@iveri/contracts 0.6.0 → 0.8.0

package/dist/cjs/api/unibox/message.type.d.ts

@@ -0,0 +1,120 @@
+import type { CursorPage } from '../../type/cursor-page.type.js';
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { MessageAuthorType } from './message-author-type.enum.js';
+import type { MessageContentType } from './message-content-type.enum.js';
+import type { MessageDirection } from './message-direction.enum.js';
+import type { MessageStatus } from './message-status.enum.js';
+/** A file attached to a message. Media is referenced by provider URL until `iveri-files-api` exists. */
+export interface MessageAttachment {
+    contentType: MessageContentType;
+    /**
+     * Where the media lives.
+     *
+     * Today this is the provider's own URL, which for most platforms is short-lived and requires
+     * the channel's credentials to fetch — so it is not something a browser can render directly.
+     * Re-hosting is `iveri-files-api`'s job (build-order step 10 territory), and this field is
+     * what will point at it instead.
+     */
+    url: Nullable<string>;
+    /** The provider's media id, which is what a re-host job would need to fetch it. */
+    externalMediaId: Nullable<string>;
+    fileName: Nullable<string>;
+    mimeType: Nullable<string>;
+    sizeBytes: Nullable<number>;
+}
+/**
+ * One message in a conversation.
+ *
+ * Immutable once written, apart from `status` and its timestamps. An inbox is a record of what was
+ * said, and an editable one is not evidence of anything — which matters the first time a customer
+ * disputes what they were told.
+ */
+export interface Message {
+    id: UUID;
+    conversationId: UUID;
+    direction: MessageDirection;
+    authorType: MessageAuthorType;
+    /** The agent who wrote it. Null for anything not authored by a human. */
+    authorUserId: Nullable<UUID>;
+    contentType: MessageContentType;
+    /** The text, or a caption on a media message. Null when there was none. */
+    text: Nullable<string>;
+    attachments: MessageAttachment[];
+    status: MessageStatus;
+    /** Why a `FAILED` message failed, in words an agent can act on. Null otherwise. */
+    failureReason: Nullable<string>;
+    /**
+     * The provider's own message id.
+     *
+     * Inbound, this is the **idempotency key**: Conduit is at-least-once by design and a
+     * redelivered webhook must not produce a second message. Outbound, it arrives with the
+     * provider's acceptance and is what a later status webhook is matched against.
+     */
+    externalMessageId: Nullable<string>;
+    /**
+     * The Conduit dispatch this send was submitted as.
+     *
+     * Kept so a dead letter in Conduit's outbound DLQ can be traced back to the message an agent
+     * is looking at. Conduit puts `x-conduit-dispatch-id` on every send for the same reason from
+     * the other end.
+     */
+    dispatchId: Nullable<UUID>;
+    /**
+     * When the message was said, according to the provider — not when we stored it.
+     *
+     * These differ by however long a provider queued a webhook, which after an outage is hours.
+     * Ordering the thread by arrival would then shuffle a conversation into nonsense, so this is
+     * what the thread sorts on.
+     */
+    sentAt: IsoDateTime;
+    deliveredAt: Nullable<IsoDateTime>;
+    readAt: Nullable<IsoDateTime>;
+    createdAt: IsoDateTime;
+}
+/**
+ * `GET /api/v1/conversations/:id/messages`. Cursor-paged, **newest first**.
+ *
+ * Newest first because that is what a thread opens to, and because paging backwards through
+ * history is the direction a scroll actually goes. The client reverses a page to render it.
+ */
+export type MessagesPage = CursorPage<Message>;
+/** Query for `GET /api/v1/conversations/:id/messages`. */
+export interface GetMessagesQuery {
+    limit?: number;
+    /** Opaque cursor from the previous page's `nextCursor`. Never parse it. */
+    before?: Nullable<string>;
+}
+/**
+ * `POST /api/v1/conversations/:id/messages` — an agent replying.
+ *
+ * Note what is absent: no channel, no recipient, no provider fields. The conversation already
+ * knows which channel it is on and who the contact is, and letting a caller restate either would
+ * be a way to send a message to one person through another person's thread.
+ */
+export interface SendMessageBody {
+    /** The reply text. Required for `TEXT`; a caption otherwise. */
+    text?: Nullable<string>;
+    contentType?: Nullable<MessageContentType>;
+    attachments?: Nullable<MessageAttachment[]>;
+    /**
+     * The caller's idempotency key, scoped to the conversation.
+     *
+     * **Strongly recommended, and forwarded to Conduit as its dispatch key.** Without one, an
+     * agent double-clicking Send messages the customer twice — and unlike an inbound duplicate,
+     * which is evidence, an outbound duplicate is a mistake the customer sees.
+     */
+    idempotencyKey?: Nullable<string>;
+}
+/**
+ * `POST /api/v1/conversations/:id/notes` — a private note in the thread.
+ *
+ * A separate endpoint from sending rather than a flag on {@link SendMessageBody}, because the
+ * difference between "the customer reads this" and "only we read this" must not be one boolean
+ * away from being wrong. It also carries a different permission: writing a note is not sending.
+ */
+export interface AddNoteBody {
+    text: string;
+}
+//# sourceMappingURL=message.type.d.ts.map

package/dist/cjs/api/unibox/message.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.type.d.ts","sourceRoot":"","sources":["../../../../src/api/unibox/message.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AACvE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,gCAAgC,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D,wGAAwG;AACxG,MAAM,WAAW,iBAAiB;IAC9B,WAAW,EAAE,kBAAkB,CAAC;IAEhC;;;;;;;OAOG;IACH,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEtB,mFAAmF;IACnF,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAElC,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC3B,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,OAAO;IACpB,EAAE,EAAE,IAAI,CAAC;IAET,cAAc,EAAE,IAAI,CAAC;IAErB,SAAS,EAAE,gBAAgB,CAAC;IAE5B,UAAU,EAAE,iBAAiB,CAAC;IAE9B,yEAAyE;IACzE,YAAY,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE7B,WAAW,EAAE,kBAAkB,CAAC;IAEhC,2EAA2E;IAC3E,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEvB,WAAW,EAAE,iBAAiB,EAAE,CAAC;IAEjC,MAAM,EAAE,aAAa,CAAC;IAEtB,mFAAmF;IACnF,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEhC;;;;;;OAMG;IACH,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAEpC;;;;;;OAMG;IACH,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAE3B;;;;;;OAMG;IACH,MAAM,EAAE,WAAW,CAAC;IAEpB,WAAW,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE9B,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;AAE/C,0DAA0D;AAC1D,MAAM,WAAW,gBAAgB;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,2EAA2E;IAC3E,MAAM,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC7B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,eAAe;IAC5B,gEAAgE;IAChE,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAExB,WAAW,CAAC,EAAE,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IAE3C,WAAW,CAAC,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC;IAE5C;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,WAAW;IACxB,IAAI,EAAE,MAAM,CAAC;CAChB"}

package/dist/cjs/api/unibox/message.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=message.type.js.map

package/dist/cjs/api/unibox/message.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"message.type.js","sourceRoot":"","sources":["../../../../src/api/unibox/message.type.ts"],"names":[],"mappings":""}

package/dist/cjs/api/unibox/team.type.d.ts

@@ -0,0 +1,50 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { Paginated } from '../../type/paginated.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+/**
+ * A group of agents work is routed to — Support, Sales, Billing.
+ *
+ * **A team is not a role and not a membership.** Identity owns who exists and what they may do;
+ * this owns who is expected to answer what. Keeping them apart is what lets an agent be moved
+ * between teams without touching their permissions, which is the operation that actually happens
+ * weekly.
+ *
+ * `memberUserIds` names users in `iveri-identity-api`, so it is a loose reference with no foreign
+ * key. A user removed there leaves a stale id here; Unibox filters those out when resolving a
+ * team rather than pretending it can prevent them.
+ */
+export interface Team {
+    id: UUID;
+    name: string;
+    description: Nullable<string>;
+    /** Identity user ids. Order is not meaningful. */
+    memberUserIds: UUID[];
+    /**
+     * Conversations on these channels are routed to this team when nothing else claims them.
+     *
+     * Empty means the team takes no automatic routing and is assignment-only. Deliberately a list
+     * on the team rather than a team id on the channel: a channel routed to two teams during a
+     * handover period is a real thing customers ask for, and the other direction cannot express it.
+     */
+    channelIds: UUID[];
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/teams`. Offset-paged; a tenant has a handful. */
+export type TeamsPage = Paginated<Team>;
+/** `POST /api/v1/teams`. */
+export interface CreateTeamBody {
+    name: string;
+    description?: Nullable<string>;
+    memberUserIds?: Nullable<UUID[]>;
+    channelIds?: Nullable<UUID[]>;
+}
+/** `PATCH /api/v1/teams/:id`. Both id lists replace wholesale; omit to leave alone, `[]` clears. */
+export interface UpdateTeamBody {
+    name?: string;
+    description?: Nullable<string>;
+    memberUserIds?: Nullable<UUID[]>;
+    channelIds?: Nullable<UUID[]>;
+}
+//# sourceMappingURL=team.type.d.ts.map

package/dist/cjs/api/unibox/team.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.type.d.ts","sourceRoot":"","sources":["../../../../src/api/unibox/team.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,IAAI;IACjB,EAAE,EAAE,IAAI,CAAC;IAET,IAAI,EAAE,MAAM,CAAC;IAEb,WAAW,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE9B,kDAAkD;IAClD,aAAa,EAAE,IAAI,EAAE,CAAC;IAEtB;;;;;;OAMG;IACH,UAAU,EAAE,IAAI,EAAE,CAAC;IAEnB,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,iEAAiE;AACjE,MAAM,MAAM,SAAS,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;AAExC,4BAA4B;AAC5B,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CACjC;AAED,oGAAoG;AACpG,MAAM,WAAW,cAAc;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC/B,aAAa,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IACjC,UAAU,CAAC,EAAE,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;CACjC"}

package/dist/cjs/api/unibox/team.type.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=team.type.js.map

package/dist/cjs/api/unibox/team.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"team.type.js","sourceRoot":"","sources":["../../../../src/api/unibox/team.type.ts"],"names":[],"mappings":""}

package/dist/cjs/enum/user-permission.enum.d.ts

@@ -128,7 +128,54 @@ export declare enum UserPermission {
      */
     CONDUIT_DISPATCH_SEND = "conduit:dispatch:send",
     /** Redrive a dead-lettered dispatch, or cancel one still pending. */
-    CONDUIT_DISPATCH_OPERATE = "conduit:dispatch:operate"
+    CONDUIT_DISPATCH_OPERATE = "conduit:dispatch:operate",
+    /** Read connected messaging accounts. Never exposes a channel's ingest secret. */
+    UNIBOX_CHANNEL_READ = "unibox:channel:read",
+    /**
+     * Connect, amend or disconnect a messaging account, and rotate its ingest secret.
+     *
+     * A single manage permission for the same reason as `CONDUIT_CONNECTION_MANAGE`: the
+     * dangerous act is holding the credential that lets anything post messages into a tenant's
+     * inbox, and create/update/delete carry that identically.
+     */
+    UNIBOX_CHANNEL_MANAGE = "unibox:channel:manage",
+    /** Read contacts. Personal data — closer to a data-export permission than a config one. */
+    UNIBOX_CONTACT_READ = "unibox:contact:read",
+    /** Create, amend or delete a contact record. */
+    UNIBOX_CONTACT_MANAGE = "unibox:contact:manage",
+    /**
+     * Read the inbox and every message in it.
+     *
+     * **There is deliberately no separate `unibox:message:read`.** A conversation with its
+     * messages hidden is an empty row, so a permission that granted one without the other would
+     * describe a screen nobody can use — and the reverse would be a way to read a customer's
+     * messages while appearing to have no access to the inbox.
+     */
+    UNIBOX_CONVERSATION_READ = "unibox:conversation:read",
+    /** Change a conversation's status — close, snooze, reopen — and write internal notes. */
+    UNIBOX_CONVERSATION_MANAGE = "unibox:conversation:manage",
+    /**
+     * Assign a conversation to an agent or a team, and take over from the AI.
+     *
+     * Separate from `UNIBOX_CONVERSATION_MANAGE` because assignment decides whose work this is.
+     * A supervisor routing a queue and an agent closing their own conversations are different
+     * jobs, and a tenant that wants only the first to reassign should be able to say so.
+     */
+    UNIBOX_CONVERSATION_ASSIGN = "unibox:conversation:assign",
+    /**
+     * Send a message to a contact.
+     *
+     * The sharpest permission in this service, and the reason there is no `unibox:message:*`
+     * read counterpart. Everything else here moves rows around inside our own database; this one
+     * reaches a real person on their phone, through a paid channel, and cannot be taken back.
+     */
+    UNIBOX_MESSAGE_SEND = "unibox:message:send",
+    UNIBOX_TEAM_READ = "unibox:team:read",
+    /** Create teams and change who is in them. Routing, not permissions — identity owns those. */
+    UNIBOX_TEAM_MANAGE = "unibox:team:manage",
+    UNIBOX_CANNED_REPLY_READ = "unibox:canned-reply:read",
+    /** Author the saved replies every agent in the tenant will send. */
+    UNIBOX_CANNED_REPLY_MANAGE = "unibox:canned-reply:manage"
 }
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;IAGrD,wFAAwF;IACxF,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IAGrD,sEAAsE;IACtE,uBAAuB,4BAA4B;IACnD;;;;;OAKG;IACH,yBAAyB,8BAA8B;IAGvD;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C,qEAAqE;IACrE,wBAAwB,6BAA6B;CACxD;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}
+{"version":3,"file":"user-permission.enum.d.ts","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,oBAAY,cAAc;IAItB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,sFAAsF;IACtF,aAAa,kBAAkB;IAG/B,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,eAAe,oBAAoB;IACnC,6EAA6E;IAC7E,iBAAiB,sBAAsB;IACvC;;;OAGG;IACH,sBAAsB,2BAA2B;IAGjD,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAG3B,YAAY,iBAAiB;IAC7B,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IAKjC,qEAAqE;IACrE,qBAAqB,0BAA0B;IAC/C,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IACnD,uBAAuB,4BAA4B;IAGnD;;;;OAIG;IACH,oBAAoB,yBAAyB;IAC7C,sBAAsB,2BAA2B;IAGjD;;;;OAIG;IACH,sBAAsB,2BAA2B;IAGjD,qBAAqB,0BAA0B;IAC/C,yFAAyF;IACzF,uBAAuB,4BAA4B;IAGnD,mEAAmE;IACnE,wBAAwB,6BAA6B;IACrD;;;;;;;OAOG;IACH,0BAA0B,+BAA+B;IAGzD,kBAAkB,uBAAuB;IACzC,2DAA2D;IAC3D,oBAAoB,yBAAyB;IAG7C;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;OAMG;IACH,wBAAwB,6BAA6B;IAGrD,wFAAwF;IACxF,sBAAsB,2BAA2B;IACjD;;;;;;;;OAQG;IACH,wBAAwB,6BAA6B;IAGrD,sEAAsE;IACtE,uBAAuB,4BAA4B;IACnD;;;;;OAKG;IACH,yBAAyB,8BAA8B;IAGvD;;;;;OAKG;IACH,qBAAqB,0BAA0B;IAC/C;;;;;;;OAOG;IACH,qBAAqB,0BAA0B;IAC/C,qEAAqE;IACrE,wBAAwB,6BAA6B;IAKrD,kFAAkF;IAClF,mBAAmB,wBAAwB;IAC3C;;;;;;OAMG;IACH,qBAAqB,0BAA0B;IAG/C,2FAA2F;IAC3F,mBAAmB,wBAAwB;IAC3C,gDAAgD;IAChD,qBAAqB,0BAA0B;IAG/C;;;;;;;OAOG;IACH,wBAAwB,6BAA6B;IACrD,yFAAyF;IACzF,0BAA0B,+BAA+B;IACzD;;;;;;OAMG;IACH,0BAA0B,+BAA+B;IAGzD;;;;;;OAMG;IACH,mBAAmB,wBAAwB;IAG3C,gBAAgB,qBAAqB;IACrC,8FAA8F;IAC9F,kBAAkB,uBAAuB;IAGzC,wBAAwB,6BAA6B;IACrD,oEAAoE;IACpE,0BAA0B,+BAA+B;CAC5D;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,cAAc,EAAiD,CAAC"}

package/dist/cjs/enum/user-permission.enum.js

@@ -150,6 +150,60 @@ var UserPermission;
     UserPermission["CONDUIT_DISPATCH_SEND"] = "conduit:dispatch:send";
     /** Redrive a dead-lettered dispatch, or cancel one still pending. */
     UserPermission["CONDUIT_DISPATCH_OPERATE"] = "conduit:dispatch:operate";
+    // ══ unibox-api ═══════════════════════════════════════════════════════════
+    // ── Channel ─────────────────────────────────────────────────────────────
+    /** Read connected messaging accounts. Never exposes a channel's ingest secret. */
+    UserPermission["UNIBOX_CHANNEL_READ"] = "unibox:channel:read";
+    /**
+     * Connect, amend or disconnect a messaging account, and rotate its ingest secret.
+     *
+     * A single manage permission for the same reason as `CONDUIT_CONNECTION_MANAGE`: the
+     * dangerous act is holding the credential that lets anything post messages into a tenant's
+     * inbox, and create/update/delete carry that identically.
+     */
+    UserPermission["UNIBOX_CHANNEL_MANAGE"] = "unibox:channel:manage";
+    // ── Contact ─────────────────────────────────────────────────────────────
+    /** Read contacts. Personal data — closer to a data-export permission than a config one. */
+    UserPermission["UNIBOX_CONTACT_READ"] = "unibox:contact:read";
+    /** Create, amend or delete a contact record. */
+    UserPermission["UNIBOX_CONTACT_MANAGE"] = "unibox:contact:manage";
+    // ── Conversation ────────────────────────────────────────────────────────
+    /**
+     * Read the inbox and every message in it.
+     *
+     * **There is deliberately no separate `unibox:message:read`.** A conversation with its
+     * messages hidden is an empty row, so a permission that granted one without the other would
+     * describe a screen nobody can use — and the reverse would be a way to read a customer's
+     * messages while appearing to have no access to the inbox.
+     */
+    UserPermission["UNIBOX_CONVERSATION_READ"] = "unibox:conversation:read";
+    /** Change a conversation's status — close, snooze, reopen — and write internal notes. */
+    UserPermission["UNIBOX_CONVERSATION_MANAGE"] = "unibox:conversation:manage";
+    /**
+     * Assign a conversation to an agent or a team, and take over from the AI.
+     *
+     * Separate from `UNIBOX_CONVERSATION_MANAGE` because assignment decides whose work this is.
+     * A supervisor routing a queue and an agent closing their own conversations are different
+     * jobs, and a tenant that wants only the first to reassign should be able to say so.
+     */
+    UserPermission["UNIBOX_CONVERSATION_ASSIGN"] = "unibox:conversation:assign";
+    // ── Message ─────────────────────────────────────────────────────────────
+    /**
+     * Send a message to a contact.
+     *
+     * The sharpest permission in this service, and the reason there is no `unibox:message:*`
+     * read counterpart. Everything else here moves rows around inside our own database; this one
+     * reaches a real person on their phone, through a paid channel, and cannot be taken back.
+     */
+    UserPermission["UNIBOX_MESSAGE_SEND"] = "unibox:message:send";
+    // ── Team ────────────────────────────────────────────────────────────────
+    UserPermission["UNIBOX_TEAM_READ"] = "unibox:team:read";
+    /** Create teams and change who is in them. Routing, not permissions — identity owns those. */
+    UserPermission["UNIBOX_TEAM_MANAGE"] = "unibox:team:manage";
+    // ── Canned reply ────────────────────────────────────────────────────────
+    UserPermission["UNIBOX_CANNED_REPLY_READ"] = "unibox:canned-reply:read";
+    /** Author the saved replies every agent in the tenant will send. */
+    UserPermission["UNIBOX_CANNED_REPLY_MANAGE"] = "unibox:canned-reply:manage";
 })(UserPermission || (exports.UserPermission = UserPermission = {}));
 /**
  * Every member, for seeding the owner role and validating custom-role input.

package/dist/cjs/enum/user-permission.enum.js.map

@@ -1 +1 @@
-{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cAkJX;AAlJD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;AACzD,CAAC,EAlJW,cAAc,8BAAd,cAAc,QAkJzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}
+{"version":3,"file":"user-permission.enum.js","sourceRoot":"","sources":["../../../src/enum/user-permission.enum.ts"],"names":[],"mappings":";;;AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,IAAY,cA+MX;AA/MD,WAAY,cAAc;IACtB,4EAA4E;IAE5E,2EAA2E;IAC3E,6CAA2B,CAAA;IAC3B,iDAA+B,CAAA;IAC/B,sFAAsF;IACtF,iDAA+B,CAAA;IAE/B,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,qDAAmC,CAAA;IACnC,6EAA6E;IAC7E,yDAAuC,CAAA;IACvC;;;OAGG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,yCAAuB,CAAA;IACvB,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAC3B,6CAA2B,CAAA;IAE3B,2EAA2E;IAC3E,+CAA6B,CAAA;IAC7B,iDAA+B,CAAA;IAC/B,mDAAiC,CAAA;IAEjC,4EAA4E;IAE5E,2EAA2E;IAC3E,qEAAqE;IACrE,iEAA+C,CAAA;IAC/C,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IACnD,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E;;;;OAIG;IACH,+DAA6C,CAAA;IAC7C,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E;;;;OAIG;IACH,mEAAiD,CAAA;IAEjD,2EAA2E;IAC3E,iEAA+C,CAAA;IAC/C,yFAAyF;IACzF,qEAAmD,CAAA;IAEnD,2EAA2E;IAC3E,mEAAmE;IACnE,uEAAqD,CAAA;IACrD;;;;;;;OAOG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E,2DAAyC,CAAA;IACzC,2DAA2D;IAC3D,+DAA6C,CAAA;IAE7C,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;OAMG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,wFAAwF;IACxF,mEAAiD,CAAA;IACjD;;;;;;;;OAQG;IACH,uEAAqD,CAAA;IAErD,2EAA2E;IAC3E,sEAAsE;IACtE,qEAAmD,CAAA;IACnD;;;;;OAKG;IACH,yEAAuD,CAAA;IAEvD,2EAA2E;IAC3E;;;;;OAKG;IACH,iEAA+C,CAAA;IAC/C;;;;;;;OAOG;IACH,iEAA+C,CAAA;IAC/C,qEAAqE;IACrE,uEAAqD,CAAA;IAErD,4EAA4E;IAE5E,2EAA2E;IAC3E,kFAAkF;IAClF,6DAA2C,CAAA;IAC3C;;;;;;OAMG;IACH,iEAA+C,CAAA;IAE/C,2EAA2E;IAC3E,2FAA2F;IAC3F,6DAA2C,CAAA;IAC3C,gDAAgD;IAChD,iEAA+C,CAAA;IAE/C,2EAA2E;IAC3E;;;;;;;OAOG;IACH,uEAAqD,CAAA;IACrD,yFAAyF;IACzF,2EAAyD,CAAA;IACzD;;;;;;OAMG;IACH,2EAAyD,CAAA;IAEzD,2EAA2E;IAC3E;;;;;;OAMG;IACH,6DAA2C,CAAA;IAE3C,2EAA2E;IAC3E,uDAAqC,CAAA;IACrC,8FAA8F;IAC9F,2DAAyC,CAAA;IAEzC,2EAA2E;IAC3E,uEAAqD,CAAA;IACrD,oEAAoE;IACpE,2EAAyD,CAAA;AAC7D,CAAC,EA/MW,cAAc,8BAAd,cAAc,QA+MzB;AAED;;;;;GAKG;AACU,QAAA,oBAAoB,GAA8B,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC"}

package/dist/esm/api/identity/access-token-payload.interface.d.ts

@@ -0,0 +1,53 @@
+import type { UserPermission } from '../../enum/user-permission.enum.js';
+import type { UUID } from '../../type/uuid.type.js';
+import type { PrincipalType } from './principal-type.enum.js';
+/**
+ * Claims carried by an access token.
+ *
+ * **`iveri-identity-api` issues these; every other service only verifies them.** The shape is
+ * therefore a contract owned by identity, and it lives here rather than in either repo because
+ * both sides have to agree byte for byte — a service whose idea of these claims has drifted
+ * does not fail loudly, it rejects every request or, worse, reads the wrong field and keeps
+ * going. `conduit-api` carried a hand-copied duplicate of this interface until the `pt` claim
+ * had to be added to both at once, which is exactly the drift the copy invited.
+ *
+ * Names are short and non-obvious (`tid`, `perms`) because this is JWT convention and because
+ * the token travels on every request — the registered claims are three characters for the same
+ * reason.
+ *
+ * **Permissions are embedded rather than resolved per request.** That is the whole point of a
+ * JWT here: any Iveri service verifies a token with the shared secret and never calls identity
+ * on the hot path. The cost is staleness — revoking a role does not invalidate access tokens
+ * already issued, so a removed permission survives up to identity's `JWT_ACCESS_TOKEN_TTL`
+ * (15 minutes by default), or `JWT_SERVICE_TOKEN_TTL` for a service token. Anything needing
+ * immediate revocation must check state at the point of use, not rely on the token.
+ */
+export interface AccessTokenPayload {
+    /**
+     * Subject — **the principal**, which is a user id or an API key id depending on {@link pt}.
+     *
+     * Read it together with `pt` or not at all. Treating it as a user id unconditionally is the
+     * one mistake this shape is arranged to prevent.
+     */
+    sub: UUID;
+    /**
+     * Which kind of principal `sub` names.
+     *
+     * Required, so adding the service-token path could not silently leave a consumer reading a
+     * machine's `sub` as a person's id.
+     */
+    pt: PrincipalType;
+    /** Tenant the token is scoped to. Becomes `RequestContext.tenantId`; never trusted from a header. */
+    tid: UUID;
+    /** Permissions resolved from the principal's roles — or from the API key's grant — at issue time. */
+    perms: UserPermission[];
+    /** Issued-at, seconds since epoch. Set by the signer. */
+    iat?: number;
+    /** Expiry, seconds since epoch. Set by the signer. */
+    exp?: number;
+    /** Issuer, verified on every decode so a token from another Iveri environment is rejected. */
+    iss?: string;
+    /** Audience, verified alongside `iss`. */
+    aud?: string;
+}
+//# sourceMappingURL=access-token-payload.interface.d.ts.map

package/dist/esm/api/identity/access-token-payload.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-payload.interface.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,kBAAkB;IAC/B;;;;;OAKG;IACH,GAAG,EAAE,IAAI,CAAC;IAEV;;;;;OAKG;IACH,EAAE,EAAE,aAAa,CAAC;IAElB,qGAAqG;IACrG,GAAG,EAAE,IAAI,CAAC;IAEV,qGAAqG;IACrG,KAAK,EAAE,cAAc,EAAE,CAAC;IAExB,yDAAyD;IACzD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,8FAA8F;IAC9F,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,0CAA0C;IAC1C,GAAG,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/esm/api/identity/access-token-payload.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=access-token-payload.interface.js.map

package/dist/esm/api/identity/access-token-payload.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token-payload.interface.js","sourceRoot":"","sources":["../../../../src/api/identity/access-token-payload.interface.ts"],"names":[],"mappings":""}

package/dist/esm/api/identity/auth.type.d.ts

@@ -51,6 +51,27 @@ export interface AuthTokens {
     /** Lifetime of `accessToken` in seconds, not of `refreshToken`. */
     expiresInSeconds: number;
 }
+/**
+ * Returned by `POST /auth/token` — the API-key-for-JWT exchange a service makes so that other
+ * Iveri services can authorize it **without calling identity**.
+ *
+ * **There is deliberately no refresh token.** The API key already is the long-lived credential,
+ * and it is revocable by a row. A refresh token here would be a second long-lived credential
+ * with its own independent lifetime, rotation rule and leak story, obtained from the first —
+ * so revoking the key would no longer be enough to stop the caller. A service re-exchanges
+ * instead, which costs one call per {@link expiresInSeconds}.
+ *
+ * The key travels as `x-api-key`, so this call has no request body.
+ */
+export interface ServiceToken {
+    /** Send as `Authorization: Bearer <accessToken>`. Carries `pt: 'service'`. */
+    accessToken: string;
+    /**
+     * Lifetime in seconds. Shorter than a human session's: a service re-exchanges with nobody
+     * waiting, so the revocation window is cheap to shrink.
+     */
+    expiresInSeconds: number;
+}
 /**
  * Who the caller is. Returned by `GET /auth/me` and nested inside {@link AuthSession}.
  *

package/dist/esm/api/identity/auth.type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}
+{"version":3,"file":"auth.type.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/auth.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AACpE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE5D,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACvB,UAAU,EAAE,MAAM,CAAC;IAEnB,sEAAsE;IACtE,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,0BAA0B;AAC1B,MAAM,WAAW,SAAS;IACtB;;;;;OAKG;IACH,UAAU,EAAE,MAAM,CAAC;IAEnB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,oDAAoD;AACpD,MAAM,WAAW,gBAAgB;IAC7B,YAAY,EAAE,MAAM,CAAC;CACxB;AAED,iGAAiG;AACjG,MAAM,WAAW,oBAAoB;IACjC,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,+EAA+E;AAC/E,MAAM,WAAW,UAAU;IACvB,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;IAEpB;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IAErB,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,YAAY;IACzB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,CAAC;IAEpB;;;OAGG;IACH,gBAAgB,EAAE,MAAM,CAAC;CAC5B;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,SAAS;IACtB,qCAAqC;IACrC,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEvB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IACxB,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,QAAQ,EAAE,IAAI,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,YAAY,CAAC;IAE3B,qCAAqC;IACrC,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;IAE7C,SAAS,EAAE,MAAM,EAAE,CAAC;IAEpB,gEAAgE;IAChE,WAAW,EAAE,cAAc,EAAE,CAAC;CACjC;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IACxB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,UAAU,CAAC;CACtB"}

package/dist/esm/api/identity/index.d.ts

@@ -1,4 +1,6 @@
+export * from './access-token-payload.interface.js';
 export * from './auth.type.js';
 export * from './membership-status.enum.js';
+export * from './principal-type.enum.js';
 export * from './tenant-status.enum.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/esm/api/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}

package/dist/esm/api/identity/index.js

@@ -1,4 +1,6 @@
+export * from './access-token-payload.interface.js';
 export * from './auth.type.js';
 export * from './membership-status.enum.js';
+export * from './principal-type.enum.js';
 export * from './tenant-status.enum.js';
 //# sourceMappingURL=index.js.map

package/dist/esm/api/identity/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/api/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAC;AACpD,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,0BAA0B,CAAC;AACzC,cAAc,yBAAyB,CAAC"}

package/dist/esm/api/identity/principal-type.enum.d.ts

@@ -0,0 +1,19 @@
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+export declare enum PrincipalType {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    USER = "user",
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    SERVICE = "service"
+}
+//# sourceMappingURL=principal-type.enum.d.ts.map

package/dist/esm/api/identity/principal-type.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,oBAAY,aAAa;IACrB,qEAAqE;IACrE,IAAI,SAAS;IAEb,4FAA4F;IAC5F,OAAO,YAAY;CACtB"}

package/dist/esm/api/identity/principal-type.enum.js

@@ -0,0 +1,20 @@
+/**
+ * What kind of principal an access token was minted for.
+ *
+ * It exists because `sub` alone cannot answer the question. A JWT's subject is *the principal*,
+ * and identity issues tokens for two kinds of them: a person who logged in, and a service that
+ * exchanged an API key. Both put a UUID in `sub`, and the two UUIDs mean entirely different
+ * things — one names a row in `user`, the other a row in `api_key`.
+ *
+ * A consumer that reads `sub` as a user id without checking this claim attributes a machine's
+ * actions to a user who does not exist. That is why every guard branches on it, and why it is
+ * required rather than optional: `tsc` then makes the branch impossible to forget.
+ */
+export var PrincipalType;
+(function (PrincipalType) {
+    /** A person, authenticated by password. `sub` is their `user.id`. */
+    PrincipalType["USER"] = "user";
+    /** A service, authenticated by API key. `sub` is the `api_key.id`, and there is no user. */
+    PrincipalType["SERVICE"] = "service";
+})(PrincipalType || (PrincipalType = {}));
+//# sourceMappingURL=principal-type.enum.js.map

package/dist/esm/api/identity/principal-type.enum.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"principal-type.enum.js","sourceRoot":"","sources":["../../../../src/api/identity/principal-type.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,MAAM,CAAN,IAAY,aAMX;AAND,WAAY,aAAa;IACrB,qEAAqE;IACrE,8BAAa,CAAA;IAEb,4FAA4F;IAC5F,oCAAmB,CAAA;AACvB,CAAC,EANW,aAAa,KAAb,aAAa,QAMxB"}

package/dist/esm/api/unibox/canned-reply.type.d.ts

@@ -0,0 +1,49 @@
+import type { IsoDateTime } from '../../type/iso-date-time.type.js';
+import type { Nullable } from '../../type/nil.type.js';
+import type { Paginated } from '../../type/paginated.type.js';
+import type { UUID } from '../../type/uuid.type.js';
+/**
+ * A saved reply an agent can insert into a message.
+ *
+ * **Inserted into the composer, never sent by itself.** A canned reply is text an agent chooses
+ * and can edit before sending — it is not an automation, and there is no endpoint that sends one
+ * directly. That line is what keeps this out of §14's no-scripting territory: the moment a saved
+ * reply can fire on a condition, we have built a rules engine in a chat product.
+ */
+export interface CannedReply {
+    id: UUID;
+    /** What an agent types to find it, e.g. `/hours`. Unique within the tenant. */
+    shortcut: string;
+    title: string;
+    /**
+     * The text, with `{{placeholders}}` substituted client-side at insert time.
+     *
+     * Substitution is the client's job on purpose. The server would have to resolve them at send
+     * time, which means an agent could send a message whose final text they never saw — and the
+     * one thing an agent must always be able to do is read what they are about to send.
+     */
+    body: string;
+    /** For grouping in the picker. Null is the ungrouped bucket. */
+    category: Nullable<string>;
+    createdByUserId: Nullable<UUID>;
+    createdAt: IsoDateTime;
+    updatedAt: IsoDateTime;
+}
+/** `GET /api/v1/canned-replies`. Offset-paged. */
+export type CannedRepliesPage = Paginated<CannedReply>;
+/** `POST /api/v1/canned-replies`. */
+export interface CreateCannedReplyBody {
+    /** Lowercase, `[a-z0-9-]`, no leading slash — the UI supplies that. */
+    shortcut: string;
+    title: string;
+    body: string;
+    category?: Nullable<string>;
+}
+/** `PATCH /api/v1/canned-replies/:id`. */
+export interface UpdateCannedReplyBody {
+    shortcut?: string;
+    title?: string;
+    body?: string;
+    category?: Nullable<string>;
+}
+//# sourceMappingURL=canned-reply.type.d.ts.map

package/dist/esm/api/unibox/canned-reply.type.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"canned-reply.type.d.ts","sourceRoot":"","sources":["../../../../src/api/unibox/canned-reply.type.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,yBAAyB,CAAC;AAEpD;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IACxB,EAAE,EAAE,IAAI,CAAC;IAET,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,CAAC;IAEjB,KAAK,EAAE,MAAM,CAAC;IAEd;;;;;;OAMG;IACH,IAAI,EAAE,MAAM,CAAC;IAEb,gEAAgE;IAChE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;IAE3B,eAAe,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEhC,SAAS,EAAE,WAAW,CAAC;IACvB,SAAS,EAAE,WAAW,CAAC;CAC1B;AAED,kDAAkD;AAClD,MAAM,MAAM,iBAAiB,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;AAEvD,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IAClC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC/B;AAED,0CAA0C;AAC1C,MAAM,WAAW,qBAAqB;IAClC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;CAC/B"}

package/dist/esm/api/unibox/canned-reply.type.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=canned-reply.type.js.map

package/dist/esm/api/unibox/canned-reply.type.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canned-reply.type.js","sourceRoot":"","sources":["../../../../src/api/unibox/canned-reply.type.ts"],"names":[],"mappings":""}

package/dist/esm/api/unibox/channel-platform.enum.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The messaging network a channel is connected to.
+ *
+ * This is Unibox's vocabulary, not Conduit's. Conduit knows about *connectors* — a set of hosts
+ * and operations someone wrote down — and has no idea that any of them carry conversations.
+ * Unibox knows that a WhatsApp message and an Instagram message are the same kind of thing and
+ * belong in one inbox, which is the whole product.
+ *
+ * The members are the platforms Unibox can **normalize**, which is a stricter bar than the ones
+ * Conduit can talk to: normalizing means we can read a provider's webhook into a contact, a
+ * conversation and a message, and write a reply back. Adding one is a normalizer plus a
+ * connector manifest, and is a minor version here.
+ */
+export declare enum ChannelPlatform {
+    /** WhatsApp Cloud API. The first real platform, and the one `conduit-api` ships a manifest for. */
+    WHATSAPP = "whatsapp",
+    /** Instagram Direct, via the Messenger Platform. */
+    INSTAGRAM = "instagram",
+    /** Facebook Messenger. */
+    MESSENGER = "messenger",
+    /**
+     * A loopback platform for local development and tests, matching Conduit's `local-echo`
+     * connector.
+     *
+     * It exists for the same reason that connector does: the entire pipeline — receive,
+     * normalize, thread, reply, dispatch — is provable without a Meta app, and a real Meta app
+     * would only prove we can talk to Meta. It is a first-class member rather than a test double
+     * so the normalizer registry has no branch that only exists under Jest.
+     */
+    ECHO = "echo"
+}
+//# sourceMappingURL=channel-platform.enum.d.ts.map

package/dist/esm/api/unibox/channel-platform.enum.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-platform.enum.d.ts","sourceRoot":"","sources":["../../../../src/api/unibox/channel-platform.enum.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,oBAAY,eAAe;IACvB,mGAAmG;IACnG,QAAQ,aAAa;IAErB,oDAAoD;IACpD,SAAS,cAAc;IAEvB,0BAA0B;IAC1B,SAAS,cAAc;IAEvB;;;;;;;;OAQG;IACH,IAAI,SAAS;CAChB"}