@open-mercato/core 0.9.0 → 0.9.1-develop.7459.1.99e3accd30

package/src/modules/communication_channels/api/post/channels/connect/credentials/route.ts

@@ -33,16 +33,14 @@ export async function POST(req: Request): Promise<Response> {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  let body: z.infer<typeof bodySchema>
-  try {
-    const json = await readJsonSafe(req, null)
-    body = bodySchema.parse(json)
-  } catch (err) {
+  const parsed = bodySchema.safeParse(await readJsonSafe(req, null))
+  if (!parsed.success) {
     return NextResponse.json(
-      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { error: 'Invalid request body', details: parsed.error.issues },
       { status: 422 },
     )
   }
+  const body = parsed.data
 
   const container = await createRequestContainer()
 

package/src/modules/communication_channels/api/post/channels/connect/tenant-credentials/route.ts

@@ -33,16 +33,14 @@ export async function POST(req: Request): Promise<Response> {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  let body: z.infer<typeof bodySchema>
-  try {
-    const json = await readJsonSafe(req, null)
-    body = bodySchema.parse(json)
-  } catch (err) {
+  const parsed = bodySchema.safeParse(await readJsonSafe(req, null))
+  if (!parsed.success) {
     return NextResponse.json(
-      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { error: 'Invalid request body', details: parsed.error.issues },
       { status: 422 },
     )
   }
+  const body = parsed.data
 
   const container = await createRequestContainer()
 

package/src/modules/communication_channels/api/post/oauth/[provider]/initiate/route.ts

@@ -4,6 +4,8 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { toAbsoluteUrl } from '@open-mercato/shared/lib/url'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { getChannelAdapter } from '../../../../../lib/adapter-registry-singleton'
 import { resolveOAuthClientCredentials } from '../../../../../lib/oauth-client-config'
 import {
@@ -16,6 +18,8 @@ import {
   OAuthStateError,
 } from '../../../../../lib/oauth-state'
 
+const logger = createLogger('communication_channels').child({ component: 'oauth-initiate' })
+
 export const metadata = {
   path: '/communication_channels/oauth/[provider]/initiate',
   POST: {
@@ -56,6 +60,21 @@ function defaultRedirectUri(req: Request, providerKey: string): string {
   return toAbsoluteUrl(req, `/api/communication_channels/oauth/${providerKey}/callback`)
 }
 
+function oauthStateErrorResponse(err: unknown): Response | null {
+  if (err instanceof OAuthStateError) {
+    if (err.code === 'missing_secret') {
+      logger.error('OAuth state secret is not configured', { err })
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'communication_channels',
+        code: 'communication_channels.missing_secret',
+      })
+      return NextResponse.json({ error: 'OAuth is not available', code: err.code }, { status: 500 })
+    }
+    return NextResponse.json({ error: err.message, code: err.code }, { status: 500 })
+  }
+  return null
+}
+
 export async function POST(req: Request, context: RouteContext): Promise<Response> {
   const { provider } = await context.params
   if (!/^[a-z0-9_-]+$/i.test(provider)) {
@@ -121,13 +140,20 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
   }
 
   const redirectUri = defaultRedirectUri(req, provider)
-  const stateEnvelope = createOAuthState({
-    userId: auth.sub as string,
-    tenantId: auth.tenantId as string,
-    organizationId: (auth as { orgId?: string | null }).orgId ?? null,
-    providerKey: provider,
-    returnUrl: normalizeOAuthReturnUrl(body.returnUrl, DEFAULT_OAUTH_RETURN_URL),
-  })
+  let stateEnvelope: ReturnType<typeof createOAuthState>
+  try {
+    stateEnvelope = createOAuthState({
+      userId: auth.sub as string,
+      tenantId: auth.tenantId as string,
+      organizationId: (auth as { orgId?: string | null }).orgId ?? null,
+      providerKey: provider,
+      returnUrl: normalizeOAuthReturnUrl(body.returnUrl, DEFAULT_OAUTH_RETURN_URL),
+    })
+  } catch (err) {
+    const response = oauthStateErrorResponse(err)
+    if (response) return response
+    throw err
+  }
 
   let result
   try {
@@ -153,12 +179,21 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
 
   // If the adapter packed extras (PKCE verifier, scopes), bake them into the
   // state cookie now so the callback handler can pass them to exchangeOAuthCode.
-  const finalCookie = result.extra
-    ? (await import('../../../../../lib/oauth-state')).encryptOAuthState({
+  let finalCookie: string
+  if (result.extra) {
+    try {
+      finalCookie = (await import('../../../../../lib/oauth-state')).encryptOAuthState({
         ...stateEnvelope.payload,
         extra: { ...(stateEnvelope.payload.extra ?? {}), ...result.extra },
       })
-    : stateEnvelope.cookie
+    } catch (err) {
+      const response = oauthStateErrorResponse(err)
+      if (response) return response
+      throw err
+    }
+  } else {
+    finalCookie = stateEnvelope.cookie
+  }
 
   const response = NextResponse.json({ authorizeUrl: result.authorizeUrl })
   response.cookies.set({
@@ -184,6 +219,7 @@ export const openApi = {
         { status: 400, description: 'Invalid provider or unsupported (no OAuth)' },
         { status: 401, description: 'Unauthorized' },
         { status: 422, description: 'Invalid request body' },
+        { status: 500, description: 'OAuth state secret missing or state encryption failed' },
         { status: 502, description: 'Adapter failed to build authorize URL' },
       ],
     },

package/src/modules/communication_channels/commands/deliver-outbound-message.ts

@@ -76,6 +76,11 @@ export type DeliverOutboundMessageResult =
 export const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =
   'communication_channels.message.deliver_outbound'
 
+function omitRawMessage(metadata: Record<string, unknown> | undefined): Record<string, unknown> {
+  if (!metadata) return {}
+  return Object.fromEntries(Object.entries(metadata).filter(([key]) => key !== 'rawMessage'))
+}
+
 type CredentialsServiceLike = {
   resolve: (
     integrationId: string,
@@ -500,7 +505,7 @@ const deliverOutboundMessageCommand: CommandHandler<
       link.externalMessageId = externalMessageRowId
       link.channelMetadata = {
         ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),
-        ...(converted.metadata ?? {}),
+        ...omitRawMessage(converted.metadata),
         externalMessageId: sendResult.externalMessageId,
         // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ
         // strategy in lib/thread-matcher) and sent-folder dedup can resolve this

package/src/modules/communication_channels/i18n/de.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Kanal verbunden.",
   "communication_channels.profile.connect.connecting": "Wird verbunden...",
   "communication_channels.profile.connect.credentialsFailed": "Postfach konnte nicht verbunden werden.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Geben Sie eine gültige E-Mail-Adresse ein.",
+  "communication_channels.profile.connect.errors.invalidPort": "Geben Sie einen Port zwischen 1 und 65535 ein.",
+  "communication_channels.profile.connect.errors.required": "Dieses Feld ist erforderlich.",
   "communication_channels.profile.connect.fields.displayName": "Anzeigename",
   "communication_channels.profile.connect.fields.fromAddress": "Absenderadresse",
   "communication_channels.profile.connect.fields.imapHost": "IMAP-Host",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "IMAP-Postfach verbinden",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Dieses Postfach ist bereits über einen anderen Anbieter verbunden. Trennen Sie es zuerst, um es mit einem anderen Anbieter erneut zu verbinden.",
   "communication_channels.profile.connect.menu": "Kanal verbinden",
+  "communication_channels.profile.connect.notAvailable": "Die Verbindung mit einem Postfach ist nicht verfügbar. Bitten Sie einen Administrator, den OAuth-Zustandsschlüssel zu konfigurieren.",
   "communication_channels.profile.connect.notConfigured": "Dieser Anbieter ist noch nicht konfiguriert. Bitten Sie einen Administrator, die OAuth-Client-ID und das Secret unter Integrationen zu hinterlegen, bevor ein Postfach verbunden wird.",
   "communication_channels.profile.connect.oauthFailed": "OAuth-Verbindung konnte nicht gestartet werden.",
   "communication_channels.profile.connect.save": "Verbinden",

package/src/modules/communication_channels/i18n/en.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Channel connected.",
   "communication_channels.profile.connect.connecting": "Connecting...",
   "communication_channels.profile.connect.credentialsFailed": "Could not connect mailbox.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Enter a valid email address.",
+  "communication_channels.profile.connect.errors.invalidPort": "Enter a port between 1 and 65535.",
+  "communication_channels.profile.connect.errors.required": "This field is required.",
   "communication_channels.profile.connect.fields.displayName": "Display name",
   "communication_channels.profile.connect.fields.fromAddress": "From address",
   "communication_channels.profile.connect.fields.imapHost": "IMAP host",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Connect IMAP mailbox",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "This mailbox is already connected through another provider. Disconnect it first to reconnect it with a different one.",
   "communication_channels.profile.connect.menu": "Connect channel",
+  "communication_channels.profile.connect.notAvailable": "Mailbox connection is not available. Ask an administrator to configure the OAuth state key.",
   "communication_channels.profile.connect.notConfigured": "This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.",
   "communication_channels.profile.connect.oauthFailed": "Could not start OAuth connection.",
   "communication_channels.profile.connect.save": "Connect",

package/src/modules/communication_channels/i18n/es.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Canal conectado.",
   "communication_channels.profile.connect.connecting": "Conectando...",
   "communication_channels.profile.connect.credentialsFailed": "No se pudo conectar el buzón.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Introduce una dirección de correo electrónico válida.",
+  "communication_channels.profile.connect.errors.invalidPort": "Introduce un puerto entre 1 y 65535.",
+  "communication_channels.profile.connect.errors.required": "Este campo es obligatorio.",
   "communication_channels.profile.connect.fields.displayName": "Nombre visible",
   "communication_channels.profile.connect.fields.fromAddress": "Dirección de remitente",
   "communication_channels.profile.connect.fields.imapHost": "Host IMAP",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Conectar buzón IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Este buzón ya está conectado a través de otro proveedor. Desconéctalo primero para volver a conectarlo con uno diferente.",
   "communication_channels.profile.connect.menu": "Conectar canal",
+  "communication_channels.profile.connect.notAvailable": "La conexión del buzón no está disponible. Pide a un administrador que configure la clave de estado de OAuth.",
   "communication_channels.profile.connect.notConfigured": "Este proveedor aún no está configurado. Pide a un administrador que añada el ID de cliente y el secreto de OAuth en Integraciones antes de conectar un buzón.",
   "communication_channels.profile.connect.oauthFailed": "No se pudo iniciar la conexión OAuth.",
   "communication_channels.profile.connect.save": "Conectar",

package/src/modules/communication_channels/i18n/ko.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "채널이 연결되었습니다.",
   "communication_channels.profile.connect.connecting": "연결 중...",
   "communication_channels.profile.connect.credentialsFailed": "메일함에 연결할 수 없습니다.",
+  "communication_channels.profile.connect.errors.invalidEmail": "유효한 이메일 주소를 입력하세요.",
+  "communication_channels.profile.connect.errors.invalidPort": "1에서 65535 사이의 포트를 입력하세요.",
+  "communication_channels.profile.connect.errors.required": "필수 입력 항목입니다.",
   "communication_channels.profile.connect.fields.displayName": "표시 이름",
   "communication_channels.profile.connect.fields.fromAddress": "보내는 주소",
   "communication_channels.profile.connect.fields.imapHost": "IMAP 호스트",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "IMAP 메일함 연결",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "이 메일함은 이미 다른 제공업체를 통해 연결되어 있습니다. 다른 제공업체로 다시 연결하려면 먼저 연결을 해제하세요.",
   "communication_channels.profile.connect.menu": "채널 연결",
+  "communication_channels.profile.connect.notAvailable": "메일함 연결을 사용할 수 없습니다. 관리자에게 OAuth 상태 키를 구성하도록 요청하세요.",
   "communication_channels.profile.connect.notConfigured": "이 제공업체는 아직 구성되지 않았습니다. 메일함을 연결하기 전에 관리자에게 통합에서 OAuth 클라이언트 ID와 시크릿을 추가하도록 요청하세요.",
   "communication_channels.profile.connect.oauthFailed": "OAuth 연결을 시작할 수 없습니다.",
   "communication_channels.profile.connect.save": "연결",

package/src/modules/communication_channels/i18n/pl.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Kanał połączony.",
   "communication_channels.profile.connect.connecting": "Łączenie...",
   "communication_channels.profile.connect.credentialsFailed": "Nie udało się połączyć skrzynki pocztowej.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Wprowadź prawidłowy adres e-mail.",
+  "communication_channels.profile.connect.errors.invalidPort": "Wprowadź port z zakresu od 1 do 65535.",
+  "communication_channels.profile.connect.errors.required": "To pole jest wymagane.",
   "communication_channels.profile.connect.fields.displayName": "Nazwa wyświetlana",
   "communication_channels.profile.connect.fields.fromAddress": "Adres nadawcy",
   "communication_channels.profile.connect.fields.imapHost": "Host IMAP",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Połącz skrzynkę IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Ta skrzynka jest już połączona przez innego dostawcę. Najpierw ją rozłącz, aby połączyć ją z innym dostawcą.",
   "communication_channels.profile.connect.menu": "Połącz kanał",
+  "communication_channels.profile.connect.notAvailable": "Połączenie skrzynki pocztowej jest niedostępne. Poproś administratora o skonfigurowanie klucza stanu OAuth.",
   "communication_channels.profile.connect.notConfigured": "Ten dostawca nie został jeszcze skonfigurowany. Poproś administratora o dodanie identyfikatora klienta i sekretu OAuth w sekcji Integracje przed połączeniem skrzynki.",
   "communication_channels.profile.connect.oauthFailed": "Nie udało się rozpocząć połączenia OAuth.",
   "communication_channels.profile.connect.save": "Połącz",

package/src/modules/communication_channels/lib/inbound-message-origin.ts

@@ -1,12 +1,8 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveCommunicationChannelsSystemUserId } from './system-user'
+import { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE } from '../../messages/lib/messageSourceEntityTypes'
 
-/**
- * Entity type a channel-backed conversation is exposed under on a message's
- * `sourceEntityType`. Written by `commands/ingest-inbound-message.ts` and
- * inherited by every operator message composed on the same conversation.
- */
-export const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'
+export { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE }
 
 /**
  * Dedup key `ingest-inbound-message` stamps on the platform message it composes,

package/src/modules/communication_channels/lib/oauth-state.ts

@@ -138,7 +138,10 @@ function getSecret(): string {
   // state cookies, bypassing the userId/tenant binding. In non-production we fall
   // back to JWT_SECRET so dev/test envs that only configure one secret still work.
   if (process.env.NODE_ENV === 'production') {
-    throw new Error('[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production')
+    throw new OAuthStateError(
+      '[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production',
+      'missing_secret',
+    )
   }
   const fallback = process.env.JWT_SECRET
   if (!fallback) {

package/src/modules/communication_channels/lib/use-connect-channel.ts

@@ -46,6 +46,16 @@ export function useConnectChannel(options: {
       })
       const body = response.result as InitiateResponse | undefined
       if (!response.ok || !body?.authorizeUrl) {
+        if (body?.code === 'missing_secret') {
+          flash(
+            t(
+              'communication_channels.profile.connect.notAvailable',
+              'Mailbox connection is not available. Ask an administrator to configure the OAuth state key.',
+            ),
+            'error',
+          )
+          return
+        }
         if (body?.code === 'oauth_client_not_configured') {
           flash(
             t(

package/src/modules/customers/api/activity-types/route.ts

@@ -0,0 +1,154 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveDictionaryRouteContext } from '../dictionaries/context'
+import { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from '../dictionaries/cache'
+import { getInjectionRegistryVersion } from '@open-mercato/shared/modules/widgets/injection-loader'
+import {
+  resolveScopedCalendarEventTypes,
+} from '../../lib/calendar/eventTypeResolver'
+import { calendarEventTypeBehaviorSchema } from '../../calendar-event-types'
+import { getCalendarEventTypeRegistryVersion } from '../../calendar-event-types'
+
+const logger = createLogger('customers')
+
+function reportActivityTypeError(error: unknown, code: string, attributes?: Record<string, string>): void {
+  try {
+    getTelemetryRuntime()?.reportError(error, { module: 'customers', code, attributes })
+  } catch {}
+}
+
+const querySchema = z.object({ organizationId: z.string().uuid().optional() })
+const responseSchema = z.object({
+  fallbackKey: z.literal('meeting'),
+  items: z.array(z.object({
+    key: z.string(),
+    label: z.string(),
+    labelKey: z.string().optional(),
+    icon: z.string().nullable().optional(),
+    color: z.string().nullable().optional(),
+    behavior: calendarEventTypeBehaviorSchema,
+    selectable: z.boolean(),
+    panelKey: z.string().optional(),
+    source: z.string(),
+    provenance: z.record(z.string(), z.unknown()),
+    historical: z.boolean(),
+    fallbackReason: z.enum(['tombstoned', 'module-unavailable', 'unknown']).optional(),
+    adminConfigurable: z.boolean(),
+    isInherited: z.boolean(),
+    isLocalOverride: z.boolean(),
+    updatedAt: z.string().nullable(),
+    missingCustomFieldsetIds: z.array(z.string()),
+    inactiveDictionaryOverride: z.boolean().optional(),
+  })),
+})
+
+export const metadata = {
+  GET: { requireAuth: true },
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const query = querySchema.parse({ organizationId: url.searchParams.get('organizationId') ?? undefined })
+    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId })
+    if (!context.organizationId) {
+      return NextResponse.json({ error: context.translate('customers.errors.organization_required', 'Organization context is required') }, { status: 400 })
+    }
+    const organizationId = context.organizationId
+    const rbac = context.container.resolve('rbacService') as RbacService | undefined
+    const actorId = context.auth?.sub
+    if (!rbac || !actorId) {
+      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })
+    }
+    const permissionScope = { tenantId: context.tenantId, organizationId }
+    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ['customers.interactions.view'], permissionScope)
+    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ['customers.settings.manage'], permissionScope)
+    if (!canManageSettings) {
+      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })
+    }
+    const hierarchy = context.container.resolve('organizationHierarchyService') as OrganizationHierarchyService
+    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId })
+    if (ancestors === null) {
+      throw new CrudHttpError(403, { error: context.translate('customers.errors.organization_forbidden', 'Organization not accessible') })
+    }
+    const scopeIds = Array.from(new Set([organizationId, ...ancestors.slice().reverse()]))
+    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join('|')}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`
+    const cached = await context.cache?.get(cacheKey)
+    if (cached) return NextResponse.json(cached)
+
+    let catalog
+    try {
+      catalog = await resolveScopedCalendarEventTypes({
+        em: context.em,
+        tenantId: context.tenantId,
+        organizationId,
+        readableOrganizationIds: scopeIds,
+      })
+    } catch (err) {
+      logger.error('customers.activity_types.resolve failed', {
+        err,
+        tenantId: context.tenantId,
+        organizationId,
+      })
+      reportActivityTypeError(err, 'customers.activity_type_catalog_resolution_failed', {
+        tenantId: context.tenantId,
+        organizationId,
+      })
+      return NextResponse.json({
+        error: context.translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),
+        code: 'activity_type_catalog_unavailable',
+      }, { status: 503 })
+    }
+    if (context.cache) {
+      await context.cache.set(cacheKey, catalog, {
+        ttl: DICTIONARY_CACHE_TTL_MS,
+        tags: createDictionaryCacheTags({
+          tenantId: context.tenantId,
+          mappedKind: 'activity_type',
+          organizationIds: scopeIds,
+        }),
+      }).catch((err) => {
+        logger.warn('customers.activity_types cache write failed', { err })
+        reportActivityTypeError(err, 'customers.activity_type_catalog_cache_write_failed', {
+          tenantId: context.tenantId,
+          organizationId,
+        })
+      })
+    }
+    return NextResponse.json(catalog)
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('customers.activity_types request failed', { err })
+    reportActivityTypeError(err, 'customers.activity_type_catalog_request_failed')
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({
+      error: translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),
+    }, { status: err instanceof z.ZodError ? 400 : 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Effective calendar activity types',
+  methods: {
+    GET: {
+      summary: 'List effective calendar activity types',
+      description: 'Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.',
+      responses: [{ status: 200, description: 'Effective activity-type catalog', schema: responseSchema }],
+      errors: [
+        { status: 400, description: 'Organization scope is required', schema: z.object({ error: z.string() }) },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },
+        { status: 500, description: 'Unexpected server error', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -10,7 +10,12 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
-import { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'
+import {
+  CustomerDeal,
+  CustomerDealPersonLink,
+  CustomerEntity,
+  CustomerPersonProfile,
+} from '../../../../data/entities'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customers')
@@ -41,12 +46,36 @@ type DealPersonItem = {
   kind: 'person'
   linkedAt: string
   isPrimary: boolean
+  // Added for the shared linked-people card, which renders the same shape the company
+  // endpoint already returns. Purely additive: every key above keeps its meaning, so
+  // `DealLinkedEntitiesTab` and any third-party consumer are unaffected.
+  displayName: string
+  primaryEmail: string | null
+  primaryPhone: string | null
+  status: string | null
+  lifecycleStage: string | null
+  jobTitle: string | null
+  department: string | null
+  createdAt: string
+  organizationId: string
+  temperature: string | null
+  source: string | null
 }
 
 function matchesSearch(item: DealPersonItem, query: string): boolean {
   const normalized = query.trim().toLowerCase()
   if (!normalized.length) return true
-  return [item.label, item.subtitle]
+  return [
+    item.label,
+    item.subtitle,
+    item.primaryEmail,
+    item.primaryPhone,
+    item.jobTitle,
+    item.department,
+    item.status,
+    item.lifecycleStage,
+    item.source,
+  ]
     .filter((value): value is string => typeof value === 'string' && value.length > 0)
     .some((value) => value.toLowerCase().includes(normalized))
 }
@@ -119,17 +148,56 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
       entityScope,
     )
 
+    // One batched read for the profile-only columns, keyed by every linked person — not one
+    // query per row. The handler filters, sorts and paginates in memory below, so the batch
+    // covers the whole link set rather than the page; that is fine at the expected scale of
+    // tens of contacts per deal, and the in-memory pipeline is what to revisit first if it
+    // ever is not.
+    const personIds = links
+      .map((link) => (link.person as CustomerEntity | null)?.id)
+      .filter((personId): personId is string => typeof personId === 'string' && personId.length > 0)
+
+    const profiles = personIds.length > 0
+      ? await findWithDecryption(
+          em,
+          CustomerPersonProfile,
+          {
+            entity: { $in: personIds },
+            tenantId: deal.tenantId,
+            organizationId: deal.organizationId,
+          },
+          {},
+          entityScope,
+        )
+      : []
+    const profileByPersonId = new Map(
+      profiles.map((profile) => [(profile.entity as { id: string }).id, profile]),
+    )
+
     const items = links
       .map((link) => {
         const person = link.person as CustomerEntity | null
         if (!person?.id) return null
+        const profile = profileByPersonId.get(person.id) ?? null
+        const displayName = person.displayName ?? person.primaryEmail ?? person.id
         return {
           id: person.id,
-          label: person.displayName ?? person.primaryEmail ?? person.id,
+          label: displayName,
           subtitle: person.primaryEmail ?? person.primaryPhone ?? null,
           kind: 'person',
           linkedAt: link.createdAt.toISOString(),
           isPrimary: link.isPrimary === true,
+          displayName,
+          primaryEmail: person.primaryEmail ?? null,
+          primaryPhone: person.primaryPhone ?? null,
+          status: person.status ?? null,
+          lifecycleStage: person.lifecycleStage ?? null,
+          jobTitle: profile?.jobTitle ?? null,
+          department: profile?.department ?? null,
+          createdAt: person.createdAt.toISOString(),
+          organizationId: person.organizationId,
+          temperature: person.temperature ?? null,
+          source: person.source ?? null,
         } satisfies DealPersonItem
       })
       .filter((item): item is DealPersonItem => item !== null)
@@ -176,6 +244,17 @@ export const openApi: OpenApiRouteDoc = {
                 kind: z.literal('person'),
                 linkedAt: z.string(),
                 isPrimary: z.boolean(),
+                displayName: z.string(),
+                primaryEmail: z.string().nullable(),
+                primaryPhone: z.string().nullable(),
+                status: z.string().nullable(),
+                lifecycleStage: z.string().nullable(),
+                jobTitle: z.string().nullable(),
+                department: z.string().nullable(),
+                createdAt: z.string(),
+                organizationId: z.string().uuid().nullable(),
+                temperature: z.string().nullable(),
+                source: z.string().nullable(),
               }),
             ),
             total: z.number().int().nonnegative(),

package/src/modules/customers/api/dictionaries/[kind]/[id]/route.ts

@@ -17,6 +17,7 @@ import {
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { calendarEventTypeBehaviorSchema } from '../../../../calendar-event-types'
 
 const logger = createLogger('customers')
 
@@ -30,8 +31,9 @@ const patchSchema = z
     label: z.string().trim().max(150).optional(),
     color: z.union([z.string().trim(), z.null()]).optional(),
     icon: z.union([z.string().trim(), z.null()]).optional(),
+    behavior: calendarEventTypeBehaviorSchema.nullable().optional(),
   })
-  .refine((input) => input.value !== undefined || input.label !== undefined || input.color !== undefined || input.icon !== undefined, {
+  .refine((input) => input.value !== undefined || input.label !== undefined || input.color !== undefined || input.icon !== undefined || input.behavior !== undefined, {
     message: 'No changes provided',
   })
 
@@ -81,6 +83,7 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
           label: payload.label,
           color: payload.color,
           icon: payload.icon,
+          behavior: payload.behavior,
         },
         ctx: routeContext.ctx,
       })) as CommandExecuteResult<{ entryId: string; changed: boolean }>
@@ -103,6 +106,7 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
               ),
             })
           }
+          if (typeof err.body.code === 'string') throw err
           throw new CrudHttpError(409, { error: routeContext.translate('customers.config.dictionaries.errors.duplicate', 'An entry with this value already exists') })
         }
         if (err.status === 400) {
@@ -141,8 +145,10 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
       label: entry.label,
       color: entry.color,
       icon: entry.icon,
+      ...(mappedKind === 'activity_type' ? { behavior: entry.activityTypeBehavior ?? null } : {}),
       organizationId: entry.organizationId,
       isInherited: false,
+      updatedAt: entry.updatedAt,
     })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -297,8 +303,10 @@ const dictionaryEntrySchema = z.object({
   label: z.string().nullable().optional(),
   color: z.string().nullable().optional(),
   icon: z.string().nullable().optional(),
+  behavior: calendarEventTypeBehaviorSchema.nullable().optional(),
   organizationId: z.string().uuid().nullable().optional(),
   isInherited: z.boolean().optional(),
+  updatedAt: z.date().or(z.string()).optional(),
 })
 
 const dictionaryDeleteResponseSchema = z.object({