@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/modules/messages/lib/markdownEmailBody.ts

@@ -0,0 +1,25 @@
+import * as React from 'react'
+
+/**
+ * Render a markdown message body to the HTML an email carries.
+ *
+ * Shared by every path that delivers a composed message off-platform, so a
+ * markdown compose reads the same whether it leaves through the platform sender
+ * or through an employee's own mailbox. The renderer dependencies are imported
+ * lazily because they are only needed for markdown bodies.
+ */
+export async function renderMarkdownEmailBody(body: string): Promise<string> {
+  const ReactMarkdownModule = await import('react-markdown')
+  const remarkGfmModule = await import('remark-gfm')
+  const ReactMarkdown =
+    (ReactMarkdownModule.default ?? ReactMarkdownModule) as React.ComponentType<{
+      remarkPlugins?: unknown
+      children?: React.ReactNode
+    }>
+  const remarkGfmPlugin = remarkGfmModule.default ?? remarkGfmModule
+  const { renderToStaticMarkup } = await import('react-dom/server')
+
+  return renderToStaticMarkup(
+    React.createElement(ReactMarkdown, { remarkPlugins: [remarkGfmPlugin] }, body),
+  )
+}

package/src/modules/messages/lib/messageSourceEntityTypes.ts

@@ -0,0 +1,12 @@
+/**
+ * `Message.sourceEntityType` sentinels written by `communication_channels` for
+ * messages it composes on the platform's behalf. Owned here (not in
+ * `communication_channels`) because `messages` is a hard dependency of
+ * `communication_channels` (it imports the `Message` entity directly), while
+ * `communication_channels` is an optional dependency of `messages` — see
+ * `resolveComposeSourceChannelType`'s `tryResolveChannelTypeService`. A
+ * constant defined here can be imported by `communication_channels` without
+ * creating the reverse, forbidden coupling.
+ */
+export const SEND_AS_USER_SOURCE_ENTITY_TYPE = 'communication_channels.send_as_user'
+export { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE } from './composeSourceChannelType'

package/src/modules/messages/lib/routeHelpers.ts

@@ -1,4 +1,10 @@
 import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
+import {
+  CHANNEL_THREAD_FALLBACK_FEATURE,
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  resolveActorFeatures,
+  resolveMessageChannelThreadAccess,
+} from './channelThreadAccess'
 
 export function hasOrganizationAccess(
   scopeOrganizationId: string | null,
@@ -49,6 +55,92 @@ export async function parseRequestBodySafe(req: Request): Promise<unknown> {
   }
 }
 
+/**
+ * Whether the caller may fall back to the channels hub's access rule on a
+ * channel-linked thread (#5535).
+ *
+ * Resolved through RBAC, never through `ctx.auth.features`: the session JWT
+ * carries no `features` claim, so reading it here would deny every caller —
+ * a tenant admin included — and re-close the very journey #5535 opened. RBAC is
+ * also what makes the check wildcard-aware. Fails closed, like the sibling
+ * feature checks in this file.
+ *
+ * Takes only the container, so the reply and forward commands apply the same
+ * gate as the read routes (#6355).
+ */
+export async function canUseChannelThreadFallback(
+  ctx: { container: { resolve: (name: string) => unknown } },
+  scope: MessageScope,
+): Promise<boolean> {
+  if (!scope.userId || !scope.tenantId) return false
+  try {
+    const rbac = ctx.container.resolve('rbacService') as RbacService | undefined
+    if (typeof rbac?.userHasAllFeatures !== 'function') return false
+    return await rbac.userHasAllFeatures(scope.userId, [CHANNEL_THREAD_FALLBACK_FEATURE], {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+    })
+  } catch {
+    return false
+  }
+}
+
+/**
+ * Whether the caller may work the channel-linked thread `message` belongs to
+ * through the channels hub's access rule, rather than as a participant (#5535).
+ *
+ * Shared by every read route that widens its participant test for channel
+ * threads — the detail read, the attachments list and the forward preview — so
+ * the three cannot drift apart (#6354). Only channel-sourced messages pay the
+ * lookup; the fallback is feature-gated through {@link canUseChannelThreadFallback}
+ * because the hub's rule grants every shared channel unconditionally. An
+ * internal thread, a missing hub or a denied gate all read `false`, leaving the
+ * participant rule in force.
+ *
+ * Callers still decide what the widening covers: channel access never opens a
+ * message that is not explicitly public.
+ */
+export async function hasChannelThreadReadAccess(
+  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],
+  scope: MessageScope,
+  message: { id: string; threadId?: string | null; sourceEntityType?: string | null },
+): Promise<boolean> {
+  if (message.sourceEntityType !== EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return false
+  if (!(await canUseChannelThreadFallback(ctx, scope))) return false
+  const channelThread = await resolveMessageChannelThreadAccess(
+    ctx.container,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },
+    { messageThreadId: message.threadId ?? message.id },
+    { userId: scope.userId, features: resolveActorFeatures(ctx.auth) },
+  )
+  return channelThread?.canAccess === true
+}
+
+/**
+ * Whether the caller may post a message meant to leave the platform onto
+ * `messageThreadId` (#5645 review, #6432).
+ *
+ * An internal thread, a thread outside the caller's scope and an absent hub all
+ * resolve to `null` and allow, keeping the pre-existing rule. A channel thread
+ * needs both the hub's access rule and `messages.view`, because the hub grants
+ * every shared channel regardless of features. Shared by the compose route and
+ * the draft send transition so a draft cannot be used to skip the gate.
+ */
+export async function canPostToChannelThread(
+  ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],
+  scope: MessageScope,
+  messageThreadId: string,
+): Promise<boolean> {
+  const channelThread = await resolveMessageChannelThreadAccess(
+    ctx.container,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },
+    { messageThreadId },
+    { userId: scope.userId, features: resolveActorFeatures(ctx.auth) },
+  )
+  if (!channelThread) return true
+  return channelThread.canAccess && (await canUseChannelThreadFallback(ctx, scope))
+}
+
 export async function canUseMessageEmailFeature(
   ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx'],
   scope: MessageScope,

package/src/modules/messages/subscribers/message-notification.ts

@@ -10,6 +10,10 @@ import {
 import { User } from '../../auth/data/entities'
 import { Message } from '../data/entities'
 import { notificationTypes } from '../notifications'
+import {
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  SEND_AS_USER_SOURCE_ENTITY_TYPE,
+} from '../lib/messageSourceEntityTypes'
 
 export const metadata = {
   event: 'messages.message.sent',
@@ -98,6 +102,48 @@ async function resolveNotificationVariables(payload: MessageSentPayload, ctx: Re
 }
 
 
+/**
+ * Whether this Message is already being delivered through a connected
+ * channel (`sendAsUser`, or the platform copy of an inbound channel message),
+ * so the external-email job below would duplicate — or, for the inbound
+ * case, misdirect — the send. Mirrors `outbound-bridge.ts`'s re-fetch: the
+ * `messages.message.sent` payload doesn't carry `sourceEntityType` and never
+ * should, to keep this subscriber decoupled from `communication_channels`.
+ *
+ * Fails open (`false`, i.e. today's behavior) when the Message can't be
+ * found — we can only skip the external send when we can affirmatively show
+ * it is channel-routed.
+ */
+async function isChannelRoutedMessage(payload: MessageSentPayload, ctx: ResolverContext): Promise<boolean> {
+  try {
+    const em = ctx.resolve<EntityManager>('em')?.fork()
+    if (!em) return false
+
+    const message = await findOneWithDecryption(
+      em,
+      Message,
+      {
+        id: payload.messageId,
+        tenantId: payload.tenantId,
+        organizationId: payload.organizationId ?? null,
+        deletedAt: null,
+      },
+      undefined,
+      {
+        tenantId: payload.tenantId,
+        organizationId: payload.organizationId ?? null,
+      },
+    )
+    if (!message) return false
+    return (
+      message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE ||
+      message.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE
+    )
+  } catch {
+    return false
+  }
+}
+
 export default async function handle(payload: MessageSentPayload, ctx: ResolverContext): Promise<void> {
   const uniqueRecipientUserIds = Array.from(new Set(payload.recipientUserIds))
 
@@ -138,7 +184,7 @@ export default async function handle(payload: MessageSentPayload, ctx: ResolverC
   }
 
   const externalEmail = payload.externalEmail?.trim()
-  if (externalEmail) {
+  if (externalEmail && !(await isChannelRoutedMessage(payload, ctx))) {
     await emailQueue.enqueue({
       type: 'external',
       messageId: payload.messageId,

package/src/modules/notifications/AGENTS.md

@@ -31,7 +31,7 @@ In-app notifications plus two channel-agnostic surfaces that every delivery chan
 - `syncNotificationTypes(em)` reconciles the registry into the table (idempotent, `tenant_id IS NULL`). It runs lazily on the first `GET /api/notifications/types` per process and on the `notifications.type_registry.sync` event (emitted from `setup.ts` `seedDefaults`; handled by `subscribers/sync-notification-types.ts`).
 - Field map: `id ← def.type`, `label_key ← def.labelKey ?? def.titleKey`, `description_key ← def.descriptionKey ?? null`, `category ← def.category ?? deriveCategory(def.type)`. Give a type a distinct preferences-screen label by adding optional `labelKey`/`descriptionKey` to its `NotificationTypeDefinition` (additive — falls back to `titleKey`).
 - **Grouping (`category`).** Defaults to the prefix before the first dot in the type id (`sales.order.created` → `sales`), resolved once in `syncNotificationTypes` so every mirrored row carries a key and read paths need no fallback branch. Declare `category` on the definition only to override that default.
-- **Category labels live in the declaring module, never here.** This module ships no `notifications.categories.*` entries and holds no list of categories — it must stay ignorant of which ones exist. To localize a heading, add `notifications.categories.<key>` to **your own** module's `i18n/{en,pl,es,de}.json`; dictionaries merge flat across modules, so the shared key namespace costs no coupling. A category with no translation anywhere falls back to the raw key.
+- **Category labels live in the declaring module, never here.** This module ships no `notifications.categories.*` entries and holds no list of categories — it must stay ignorant of which ones exist. To localize a heading, add `notifications.categories.<key>` to **your own** module's `i18n/{en,pl,es,de,ko}.json`; dictionaries merge flat across modules, so the shared key namespace costs no coupling. A category with no translation anywhere falls back to the raw key on screen, and `__tests__/category-labels-coverage.test.ts` fails the build for it (OSS packages; `packages/enterprise` is out of its scope). To join an existing group instead, declare `category` on the type.
 - **`GET /api/notifications/types` returns resolved display strings** — `label`, `description`, `categoryLabel` — alongside the existing `labelKey`/`descriptionKey`/`category`, so clients without the app dictionary (the mobile app) render directly. Locale comes from `resolveLocaleFromRequest` (`?locale=` → `x-locale` → cookie → `Accept-Language`), re-validated through `resolveSupportedLocale` because only that helper's `Accept-Language` branch validates its input. **Group on `category`, display `categoryLabel`** — grouping on the localized string re-partitions the list whenever the locale changes.
 - Mark a type `silent: true` on its `NotificationTypeDefinition` to make its pushes content-available wake-ups (no banner, data-only). `silent` controls **delivery style only** — the notification still flows through the normal `notificationService.create()` path (in-app row created, per-channel push preference respected); to make a silent type always fire, also mark it `nonOptOut: true`. There is no separate silent-send API — the `push` delivery strategy handles `silent` types. The flag lives only in the in-memory registry (not mirrored to `notification_types`).
 - A create call may carry an optional `data` (arbitrary app-readable string map — persisted on the row, exposed in the notification DTO, and delivered in the push data payload) and `pushOptions` (flat `sound`/`badge`/`image`/`priority`/`channelId`/`body` map — persisted, push-only, mapped per provider by the push adapters). Both are additive optional fields on the create/batch/role/feature schemas.

package/src/modules/notifications/api/[id]/action/route.ts

@@ -8,6 +8,7 @@ import {
   runGuardedNotificationWrite,
 } from '../../../lib/routeHelpers'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveNotificationActionHref } from '../../../lib/safeHref'
 
 export const metadata = {
   POST: { requireAuth: true },
@@ -41,7 +42,7 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
     const { notification, result } = guarded.result
 
     const action = notification.actionData?.actions?.find((a) => a.id === input.actionId)
-    const href = action?.href?.replace('{sourceEntityId}', notification.sourceEntityId ?? '')
+    const href = resolveNotificationActionHref(action?.href, notification.sourceEntityId)
 
     return Response.json({
       ok: true,

package/src/modules/notifications/api/openapi.ts

@@ -29,6 +29,7 @@ export const notificationItemSchema = z.object({
     labelKey: z.string().optional(),
     variant: z.string().optional(),
     icon: z.string().optional(),
+    href: z.string().optional(),
   })),
   primaryActionId: z.string().optional(),
   sourceModule: z.string().nullable().optional(),

package/src/modules/notifications/frontend/NotificationSettingsPageClient.tsx

@@ -18,6 +18,8 @@ type NotificationTypeCatalogueItem = {
   id: string
   labelKey: string
   descriptionKey?: string | null
+  category?: string | null
+  categoryLabel?: string | null
   // Effective "required" flag (tenant override ?? code-declared).
   nonOptOut?: boolean
   // Effective channel eligibility for this tenant (stored override ?? code-declared; null = every channel).
@@ -80,6 +82,26 @@ export function NotificationSettingsPageClient() {
   const [types, setTypes] = React.useState<NotificationTypeCatalogueItem[]>([])
   const [channels, setChannels] = React.useState<Array<{ id: string; labelKey: string }>>([])
   const [savingTypeCell, setSavingTypeCell] = React.useState<string | null>(null)
+  const groupHeadingId = React.useId()
+  const typeGroups = React.useMemo(() => {
+    const groups = new Map<string | null, {
+      category: string | null
+      label: string | null
+      items: NotificationTypeCatalogueItem[]
+    }>()
+    for (const type of types) {
+      const category = type.category || null
+      const group = groups.get(category)
+      if (group) group.items.push(type)
+      else groups.set(category, { category, label: category ? type.categoryLabel || category : null, items: [type] })
+    }
+    return Array.from(groups.values()).sort((left, right) => {
+      if (left.category === right.category) return 0
+      if (left.category === null) return 1
+      if (right.category === null) return -1
+      return left.category < right.category ? -1 : left.category > right.category ? 1 : 0
+    })
+  }, [types])
 
   const fetchCatalogue = React.useCallback(async () => {
     try {
@@ -453,55 +475,62 @@ export function NotificationSettingsPageClient() {
                     </th>
                   </tr>
                 </thead>
-                <tbody>
-                  {types.map((type) => (
-                    <tr key={type.id} className="border-b border-border last:border-0">
-                      <td className="px-4 py-3">
-                        <div className="font-medium">{t(type.labelKey, type.id)}</div>
-                        {type.descriptionKey ? (
-                          <div className="text-xs text-muted-foreground">{t(type.descriptionKey, '')}</div>
-                        ) : null}
-                      </td>
-                      {channels.map((channel) => {
-                        const cellKey = `${type.id}::${channel.id}`
-                        const channelEnabled = type.channels === null || type.channels.includes(channel.id)
-                        return (
-                          <td key={channel.id} className="px-4 py-3">
-                            {/* The saving spinner is absolutely positioned so it never joins the cell's
-                                layout flow — an in-flow sibling would widen the column mid-toggle and
-                                make the whole table jump for the duration of the save. */}
-                            <span className="relative inline-flex items-center">
-                              <Switch
-                                checked={channelEnabled}
-                                disabled={savingTypeCell !== null}
-                                aria-label={`${t(type.labelKey, type.id)} – ${t(channel.labelKey, channel.id)}`}
-                                onCheckedChange={(checked) =>
-                                  handleTypeChannelToggle(type, channel.id, checked)
-                                }
-                              />
-                              {savingTypeCell === cellKey ? (
-                                <Spinner size="sm" className="absolute left-full ml-2" />
-                              ) : null}
-                            </span>
-                          </td>
-                        )
-                      })}
-                      <td className="px-4 py-3">
-                        <span className="relative inline-flex">
-                          <Switch
-                            checked={type.nonOptOut === true}
-                            disabled={savingTypeCell !== null}
-                            aria-label={`${t(type.labelKey, type.id)} – ${t('notifications.settings.types.requiredColumn', 'Required')}`}
-                            onCheckedChange={(checked) => handleTypeNonOptOutToggle(type, checked)}
-                          />
-                          {savingTypeCell === `${type.id}::nonOptOut` ? (
-                            <Spinner size="sm" className="absolute left-full ml-2" />
-                          ) : null}
-                        </span>
-                      </td>
+                {typeGroups.map((group, index) => (
+                  <tbody key={JSON.stringify(group.category)} aria-labelledby={`${groupHeadingId}-${index}`}>
+                    <tr className="border-b border-border bg-muted/50">
+                      <th id={`${groupHeadingId}-${index}`} scope="rowgroup" colSpan={channels.length + 2} className="px-4 py-3 text-left font-semibold">
+                        {group.label ?? t('notifications.settings.types.uncategorized', 'Other notifications')}
+                      </th>
                     </tr>
-                  ))}
-                </tbody>
+                    {group.items.map((type) => (
+                      <tr key={type.id} className="border-b border-border last:border-0">
+                        <td className="px-4 py-3">
+                          <div className="font-medium">{t(type.labelKey, type.id)}</div>
+                          {type.descriptionKey ? (
+                            <div className="text-xs text-muted-foreground">{t(type.descriptionKey, '')}</div>
+                          ) : null}
+                        </td>
+                        {channels.map((channel) => {
+                          const cellKey = `${type.id}::${channel.id}`
+                          const channelEnabled = type.channels === null || type.channels.includes(channel.id)
+                          return (
+                            <td key={channel.id} className="px-4 py-3">
+                              {/* The saving spinner is absolutely positioned so it never joins the cell's
+                                  layout flow — an in-flow sibling would widen the column mid-toggle and
+                                  make the whole table jump for the duration of the save. */}
+                              <span className="relative inline-flex items-center">
+                                <Switch
+                                  checked={channelEnabled}
+                                  disabled={savingTypeCell !== null}
+                                  aria-label={`${t(type.labelKey, type.id)} – ${t(channel.labelKey, channel.id)}`}
+                                  onCheckedChange={(checked) =>
+                                    handleTypeChannelToggle(type, channel.id, checked)
+                                  }
+                                />
+                                {savingTypeCell === cellKey ? (
+                                  <Spinner size="sm" className="absolute left-full ml-2" />
+                                ) : null}
+                              </span>
+                            </td>
+                          )
+                        })}
+                        <td className="px-4 py-3">
+                          <span className="relative inline-flex">
+                            <Switch
+                              checked={type.nonOptOut === true}
+                              disabled={savingTypeCell !== null}
+                              aria-label={`${t(type.labelKey, type.id)} – ${t('notifications.settings.types.requiredColumn', 'Required')}`}
+                              onCheckedChange={(checked) => handleTypeNonOptOutToggle(type, checked)}
+                            />
+                            {savingTypeCell === `${type.id}::nonOptOut` ? (
+                              <Spinner size="sm" className="absolute left-full ml-2" />
+                            ) : null}
+                          </span>
+                        </td>
+                      </tr>
+                    ))}
+                  </tbody>
+                ))}
               </table>
             </div>
           )}

package/src/modules/notifications/i18n/de.json

@@ -85,6 +85,7 @@
   "notifications.settings.types.saveSuccess": "Einstellungen des Benachrichtigungstyps gespeichert",
   "notifications.settings.types.title": "Zustellkanäle pro Typ",
   "notifications.settings.types.typeColumn": "Benachrichtigungstyp",
+  "notifications.settings.types.uncategorized": "Weitere Benachrichtigungen",
   "notifications.title": "Benachrichtigungen",
   "notifications.toast.actionError": "Aktion konnte nicht ausgeführt werden",
   "notifications.toast.actionSuccess": "Aktion erfolgreich ausgeführt",

package/src/modules/notifications/i18n/en.json

@@ -85,6 +85,7 @@
   "notifications.settings.types.saveSuccess": "Notification type settings saved",
   "notifications.settings.types.title": "Delivery channels per type",
   "notifications.settings.types.typeColumn": "Notification type",
+  "notifications.settings.types.uncategorized": "Other notifications",
   "notifications.title": "Notifications",
   "notifications.toast.actionError": "Failed to execute action",
   "notifications.toast.actionSuccess": "Action completed successfully",

package/src/modules/notifications/i18n/es.json

@@ -85,6 +85,7 @@
   "notifications.settings.types.saveSuccess": "Ajustes del tipo de notificación guardados",
   "notifications.settings.types.title": "Canales de entrega por tipo",
   "notifications.settings.types.typeColumn": "Tipo de notificación",
+  "notifications.settings.types.uncategorized": "Otras notificaciones",
   "notifications.title": "Notificaciones",
   "notifications.toast.actionError": "No se pudo ejecutar la acción",
   "notifications.toast.actionSuccess": "Acción completada correctamente",

package/src/modules/notifications/i18n/ko.json

@@ -85,6 +85,7 @@
   "notifications.settings.types.saveSuccess": "알림 유형 설정이 저장되었습니다",
   "notifications.settings.types.title": "유형별 전송 채널",
   "notifications.settings.types.typeColumn": "알림 유형",
+  "notifications.settings.types.uncategorized": "기타 알림",
   "notifications.title": "알림",
   "notifications.toast.actionError": "작업을 실행하지 못했습니다",
   "notifications.toast.actionSuccess": "작업이 성공적으로 완료되었습니다",

package/src/modules/notifications/i18n/pl.json

@@ -85,6 +85,7 @@
   "notifications.settings.types.saveSuccess": "Zapisano ustawienia typu powiadomienia",
   "notifications.settings.types.title": "Kanały dostarczania per typ",
   "notifications.settings.types.typeColumn": "Typ powiadomienia",
+  "notifications.settings.types.uncategorized": "Inne powiadomienia",
   "notifications.title": "Powiadomienia",
   "notifications.toast.actionError": "Nie udało się wykonać akcji",
   "notifications.toast.actionSuccess": "Akcja wykonana pomyślnie",

package/src/modules/notifications/lib/deliveryConfig.ts

@@ -36,6 +36,23 @@ const envString = (value: string | undefined | null) => {
   return trimmed.length ? trimmed : undefined
 }
 
+const PLACEHOLDER_EMAIL_DOMAINS = new Set(['your-domain.com'])
+
+const EMAIL_DOMAIN_PATTERN = /@([^@\s<>]+)>?\s*$/
+
+function isPlaceholderEmailAddress(value: string | undefined | null): boolean {
+  const address = envString(value)
+  if (!address) return false
+  const domain = EMAIL_DOMAIN_PATTERN.exec(address)?.[1]?.toLowerCase()
+  return domain ? PLACEHOLDER_EMAIL_DOMAINS.has(domain) : false
+}
+
+const resolveStoredSenderAddress = (value: string | undefined): string | undefined => {
+  const address = envString(value)
+  if (!address || isPlaceholderEmailAddress(address)) return undefined
+  return address
+}
+
 const resolveEnvDefaults = () => {
   const appUrl = envString(
     process.env.NOTIFICATIONS_APP_URL ||
@@ -77,6 +94,18 @@ export const DEFAULT_NOTIFICATION_DELIVERY_CONFIG: NotificationDeliveryConfig =
   }
 })()
 
+export const STORED_DEFAULT_NOTIFICATION_DELIVERY_CONFIG: NotificationDeliveryConfig = {
+  ...DEFAULT_NOTIFICATION_DELIVERY_CONFIG,
+  strategies: {
+    ...DEFAULT_NOTIFICATION_DELIVERY_CONFIG.strategies,
+    email: {
+      ...DEFAULT_NOTIFICATION_DELIVERY_CONFIG.strategies.email,
+      from: undefined,
+      replyTo: resolveStoredSenderAddress(DEFAULT_NOTIFICATION_DELIVERY_CONFIG.strategies.email.replyTo),
+    },
+  },
+}
+
 const normalizeDeliveryConfig = (input?: unknown | null): NotificationDeliveryConfig => {
   const parsed = notificationDeliveryConfigSchema.safeParse(input ?? {})
   if (!parsed.success) {
@@ -95,8 +124,8 @@ const normalizeDeliveryConfig = (input?: unknown | null): NotificationDeliveryCo
       },
       email: {
         enabled: strategies.email?.enabled ?? DEFAULT_NOTIFICATION_DELIVERY_CONFIG.strategies.email.enabled,
-        from: strategies.email?.from,
-        replyTo: strategies.email?.replyTo,
+        from: resolveStoredSenderAddress(strategies.email?.from),
+        replyTo: resolveStoredSenderAddress(strategies.email?.replyTo),
         subjectPrefix: strategies.email?.subjectPrefix,
       },
       custom: strategies.custom ?? {},

package/src/modules/notifications/lib/notificationMapper.ts

@@ -1,6 +1,7 @@
 import type { NotificationDto } from '@open-mercato/shared/modules/notifications/types'
 import { Notification } from '../data/entities'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { resolveNotificationActionHref } from './safeHref'
 
 const logger = createLogger('notifications').child({ component: 'mapper' })
 
@@ -31,6 +32,7 @@ export function toNotificationDto(notification: Notification): NotificationDto {
       labelKey: action.labelKey,
       variant: action.variant,
       icon: action.icon,
+      href: resolveNotificationActionHref(action.href, notification.sourceEntityId),
     })) ?? [],
     primaryActionId: notification.actionData?.primaryActionId,
     sourceModule: notification.sourceModule,

package/src/modules/notifications/lib/safeHref.ts

@@ -4,6 +4,13 @@ export function isSafeNotificationHref(href: string): boolean {
   return href.startsWith('/') && !href.startsWith('//')
 }
 
+export function resolveNotificationActionHref(
+  href: string | undefined | null,
+  sourceEntityId: string | undefined | null,
+): string | undefined {
+  return href?.replace('{sourceEntityId}', sourceEntityId ?? '') ?? undefined
+}
+
 export function assertSafeNotificationHref(href: string | undefined | null): string | undefined {
   if (href == null) {
     return undefined

package/src/modules/planner/api/availability-date-specific.ts

@@ -4,6 +4,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -40,7 +41,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('planner.availability.errors.organizationRequired', 'Organization context is required'),

package/src/modules/planner/api/availability-weekly.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -36,7 +37,7 @@ async function resolveRequestContext(req: Request): Promise<RequestContext> {
   }
 
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null
   if (!organizationId) {
     throw new CrudHttpError(400, {
       error: translate('planner.availability.errors.organizationRequired', 'Organization context is required'),

package/src/modules/progress/AGENTS.md

@@ -88,6 +88,8 @@ Use stable, grep-friendly ids:
 |----------|--------|---------|
 | `OM_PROGRESS_BROADCAST_MIN_INTERVAL_MS` | Coalesces intermediate `progress.job.updated` broadcasts per job: the service emits only when this many ms elapsed since the last broadcast **or** `progressPercent` advanced by ≥1; sub-threshold updates buffer in memory. Keeps bulk workers from firing one serialized `pg_notify` roundtrip + tenant-wide SSE fan-out per record. Persistence is throttled independently: heartbeats reach the database at least every `HEARTBEAT_INTERVAL_MS` (5s) regardless of this knob, so no value can starve the 60s `STALE_JOB_TIMEOUT_SECONDS` sweep. Terminal events (`created`/`started`/`completed`/`failed`/`cancelled`) are never throttled. Set to `0` to restore per-record emission (tests/debugging). | `250` |
 
+This knob stays service-local: it buffers persistence alongside the broadcast, which the generic mechanism does not. For any OTHER bulk-written browser event, declare `broadcastCoalescing: true` instead — see `packages/events/AGENTS.md` → Coalescing browser deliveries.
+
 ## Concurrency Semantics (multi-instance safe)
 
 `progressService` is safe to run across many app/worker instances. Do not reintroduce read-modify-write transitions:

package/src/modules/progress/api/active/route.ts

@@ -2,6 +2,10 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { ProgressJob } from '../../data/entities'
+import {
+  hasReadableProgressScope,
+  resolveProgressRequestScope,
+} from '../requestScope'
 
 const routeMetadata = {
   GET: { requireAuth: true, requireFeatures: ['progress.view'] },
@@ -17,10 +21,18 @@ export async function GET(req: Request) {
 
   const container = await createRequestContainer()
   const progressService = container.resolve('progressService') as import('../../lib/progressService').ProgressService
+  const scope = await resolveProgressRequestScope(container, auth, req)
+  if (!hasReadableProgressScope(scope)) {
+    return NextResponse.json({ active: [], recentlyCompleted: [] })
+  }
 
-  const ctx = { tenantId: auth.tenantId, organizationId: auth.orgId }
+  const ctx = {
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
+    organizationIds: scope.filterIds,
+  }
 
-  await progressService.markStaleJobsFailed(auth.tenantId, undefined, auth.orgId)
+  await progressService.markStaleJobsFailed(scope.tenantId, undefined, scope.selectedId, scope.filterIds)
 
   const [jobs, recentlyCompleted] = await Promise.all([
     progressService.getActiveJobs(ctx),