@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/src/modules/wms/lib/availabilityProvider.ts

@@ -0,0 +1,47 @@
+/**
+ * `wms`'s `AvailabilityProvider` registration (`id: 'wms'`).
+ *
+ * @see .ai/specs/2026-08-14-availability-contract.md §3.1, §4.2
+ *
+ * The shared registry is process-wide, while `wms/di.ts`'s `register()` runs
+ * once per `createRequestContainer()` call. The provider therefore captures
+ * no container: every `getAvailability()` call resolves `em`, the cache and
+ * the policy service from the calling request's container
+ * (`context.container`), or builds a fresh request container when the caller
+ * passed none. A request can never reach another request's container.
+ */
+
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type {
+  AvailabilityDependencyResolver,
+  AvailabilityProvider,
+  AvailabilityProviderContext,
+  AvailabilityQuery,
+  AvailabilityResult,
+} from '@open-mercato/shared/lib/availability'
+import { computeAvailabilityCached } from './availabilityCache'
+
+export const WMS_AVAILABILITY_PROVIDER_ID = 'wms'
+
+export type WmsAvailabilityProviderOptions = {
+  createContainer?: () => Promise<AvailabilityDependencyResolver>
+}
+
+async function createDefaultContainer(): Promise<AvailabilityDependencyResolver> {
+  const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+  return createRequestContainer()
+}
+
+export function createWmsAvailabilityProvider(options: WmsAvailabilityProviderOptions = {}): AvailabilityProvider {
+  const createContainer = options.createContainer ?? createDefaultContainer
+  return {
+    id: WMS_AVAILABILITY_PROVIDER_ID,
+    async getAvailability(query: AvailabilityQuery, context?: AvailabilityProviderContext): Promise<AvailabilityResult> {
+      const container = context?.container ?? (await createContainer())
+      const em = container.resolve<EntityManager>('em').fork()
+      return computeAvailabilityCached(em, container, query)
+    },
+  }
+}
+
+export const wmsAvailabilityProvider: AvailabilityProvider = createWmsAvailabilityProvider()

package/src/modules/wms/lib/loadOperationalDashboard.ts

@@ -219,10 +219,29 @@ export function buildExpiryLotRows(
   return [...expiringRows, ...pastDueRows]
 }
 
+export function resolveEffectiveProfilesByVariant(
+  profiles: ProductInventoryProfile[],
+  variantIdsByProduct: Map<string, string[]> = new Map(),
+): Map<string, ProductInventoryProfile> {
+  const effective = new Map<string, ProductInventoryProfile>()
+  for (const profile of profiles) {
+    const variantId = profile.catalogVariantId
+    if (variantId && !effective.has(variantId)) effective.set(variantId, profile)
+  }
+  for (const profile of profiles) {
+    if (profile.catalogVariantId) continue
+    for (const variantId of variantIdsByProduct.get(profile.catalogProductId) ?? []) {
+      if (!effective.has(variantId)) effective.set(variantId, profile)
+    }
+  }
+  return effective
+}
+
 export function computeLowStockCounts(
   profiles: ProductInventoryProfile[],
   balances: InventoryBalance[],
   warehouseId?: string | null,
+  variantIdsByProduct?: Map<string, string[]>,
 ): { lowStockCount: number; reorderCriticalCount: number } {
   const availableByVariantWarehouse = new Map<string, number>()
   for (const balance of balances) {
@@ -238,9 +257,7 @@ export function computeLowStockCounts(
   let reorderCriticalCount = 0
   const seenLowStockKeys = new Set<string>()
 
-  for (const profile of profiles) {
-    const variantId = profile.catalogVariantId
-    if (!variantId) continue
+  for (const [variantId, profile] of resolveEffectiveProfilesByVariant(profiles, variantIdsByProduct)) {
     const reorderPoint = toOperationalDashboardNumber(profile.reorderPoint)
     const safetyStock = toOperationalDashboardNumber(profile.safetyStock)
     if (reorderPoint <= 0 && safetyStock <= 0) continue
@@ -323,6 +340,35 @@ async function loadVariantSkus(
   return map
 }
 
+async function loadVariantIdsForProductLevelProfiles(
+  em: EntityManager,
+  scope: OperationalDashboardScope,
+  profiles: ProductInventoryProfile[],
+): Promise<Map<string, string[]>> {
+  const productIds = Array.from(
+    new Set(
+      profiles
+        .filter((profile) => !profile.catalogVariantId && profile.catalogProductId)
+        .map((profile) => profile.catalogProductId),
+    ),
+  )
+  if (productIds.length === 0) return new Map()
+  const rows = await em.getConnection().execute<Array<{ id: string; product_id: string }>>(
+    `select id, product_id from catalog_product_variants
+     where organization_id = ? and tenant_id = ? and product_id in (${productIds.map(() => '?').join(', ')})
+     and is_active = true and deleted_at is null`,
+    [scope.organizationId, scope.tenantId, ...productIds],
+  )
+  const map = new Map<string, string[]>()
+  for (const row of rows) {
+    if (!row.id || !row.product_id) continue
+    const variantIds = map.get(row.product_id) ?? []
+    variantIds.push(row.id)
+    map.set(row.product_id, variantIds)
+  }
+  return map
+}
+
 async function countMovementsBetween(
   em: EntityManager,
   scope: OperationalDashboardScope,
@@ -654,10 +700,12 @@ export async function loadOperationalDashboard(
     ),
   ])
 
+  const variantIdsByProduct = await loadVariantIdsForProductLevelProfiles(em, scope, profiles)
   const { lowStockCount, reorderCriticalCount } = computeLowStockCounts(
     profiles,
     balances,
     scope.warehouseId,
+    variantIdsByProduct,
   )
 
   const expiringSoonCount = expiringSoonLots.filter(

package/src/modules/wms/lib/lowStockBalanceFilter.ts

@@ -30,12 +30,11 @@ export async function resolveLowStockVariantIds(
       ? 'coalesce(p.safety_stock, 0) > 0'
       : '(coalesce(p.reorder_point, 0) > 0 or coalesce(p.safety_stock, 0) > 0)'
 
-  params.push(scope.organizationId, scope.tenantId)
+  params.push(scope.organizationId, scope.tenantId, scope.organizationId, scope.tenantId)
 
   const sql = `
-    select distinct p.catalog_variant_id as catalog_variant_id
-    from wms_product_inventory_profiles p
-    join (
+    select distinct availability.catalog_variant_id as catalog_variant_id
+    from (
       select
         b.catalog_variant_id,
         b.warehouse_id,
@@ -51,12 +50,26 @@ export async function resolveLowStockVariantIds(
         ${warehouseJoin}
       group by b.catalog_variant_id, b.warehouse_id
     ) availability
-      on availability.catalog_variant_id = p.catalog_variant_id
-    where p.organization_id = ?
-      and p.tenant_id = ?
-      and p.deleted_at is null
-      and p.catalog_variant_id is not null
-      and ${thresholdGuard}
+    left join catalog_product_variants v
+      on v.id = availability.catalog_variant_id
+     and v.organization_id = ?
+     and v.tenant_id = ?
+     and v.is_active = true
+     and v.deleted_at is null
+    join lateral (
+      select profile.reorder_point, profile.safety_stock
+      from wms_product_inventory_profiles profile
+      where profile.organization_id = ?
+        and profile.tenant_id = ?
+        and profile.deleted_at is null
+        and (
+          profile.catalog_variant_id = availability.catalog_variant_id
+          or (profile.catalog_variant_id is null and profile.catalog_product_id = v.product_id)
+        )
+      order by (profile.catalog_variant_id is null) asc
+      limit 1
+    ) p on true
+    where ${thresholdGuard}
       and availability.available <= ${thresholdExpr}
   `
 

package/src/modules/wms/lib/sqlInClause.ts

@@ -0,0 +1,21 @@
+/**
+ * Renders an id list into a raw-SQL `IN` clause with one placeholder per member.
+ *
+ * MikroORM does not bind parameters at the driver level: `AbstractSqlConnection.execute`
+ * calls `platform.formatQuery`, which interpolates each value through
+ * `BasePostgreSqlPlatform.escape`, and that renders a JavaScript array as a bare
+ * comma-separated list. `column = ANY(?)` therefore reaches PostgreSQL as
+ * `= ANY('a', 'b')` — or, for a single-element array, as the bare scalar, which fails
+ * with `malformed array literal`. Same fix as the dashboards aggregation builder (#4669)
+ * and the staff time-tracking raw queries: one placeholder per member.
+ *
+ * An empty list yields `IN (NULL)` rather than a dropped clause: a caller that narrowed
+ * to nothing must select nothing, never silently widen to every row.
+ */
+export type SqlInClause = { sql: string; params: unknown[] }
+
+export function buildSqlInClause(column: string, values: readonly string[]): SqlInClause {
+  if (values.length === 0) return { sql: `${column} IN (NULL)`, params: [] }
+  const placeholders = values.map(() => '?').join(', ')
+  return { sql: `${column} IN (${placeholders})`, params: [...values] }
+}

package/src/modules/wms/lib/tryResolve.ts

@@ -0,0 +1,8 @@
+/** Per-module local soft-resolve helper — see `packages/core/AGENTS.md` § Cross-Module Coupling. */
+export function tryResolve<T>(resolver: { resolve: <R = unknown>(name: string) => R }, name: string): T | undefined {
+  try {
+    return resolver.resolve<T>(name)
+  } catch {
+    return undefined
+  }
+}

package/src/modules/wms/subscribers/invalidate-availability-cache-policy.ts

@@ -0,0 +1,18 @@
+// Invalidates the wms availability read-through cache when an availability policy
+// changes; backorder, preorder and order-quantity rules feed the cached state.
+// Same ephemeral contract as `invalidate-availability-cache.ts`; the 60s TTL is the backstop.
+
+import invalidateAvailabilityCache from './invalidate-availability-cache'
+
+export const metadata = {
+  event: 'availability.policy.*',
+  persistent: false,
+  id: 'wms:invalidate-availability-cache-policy',
+}
+
+export default async function handle(
+  payload: unknown,
+  ctx: Parameters<typeof invalidateAvailabilityCache>[1],
+): Promise<void> {
+  await invalidateAvailabilityCache(payload, ctx)
+}

package/src/modules/wms/subscribers/invalidate-availability-cache-profile.ts

@@ -0,0 +1,18 @@
+// Invalidates the wms availability read-through cache when an inventory profile
+// changes; safety stock and reorder point feed the cached sellable quantity.
+// Same ephemeral contract as `invalidate-availability-cache.ts`; the 60s TTL is the backstop.
+
+import invalidateAvailabilityCache from './invalidate-availability-cache'
+
+export const metadata = {
+  event: 'wms.inventory_profile.*',
+  persistent: false,
+  id: 'wms:invalidate-availability-cache-profile',
+}
+
+export default async function handle(
+  payload: unknown,
+  ctx: Parameters<typeof invalidateAvailabilityCache>[1],
+): Promise<void> {
+  await invalidateAvailabilityCache(payload, ctx)
+}

package/src/modules/wms/subscribers/invalidate-availability-cache.ts

@@ -0,0 +1,30 @@
+// Invalidates the wms AvailabilityProvider's read-through cache
+// (`availabilityCache.ts`) whenever a balance changes. Ephemeral
+// (`persistent: false`) — cache invalidation is a real-time housekeeping
+// concern, not something that needs retry/audit semantics; the cache's own
+// 60s TTL is the backstop if an event is ever lost.
+//
+// `wms.*` does NOT match `wms.inventory_balance.created` (single-segment
+// matcher) — `wms.inventory_balance.*` matches all three CRUD actions
+// (created/updated/deleted) in one subscriber, mirroring
+// `invalidate-enricher-cache-balance.ts`.
+
+import { invalidateWmsAvailabilityCache } from '../lib/availabilityCache'
+
+export const metadata = {
+  event: 'wms.inventory_balance.*',
+  persistent: false,
+  id: 'wms:invalidate-availability-cache',
+}
+
+type SubscriberContext = {
+  resolve: <T = unknown>(name: string) => T
+  tenantId?: string | null
+}
+
+export default async function handle(payload: unknown, ctx: SubscriberContext): Promise<void> {
+  const data = (payload ?? {}) as Record<string, unknown>
+  const tenantId =
+    typeof data.tenantId === 'string' && data.tenantId.length > 0 ? data.tenantId : ctx.tenantId ?? null
+  await invalidateWmsAvailabilityCache(ctx, tenantId)
+}

package/src/modules/wms/widgets/notifications/WmsLowStockRenderer.tsx

@@ -28,7 +28,7 @@ export function WmsLowStockRenderer({
   const viewAction = actions.find((action) => action.id === 'view') ?? actions[0] ?? null
 
   const handleView = async () => {
-    if (!viewAction) {
+    if (!viewAction || notification.status === 'actioned') {
       if (notification.linkHref) router.push(notification.linkHref)
       return
     }
@@ -113,7 +113,7 @@ export function WmsLowStockRenderer({
               e.stopPropagation()
               handleView()
             }}
-            disabled={executing || (!viewAction && !notification.linkHref)}
+            disabled={executing || (!viewAction && !notification.linkHref) || (notification.status === 'actioned' && !notification.linkHref)}
           >
             <ExternalLink className="size-3.5" aria-hidden="true" />
             {t('wms.notifications.lowStock.renderer.viewSku', 'View SKU')}

package/src/modules/wms/widgets/notifications/WmsReservationShortfallRenderer.tsx

@@ -42,11 +42,12 @@ export function WmsReservationShortfallRenderer({
         : actionId === 'view-inventory'
           ? inventoryAction
           : null
-    if (!action && fallbackHref) {
+    const alreadyActioned = notification.status === 'actioned'
+    if ((!action || alreadyActioned) && fallbackHref) {
       router.push(fallbackHref)
       return
     }
-    if (!action) return
+    if (!action || alreadyActioned) return
     setExecuting(actionId)
     try {
       await onAction(action.id)
@@ -139,7 +140,7 @@ export function WmsReservationShortfallRenderer({
               event.stopPropagation()
               void handleAction('view-order', notification.linkHref ?? undefined)
             }}
-            disabled={executing !== null}
+            disabled={executing !== null || (notification.status === 'actioned' && !notification.linkHref)}
           >
             <ExternalLink className="size-3.5" aria-hidden="true" />
             {t('wms.notifications.reservationShortfall.renderer.viewOrder', 'View order')}

package/src/modules/workflows/AGENTS.md

@@ -94,12 +94,12 @@ Definition → startWorkflow() → Instance → executeWorkflow() loop
 
 | Activity type | When to use |
 |---------------|-------------|
-| `SEND_EMAIL` | Send templated email via mail service |
+| `SEND_EMAIL` | Send templated email via mail service. The handler passes `signal?: AbortSignal` on the send payload; honouring it is optional for implementations. Adapter authors serializing the payload for a queue must strip the field before enqueuing. |
 | `CALL_API` | Call an internal API endpoint |
 | `CALL_WEBHOOK` | Call an external HTTP endpoint (SSRF-guarded via `@open-mercato/shared/lib/url-safety`; `redirect: 'manual'`, 3xx rejected) |
-| `UPDATE_ENTITY` | Mutate an entity via the command bus |
-| `EMIT_EVENT` | Emit a domain event to the event bus |
-| `EXECUTE_FUNCTION` | Run a registered custom function |
+| `UPDATE_ENTITY` | Mutate an entity via the command bus. `CommandBus.execute` does not declare a signal; a write that has already begun cannot be cancelled on timeout. |
+| `EMIT_EVENT` | Emit a domain event to the event bus. `eventBus.emitEvent` does not declare a signal; an emit that has already begun cannot be cancelled on timeout. |
+| `EXECUTE_FUNCTION` | Run a registered custom function. Functions receive `(args, context, signal?: AbortSignal)` — the third arg is additive; existing two-arg functions are unaffected. |
 | `WAIT` | Delay execution for a configured duration |
 | `SET_VARIABLE` | Write values into workflow context at dot paths (assignments land at top-level context, not namespaced under the activity) |
 
@@ -995,6 +995,8 @@ Configure automatic workflow starts from domain events:
 
 Precedence: **a DB-backed definition wins over its code counterpart.** Any non-deleted `workflow_definitions` row shadows the code projection for the same `workflowId` — including a disabled row, and including a customization whose `triggers[]` was emptied. This preserves `customize` semantics: once an operator materializes a code workflow, the DB row alone decides which triggers are live.
 
+Versions: **embedded triggers come only from the highest enabled, published version of each `workflowId`** — the row an unpinned `findWorkflowDefinition` returns among DB rows. Publishing copies `triggers[]` into the new version and leaves the source row enabled for pinned instances and callers, so projecting every enabled row would start one instance per version for a single event. Older, disabled, `draft` and `archived` rows still count for the shadow rule above but contribute no triggers.
+
 MUST invalidate the trigger cache after any write that changes which source owns a workflow's triggers — `loadTriggersForTenant()` caches per tenant/organization for `TRIGGER_CACHE_TTL` (5 min), so without invalidation the wildcard subscriber keeps matching a stale snapshot:
 
 ```typescript
@@ -1003,7 +1005,7 @@ import { invalidateTriggerCache } from '../lib/event-trigger-service'
 if (tenantId) invalidateTriggerCache(tenantId, organizationId ?? undefined)
 ```
 
-This covers definition create/update/delete **and** `POST .../[id]/customize` (code projection → embedded row) and `POST .../[id]/reset-to-code` (embedded row → code projection). Invalidate for the **written row's own** tenant/organization rather than the caller's — `customize` looks an override up by `(workflowId, tenantId)`, so it can revive a row owned by a sibling organization. Omitting `organizationId` clears every organization under the tenant.
+This covers definition create/update/delete **and** `POST .../[id]/customize` (code projection → embedded row), `POST .../[id]/reset-to-code` (embedded row → code projection) and `POST .../[id]/publish` (the minted version becomes the one triggers resolve to). Invalidate for the **written row's own** tenant/organization rather than the caller's — `customize` looks an override up by `(workflowId, tenantId)`, so it can revive a row owned by a sibling organization. Omitting `organizationId` clears every organization under the tenant.
 
 ## Widget Injection
 

package/src/modules/workflows/api/commands/route.ts

@@ -29,11 +29,13 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { listWorkflowSafeCommands } from '../../lib/workflow-safe-commands'
 import { resolveWorkflowCommandCatalogue } from '../../lib/workflow-command-enablement'
 import { resolveWorkflowCommandPolicyForContainer } from '../../lib/workflow-command-settings'
 import { workflowsTag, workflowErrorSchema, workflowSafeCommandListResponseSchema } from '../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows')
 
@@ -58,7 +60,7 @@ export async function GET(request: NextRequest) {
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
     if (!tenantId) {
       return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })
@@ -80,6 +82,7 @@ export async function GET(request: NextRequest) {
 
     return NextResponse.json({ items })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error listing workflow-safe commands', { err: error })
     return NextResponse.json(
       { error: 'Failed to list workflow-safe commands' },

package/src/modules/workflows/api/definitions/[id]/callers/route.ts

@@ -14,9 +14,11 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { WorkflowDefinition } from '../../../../data/entities'
 import type { WorkflowIoContract } from '../../../../data/validators'
 import { findSubWorkflowCallers } from '../../../../lib/caller-graph'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows').child({ component: 'definition-callers-api' })
 
@@ -42,7 +44,7 @@ export async function GET(request: NextRequest, context: RouteContext) {
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
     if (!tenantId || !organizationId) {
       return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })
@@ -68,6 +70,7 @@ export async function GET(request: NextRequest, context: RouteContext) {
 
     return NextResponse.json({ callers })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('error resolving workflow definition callers', {
       error: error instanceof Error ? error.message : String(error),
     })

package/src/modules/workflows/api/definitions/[id]/context-schema/route.ts

@@ -26,7 +26,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
+import { resolveOrganizationScopeFilter, resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { type WorkflowDefinitionData } from '../../../../data/entities'
 import {
   computeDefinitionContextLedger,
@@ -40,6 +40,7 @@ import {
   workflowContextSchemaResponseSchema,
 } from '../../../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows')
 
@@ -90,7 +91,7 @@ export async function GET(
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
 
     if (!tenantId) {
       return NextResponse.json({ error: 'Missing tenant context' }, { status: 400 })
@@ -129,6 +130,7 @@ export async function GET(
 
     return respondWithLedger(definitionData, stepId)
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error computing workflow context schema', { err: error })
     return NextResponse.json(
       { error: 'Failed to compute workflow context schema' },

package/src/modules/workflows/api/definitions/[id]/customize/route.ts

@@ -13,6 +13,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { WorkflowDefinition } from '../../../../data/entities'
 import { serializeWorkflowDefinition } from '../../serialize'
@@ -20,6 +21,7 @@ import { workflowDefinitionMutationResponseSchema, workflowErrorSchema } from '.
 import { getCodeWorkflow } from '../../../../lib/code-registry'
 import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows')
 
@@ -47,7 +49,7 @@ export async function POST(request: NextRequest, context: RouteContext) {
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
     if (!params.id.startsWith('code:')) {
       return NextResponse.json(
@@ -167,6 +169,7 @@ export async function POST(request: NextRequest, context: RouteContext) {
       message: 'Workflow definition customized successfully',
     })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error customizing workflow definition', { err: error })
     return NextResponse.json({ error: 'Failed to customize workflow definition' }, { status: 500 })
   }

package/src/modules/workflows/api/definitions/[id]/draft/route.ts

@@ -21,6 +21,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { WorkflowDefinition, WorkflowDefinitionDraft } from '../../../../data/entities'
 import {
@@ -35,6 +36,7 @@ import {
   workflowDefinitionDraftDeleteResponseSchema,
 } from '../../../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows')
 
@@ -100,7 +102,7 @@ async function resolveDraftContext(
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
   const tenantId = auth.tenantId
-  const organizationId = scope?.selectedId ?? auth.orgId
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
   if (!tenantId) {
     return { ok: false, response: NextResponse.json({ error: 'Missing tenant context' }, { status: 400 }) }
@@ -178,6 +180,7 @@ export async function GET(
 
     return NextResponse.json({ data: serializeWorkflowDefinitionDraft(draft) })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error getting workflow definition draft', { err: error })
     return NextResponse.json({ error: 'Failed to get workflow definition draft' }, { status: 500 })
   }
@@ -280,6 +283,7 @@ export async function PUT(
       message: 'Workflow definition draft saved',
     })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error saving workflow definition draft', { err: error })
     return NextResponse.json({ error: 'Failed to save workflow definition draft' }, { status: 500 })
   }
@@ -334,6 +338,7 @@ export async function DELETE(
 
     return NextResponse.json({ message: 'Workflow definition draft discarded' })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error discarding workflow definition draft', { err: error })
     return NextResponse.json({ error: 'Failed to discard workflow definition draft' }, { status: 500 })
   }

package/src/modules/workflows/api/definitions/[id]/publish/route.ts

@@ -16,17 +16,20 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { WorkflowDefinition } from '../../../../data/entities'
 import type { WorkflowIoContract } from '../../../../data/validators'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { serializeWorkflowDefinition } from '../../serialize'
 import { findSubWorkflowCallers } from '../../../../lib/caller-graph'
+import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import {
   authorizeWorkflowGrantChange,
   normalizeGrantedFeatures,
   syncWorkflowDefinitionPrincipal,
 } from '../../../../lib/definition-grant'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows').child({ component: 'definition-publish-api' })
 
@@ -56,7 +59,7 @@ export async function POST(request: NextRequest, context: RouteContext) {
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
     if (!tenantId || !organizationId) {
       return NextResponse.json({ error: 'Missing tenant or organization context' }, { status: 400 })
@@ -165,6 +168,11 @@ export async function POST(request: NextRequest, context: RouteContext) {
     em.persist(published)
     await em.flush()
 
+    // The minted version is now the one unpinned starts and event triggers
+    // resolve to, so the cached trigger set still pointing at the previous
+    // version must be dropped.
+    invalidateTriggerCache(tenantId, organizationId)
+
     if (guardResult?.shouldRunAfterSuccess) {
       await runCrudMutationGuardAfterSuccess(container, {
         tenantId,
@@ -209,6 +217,7 @@ export async function POST(request: NextRequest, context: RouteContext) {
       message: 'Workflow definition published successfully',
     })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('error publishing workflow definition', {
       error: error instanceof Error ? error.message : String(error),
     })

package/src/modules/workflows/api/definitions/[id]/reset-to-code/route.ts

@@ -12,6 +12,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { validateCrudMutationGuard, runCrudMutationGuardAfterSuccess } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { WorkflowDefinition, WorkflowInstance } from '../../../../data/entities'
 import { serializeCodeWorkflowDefinition } from '../../serialize'
@@ -19,6 +20,7 @@ import { workflowDefinitionResetResponseSchema, workflowErrorSchema } from '../.
 import { getCodeWorkflow } from '../../../../lib/code-registry'
 import { invalidateTriggerCache } from '../../../../lib/event-trigger-service'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 const logger = createLogger('workflows')
 
@@ -54,7 +56,7 @@ export async function POST(
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
     const tenantId = auth.tenantId
-    const organizationId = scope?.selectedId ?? auth.orgId
+    const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
 
     // Check edit permission
     const rbacService = container.resolve('rbacService')
@@ -202,6 +204,7 @@ export async function POST(
       message: 'Workflow definition reset to code version',
     })
   } catch (error) {
+    if (isCrudHttpError(error)) return NextResponse.json(error.body, { status: error.status })
     logger.error('Error resetting workflow definition to code', { err: error })
     return NextResponse.json(
       { error: 'Failed to reset workflow definition to code' },