.error.invalidToken": "Invitación no válida o expirada.",

package/src/modules/portal/i18n/ko.json

@@ -27,6 +27,7 @@
   "portal.invite.confirmPassword.placeholder": "••••••••",
   "portal.invite.description": "이 초대를 수락하려면 포털 계정을 만드세요.",
   "portal.invite.displayName": "표시 이름",
+  "portal.invite.error.accountExists": "이 이메일 주소에는 이미 포털 계정이 있습니다. 초대를 수락하는 대신 아래에서 로그인하세요.",
   "portal.invite.error.displayNameRequired": "표시 이름이 필요합니다.",
   "portal.invite.error.generic": "초대 수락에 실패했습니다. 다시 시도해 주세요.",
   "portal.invite.error.invalidToken": "초대가 유효하지 않거나 만료되었습니다.",

package/src/modules/portal/i18n/pl.json

@@ -27,6 +27,7 @@
   "portal.invite.confirmPassword.placeholder": "••••••••",
   "portal.invite.description": "Utwórz konto w portalu, aby przyjąć to zaproszenie.",
   "portal.invite.displayName": "Nazwa wyświetlana",
+  "portal.invite.error.accountExists": "Ten adres e-mail ma już konto w portalu. Zaloguj się poniżej zamiast przyjmować zaproszenie.",
   "portal.invite.error.displayNameRequired": "Nazwa wyświetlana jest wymagana.",
   "portal.invite.error.generic": "Nie udało się przyjąć zaproszenia. Spróbuj ponownie.",
   "portal.invite.error.invalidToken": "Nieprawidłowe lub wygasłe zaproszenie.",

package/src/modules/portal/lib/navigation.ts

@@ -1,3 +1,8 @@
-export function navigateWithPageReload(path: string): void {
-  window.location.assign(path)
-}
+/**
+ * Portal-local import path for the boundary-crossing navigation helpers.
+ *
+ * The implementation lives in `@open-mercato/shared/lib/navigation/pageReload` so `@open-mercato/ui`
+ * — which does not depend on `@open-mercato/core` — can reach it from the portal shell and hooks.
+ * This re-export keeps the published import path stable for existing callers.
+ */
+export { navigateWithPageReload, replaceWithPageReload } from '@open-mercato/shared/lib/navigation/pageReload'

package/src/modules/query_index/lib/engine.ts

@@ -10,6 +10,14 @@ import { readCoverageSnapshot, refreshCoverageSnapshot } from './coverage'
 import { createProfiler, shouldEnableProfiler, type Profiler } from '@open-mercato/shared/lib/profiler'
 import type { VectorIndexService } from '@open-mercato/search/vector'
 import { decryptIndexDocCustomFields } from '@open-mercato/shared/lib/encryption/indexDoc'
+import {
+  buildCustomFieldKindIndex,
+  createCustomFieldKindMapResolver,
+  emptyCustomFieldKindIndex,
+  mergeCustomFieldKindIndexes,
+  type CustomFieldKindIndex,
+  type CustomFieldKindMapResolver,
+} from '@open-mercato/shared/lib/custom-fields/kinds'
 import { parseBooleanToken, parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
 import {
   applyJoinFilters,
@@ -31,10 +39,12 @@ import {
   type SearchTokenProbeQueryBuilder,
 } from '@open-mercato/shared/lib/search/availability'
 import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
+import { buildContainmentPatterns } from '@open-mercato/shared/lib/search/containment'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from '@open-mercato/shared/lib/query/query-extension-runner'
 import { warnOnCiphertextLikeFallback } from '@open-mercato/shared/lib/query/ciphertext-search-warning'
 import { resolveEncryptedSortFields, resolveEncryptedSortMaxRows, sortRowsInMemory } from '@open-mercato/shared/lib/query/encrypted-sort'
 import { resolveListCountCap } from '@open-mercato/shared/lib/query/count-cap'
+import { resolveCfDefIndexOrgCandidates } from '@open-mercato/shared/lib/crud/custom-field-definition-index'
 import { mapWithConcurrency } from '@open-mercato/shared/lib/query/bounded-decrypt'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { parseNumberWithDefault } from '@open-mercato/shared/lib/number'
@@ -42,11 +52,30 @@ import { createBoundedTtlMemo } from '@open-mercato/shared/lib/query/bounded-ttl
 
 const logger = createLogger('query_index').child({ component: 'engine' })
 
+/**
+ * Plain-row shape of the `custom_field_defs` columns the key and kind lookups read. The
+ * scope columns are load-bearing: a key can carry an organization-specific definition that
+ * overrides the tenant-wide or global one with a different `kind`, so the winner can only be
+ * picked once the row being decrypted is known.
+ */
+type CustomFieldDefRow = {
+  entityId: string
+  key: string
+  kind: unknown
+  organizationId: string | null
+  tenantId: string | null
+  configJson: unknown
+  updatedAt: unknown
+}
+
 /** Operators `buildCfFilterExpression` compiles; anything else yields no predicate. */
 const CF_FILTER_SUPPORTED_OPS = new Set<FilterOp>([
   'eq', 'ne', 'in', 'nin', 'like', 'ilike', 'exists', 'gt', 'gte', 'lt', 'lte',
 ])
 
+/** Custom field kinds stored numerically (`custom_field_values.value_int`/`value_float`) — sort numerically, not as text (#5674). */
+const NUMERIC_CF_SORT_KINDS = new Set(['integer', 'float'])
+
 const DECRYPT_CONCURRENCY = 8
 const AUTO_REINDEX_DEBOUNCE_DEFAULT_MS = 30_000
 const AUTO_REINDEX_DEBOUNCE_MAX_SCOPES = 10_000
@@ -219,8 +248,9 @@ function createQueryProfiler(entity: string): Profiler {
 
 export class HybridQueryEngine implements QueryEngine {
   private coverageStatsTtlMs: number
-  private customFieldKeysCache = new Map<string, { expiresAt: number; value: string[] }>()
+  private customFieldDefsCache = new Map<string, { expiresAt: number; value: CustomFieldDefRow[] }>()
   private customFieldKeysTtlMs: number
+  private customFieldKindCache = new Map<string, { expiresAt: number; value: Map<string, string> }>()
   private columnCache = new Map<string, boolean>()
   private customEntityCache = new Map<string, boolean>()
   private debugVerbosity: boolean | null = null
@@ -544,6 +574,8 @@ export class HybridQueryEngine implements QueryEngine {
         searchConfig.useIlikeForNonEncryptedFields === true &&
         sourceSearchFilters.some((filter) => !String(filter.field).startsWith('cf:'))
       ) {
+        // Gated on OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS (default false per #5383; set it
+        // to true to opt into the #5803 fix ahead of that follow-up).
         // `ignoreRuntimeHealth` asks the on-disk question -- a column holds ciphertext even while
         // the KMS is down -- so an outage keeps encrypted columns on the token path (#4622).
         // `organizationId: null` is deliberate, not an omission: the service then unions in every
@@ -757,6 +789,18 @@ export class HybridQueryEngine implements QueryEngine {
       )
       const requiresPlaintextSort = encryptedSortFields.size > 0
 
+      const cfSortKeys = Array.from(new Set(
+        resolvedSorts.filter((sort) => sort.field.startsWith('cf:')).map((sort) => sort.field.slice(3))
+      ))
+      const cfSortKinds = cfSortKeys.length
+        ? await this.resolveCustomFieldSortKinds(
+            indexSources.map((source) => String(source.entityId)),
+            opts.tenantId ?? null,
+            resolveCfDefIndexOrgCandidates(opts.organizationIds, fallbackOrgId),
+            cfSortKeys,
+          )
+        : new Map<string, string>()
+
       // ────────────────────────────────────────────────────────────────
       // Build a reusable "applyQueryShape" function that applies every
       // WHERE/JOIN/scope to a fresh SelectQueryBuilder. We use this in
@@ -1164,7 +1208,22 @@ export class HybridQueryEngine implements QueryEngine {
             const textExpr = this.buildCfTextExprSql(fieldName, indexSources)
             if (textExpr) {
               const direction = sql.raw(coerceSortDirection(s.dir))
-              next = next.orderBy(sql`${textExpr} ${direction}`)
+              const kind = cfSortKinds.get(fieldName.slice(3))
+              let sortExpr: RawBuilder<unknown> = textExpr
+              if (kind && NUMERIC_CF_SORT_KINDS.has(kind)) {
+                const jsonExpr = this.buildCfJsonExprSql(fieldName, indexSources)
+                // The index doc does not guarantee a numeric scalar for a
+                // numeric-kind field (ciphertext on an encrypted field, a JSON
+                // array from a multi-value/duplicated-row source, or a stale
+                // value from before the kind changed) — casting unconditionally
+                // turns one bad row into a 500 for the whole list. Only cast
+                // when the doc value is actually a JSON number; anything else
+                // sorts as NULL, same as an unset field (#5674 review).
+                sortExpr = jsonExpr
+                  ? sql`CASE WHEN jsonb_typeof(${jsonExpr}) = 'number' THEN (${textExpr})::numeric END`
+                  : textExpr
+              }
+              next = next.orderBy(sql`${sortExpr} ${direction} NULLS LAST`)
             }
           } else {
             const baseField = resolveBaseColumn(fieldName)
@@ -1172,6 +1231,10 @@ export class HybridQueryEngine implements QueryEngine {
             next = next.orderBy(qualify(baseField), s.dir ?? SortDir.Asc)
           }
         }
+        const lastSortField = resolvedSorts.length ? String(resolvedSorts[resolvedSorts.length - 1].field) : null
+        if (resolvedSorts.length && lastSortField !== 'id') {
+          next = next.orderBy(qualify('id'), SortDir.Asc)
+        }
         return next
       }
 
@@ -1217,6 +1280,20 @@ export class HybridQueryEngine implements QueryEngine {
       const listCountCapWarning: ListCountCapWarning | undefined = counted.warning
 
       const dekKeyCache = new Map<string | null, string | null>()
+      // Resolved lazily and only once per query, then memoized per scope: rows of one
+      // organization share a kind map. `resolveCustomFieldKinds()` still runs for every
+      // row once encryption is active, but the underlying `custom_field_defs` lookup is
+      // TTL-cached, so a warm cache adds no extra query.
+      let customFieldKinds: Promise<CustomFieldKindMapResolver> | null = null
+      const resolveCustomFieldKinds = (): Promise<CustomFieldKindMapResolver> => {
+        if (!customFieldKinds) {
+          customFieldKinds = this.resolveCustomFieldKindIndex(
+            Array.from(new Set(indexSources.map((src) => String(src.entityId)))),
+            opts.tenantId ?? null,
+          ).then((index) => createCustomFieldKindMapResolver(index))
+        }
+        return customFieldKinds
+      }
 
       const decryptRow = async (item: Record<string, unknown>): Promise<Record<string, unknown>> => {
         let next = item
@@ -1237,13 +1314,16 @@ export class HybridQueryEngine implements QueryEngine {
         }
         if (encSvc) {
           try {
+            // The kind is resolved against the very scope the value is decrypted with, so an
+            // organization-specific definition can never type another organization's value.
+            const cfScope = {
+              tenantId: (next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null) as string | null,
+              organizationId: (next?.organization_id ?? next?.organizationId ?? fallbackOrgId ?? null) as string | null,
+            }
+            const resolveKinds = await resolveCustomFieldKinds()
             next = await decryptIndexDocCustomFields(
-              next,
-              {
-                tenantId: (next?.tenant_id ?? next?.tenantId ?? opts.tenantId ?? null) as string | null,
-                organizationId: (next?.organization_id ?? next?.organizationId ?? null) as string | null,
-              },
-              encSvc as any, dekKeyCache,
+              next, cfScope, encSvc as any, dekKeyCache,
+              resolveKinds(cfScope.organizationId, cfScope.tenantId),
             )
           } catch { /* keep next as-is */ }
         }
@@ -1954,6 +2034,20 @@ export class HybridQueryEngine implements QueryEngine {
         ? sql<boolean>`false`
         : sql<boolean>`true`
     }
+    // Reaching here with a resolved encryption map means this is a PLAINTEXT column the gate above
+    // deliberately kept off the token path. Apply the declared containment per word so the token
+    // path's word-order-independent matching survives the reroute (#5803 / TC-RESO-009).
+    if (
+      (filter.op === 'like' || filter.op === 'ilike') &&
+      typeof filter.value === 'string' &&
+      searchRuntime?.enabled &&
+      searchRuntime.encryptedFields != null
+    ) {
+      const patterns = buildContainmentPatterns(filter.value)
+      if (patterns.length > 1) {
+        return eb.and(patterns.map((pattern) => eb(qualify(baseField), filter.op, pattern)))
+      }
+    }
     return this.buildColumnFilterExpression(eb, qualify(baseField), filter.op, filter.value)
   }
 
@@ -2193,37 +2287,149 @@ export class HybridQueryEngine implements QueryEngine {
     return present
   }
 
-  private async resolveAvailableCustomFieldKeys(entityIds: string[], tenantId: string | null): Promise<string[]> {
+  private async resolveCustomFieldDefs(
+    entityIds: string[],
+    tenantId: string | null,
+  ): Promise<CustomFieldDefRow[]> {
     if (!entityIds.length) return []
     const cacheKey = this.customFieldKeysCacheKey(entityIds, tenantId)
     const now = Date.now()
-    const cached = this.customFieldKeysCache.get(cacheKey)
+    const cached = this.customFieldDefsCache.get(cacheKey)
     if (cached && cached.expiresAt > now) return cached.value.slice()
 
     const db = this.getDb() as any
     const rows = await db
       .selectFrom('custom_field_defs')
-      .select('key')
+      .select(['entity_id', 'key', 'kind', 'organization_id', 'tenant_id', 'config_json', 'updated_at'])
       .where('entity_id', 'in', entityIds)
       .where('is_active', '=', true)
       .where((eb: any) => eb.or([
         eb('tenant_id', '=', tenantId),
         eb('tenant_id', 'is', null),
       ]))
-      .execute() as Array<{ key: unknown }>
-    const keys = new Set<string>()
+      .execute() as Array<Record<string, unknown>>
+    const result: CustomFieldDefRow[] = []
     for (const row of rows) {
       const key = row.key
-      if (typeof key === 'string' && key.trim().length) keys.add(key.trim())
-      else if (key != null) keys.add(String(key))
+      const normalized = typeof key === 'string' ? key.trim() : key == null ? '' : String(key)
+      if (!normalized.length) continue
+      const entityId = typeof row.entity_id === 'string' ? row.entity_id : String(row.entity_id ?? '')
+      result.push({
+        entityId,
+        key: normalized,
+        kind: row.kind,
+        organizationId: typeof row.organization_id === 'string' ? row.organization_id : null,
+        tenantId: typeof row.tenant_id === 'string' ? row.tenant_id : null,
+        configJson: row.config_json ?? null,
+        updatedAt: row.updated_at ?? null,
+      })
     }
-    const result = Array.from(keys)
     if (this.customFieldKeysTtlMs > 0) {
-      this.customFieldKeysCache.set(cacheKey, { expiresAt: now + this.customFieldKeysTtlMs, value: result })
+      this.customFieldDefsCache.set(cacheKey, { expiresAt: now + this.customFieldKeysTtlMs, value: result })
     }
     return result.slice()
   }
 
+  /**
+   * Resolve the declared `kind` for a set of `cf:` sort keys so `applySort` can
+   * cast numeric kinds instead of ordering by jsonb text (#5674). A same-org
+   * definition wins over a tenant-wide one, which wins over a global one, for
+   * the same key — a same-key definition scoped to a *different* organization
+   * in the tenant never gets to decide the kind (#5674 review).
+   */
+  private async resolveCustomFieldSortKinds(
+    entityIds: string[],
+    tenantId: string | null,
+    organizationIds: string[],
+    keys: string[]
+  ): Promise<Map<string, string>> {
+    if (!entityIds.length || !keys.length) return new Map()
+    const sortedOrgIds = organizationIds.slice().sort((a, b) => (a < b ? -1 : a > b ? 1 : 0))
+    const cacheKey = `${this.customFieldKeysCacheKey(entityIds, tenantId)}|org:${sortedOrgIds.join(',')}|${keys.slice().sort((a, b) => (a < b ? -1 : a > b ? 1 : 0)).join(',')}`
+    const now = Date.now()
+    const cached = this.customFieldKindCache.get(cacheKey)
+    if (cached && cached.expiresAt > now) return new Map(cached.value)
+
+    const db = this.getDb() as any
+    const rows = await db
+      .selectFrom('custom_field_defs')
+      .select(['key', 'kind', 'organization_id', 'tenant_id'])
+      .where('entity_id', 'in', entityIds)
+      .where('key', 'in', keys)
+      .where('is_active', '=', true)
+      .where((eb: any) => eb.or([
+        eb('tenant_id', '=', tenantId),
+        eb('tenant_id', 'is', null),
+      ]))
+      .where((eb: any) => sortedOrgIds.length
+        ? eb.or([
+            eb('organization_id', 'is', null),
+            eb('organization_id', 'in', sortedOrgIds),
+          ])
+        : eb('organization_id', 'is', null))
+      .execute() as Array<{ key: unknown; kind: unknown; organization_id: unknown; tenant_id: unknown }>
+
+    const winners = new Map<string, { kind: string; specificity: number }>()
+    for (const row of rows) {
+      const key = typeof row.key === 'string' ? row.key : String(row.key)
+      const kind = typeof row.kind === 'string' ? row.kind : null
+      if (!kind) continue
+      // Org-scoped beats tenant-wide beats global for the same key; rows from
+      // an unrelated org were already excluded by the WHERE clause above.
+      const specificity = row.organization_id != null ? 2 : row.tenant_id != null ? 1 : 0
+      const existing = winners.get(key)
+      if (!existing || specificity >= existing.specificity) winners.set(key, { kind, specificity })
+    }
+    const result = new Map<string, string>()
+    for (const [key, entry] of winners) result.set(key, entry.kind)
+    if (this.customFieldKeysTtlMs > 0) {
+      this.customFieldKindCache.set(cacheKey, { expiresAt: now + this.customFieldKeysTtlMs, value: new Map(result) })
+    }
+    return result
+  }
+
+  private async resolveAvailableCustomFieldKeys(entityIds: string[], tenantId: string | null): Promise<string[]> {
+    const defs = await this.resolveCustomFieldDefs(entityIds, tenantId)
+    return Array.from(new Set(defs.map((def) => def.key)))
+  }
+
+  /**
+   * Kind lookup for the `cf:`/`cf_` keys of an index document, so encrypted string-typed
+   * custom fields keep their type on read instead of being `JSON.parse`d back into numbers
+   * or booleans (issue #5968). Backed by the same TTL cache as the key lookup, so this adds
+   * no round trip on a warm cache and fails open to an empty index on a cold-cache error.
+   *
+   * The index keeps every scope's definition per key rather than collapsing to one kind:
+   * the caller resolves the winner against each row's own `organization_id`, the same scope
+   * the row is decrypted with, so an organization's override never types another
+   * organization's value.
+   *
+   * `entityIds` MUST arrive in `indexSources` order: `buildCfJsonExprSql` reads a `cf` value
+   * with `coalesce(source0, source1, …)`, so a key defined by several sources has to be typed
+   * by the same source the value came from — hence the priority-ordered merge rather than
+   * whatever order the rows happen to come back in.
+   */
+  private async resolveCustomFieldKindIndex(
+    entityIds: string[],
+    tenantId: string | null,
+  ): Promise<CustomFieldKindIndex> {
+    try {
+      const defs = await this.resolveCustomFieldDefs(entityIds, tenantId)
+      const byEntityId = new Map<string, CustomFieldDefRow[]>()
+      for (const def of defs) {
+        const group = byEntityId.get(def.entityId) ?? []
+        group.push(def)
+        byEntityId.set(def.entityId, group)
+      }
+      return mergeCustomFieldKindIndexes(
+        entityIds.map((entityId) => buildCustomFieldKindIndex(byEntityId.get(entityId) ?? [])),
+      )
+    } catch (err) {
+      logger.warn('Failed to resolve custom field kinds', { entityIds, err })
+      return emptyCustomFieldKindIndex()
+    }
+  }
+
   private async entityHasActiveCustomFields(entityId: string, tenantId: string | null): Promise<boolean> {
     try {
       const keys = await this.resolveAvailableCustomFieldKeys([entityId], tenantId)
@@ -2640,6 +2846,21 @@ export class HybridQueryEngine implements QueryEngine {
       return q
     }
     const col: any = column
+    // A PLAINTEXT column the gate kept off the token path: AND one containment predicate per word,
+    // which is what the token subquery matched (#5803 / TC-RESO-009). Chained `where`s ARE the AND.
+    if (
+      (filter.op === 'like' || filter.op === 'ilike') &&
+      typeof filter.value === 'string' &&
+      search?.enabled &&
+      search.encryptedFields != null
+    ) {
+      const patterns = buildContainmentPatterns(filter.value)
+      if (patterns.length > 1) {
+        let next = q
+        for (const pattern of patterns) next = next.where(col, filter.op, pattern as any)
+        return next
+      }
+    }
     switch (filter.op) {
       case 'eq':
         return filter.value === null