@nlabs/reaktor 1.19.0 → 1.20.0-reactorbox.1

package/lib/actions/supportConversation.js

@@ -0,0 +1,100 @@
+/* eslint-disable no-underscore-dangle -- Native document identity and revision checks. */ import { aql } from 'arangojs';
+import { scopeContextToApp } from '../utils/appContext.js';
+import { useDb } from '../utils/arangodbUtils.js';
+import { crmCanonicalDigest } from './crmCanonicalPolicy.js';
+import { authorizeCrmExecutionGrant } from './crmExecution.js';
+export const supportConversationKey = (value)=>typeof value === 'string' && /^[\w.-]{1,160}$/.test(value);
+export const validSupportConversationInput = (input)=>Boolean(input && Object.keys(input).sort().join(',') === 'appId,ticketId,ticketRevision' && [
+        input.appId,
+        input.ticketId,
+        input.ticketRevision
+    ].every(supportConversationKey));
+export const readSupportConversationRow = async (db, input, purpose, query = db.query.bind(db))=>query(aql`
+  LET ticket = DOCUMENT('supportTickets', ${input.ticketId})
+  LET user = ticket ? DOCUMENT('users', ticket.userId) : null
+  LET matchingConsent = (FOR candidate IN supportPurposeConsents FILTER candidate.appId == ${input.appId}
+    AND candidate.userId == user._key AND candidate.purpose == ${purpose} LIMIT 2 RETURN candidate)
+  LET messages = (FOR message IN supportTicketMessages FILTER message.supportTicketId == ${input.ticketId}
+    AND (message.appId == null OR message.appId == ${input.appId}) AND message.visibility == 'customer' AND
+      message.deleted != true
+    SORT message.modified ASC, message._key ASC LIMIT 51
+    LET bindings = (FOR edge IN hasSupportTicketMessage FILTER edge._from == ${`supportTickets/${input.ticketId}`}
+      AND edge._to == CONCAT('supportTicketMessages/', message._key) AND edge.visibility == 'customer' LIMIT 2
+        RETURN edge._key)
+    RETURN {bindingCount: LENGTH(bindings), _key: message._key, _rev: message._rev, appId: message.appId, body:
+      message.body,
+      deleted: message.deleted, modified: message.modified, supportTicketId: message.supportTicketId,
+      visibility: message.visibility})
+  RETURN {consent: LENGTH(matchingConsent) == 1 ? matchingConsent[0] : null, messages,
+    ticket: ticket ? {_key: ticket._key, _rev: ticket._rev, appId: ticket.appId, deleted: ticket.deleted,
+      status: ticket.status, userId: ticket.userId} : null,
+    user: user ? {_key: user._key, _rev: user._rev, active: user.active, appId: user.appId, deleted: user.deleted,
+      email: user.email, verifiedEmail: user.verifiedEmail, emailDeliveryStatus: user.emailDeliveryStatus, supportEmailSuppressed:
+        user.supportEmailSuppressed} : null}`).then((cursor)=>cursor.next());
+export const validateSupportConversationRow = (row, input, purpose, at)=>{
+    const { consent, ticket, user } = row || {};
+    if (!ticket || ticket._key !== input.ticketId || ticket._rev !== input.ticketRevision || ticket.appId !== input.appId || ticket.deleted === true || ![
+        'submitted',
+        'open',
+        'in_progress',
+        'waiting_on_customer',
+        'waiting_on_internal'
+    ].includes(ticket.status) || !user || user._key !== ticket.userId || !supportConversationKey(user._rev) || user.appId !== input.appId || user.deleted === true || user.active === false || !consent || consent.appId !== input.appId || consent.userId !== user._key || !supportConversationKey(consent._rev) || consent.purpose !== purpose || consent.source !== 'authenticated_customer' || consent.status !== 'active' || !Number.isSafeInteger(consent.expiresAt) || consent.expiresAt <= at || !Array.isArray(row.messages) || row.messages.some((message)=>!supportConversationKey(message._key) || !supportConversationKey(message._rev) || message.appId !== undefined && message.appId !== input.appId || message.bindingCount !== 1 || message.deleted === true || message.supportTicketId !== input.ticketId || message.visibility !== 'customer' || typeof message.body !== 'string' || message.body.length > 4000 || !Number.isSafeInteger(message.modified) || message.modified < 0 || message.modified > at)) {
+        throw new Error('support_conversation_source_hold');
+    }
+    return crmCanonicalDigest([
+        ticket._rev,
+        user._rev,
+        consent._rev,
+        row.messages.map((message)=>[
+                message._key,
+                message._rev
+            ])
+    ]);
+};
+export const supportPurposeScope = {
+    support_conversation: 'support:conversation',
+    support_email_reply: 'support:email_reply',
+    support_semantic_summary: 'support:summary'
+};
+/** The bounded native customer-visible feed is an owned source, never an external transcript assertion. */ export const readSupportPurposeConversation = async (context, input, purpose, now = Date.now)=>{
+    if (!validSupportConversationInput(input)) {
+        throw new Error('invalid_support_conversation');
+    }
+    // These new scopes are added to the public grant contract during coordinated package wiring.
+    const grant = await authorizeCrmExecutionGrant(context, input.appId, supportPurposeScope[purpose], now());
+    await authorizeCrmExecutionGrant(context, input.appId, 'support:read', now());
+    const scoped = await scopeContextToApp(context, input.appId);
+    if (scoped.databaseName !== grant.databaseName) {
+        throw new Error('support_conversation_app_changed');
+    }
+    const db = useDb(grant.databaseName);
+    const row = await readSupportConversationRow(db, input, purpose);
+    const revision = validateSupportConversationRow(row, input, purpose, now());
+    const latest = await authorizeCrmExecutionGrant(context, input.appId, supportPurposeScope[purpose], now());
+    const scope = await scopeContextToApp(context, input.appId);
+    if (grant.id !== latest.id || grant.hash !== latest.hash || grant.databaseName !== latest.databaseName || scope.databaseName !== grant.databaseName || validateSupportConversationRow(await readSupportConversationRow(db, input, purpose), input, purpose, now()) !== revision) {
+        throw new Error('support_conversation_changed');
+    }
+    return {
+        appId: input.appId,
+        generatedAt: now(),
+        messages: row.messages.slice(0, 50).map((message)=>({
+                body: message.body,
+                id: message._key,
+                modifiedAt: message.modified,
+                revision: message._rev
+            })),
+        provenance: 'native_customer_visible_feed',
+        revision,
+        schemaVersion: 'support_conversation_v1',
+        ticketId: input.ticketId,
+        ticketRevision: input.ticketRevision,
+        truncated: row.messages.length > 50,
+        validUntil: Math.min(now() + 300000, latest.expires, row.consent.expiresAt)
+    };
+};
+export const readSupportConversation = async (context, input, now = Date.now)=>readSupportPurposeConversation(context, input, 'support_conversation', now);
+export const readSupportSemanticSource = async (context, input, now = Date.now)=>readSupportPurposeConversation(context, input, 'support_semantic_summary', now);
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi90bXAvcmVhY3RvcmJveC1zdXBwb3J0LW93bmVyLWZyZWV6ZS0yMDI2MTAwOC9pbnB1dC9hY3Rpb25zL3N1cHBvcnRDb252ZXJzYXRpb24udHMiXSwic291cmNlc0NvbnRlbnQiOlsiLyogZXNsaW50LWRpc2FibGUgbm8tdW5kZXJzY29yZS1kYW5nbGUgLS0gTmF0aXZlIGRvY3VtZW50IGlkZW50aXR5IGFuZCByZXZpc2lvbiBjaGVja3MuICovXG5pbXBvcnQge2FxbH0gZnJvbSAnYXJhbmdvanMnO1xuXG5pbXBvcnQge3Njb3BlQ29udGV4dFRvQXBwfSBmcm9tICcuLi91dGlscy9hcHBDb250ZXh0LmpzJztcbmltcG9ydCB7dXNlRGJ9IGZyb20gJy4uL3V0aWxzL2FyYW5nb2RiVXRpbHMuanMnO1xuaW1wb3J0IHtjcm1DYW5vbmljYWxEaWdlc3R9IGZyb20gJy4vY3JtQ2Fub25pY2FsUG9saWN5LmpzJztcbmltcG9ydCB7YXV0aG9yaXplQ3JtRXhlY3V0aW9uR3JhbnR9IGZyb20gJy4vY3JtRXhlY3V0aW9uLmpzJztcblxuaW1wb3J0IHR5cGUge0FwaUNvbnRleHR9IGZyb20gJy4uL3R5cGVzL2F1dGgudHlwZXMuanMnO1xuaW1wb3J0IHR5cGUge1N1cHBvcnRDb25zZW50UHVycG9zZSwgU3VwcG9ydFB1cnBvc2VDb25zZW50UmVjb3JkfSBmcm9tICcuL3N1cHBvcnRQdXJwb3NlQ29uc2VudC5qcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgU3VwcG9ydENvbnZlcnNhdGlvbklucHV0IHtcbiAgYXBwSWQ6IHN0cmluZztcbiAgdGlja2V0SWQ6IHN0cmluZztcbiAgdGlja2V0UmV2aXNpb246IHN0cmluZztcbn1cbmV4cG9ydCBjb25zdCBzdXBwb3J0Q29udmVyc2F0aW9uS2V5ID0gKHZhbHVlOiB1bmtub3duKTogdmFsdWUgaXMgc3RyaW5nID0+IHR5cGVvZiB2YWx1ZSA9PT0gJ3N0cmluZycgJiZcbiAgL15bXFx3Li1dezEsMTYwfSQvLnRlc3QodmFsdWUpO1xuZXhwb3J0IGNvbnN0IHZhbGlkU3VwcG9ydENvbnZlcnNhdGlvbklucHV0ID0gKGlucHV0OiBTdXBwb3J0Q29udmVyc2F0aW9uSW5wdXQpID0+IEJvb2xlYW4oaW5wdXRcbiAgICAmJiBPYmplY3Qua2V5cyhpbnB1dCkuc29ydCgpLmpvaW4oJywnKSA9PT0gJ2FwcElkLHRpY2tldElkLHRpY2tldFJldmlzaW9uJ1xuICAgICYmIFtpbnB1dC5hcHBJZCwgaW5wdXQudGlja2V0SWQsIGlucHV0LnRpY2tldFJldmlzaW9uXS5ldmVyeShzdXBwb3J0Q29udmVyc2F0aW9uS2V5KSk7XG5leHBvcnQgaW50ZXJmYWNlIFN1cHBvcnRDb252ZXJzYXRpb25Sb3cge1xuICBjb25zZW50PzogU3VwcG9ydFB1cnBvc2VDb25zZW50UmVjb3JkO1xuICBtZXNzYWdlczoge1xuICAgIF9rZXk6IHN0cmluZztcbiAgICBfcmV2OiBzdHJpbmc7XG4gICAgYXBwSWQ/OiBzdHJpbmc7XG4gICAgYmluZGluZ0NvdW50OiBudW1iZXI7XG4gICAgYm9keTogc3RyaW5nO1xuICAgIGRlbGV0ZWQ/OiBib29sZWFuO1xuICAgIG1vZGlmaWVkOiBudW1iZXI7XG4gICAgc3VwcG9ydFRpY2tldElkOiBzdHJpbmc7XG4gICAgdmlzaWJpbGl0eTogc3RyaW5nO1xuICB9W107XG4gIHRpY2tldD86IHtcbiAgICBfa2V5OiBzdHJpbmc7XG4gICAgX3Jldjogc3RyaW5nO1xuICAgIGFwcElkOiBzdHJpbmc7XG4gICAgZGVsZXRlZD86IGJvb2xlYW47XG4gICAgc3RhdHVzOiBzdHJpbmc7XG4gICAgdXNlcklkOiBzdHJpbmc7XG4gIH07XG4gIHVzZXI/OiB7XG4gICAgX2tleTogc3RyaW5nO1xuICAgIF9yZXY6IHN0cmluZztcbiAgICBhY3RpdmU/OiBib29sZWFuO1xuICAgIGFwcElkOiBzdHJpbmc7XG4gICAgZGVsZXRlZD86IGJvb2xlYW47XG4gICAgZW1haWw/OiBzdHJpbmc7XG4gICAgdmVyaWZpZWRFbWFpbD86IGJvb2xlYW47IGVtYWlsRGVsaXZlcnlTdGF0dXM/OiBzdHJpbmc7XG4gICAgc3VwcG9ydEVtYWlsU3VwcHJlc3NlZD86IGJvb2xlYW47XG4gIH07XG59XG5leHBvcnQgY29uc3QgcmVhZFN1cHBvcnRDb252ZXJzYXRpb25Sb3cgPSBhc3luYyAoZGI6IFJldHVyblR5cGU8dHlwZW9mIHVzZURiPiwgaW5wdXQ6IFN1cHBvcnRDb252ZXJzYXRpb25JbnB1dCxcbiAgcHVycG9zZTogU3VwcG9ydENvbnNlbnRQdXJwb3NlLCBxdWVyeSA9IGRiLnF1ZXJ5LmJpbmQoZGIpKTogUHJvbWlzZTxTdXBwb3J0Q29udmVyc2F0aW9uUm93PiA9PiBxdWVyeShhcWwgYFxuICBMRVQgdGlja2V0ID0gRE9DVU1FTlQoJ3N1cHBvcnRUaWNrZXRzJywgJHtpbnB1dC50aWNrZXRJZH0pXG4gIExFVCB1c2VyID0gdGlja2V0ID8gRE9DVU1FTlQoJ3VzZXJzJywgdGlja2V0LnVzZXJJZCkgOiBudWxsXG4gIExFVCBtYXRjaGluZ0NvbnNlbnQgPSAoRk9SIGNhbmRpZGF0ZSBJTiBzdXBwb3J0UHVycG9zZUNvbnNlbnRzIEZJTFRFUiBjYW5kaWRhdGUuYXBwSWQgPT0gJHtpbnB1dC5hcHBJZH1cbiAgICBBTkQgY2FuZGlkYXRlLnVzZXJJZCA9PSB1c2VyLl9rZXkgQU5EIGNhbmRpZGF0ZS5wdXJwb3NlID09ICR7cHVycG9zZX0gTElNSVQgMiBSRVRVUk4gY2FuZGlkYXRlKVxuICBMRVQgbWVzc2FnZXMgPSAoRk9SIG1lc3NhZ2UgSU4gc3VwcG9ydFRpY2tldE1lc3NhZ2VzIEZJTFRFUiBtZXNzYWdlLnN1cHBvcnRUaWNrZXRJZCA9PSAke2lucHV0LnRpY2tldElkfVxuICAgIEFORCAobWVzc2FnZS5hcHBJZCA9PSBudWxsIE9SIG1lc3NhZ2UuYXBwSWQgPT0gJHtpbnB1dC5hcHBJZH0pIEFORCBtZXNzYWdlLnZpc2liaWxpdHkgPT0gJ2N1c3RvbWVyJyBBTkRcbiAgICAgIG1lc3NhZ2UuZGVsZXRlZCAhPSB0cnVlXG4gICAgU09SVCBtZXNzYWdlLm1vZGlmaWVkIEFTQywgbWVzc2FnZS5fa2V5IEFTQyBMSU1JVCA1MVxuICAgIExFVCBiaW5kaW5ncyA9IChGT1IgZWRnZSBJTiBoYXNTdXBwb3J0VGlja2V0TWVzc2FnZSBGSUxURVIgZWRnZS5fZnJvbSA9PSAke2BzdXBwb3J0VGlja2V0cy8ke2lucHV0LnRpY2tldElkfWB9XG4gICAgICBBTkQgZWRnZS5fdG8gPT0gQ09OQ0FUKCdzdXBwb3J0VGlja2V0TWVzc2FnZXMvJywgbWVzc2FnZS5fa2V5KSBBTkQgZWRnZS52aXNpYmlsaXR5ID09ICdjdXN0b21lcicgTElNSVQgMlxuICAgICAgICBSRVRVUk4gZWRnZS5fa2V5KVxuICAgIFJFVFVSTiB7YmluZGluZ0NvdW50OiBMRU5HVEgoYmluZGluZ3MpLCBfa2V5OiBtZXNzYWdlLl9rZXksIF9yZXY6IG1lc3NhZ2UuX3JldiwgYXBwSWQ6IG1lc3NhZ2UuYXBwSWQsIGJvZHk6XG4gICAgICBtZXNzYWdlLmJvZHksXG4gICAgICBkZWxldGVkOiBtZXNzYWdlLmRlbGV0ZWQsIG1vZGlmaWVkOiBtZXNzYWdlLm1vZGlmaWVkLCBzdXBwb3J0VGlja2V0SWQ6IG1lc3NhZ2Uuc3VwcG9ydFRpY2tldElkLFxuICAgICAgdmlzaWJpbGl0eTogbWVzc2FnZS52aXNpYmlsaXR5fSlcbiAgUkVUVVJOIHtjb25zZW50OiBMRU5HVEgobWF0Y2hpbmdDb25zZW50KSA9PSAxID8gbWF0Y2hpbmdDb25zZW50WzBdIDogbnVsbCwgbWVzc2FnZXMsXG4gICAgdGlja2V0OiB0aWNrZXQgPyB7X2tleTogdGlja2V0Ll9rZXksIF9yZXY6IHRpY2tldC5fcmV2LCBhcHBJZDogdGlja2V0LmFwcElkLCBkZWxldGVkOiB0aWNrZXQuZGVsZXRlZCxcbiAgICAgIHN0YXR1czogdGlja2V0LnN0YXR1cywgdXNlcklkOiB0aWNrZXQudXNlcklkfSA6IG51bGwsXG4gICAgdXNlcjogdXNlciA/IHtfa2V5OiB1c2VyLl9rZXksIF9yZXY6IHVzZXIuX3JldiwgYWN0aXZlOiB1c2VyLmFjdGl2ZSwgYXBwSWQ6IHVzZXIuYXBwSWQsIGRlbGV0ZWQ6IHVzZXIuZGVsZXRlZCxcbiAgICAgIGVtYWlsOiB1c2VyLmVtYWlsLCB2ZXJpZmllZEVtYWlsOiB1c2VyLnZlcmlmaWVkRW1haWwsIGVtYWlsRGVsaXZlcnlTdGF0dXM6IHVzZXIuZW1haWxEZWxpdmVyeVN0YXR1cywgc3VwcG9ydEVtYWlsU3VwcHJlc3NlZDpcbiAgICAgICAgdXNlci5zdXBwb3J0RW1haWxTdXBwcmVzc2VkfSA6IG51bGx9YClcbiAgLnRoZW4oKGN1cnNvcikgPT4gY3Vyc29yLm5leHQoKSk7XG5leHBvcnQgY29uc3QgdmFsaWRhdGVTdXBwb3J0Q29udmVyc2F0aW9uUm93ID0gKHJvdzogU3VwcG9ydENvbnZlcnNhdGlvblJvdyB8IHVuZGVmaW5lZCwgaW5wdXQ6XG5TdXBwb3J0Q29udmVyc2F0aW9uSW5wdXQsIHB1cnBvc2U6IFN1cHBvcnRDb25zZW50UHVycG9zZSwgYXQ6IG51bWJlcikgPT4ge1xuICBjb25zdCB7Y29uc2VudCwgdGlja2V0LCB1c2VyfSA9IHJvdyB8fCB7fTtcbiAgaWYoIXRpY2tldCB8fCB0aWNrZXQuX2tleSAhPT0gaW5wdXQudGlja2V0SWQgfHwgdGlja2V0Ll9yZXYgIT09IGlucHV0LnRpY2tldFJldmlzaW9uXG4gICAgICAgIHx8IHRpY2tldC5hcHBJZCAhPT0gaW5wdXQuYXBwSWQgfHwgdGlja2V0LmRlbGV0ZWQgPT09IHRydWVcbiAgICAgICAgfHwgIVsnc3VibWl0dGVkJywgJ29wZW4nLCAnaW5fcHJvZ3Jlc3MnLCAnd2FpdGluZ19vbl9jdXN0b21lcicsICd3YWl0aW5nX29uX2ludGVybmFsJ10uaW5jbHVkZXModGlja2V0LnN0YXR1cylcbiAgICAgICAgfHwgIXVzZXIgfHwgdXNlci5fa2V5ICE9PSB0aWNrZXQudXNlcklkIHx8ICFzdXBwb3J0Q29udmVyc2F0aW9uS2V5KHVzZXIuX3JldilcbiAgICAgICAgfHwgdXNlci5hcHBJZCAhPT0gaW5wdXQuYXBwSWQgfHwgdXNlci5kZWxldGVkID09PSB0cnVlIHx8IHVzZXIuYWN0aXZlID09PSBmYWxzZVxuICAgICAgICB8fCAhY29uc2VudCB8fCBjb25zZW50LmFwcElkICE9PSBpbnB1dC5hcHBJZCB8fCBjb25zZW50LnVzZXJJZCAhPT0gdXNlci5fa2V5XG4gICAgICAgIHx8ICFzdXBwb3J0Q29udmVyc2F0aW9uS2V5KGNvbnNlbnQuX3JldikgfHwgY29uc2VudC5wdXJwb3NlICE9PSBwdXJwb3NlXG4gICAgICAgIHx8IGNvbnNlbnQuc291cmNlICE9PSAnYXV0aGVudGljYXRlZF9jdXN0b21lcicgfHwgY29uc2VudC5zdGF0dXMgIT09ICdhY3RpdmUnXG4gICAgICAgIHx8ICFOdW1iZXIuaXNTYWZlSW50ZWdlcihjb25zZW50LmV4cGlyZXNBdCkgfHwgY29uc2VudC5leHBpcmVzQXQgPD0gYXRcbiAgICAgICAgfHwgIUFycmF5LmlzQXJyYXkocm93Lm1lc3NhZ2VzKSB8fCByb3cubWVzc2FnZXMuc29tZSgobWVzc2FnZSkgPT4gIXN1cHBvcnRDb252ZXJzYXRpb25LZXkobWVzc2FnZS5fa2V5KVxuICAgICAgICB8fCAhc3VwcG9ydENvbnZlcnNhdGlvbktleShtZXNzYWdlLl9yZXYpIHx8IChtZXNzYWdlLmFwcElkICE9PSB1bmRlZmluZWQgJiYgbWVzc2FnZS5hcHBJZCAhPT0gaW5wdXQuYXBwSWQpXG4gICAgICAgICAgfHwgbWVzc2FnZS5iaW5kaW5nQ291bnQgIT09IDEgfHwgbWVzc2FnZS5kZWxldGVkID09PSB0cnVlXG4gICAgICAgIHx8IG1lc3NhZ2Uuc3VwcG9ydFRpY2tldElkICE9PSBpbnB1dC50aWNrZXRJZCB8fCBtZXNzYWdlLnZpc2liaWxpdHkgIT09ICdjdXN0b21lcidcbiAgICAgICAgfHwgdHlwZW9mIG1lc3NhZ2UuYm9keSAhPT0gJ3N0cmluZycgfHwgbWVzc2FnZS5ib2R5Lmxlbmd0aCA+IDQwMDBcbiAgICAgICAgfHwgIU51bWJlci5pc1NhZmVJbnRlZ2VyKG1lc3NhZ2UubW9kaWZpZWQpIHx8IG1lc3NhZ2UubW9kaWZpZWQgPCAwIHx8IG1lc3NhZ2UubW9kaWZpZWQgPiBhdCkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ3N1cHBvcnRfY29udmVyc2F0aW9uX3NvdXJjZV9ob2xkJyk7XG4gIH1cbiAgcmV0dXJuIGNybUNhbm9uaWNhbERpZ2VzdChbdGlja2V0Ll9yZXYsIHVzZXIuX3JldiwgY29uc2VudC5fcmV2LFxuICAgIHJvdy5tZXNzYWdlcy5tYXAoKG1lc3NhZ2UpID0+IFttZXNzYWdlLl9rZXksIG1lc3NhZ2UuX3Jldl0pXSk7XG59O1xuZXhwb3J0IGNvbnN0IHN1cHBvcnRQdXJwb3NlU2NvcGUgPSB7XG4gIHN1cHBvcnRfY29udmVyc2F0aW9uOiAnc3VwcG9ydDpjb252ZXJzYXRpb24nLFxuICBzdXBwb3J0X2VtYWlsX3JlcGx5OiAnc3VwcG9ydDplbWFpbF9yZXBseScsIHN1cHBvcnRfc2VtYW50aWNfc3VtbWFyeTogJ3N1cHBvcnQ6c3VtbWFyeSdcbn0gYXMgY29uc3Q7XG4vKiogVGhlIGJvdW5kZWQgbmF0aXZlIGN1c3RvbWVyLXZpc2libGUgZmVlZCBpcyBhbiBvd25lZCBzb3VyY2UsIG5ldmVyIGFuIGV4dGVybmFsIHRyYW5zY3JpcHQgYXNzZXJ0aW9uLiAqL1xuZXhwb3J0IGNvbnN0IHJlYWRTdXBwb3J0UHVycG9zZUNvbnZlcnNhdGlvbiA9IGFzeW5jIChjb250ZXh0OiBBcGlDb250ZXh0LCBpbnB1dDogU3VwcG9ydENvbnZlcnNhdGlvbklucHV0LFxuICBwdXJwb3NlOiBTdXBwb3J0Q29uc2VudFB1cnBvc2UsIG5vdyA9IERhdGUubm93KSA9PiB7XG4gIGlmKCF2YWxpZFN1cHBvcnRDb252ZXJzYXRpb25JbnB1dChpbnB1dCkpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ2ludmFsaWRfc3VwcG9ydF9jb252ZXJzYXRpb24nKTtcbiAgfVxuICAvLyBUaGVzZSBuZXcgc2NvcGVzIGFyZSBhZGRlZCB0byB0aGUgcHVibGljIGdyYW50IGNvbnRyYWN0IGR1cmluZyBjb29yZGluYXRlZCBwYWNrYWdlIHdpcmluZy5cbiAgY29uc3QgZ3JhbnQgPSBhd2FpdCBhdXRob3JpemVDcm1FeGVjdXRpb25HcmFudChjb250ZXh0LCBpbnB1dC5hcHBJZCwgc3VwcG9ydFB1cnBvc2VTY29wZVtwdXJwb3NlXSwgbm93KCkpO1xuICBhd2FpdCBhdXRob3JpemVDcm1FeGVjdXRpb25HcmFudChjb250ZXh0LCBpbnB1dC5hcHBJZCwgJ3N1cHBvcnQ6cmVhZCcsIG5vdygpKTtcbiAgY29uc3Qgc2NvcGVkID0gYXdhaXQgc2NvcGVDb250ZXh0VG9BcHAoY29udGV4dCwgaW5wdXQuYXBwSWQpO1xuICBpZihzY29wZWQuZGF0YWJhc2VOYW1lICE9PSBncmFudC5kYXRhYmFzZU5hbWUpIHtcbiAgICB0aHJvdyBuZXcgRXJyb3IoJ3N1cHBvcnRfY29udmVyc2F0aW9uX2FwcF9jaGFuZ2VkJyk7XG4gIH1cbiAgY29uc3QgZGIgPSB1c2VEYihncmFudC5kYXRhYmFzZU5hbWUpO1xuICBjb25zdCByb3cgPSBhd2FpdCByZWFkU3VwcG9ydENvbnZlcnNhdGlvblJvdyhkYiwgaW5wdXQsIHB1cnBvc2UpO1xuICBjb25zdCByZXZpc2lvbiA9IHZhbGlkYXRlU3VwcG9ydENvbnZlcnNhdGlvblJvdyhyb3csIGlucHV0LCBwdXJwb3NlLCBub3coKSk7XG4gIGNvbnN0IGxhdGVzdCA9IGF3YWl0IGF1dGhvcml6ZUNybUV4ZWN1dGlvbkdyYW50KGNvbnRleHQsIGlucHV0LmFwcElkLCBzdXBwb3J0UHVycG9zZVNjb3BlW3B1cnBvc2VdLCBub3coKSk7XG4gIGNvbnN0IHNjb3BlID0gYXdhaXQgc2NvcGVDb250ZXh0VG9BcHAoY29udGV4dCwgaW5wdXQuYXBwSWQpO1xuICBpZihncmFudC5pZCAhPT0gbGF0ZXN0LmlkIHx8IGdyYW50Lmhhc2ggIT09IGxhdGVzdC5oYXNoIHx8IGdyYW50LmRhdGFiYXNlTmFtZSAhPT0gbGF0ZXN0LmRhdGFiYXNlTmFtZVxuICAgICAgICB8fCBzY29wZS5kYXRhYmFzZU5hbWUgIT09IGdyYW50LmRhdGFiYXNlTmFtZVxuICAgICAgICB8fCB2YWxpZGF0ZVN1cHBvcnRDb252ZXJzYXRpb25Sb3coYXdhaXQgcmVhZFN1cHBvcnRDb252ZXJzYXRpb25Sb3coZGIsIGlucHV0LCBwdXJwb3NlKSwgaW5wdXQsIHB1cnBvc2UsXG4gICAgICAgICAgbm93KCkpICE9PSByZXZpc2lvbikge1xuICAgIHRocm93IG5ldyBFcnJvcignc3VwcG9ydF9jb252ZXJzYXRpb25fY2hhbmdlZCcpO1xuICB9XG4gIHJldHVybiB7XG4gICAgYXBwSWQ6IGlucHV0LmFwcElkLCBnZW5lcmF0ZWRBdDogbm93KCksIG1lc3NhZ2VzOiByb3cubWVzc2FnZXMuc2xpY2UoMCwgNTApLm1hcCgobWVzc2FnZSkgPT4gKHtcbiAgICAgIGJvZHk6IG1lc3NhZ2UuYm9keSwgaWQ6IG1lc3NhZ2UuX2tleSwgbW9kaWZpZWRBdDogbWVzc2FnZS5tb2RpZmllZCwgcmV2aXNpb246IG1lc3NhZ2UuX3JldlxuICAgIH0pKSxcbiAgICBwcm92ZW5hbmNlOiAnbmF0aXZlX2N1c3RvbWVyX3Zpc2libGVfZmVlZCcsIHJldmlzaW9uLCBzY2hlbWFWZXJzaW9uOiAnc3VwcG9ydF9jb252ZXJzYXRpb25fdjEnLFxuICAgIHRpY2tldElkOiBpbnB1dC50aWNrZXRJZCwgdGlja2V0UmV2aXNpb246IGlucHV0LnRpY2tldFJldmlzaW9uLCB0cnVuY2F0ZWQ6IHJvdy5tZXNzYWdlcy5sZW5ndGggPiA1MCxcbiAgICB2YWxpZFVudGlsOiBNYXRoLm1pbihub3coKSArIDMwMDAwMCwgbGF0ZXN0LmV4cGlyZXMsIHJvdy5jb25zZW50LmV4cGlyZXNBdClcbiAgfTtcbn07XG5leHBvcnQgY29uc3QgcmVhZFN1cHBvcnRDb252ZXJzYXRpb24gPSBhc3luYyAoY29udGV4dDogQXBpQ29udGV4dCwgaW5wdXQ6IFN1cHBvcnRDb252ZXJzYXRpb25JbnB1dCwgbm93ID1cbiAgRGF0ZS5ub3cpID0+IHJlYWRTdXBwb3J0UHVycG9zZUNvbnZlcnNhdGlvbihjb250ZXh0LCBpbnB1dCwgJ3N1cHBvcnRfY29udmVyc2F0aW9uJywgbm93KTtcbmV4cG9ydCBjb25zdCByZWFkU3VwcG9ydFNlbWFudGljU291cmNlID0gYXN5bmMgKGNvbnRleHQ6IEFwaUNvbnRleHQsIGlucHV0OiBTdXBwb3J0Q29udmVyc2F0aW9uSW5wdXQsIG5vdyA9XG4gIERhdGUubm93KSA9PiByZWFkU3VwcG9ydFB1cnBvc2VDb252ZXJzYXRpb24oY29udGV4dCwgaW5wdXQsICdzdXBwb3J0X3NlbWFudGljX3N1bW1hcnknLCBub3cpO1xuIl0sIm5hbWVzIjpbImFxbCIsInNjb3BlQ29udGV4dFRvQXBwIiwidXNlRGIiLCJjcm1DYW5vbmljYWxEaWdlc3QiLCJhdXRob3JpemVDcm1FeGVjdXRpb25HcmFudCIsInN1cHBvcnRDb252ZXJzYXRpb25LZXkiLCJ2YWx1ZSIsInRlc3QiLCJ2YWxpZFN1cHBvcnRDb252ZXJzYXRpb25JbnB1dCIsImlucHV0IiwiQm9vbGVhbiIsIk9iamVjdCIsImtleXMiLCJzb3J0Iiwiam9pbiIsImFwcElkIiwidGlja2V0SWQiLCJ0aWNrZXRSZXZpc2lvbiIsImV2ZXJ5IiwicmVhZFN1cHBvcnRDb252ZXJzYXRpb25Sb3ciLCJkYiIsInB1cnBvc2UiLCJxdWVyeSIsImJpbmQiLCJ0aGVuIiwiY3Vyc29yIiwibmV4dCIsInZhbGlkYXRlU3VwcG9ydENvbnZlcnNhdGlvblJvdyIsInJvdyIsImF0IiwiY29uc2VudCIsInRpY2tldCIsInVzZXIiLCJfa2V5IiwiX3JldiIsImRlbGV0ZWQiLCJpbmNsdWRlcyIsInN0YXR1cyIsInVzZXJJZCIsImFjdGl2ZSIsInNvdXJjZSIsIk51bWJlciIsImlzU2FmZUludGVnZXIiLCJleHBpcmVzQXQiLCJBcnJheSIsImlzQXJyYXkiLCJtZXNzYWdlcyIsInNvbWUiLCJtZXNzYWdlIiwidW5kZWZpbmVkIiwiYmluZGluZ0NvdW50Iiwic3VwcG9ydFRpY2tldElkIiwidmlzaWJpbGl0eSIsImJvZHkiLCJsZW5ndGgiLCJtb2RpZmllZCIsIkVycm9yIiwibWFwIiwic3VwcG9ydFB1cnBvc2VTY29wZSIsInN1cHBvcnRfY29udmVyc2F0aW9uIiwic3VwcG9ydF9lbWFpbF9yZXBseSIsInN1cHBvcnRfc2VtYW50aWNfc3VtbWFyeSIsInJlYWRTdXBwb3J0UHVycG9zZUNvbnZlcnNhdGlvbiIsImNvbnRleHQiLCJub3ciLCJEYXRlIiwiZ3JhbnQiLCJzY29wZWQiLCJkYXRhYmFzZU5hbWUiLCJyZXZpc2lvbiIsImxhdGVzdCIsInNjb3BlIiwiaWQiLCJoYXNoIiwiZ2VuZXJhdGVkQXQiLCJzbGljZSIsIm1vZGlmaWVkQXQiLCJwcm92ZW5hbmNlIiwic2NoZW1hVmVyc2lvbiIsInRydW5jYXRlZCIsInZhbGlkVW50aWwiLCJNYXRoIiwibWluIiwiZXhwaXJlcyIsInJlYWRTdXBwb3J0Q29udmVyc2F0aW9uIiwicmVhZFN1cHBvcnRTZW1hbnRpY1NvdXJjZSJdLCJtYXBwaW5ncyI6IkFBQUEsd0ZBQXdGLEdBQ3hGLFNBQVFBLEdBQUcsUUFBTyxXQUFXO0FBRTdCLFNBQVFDLGlCQUFpQixRQUFPLHlCQUF5QjtBQUN6RCxTQUFRQyxLQUFLLFFBQU8sNEJBQTRCO0FBQ2hELFNBQVFDLGtCQUFrQixRQUFPLDBCQUEwQjtBQUMzRCxTQUFRQywwQkFBMEIsUUFBTyxvQkFBb0I7QUFVN0QsT0FBTyxNQUFNQyx5QkFBeUIsQ0FBQ0MsUUFBb0MsT0FBT0EsVUFBVSxZQUMxRixrQkFBa0JDLElBQUksQ0FBQ0QsT0FBTztBQUNoQyxPQUFPLE1BQU1FLGdDQUFnQyxDQUFDQyxRQUFvQ0MsUUFBUUQsU0FDbkZFLE9BQU9DLElBQUksQ0FBQ0gsT0FBT0ksSUFBSSxHQUFHQyxJQUFJLENBQUMsU0FBUyxtQ0FDeEM7UUFBQ0wsTUFBTU0sS0FBSztRQUFFTixNQUFNTyxRQUFRO1FBQUVQLE1BQU1RLGNBQWM7S0FBQyxDQUFDQyxLQUFLLENBQUNiLHlCQUF5QjtBQWlDMUYsT0FBTyxNQUFNYyw2QkFBNkIsT0FBT0MsSUFBOEJYLE9BQzdFWSxTQUFnQ0MsUUFBUUYsR0FBR0UsS0FBSyxDQUFDQyxJQUFJLENBQUNILEdBQUcsR0FBc0NFLE1BQU10QixHQUFJLENBQUM7MENBQ2xFLEVBQUVTLE1BQU1PLFFBQVEsQ0FBQzs7MkZBRWdDLEVBQUVQLE1BQU1NLEtBQUssQ0FBQzsrREFDMUMsRUFBRU0sUUFBUTt5RkFDZ0IsRUFBRVosTUFBTU8sUUFBUSxDQUFDO21EQUN2RCxFQUFFUCxNQUFNTSxLQUFLLENBQUM7Ozs2RUFHWSxFQUFFLENBQUMsZUFBZSxFQUFFTixNQUFNTyxRQUFRLEVBQUUsQ0FBQzs7Ozs7Ozs7Ozs7OzRDQVl0RSxDQUFDLEVBQzFDUSxJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT0MsSUFBSSxJQUFJO0FBQ25DLE9BQU8sTUFBTUMsaUNBQWlDLENBQUNDLEtBQXlDbkIsT0FDOURZLFNBQWdDUTtJQUN4RCxNQUFNLEVBQUNDLE9BQU8sRUFBRUMsTUFBTSxFQUFFQyxJQUFJLEVBQUMsR0FBR0osT0FBTyxDQUFDO0lBQ3hDLElBQUcsQ0FBQ0csVUFBVUEsT0FBT0UsSUFBSSxLQUFLeEIsTUFBTU8sUUFBUSxJQUFJZSxPQUFPRyxJQUFJLEtBQUt6QixNQUFNUSxjQUFjLElBQzNFYyxPQUFPaEIsS0FBSyxLQUFLTixNQUFNTSxLQUFLLElBQUlnQixPQUFPSSxPQUFPLEtBQUssUUFDbkQsQ0FBQztRQUFDO1FBQWE7UUFBUTtRQUFlO1FBQXVCO0tBQXNCLENBQUNDLFFBQVEsQ0FBQ0wsT0FBT00sTUFBTSxLQUMxRyxDQUFDTCxRQUFRQSxLQUFLQyxJQUFJLEtBQUtGLE9BQU9PLE1BQU0sSUFBSSxDQUFDakMsdUJBQXVCMkIsS0FBS0UsSUFBSSxLQUN6RUYsS0FBS2pCLEtBQUssS0FBS04sTUFBTU0sS0FBSyxJQUFJaUIsS0FBS0csT0FBTyxLQUFLLFFBQVFILEtBQUtPLE1BQU0sS0FBSyxTQUN2RSxDQUFDVCxXQUFXQSxRQUFRZixLQUFLLEtBQUtOLE1BQU1NLEtBQUssSUFBSWUsUUFBUVEsTUFBTSxLQUFLTixLQUFLQyxJQUFJLElBQ3pFLENBQUM1Qix1QkFBdUJ5QixRQUFRSSxJQUFJLEtBQUtKLFFBQVFULE9BQU8sS0FBS0EsV0FDN0RTLFFBQVFVLE1BQU0sS0FBSyw0QkFBNEJWLFFBQVFPLE1BQU0sS0FBSyxZQUNsRSxDQUFDSSxPQUFPQyxhQUFhLENBQUNaLFFBQVFhLFNBQVMsS0FBS2IsUUFBUWEsU0FBUyxJQUFJZCxNQUNqRSxDQUFDZSxNQUFNQyxPQUFPLENBQUNqQixJQUFJa0IsUUFBUSxLQUFLbEIsSUFBSWtCLFFBQVEsQ0FBQ0MsSUFBSSxDQUFDLENBQUNDLFVBQVksQ0FBQzNDLHVCQUF1QjJDLFFBQVFmLElBQUksS0FDbkcsQ0FBQzVCLHVCQUF1QjJDLFFBQVFkLElBQUksS0FBTWMsUUFBUWpDLEtBQUssS0FBS2tDLGFBQWFELFFBQVFqQyxLQUFLLEtBQUtOLE1BQU1NLEtBQUssSUFDcEdpQyxRQUFRRSxZQUFZLEtBQUssS0FBS0YsUUFBUWIsT0FBTyxLQUFLLFFBQ3BEYSxRQUFRRyxlQUFlLEtBQUsxQyxNQUFNTyxRQUFRLElBQUlnQyxRQUFRSSxVQUFVLEtBQUssY0FDckUsT0FBT0osUUFBUUssSUFBSSxLQUFLLFlBQVlMLFFBQVFLLElBQUksQ0FBQ0MsTUFBTSxHQUFHLFFBQzFELENBQUNiLE9BQU9DLGFBQWEsQ0FBQ00sUUFBUU8sUUFBUSxLQUFLUCxRQUFRTyxRQUFRLEdBQUcsS0FBS1AsUUFBUU8sUUFBUSxHQUFHMUIsS0FBSztRQUNsRyxNQUFNLElBQUkyQixNQUFNO0lBQ2xCO0lBQ0EsT0FBT3JELG1CQUFtQjtRQUFDNEIsT0FBT0csSUFBSTtRQUFFRixLQUFLRSxJQUFJO1FBQUVKLFFBQVFJLElBQUk7UUFDN0ROLElBQUlrQixRQUFRLENBQUNXLEdBQUcsQ0FBQyxDQUFDVCxVQUFZO2dCQUFDQSxRQUFRZixJQUFJO2dCQUFFZSxRQUFRZCxJQUFJO2FBQUM7S0FBRTtBQUNoRSxFQUFFO0FBQ0YsT0FBTyxNQUFNd0Isc0JBQXNCO0lBQ2pDQyxzQkFBc0I7SUFDdEJDLHFCQUFxQjtJQUF1QkMsMEJBQTBCO0FBQ3hFLEVBQVc7QUFDWCx5R0FBeUcsR0FDekcsT0FBTyxNQUFNQyxpQ0FBaUMsT0FBT0MsU0FBcUJ0RCxPQUN4RVksU0FBZ0MyQyxNQUFNQyxLQUFLRCxHQUFHO0lBQzlDLElBQUcsQ0FBQ3hELDhCQUE4QkMsUUFBUTtRQUN4QyxNQUFNLElBQUkrQyxNQUFNO0lBQ2xCO0lBQ0EsNkZBQTZGO0lBQzdGLE1BQU1VLFFBQVEsTUFBTTlELDJCQUEyQjJELFNBQVN0RCxNQUFNTSxLQUFLLEVBQUUyQyxtQkFBbUIsQ0FBQ3JDLFFBQVEsRUFBRTJDO0lBQ25HLE1BQU01RCwyQkFBMkIyRCxTQUFTdEQsTUFBTU0sS0FBSyxFQUFFLGdCQUFnQmlEO0lBQ3ZFLE1BQU1HLFNBQVMsTUFBTWxFLGtCQUFrQjhELFNBQVN0RCxNQUFNTSxLQUFLO0lBQzNELElBQUdvRCxPQUFPQyxZQUFZLEtBQUtGLE1BQU1FLFlBQVksRUFBRTtRQUM3QyxNQUFNLElBQUlaLE1BQU07SUFDbEI7SUFDQSxNQUFNcEMsS0FBS2xCLE1BQU1nRSxNQUFNRSxZQUFZO0lBQ25DLE1BQU14QyxNQUFNLE1BQU1ULDJCQUEyQkMsSUFBSVgsT0FBT1k7SUFDeEQsTUFBTWdELFdBQVcxQywrQkFBK0JDLEtBQUtuQixPQUFPWSxTQUFTMkM7SUFDckUsTUFBTU0sU0FBUyxNQUFNbEUsMkJBQTJCMkQsU0FBU3RELE1BQU1NLEtBQUssRUFBRTJDLG1CQUFtQixDQUFDckMsUUFBUSxFQUFFMkM7SUFDcEcsTUFBTU8sUUFBUSxNQUFNdEUsa0JBQWtCOEQsU0FBU3RELE1BQU1NLEtBQUs7SUFDMUQsSUFBR21ELE1BQU1NLEVBQUUsS0FBS0YsT0FBT0UsRUFBRSxJQUFJTixNQUFNTyxJQUFJLEtBQUtILE9BQU9HLElBQUksSUFBSVAsTUFBTUUsWUFBWSxLQUFLRSxPQUFPRixZQUFZLElBQzVGRyxNQUFNSCxZQUFZLEtBQUtGLE1BQU1FLFlBQVksSUFDekN6QywrQkFBK0IsTUFBTVIsMkJBQTJCQyxJQUFJWCxPQUFPWSxVQUFVWixPQUFPWSxTQUM3RjJDLFdBQVdLLFVBQVU7UUFDM0IsTUFBTSxJQUFJYixNQUFNO0lBQ2xCO0lBQ0EsT0FBTztRQUNMekMsT0FBT04sTUFBTU0sS0FBSztRQUFFMkQsYUFBYVY7UUFBT2xCLFVBQVVsQixJQUFJa0IsUUFBUSxDQUFDNkIsS0FBSyxDQUFDLEdBQUcsSUFBSWxCLEdBQUcsQ0FBQyxDQUFDVCxVQUFhLENBQUE7Z0JBQzVGSyxNQUFNTCxRQUFRSyxJQUFJO2dCQUFFbUIsSUFBSXhCLFFBQVFmLElBQUk7Z0JBQUUyQyxZQUFZNUIsUUFBUU8sUUFBUTtnQkFBRWMsVUFBVXJCLFFBQVFkLElBQUk7WUFDNUYsQ0FBQTtRQUNBMkMsWUFBWTtRQUFnQ1I7UUFBVVMsZUFBZTtRQUNyRTlELFVBQVVQLE1BQU1PLFFBQVE7UUFBRUMsZ0JBQWdCUixNQUFNUSxjQUFjO1FBQUU4RCxXQUFXbkQsSUFBSWtCLFFBQVEsQ0FBQ1EsTUFBTSxHQUFHO1FBQ2pHMEIsWUFBWUMsS0FBS0MsR0FBRyxDQUFDbEIsUUFBUSxRQUFRTSxPQUFPYSxPQUFPLEVBQUV2RCxJQUFJRSxPQUFPLENBQUNhLFNBQVM7SUFDNUU7QUFDRixFQUFFO0FBQ0YsT0FBTyxNQUFNeUMsMEJBQTBCLE9BQU9yQixTQUFxQnRELE9BQWlDdUQsTUFDbEdDLEtBQUtELEdBQUcsR0FBS0YsK0JBQStCQyxTQUFTdEQsT0FBTyx3QkFBd0J1RCxLQUFLO0FBQzNGLE9BQU8sTUFBTXFCLDRCQUE0QixPQUFPdEIsU0FBcUJ0RCxPQUFpQ3VELE1BQ3BHQyxLQUFLRCxHQUFHLEdBQUtGLCtCQUErQkMsU0FBU3RELE9BQU8sNEJBQTRCdUQsS0FBSyJ9

package/lib/actions/supportEmailEvents.d.ts

@@ -0,0 +1,20 @@
+import type { ApiContext } from '../types/auth.types.js';
+export interface SupportEmailEventInput {
+    appId: string;
+    eventId: string;
+    kind: 'accepted' | 'delivered' | 'bounce' | 'complaint';
+    occurredAt: number;
+    providerMessageId: string;
+    receiptId: string;
+    recipient: string;
+}
+/** Trusted provider bridge only. It must verify SES/SNS authenticity before calling this scoped owner boundary.
+ * support_receipt SES tag + exact recipient bind an unknown acknowledgement to its actual submission.
+ * Ordinary Ads/customer keys never receive this scope; browser event assertions are not provider evidence.
+ */
+export declare const ingestSupportEmailEvent: (context: ApiContext, input: SupportEmailEventInput, now?: () => number) => Promise<{
+    id: string;
+    kind: string;
+    occurredAt: number;
+    receiptId: string;
+}>;

package/lib/actions/supportEmailEvents.js

@@ -0,0 +1,130 @@
+import { aql } from 'arangojs';
+import { useDb } from '../utils/arangodbUtils.js';
+import { crmCanonicalDigest } from './crmCanonicalPolicy.js';
+import { authorizeCrmExecutionGrant, ensureOwnerExecutionCollection } from './crmExecution.js';
+import { supportConversationKey } from './supportConversation.js';
+/** Trusted provider bridge only. It must verify SES/SNS authenticity before calling this scoped owner boundary.
+ * support_receipt SES tag + exact recipient bind an unknown acknowledgement to its actual submission.
+ * Ordinary Ads/customer keys never receive this scope; browser event assertions are not provider evidence.
+ */ export const ingestSupportEmailEvent = async (context, input, now = Date.now)=>{
+    if (!input || Object.keys(input).sort().join(',') !== 'appId,eventId,kind,occurredAt,providerMessageId,receiptId,recipient' || ![
+        input.appId,
+        input.eventId,
+        input.providerMessageId
+    ].every(supportConversationKey) || !/^[a-f0-9]{64}$/.test(input.receiptId) || typeof input.recipient !== 'string' || input.recipient.length > 254 || ![
+        'accepted',
+        'delivered',
+        'bounce',
+        'complaint'
+    ].includes(input.kind) || !Number.isSafeInteger(input.occurredAt) || input.occurredAt > now() + 60000 || input.occurredAt < now() - 30 * 86400000) {
+        throw new Error('invalid_support_email_event');
+    }
+    const grant = await authorizeCrmExecutionGrant(context, input.appId, 'support:delivery_events', now());
+    const db = useDb(grant.databaseName);
+    await Promise.all([
+        ensureOwnerExecutionCollection(db, 'supportEmailEvents'),
+        ensureOwnerExecutionCollection(db, 'hasSupportEmailEvent', true)
+    ]);
+    await db.collection('supportEmailEvents').ensureIndex({
+        expireAfter: 0,
+        fields: [
+            'retireAt'
+        ],
+        type: 'ttl'
+    });
+    await db.collection('hasSupportEmailEvent').ensureIndex({
+        expireAfter: 0,
+        fields: [
+            'retireAt'
+        ],
+        type: 'ttl'
+    });
+    const tx = await db.beginTransaction({
+        exclusive: [
+            'supportEmailEvents',
+            'hasSupportEmailEvent',
+            'supportEmailReceipts',
+            'users'
+        ],
+        read: [
+            'supportTickets'
+        ]
+    }, {
+        lockTimeout: 10
+    });
+    const query = (value)=>tx.step(()=>db.query(value));
+    try {
+        const receipt = await query(aql`RETURN DOCUMENT('supportEmailReceipts', ${input.receiptId})`).then((cursor)=>cursor.next());
+        if (!receipt || receipt.appId !== input.appId || receipt.id !== input.receiptId || ![
+            'submitting',
+            'unknown',
+            'accepted'
+        ].includes(receipt.state) || receipt.recipientHash !== crmCanonicalDigest(input.recipient) || receipt.providerMessageId && receipt.providerMessageId !== input.providerMessageId || input.occurredAt < receipt.createdAt - 60000 || input.occurredAt > receipt.createdAt + 30 * 86400000) {
+            throw new Error('support_email_event_submission_hold');
+        }
+        const id = crmCanonicalDigest([
+            input.appId,
+            input.eventId
+        ]);
+        const fingerprint = crmCanonicalDigest(input);
+        const prior = await query(aql`RETURN DOCUMENT('supportEmailEvents', ${id})`).then((cursor)=>cursor.next());
+        if (prior && prior.fingerprint !== fingerprint) {
+            throw new Error('support_email_event_conflict');
+        }
+        const latest = await authorizeCrmExecutionGrant(context, input.appId, 'support:delivery_events', now());
+        if (latest.hash !== grant.hash || latest.id !== grant.id || latest.databaseName !== grant.databaseName) {
+            throw new Error('support_email_relay_changed');
+        }
+        if (prior) {
+            await tx.commit();
+            return prior.receipt;
+        }
+        const events = await query(aql`FOR event IN supportEmailEvents FILTER event.appId == ${input.appId}
+      AND event.receipt.receiptId == ${input.receiptId} LIMIT 32 RETURN event._key`).then((cursor)=>cursor.all());
+        if (events.length >= 32) {
+            throw new Error('support_email_event_limit');
+        }
+        // Negative delivery evidence suppresses even when conversation consent/revision has since changed.
+        if ([
+            'bounce',
+            'complaint'
+        ].includes(input.kind)) {
+            await query(aql`LET ticket = DOCUMENT('supportTickets', ${receipt.ticketId})
+        FOR user IN users FILTER user._key == ticket.userId AND user.appId == ${input.appId}
+        AND user.email == ${input.recipient} AND user.deleted != true
+        UPDATE user WITH {emailDeliveryStatus: user.emailDeliveryStatus == 'complaint' OR ${input.kind} == 'complaint'
+          ? 'complaint' : 'bounce_hold', supportEmailSuppressed: true} IN users`);
+        }
+        const result = {
+            id,
+            kind: input.kind,
+            occurredAt: input.occurredAt,
+            receiptId: input.receiptId
+        };
+        const retireAt = Math.floor((now() + 30 * 86400000) / 1000);
+        await query(aql`INSERT ${{
+            _key: id,
+            appId: input.appId,
+            fingerprint,
+            receipt: result,
+            retireAt
+        }} IN supportEmailEvents`);
+        await query(aql`INSERT ${{
+            _from: `supportEmailReceipts/${input.receiptId}`,
+            _key: id,
+            _to: `supportEmailEvents/${id}`,
+            appId: input.appId,
+            retireAt
+        }} IN hasSupportEmailEvent`);
+        await query(aql`UPDATE ${input.receiptId} WITH {state: 'accepted', providerAcceptedAt:
+      ${receipt.providerAcceptedAt || input.occurredAt}, providerMessageId: ${input.providerMessageId}} IN
+        supportEmailReceipts`);
+        await tx.commit();
+        return result;
+    } catch (error) {
+        await tx.abort();
+        throw error;
+    }
+};
+
+//# sourceMappingURL=data:application/json;base64,eyJ2ZXJzaW9uIjozLCJzb3VyY2VzIjpbIi90bXAvcmVhY3RvcmJveC1zdXBwb3J0LW93bmVyLWZyZWV6ZS0yMDI2MTAwOC9pbnB1dC9hY3Rpb25zL3N1cHBvcnRFbWFpbEV2ZW50cy50cyJdLCJzb3VyY2VzQ29udGVudCI6WyJpbXBvcnQge2FxbH0gZnJvbSAnYXJhbmdvanMnO1xuXG5pbXBvcnQge3VzZURifSBmcm9tICcuLi91dGlscy9hcmFuZ29kYlV0aWxzLmpzJztcbmltcG9ydCB7Y3JtQ2Fub25pY2FsRGlnZXN0fSBmcm9tICcuL2NybUNhbm9uaWNhbFBvbGljeS5qcyc7XG5pbXBvcnQge2F1dGhvcml6ZUNybUV4ZWN1dGlvbkdyYW50LCBlbnN1cmVPd25lckV4ZWN1dGlvbkNvbGxlY3Rpb259IGZyb20gJy4vY3JtRXhlY3V0aW9uLmpzJztcbmltcG9ydCB7c3VwcG9ydENvbnZlcnNhdGlvbktleX0gZnJvbSAnLi9zdXBwb3J0Q29udmVyc2F0aW9uLmpzJztcblxuaW1wb3J0IHR5cGUge0FwaUNvbnRleHR9IGZyb20gJy4uL3R5cGVzL2F1dGgudHlwZXMuanMnO1xuaW1wb3J0IHR5cGUge1N1cHBvcnRFbWFpbFJlY2VpcHR9IGZyb20gJy4vc3VwcG9ydEVtYWlsSGFuZG9mZi5qcyc7XG5cbmV4cG9ydCBpbnRlcmZhY2UgU3VwcG9ydEVtYWlsRXZlbnRJbnB1dCB7XG4gIGFwcElkOiBzdHJpbmc7XG4gIGV2ZW50SWQ6IHN0cmluZztcbiAga2luZDogJ2FjY2VwdGVkJyB8ICdkZWxpdmVyZWQnIHwgJ2JvdW5jZScgfCAnY29tcGxhaW50JztcbiAgb2NjdXJyZWRBdDogbnVtYmVyO1xuICBwcm92aWRlck1lc3NhZ2VJZDogc3RyaW5nO1xuICByZWNlaXB0SWQ6IHN0cmluZztcbiAgcmVjaXBpZW50OiBzdHJpbmc7XG59XG4vKiogVHJ1c3RlZCBwcm92aWRlciBicmlkZ2Ugb25seS4gSXQgbXVzdCB2ZXJpZnkgU0VTL1NOUyBhdXRoZW50aWNpdHkgYmVmb3JlIGNhbGxpbmcgdGhpcyBzY29wZWQgb3duZXIgYm91bmRhcnkuXG4gKiBzdXBwb3J0X3JlY2VpcHQgU0VTIHRhZyArIGV4YWN0IHJlY2lwaWVudCBiaW5kIGFuIHVua25vd24gYWNrbm93bGVkZ2VtZW50IHRvIGl0cyBhY3R1YWwgc3VibWlzc2lvbi5cbiAqIE9yZGluYXJ5IEFkcy9jdXN0b21lciBrZXlzIG5ldmVyIHJlY2VpdmUgdGhpcyBzY29wZTsgYnJvd3NlciBldmVudCBhc3NlcnRpb25zIGFyZSBub3QgcHJvdmlkZXIgZXZpZGVuY2UuXG4gKi9cbmV4cG9ydCBjb25zdCBpbmdlc3RTdXBwb3J0RW1haWxFdmVudCA9IGFzeW5jIChjb250ZXh0OiBBcGlDb250ZXh0LCBpbnB1dDogU3VwcG9ydEVtYWlsRXZlbnRJbnB1dCwgbm93ID0gRGF0ZS5ub3cpID0+IHtcbiAgaWYoIWlucHV0IHx8IE9iamVjdC5rZXlzKGlucHV0KS5zb3J0KCkuam9pbignLCcpICE9PVxuICAgICdhcHBJZCxldmVudElkLGtpbmQsb2NjdXJyZWRBdCxwcm92aWRlck1lc3NhZ2VJZCxyZWNlaXB0SWQscmVjaXBpZW50J1xuICAgICAgICB8fCAhW2lucHV0LmFwcElkLCBpbnB1dC5ldmVudElkLCBpbnB1dC5wcm92aWRlck1lc3NhZ2VJZF0uZXZlcnkoc3VwcG9ydENvbnZlcnNhdGlvbktleSlcbiAgICAgICAgfHwgIS9eW2EtZjAtOV17NjR9JC8udGVzdChpbnB1dC5yZWNlaXB0SWQpIHx8IHR5cGVvZiBpbnB1dC5yZWNpcGllbnQgIT09ICdzdHJpbmcnIHx8XG4gICAgICAgICAgaW5wdXQucmVjaXBpZW50Lmxlbmd0aCA+IDI1NFxuICAgICAgICB8fCAhWydhY2NlcHRlZCcsICdkZWxpdmVyZWQnLCAnYm91bmNlJywgJ2NvbXBsYWludCddLmluY2x1ZGVzKGlucHV0LmtpbmQpIHx8XG4gICAgICAgICAgIU51bWJlci5pc1NhZmVJbnRlZ2VyKGlucHV0Lm9jY3VycmVkQXQpXG4gICAgICAgIHx8IGlucHV0Lm9jY3VycmVkQXQgPiBub3coKSArIDYwMDAwIHx8IGlucHV0Lm9jY3VycmVkQXQgPCBub3coKSAtICgzMCAqIDg2NDAwMDAwKSkge1xuICAgIHRocm93IG5ldyBFcnJvcignaW52YWxpZF9zdXBwb3J0X2VtYWlsX2V2ZW50Jyk7XG4gIH1cbiAgY29uc3QgZ3JhbnQgPSBhd2FpdCBhdXRob3JpemVDcm1FeGVjdXRpb25HcmFudChjb250ZXh0LCBpbnB1dC5hcHBJZCwgJ3N1cHBvcnQ6ZGVsaXZlcnlfZXZlbnRzJywgbm93KCkpO1xuICBjb25zdCBkYiA9IHVzZURiKGdyYW50LmRhdGFiYXNlTmFtZSk7XG4gIGF3YWl0IFByb21pc2UuYWxsKFtlbnN1cmVPd25lckV4ZWN1dGlvbkNvbGxlY3Rpb24oZGIsICdzdXBwb3J0RW1haWxFdmVudHMnKSxcbiAgICBlbnN1cmVPd25lckV4ZWN1dGlvbkNvbGxlY3Rpb24oZGIsICdoYXNTdXBwb3J0RW1haWxFdmVudCcsIHRydWUpXSk7XG4gIGF3YWl0IGRiLmNvbGxlY3Rpb24oJ3N1cHBvcnRFbWFpbEV2ZW50cycpLmVuc3VyZUluZGV4KHtcbiAgICBleHBpcmVBZnRlcjogMCwgZmllbGRzOiBbJ3JldGlyZUF0J10sIHR5cGU6ICd0dGwnXG4gIH0pO1xuICBhd2FpdCBkYi5jb2xsZWN0aW9uKCdoYXNTdXBwb3J0RW1haWxFdmVudCcpLmVuc3VyZUluZGV4KHtcbiAgICBleHBpcmVBZnRlcjogMCwgZmllbGRzOiBbJ3JldGlyZUF0J10sIHR5cGU6ICd0dGwnXG4gIH0pO1xuICBjb25zdCB0eCA9IGF3YWl0IGRiLmJlZ2luVHJhbnNhY3Rpb24oe1xuICAgIGV4Y2x1c2l2ZTogWydzdXBwb3J0RW1haWxFdmVudHMnLCAnaGFzU3VwcG9ydEVtYWlsRXZlbnQnLCAnc3VwcG9ydEVtYWlsUmVjZWlwdHMnLCAndXNlcnMnXSxcbiAgICByZWFkOiBbJ3N1cHBvcnRUaWNrZXRzJ11cbiAgfSwge1xuICAgIGxvY2tUaW1lb3V0OiAxMFxuICB9KTtcbiAgY29uc3QgcXVlcnkgPSAodmFsdWU6IFJldHVyblR5cGU8dHlwZW9mIGFxbD4pID0+IHR4LnN0ZXAoKCkgPT4gZGIucXVlcnkodmFsdWUpKTtcbiAgdHJ5IHtcbiAgICBjb25zdCByZWNlaXB0ID0gYXdhaXQgcXVlcnkoYXFsYFJFVFVSTiBET0NVTUVOVCgnc3VwcG9ydEVtYWlsUmVjZWlwdHMnLCAke2lucHV0LnJlY2VpcHRJZH0pYCkudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyAoU3VwcG9ydEVtYWlsUmVjZWlwdCAmIHtcbiAgICAgIHJlY2lwaWVudEhhc2g6IHN0cmluZztcbiAgICB9KSB8IHVuZGVmaW5lZDtcbiAgICBpZighcmVjZWlwdCB8fCByZWNlaXB0LmFwcElkICE9PSBpbnB1dC5hcHBJZCB8fCByZWNlaXB0LmlkICE9PSBpbnB1dC5yZWNlaXB0SWRcbiAgICAgICAgICAgIHx8ICFbJ3N1Ym1pdHRpbmcnLCAndW5rbm93bicsICdhY2NlcHRlZCddLmluY2x1ZGVzKHJlY2VpcHQuc3RhdGUpXG4gICAgICAgICAgICB8fCByZWNlaXB0LnJlY2lwaWVudEhhc2ggIT09IGNybUNhbm9uaWNhbERpZ2VzdChpbnB1dC5yZWNpcGllbnQpXG4gICAgICAgICAgICB8fCAocmVjZWlwdC5wcm92aWRlck1lc3NhZ2VJZCAmJiByZWNlaXB0LnByb3ZpZGVyTWVzc2FnZUlkICE9PSBpbnB1dC5wcm92aWRlck1lc3NhZ2VJZClcbiAgICAgICAgICAgIHx8IGlucHV0Lm9jY3VycmVkQXQgPCByZWNlaXB0LmNyZWF0ZWRBdCAtIDYwMDAwIHx8IGlucHV0Lm9jY3VycmVkQXQgPiByZWNlaXB0LmNyZWF0ZWRBdCArICgzMCAqIDg2NDAwMDAwKSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdzdXBwb3J0X2VtYWlsX2V2ZW50X3N1Ym1pc3Npb25faG9sZCcpO1xuICAgIH1cbiAgICBjb25zdCBpZCA9IGNybUNhbm9uaWNhbERpZ2VzdChbaW5wdXQuYXBwSWQsIGlucHV0LmV2ZW50SWRdKTtcbiAgICBjb25zdCBmaW5nZXJwcmludCA9IGNybUNhbm9uaWNhbERpZ2VzdChpbnB1dCk7XG4gICAgY29uc3QgcHJpb3IgPSBhd2FpdCBxdWVyeShhcWwgYFJFVFVSTiBET0NVTUVOVCgnc3VwcG9ydEVtYWlsRXZlbnRzJywgJHtpZH0pYCkudGhlbigoY3Vyc29yKSA9PiBjdXJzb3IubmV4dCgpKSBhcyB7XG4gICAgICBmaW5nZXJwcmludDogc3RyaW5nO1xuICAgICAgcmVjZWlwdDoge1xuICAgICAgICBpZDogc3RyaW5nO1xuICAgICAgICBraW5kOiBzdHJpbmc7XG4gICAgICAgIG9jY3VycmVkQXQ6IG51bWJlcjtcbiAgICAgICAgcmVjZWlwdElkOiBzdHJpbmc7XG4gICAgICB9O1xuICAgIH0gfCB1bmRlZmluZWQ7XG4gICAgaWYocHJpb3IgJiYgcHJpb3IuZmluZ2VycHJpbnQgIT09IGZpbmdlcnByaW50KSB7XG4gICAgICB0aHJvdyBuZXcgRXJyb3IoJ3N1cHBvcnRfZW1haWxfZXZlbnRfY29uZmxpY3QnKTtcbiAgICB9XG4gICAgY29uc3QgbGF0ZXN0ID0gYXdhaXQgYXV0aG9yaXplQ3JtRXhlY3V0aW9uR3JhbnQoY29udGV4dCwgaW5wdXQuYXBwSWQsICdzdXBwb3J0OmRlbGl2ZXJ5X2V2ZW50cycsIG5vdygpKTtcbiAgICBpZihsYXRlc3QuaGFzaCAhPT0gZ3JhbnQuaGFzaCB8fCBsYXRlc3QuaWQgIT09IGdyYW50LmlkIHx8IGxhdGVzdC5kYXRhYmFzZU5hbWUgIT09IGdyYW50LmRhdGFiYXNlTmFtZSkge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdzdXBwb3J0X2VtYWlsX3JlbGF5X2NoYW5nZWQnKTtcbiAgICB9XG4gICAgaWYocHJpb3IpIHtcbiAgICAgIGF3YWl0IHR4LmNvbW1pdCgpO1xuICAgICAgcmV0dXJuIHByaW9yLnJlY2VpcHQ7XG4gICAgfVxuICAgIGNvbnN0IGV2ZW50cyA9IGF3YWl0IHF1ZXJ5KGFxbCBgRk9SIGV2ZW50IElOIHN1cHBvcnRFbWFpbEV2ZW50cyBGSUxURVIgZXZlbnQuYXBwSWQgPT0gJHtpbnB1dC5hcHBJZH1cbiAgICAgIEFORCBldmVudC5yZWNlaXB0LnJlY2VpcHRJZCA9PSAke2lucHV0LnJlY2VpcHRJZH0gTElNSVQgMzIgUkVUVVJOIGV2ZW50Ll9rZXlgKS50aGVuKChjdXJzb3IpID0+IGN1cnNvci5hbGwoKSk7XG4gICAgaWYoZXZlbnRzLmxlbmd0aCA+PSAzMikge1xuICAgICAgdGhyb3cgbmV3IEVycm9yKCdzdXBwb3J0X2VtYWlsX2V2ZW50X2xpbWl0Jyk7XG4gICAgfVxuICAgIC8vIE5lZ2F0aXZlIGRlbGl2ZXJ5IGV2aWRlbmNlIHN1cHByZXNzZXMgZXZlbiB3aGVuIGNvbnZlcnNhdGlvbiBjb25zZW50L3JldmlzaW9uIGhhcyBzaW5jZSBjaGFuZ2VkLlxuICAgIGlmKFsnYm91bmNlJywgJ2NvbXBsYWludCddLmluY2x1ZGVzKGlucHV0LmtpbmQpKSB7XG4gICAgICBhd2FpdCBxdWVyeShhcWwgYExFVCB0aWNrZXQgPSBET0NVTUVOVCgnc3VwcG9ydFRpY2tldHMnLCAke3JlY2VpcHQudGlja2V0SWR9KVxuICAgICAgICBGT1IgdXNlciBJTiB1c2VycyBGSUxURVIgdXNlci5fa2V5ID09IHRpY2tldC51c2VySWQgQU5EIHVzZXIuYXBwSWQgPT0gJHtpbnB1dC5hcHBJZH1cbiAgICAgICAgQU5EIHVzZXIuZW1haWwgPT0gJHtpbnB1dC5yZWNpcGllbnR9IEFORCB1c2VyLmRlbGV0ZWQgIT0gdHJ1ZVxuICAgICAgICBVUERBVEUgdXNlciBXSVRIIHtlbWFpbERlbGl2ZXJ5U3RhdHVzOiB1c2VyLmVtYWlsRGVsaXZlcnlTdGF0dXMgPT0gJ2NvbXBsYWludCcgT1IgJHtpbnB1dC5raW5kfSA9PSAnY29tcGxhaW50J1xuICAgICAgICAgID8gJ2NvbXBsYWludCcgOiAnYm91bmNlX2hvbGQnLCBzdXBwb3J0RW1haWxTdXBwcmVzc2VkOiB0cnVlfSBJTiB1c2Vyc2ApO1xuICAgIH1cbiAgICBjb25zdCByZXN1bHQgPSB7XG4gICAgICBpZCwga2luZDogaW5wdXQua2luZCwgb2NjdXJyZWRBdDogaW5wdXQub2NjdXJyZWRBdCwgcmVjZWlwdElkOiBpbnB1dC5yZWNlaXB0SWRcbiAgICB9O1xuICAgIGNvbnN0IHJldGlyZUF0ID0gTWF0aC5mbG9vcigobm93KCkgKyAoMzAgKiA4NjQwMDAwMCkpIC8gMTAwMCk7XG4gICAgYXdhaXQgcXVlcnkoYXFsIGBJTlNFUlQgJHt7XG4gICAgICBfa2V5OiBpZCwgYXBwSWQ6IGlucHV0LmFwcElkLCBmaW5nZXJwcmludCwgcmVjZWlwdDogcmVzdWx0LCByZXRpcmVBdFxuICAgIH19IElOIHN1cHBvcnRFbWFpbEV2ZW50c2ApO1xuICAgIGF3YWl0IHF1ZXJ5KGFxbCBgSU5TRVJUICR7e1xuICAgICAgX2Zyb206IGBzdXBwb3J0RW1haWxSZWNlaXB0cy8ke2lucHV0LnJlY2VpcHRJZH1gLCBfa2V5OiBpZCxcbiAgICAgIF90bzogYHN1cHBvcnRFbWFpbEV2ZW50cy8ke2lkfWAsIGFwcElkOiBpbnB1dC5hcHBJZCwgcmV0aXJlQXRcbiAgICB9fSBJTiBoYXNTdXBwb3J0RW1haWxFdmVudGApO1xuICAgIGF3YWl0IHF1ZXJ5KGFxbCBgVVBEQVRFICR7aW5wdXQucmVjZWlwdElkfSBXSVRIIHtzdGF0ZTogJ2FjY2VwdGVkJywgcHJvdmlkZXJBY2NlcHRlZEF0OlxuICAgICAgJHtyZWNlaXB0LnByb3ZpZGVyQWNjZXB0ZWRBdCB8fCBpbnB1dC5vY2N1cnJlZEF0fSwgcHJvdmlkZXJNZXNzYWdlSWQ6ICR7aW5wdXQucHJvdmlkZXJNZXNzYWdlSWR9fSBJTlxuICAgICAgICBzdXBwb3J0RW1haWxSZWNlaXB0c2ApO1xuICAgIGF3YWl0IHR4LmNvbW1pdCgpO1xuICAgIHJldHVybiByZXN1bHQ7XG4gIH0gY2F0Y2goZXJyb3IpIHtcbiAgICBhd2FpdCB0eC5hYm9ydCgpO1xuICAgIHRocm93IGVycm9yO1xuICB9XG59O1xuIl0sIm5hbWVzIjpbImFxbCIsInVzZURiIiwiY3JtQ2Fub25pY2FsRGlnZXN0IiwiYXV0aG9yaXplQ3JtRXhlY3V0aW9uR3JhbnQiLCJlbnN1cmVPd25lckV4ZWN1dGlvbkNvbGxlY3Rpb24iLCJzdXBwb3J0Q29udmVyc2F0aW9uS2V5IiwiaW5nZXN0U3VwcG9ydEVtYWlsRXZlbnQiLCJjb250ZXh0IiwiaW5wdXQiLCJub3ciLCJEYXRlIiwiT2JqZWN0Iiwia2V5cyIsInNvcnQiLCJqb2luIiwiYXBwSWQiLCJldmVudElkIiwicHJvdmlkZXJNZXNzYWdlSWQiLCJldmVyeSIsInRlc3QiLCJyZWNlaXB0SWQiLCJyZWNpcGllbnQiLCJsZW5ndGgiLCJpbmNsdWRlcyIsImtpbmQiLCJOdW1iZXIiLCJpc1NhZmVJbnRlZ2VyIiwib2NjdXJyZWRBdCIsIkVycm9yIiwiZ3JhbnQiLCJkYiIsImRhdGFiYXNlTmFtZSIsIlByb21pc2UiLCJhbGwiLCJjb2xsZWN0aW9uIiwiZW5zdXJlSW5kZXgiLCJleHBpcmVBZnRlciIsImZpZWxkcyIsInR5cGUiLCJ0eCIsImJlZ2luVHJhbnNhY3Rpb24iLCJleGNsdXNpdmUiLCJyZWFkIiwibG9ja1RpbWVvdXQiLCJxdWVyeSIsInZhbHVlIiwic3RlcCIsInJlY2VpcHQiLCJ0aGVuIiwiY3Vyc29yIiwibmV4dCIsImlkIiwic3RhdGUiLCJyZWNpcGllbnRIYXNoIiwiY3JlYXRlZEF0IiwiZmluZ2VycHJpbnQiLCJwcmlvciIsImxhdGVzdCIsImhhc2giLCJjb21taXQiLCJldmVudHMiLCJ0aWNrZXRJZCIsInJlc3VsdCIsInJldGlyZUF0IiwiTWF0aCIsImZsb29yIiwiX2tleSIsIl9mcm9tIiwiX3RvIiwicHJvdmlkZXJBY2NlcHRlZEF0IiwiZXJyb3IiLCJhYm9ydCJdLCJtYXBwaW5ncyI6IkFBQUEsU0FBUUEsR0FBRyxRQUFPLFdBQVc7QUFFN0IsU0FBUUMsS0FBSyxRQUFPLDRCQUE0QjtBQUNoRCxTQUFRQyxrQkFBa0IsUUFBTywwQkFBMEI7QUFDM0QsU0FBUUMsMEJBQTBCLEVBQUVDLDhCQUE4QixRQUFPLG9CQUFvQjtBQUM3RixTQUFRQyxzQkFBc0IsUUFBTywyQkFBMkI7QUFjaEU7OztDQUdDLEdBQ0QsT0FBTyxNQUFNQywwQkFBMEIsT0FBT0MsU0FBcUJDLE9BQStCQyxNQUFNQyxLQUFLRCxHQUFHO0lBQzlHLElBQUcsQ0FBQ0QsU0FBU0csT0FBT0MsSUFBSSxDQUFDSixPQUFPSyxJQUFJLEdBQUdDLElBQUksQ0FBQyxTQUMxQyx5RUFDTyxDQUFDO1FBQUNOLE1BQU1PLEtBQUs7UUFBRVAsTUFBTVEsT0FBTztRQUFFUixNQUFNUyxpQkFBaUI7S0FBQyxDQUFDQyxLQUFLLENBQUNiLDJCQUM3RCxDQUFDLGlCQUFpQmMsSUFBSSxDQUFDWCxNQUFNWSxTQUFTLEtBQUssT0FBT1osTUFBTWEsU0FBUyxLQUFLLFlBQ3ZFYixNQUFNYSxTQUFTLENBQUNDLE1BQU0sR0FBRyxPQUN4QixDQUFDO1FBQUM7UUFBWTtRQUFhO1FBQVU7S0FBWSxDQUFDQyxRQUFRLENBQUNmLE1BQU1nQixJQUFJLEtBQ3RFLENBQUNDLE9BQU9DLGFBQWEsQ0FBQ2xCLE1BQU1tQixVQUFVLEtBQ3JDbkIsTUFBTW1CLFVBQVUsR0FBR2xCLFFBQVEsU0FBU0QsTUFBTW1CLFVBQVUsR0FBR2xCLFFBQVMsS0FBSyxVQUFXO1FBQ3ZGLE1BQU0sSUFBSW1CLE1BQU07SUFDbEI7SUFDQSxNQUFNQyxRQUFRLE1BQU0xQiwyQkFBMkJJLFNBQVNDLE1BQU1PLEtBQUssRUFBRSwyQkFBMkJOO0lBQ2hHLE1BQU1xQixLQUFLN0IsTUFBTTRCLE1BQU1FLFlBQVk7SUFDbkMsTUFBTUMsUUFBUUMsR0FBRyxDQUFDO1FBQUM3QiwrQkFBK0IwQixJQUFJO1FBQ3BEMUIsK0JBQStCMEIsSUFBSSx3QkFBd0I7S0FBTTtJQUNuRSxNQUFNQSxHQUFHSSxVQUFVLENBQUMsc0JBQXNCQyxXQUFXLENBQUM7UUFDcERDLGFBQWE7UUFBR0MsUUFBUTtZQUFDO1NBQVc7UUFBRUMsTUFBTTtJQUM5QztJQUNBLE1BQU1SLEdBQUdJLFVBQVUsQ0FBQyx3QkFBd0JDLFdBQVcsQ0FBQztRQUN0REMsYUFBYTtRQUFHQyxRQUFRO1lBQUM7U0FBVztRQUFFQyxNQUFNO0lBQzlDO0lBQ0EsTUFBTUMsS0FBSyxNQUFNVCxHQUFHVSxnQkFBZ0IsQ0FBQztRQUNuQ0MsV0FBVztZQUFDO1lBQXNCO1lBQXdCO1lBQXdCO1NBQVE7UUFDMUZDLE1BQU07WUFBQztTQUFpQjtJQUMxQixHQUFHO1FBQ0RDLGFBQWE7SUFDZjtJQUNBLE1BQU1DLFFBQVEsQ0FBQ0MsUUFBa0NOLEdBQUdPLElBQUksQ0FBQyxJQUFNaEIsR0FBR2MsS0FBSyxDQUFDQztJQUN4RSxJQUFJO1FBQ0YsTUFBTUUsVUFBVSxNQUFNSCxNQUFNNUMsR0FBRyxDQUFDLHdDQUF3QyxFQUFFUSxNQUFNWSxTQUFTLENBQUMsQ0FBQyxDQUFDLEVBQUU0QixJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT0MsSUFBSTtRQUcxSCxJQUFHLENBQUNILFdBQVdBLFFBQVFoQyxLQUFLLEtBQUtQLE1BQU1PLEtBQUssSUFBSWdDLFFBQVFJLEVBQUUsS0FBSzNDLE1BQU1ZLFNBQVMsSUFDbkUsQ0FBQztZQUFDO1lBQWM7WUFBVztTQUFXLENBQUNHLFFBQVEsQ0FBQ3dCLFFBQVFLLEtBQUssS0FDN0RMLFFBQVFNLGFBQWEsS0FBS25ELG1CQUFtQk0sTUFBTWEsU0FBUyxLQUMzRDBCLFFBQVE5QixpQkFBaUIsSUFBSThCLFFBQVE5QixpQkFBaUIsS0FBS1QsTUFBTVMsaUJBQWlCLElBQ25GVCxNQUFNbUIsVUFBVSxHQUFHb0IsUUFBUU8sU0FBUyxHQUFHLFNBQVM5QyxNQUFNbUIsVUFBVSxHQUFHb0IsUUFBUU8sU0FBUyxHQUFJLEtBQUssVUFBVztZQUNqSCxNQUFNLElBQUkxQixNQUFNO1FBQ2xCO1FBQ0EsTUFBTXVCLEtBQUtqRCxtQkFBbUI7WUFBQ00sTUFBTU8sS0FBSztZQUFFUCxNQUFNUSxPQUFPO1NBQUM7UUFDMUQsTUFBTXVDLGNBQWNyRCxtQkFBbUJNO1FBQ3ZDLE1BQU1nRCxRQUFRLE1BQU1aLE1BQU01QyxHQUFJLENBQUMsc0NBQXNDLEVBQUVtRCxHQUFHLENBQUMsQ0FBQyxFQUFFSCxJQUFJLENBQUMsQ0FBQ0MsU0FBV0EsT0FBT0MsSUFBSTtRQVMxRyxJQUFHTSxTQUFTQSxNQUFNRCxXQUFXLEtBQUtBLGFBQWE7WUFDN0MsTUFBTSxJQUFJM0IsTUFBTTtRQUNsQjtRQUNBLE1BQU02QixTQUFTLE1BQU10RCwyQkFBMkJJLFNBQVNDLE1BQU1PLEtBQUssRUFBRSwyQkFBMkJOO1FBQ2pHLElBQUdnRCxPQUFPQyxJQUFJLEtBQUs3QixNQUFNNkIsSUFBSSxJQUFJRCxPQUFPTixFQUFFLEtBQUt0QixNQUFNc0IsRUFBRSxJQUFJTSxPQUFPMUIsWUFBWSxLQUFLRixNQUFNRSxZQUFZLEVBQUU7WUFDckcsTUFBTSxJQUFJSCxNQUFNO1FBQ2xCO1FBQ0EsSUFBRzRCLE9BQU87WUFDUixNQUFNakIsR0FBR29CLE1BQU07WUFDZixPQUFPSCxNQUFNVCxPQUFPO1FBQ3RCO1FBQ0EsTUFBTWEsU0FBUyxNQUFNaEIsTUFBTTVDLEdBQUksQ0FBQyxzREFBc0QsRUFBRVEsTUFBTU8sS0FBSyxDQUFDO3FDQUNuRSxFQUFFUCxNQUFNWSxTQUFTLENBQUMsMkJBQTJCLENBQUMsRUFBRTRCLElBQUksQ0FBQyxDQUFDQyxTQUFXQSxPQUFPaEIsR0FBRztRQUM1RyxJQUFHMkIsT0FBT3RDLE1BQU0sSUFBSSxJQUFJO1lBQ3RCLE1BQU0sSUFBSU0sTUFBTTtRQUNsQjtRQUNBLG1HQUFtRztRQUNuRyxJQUFHO1lBQUM7WUFBVTtTQUFZLENBQUNMLFFBQVEsQ0FBQ2YsTUFBTWdCLElBQUksR0FBRztZQUMvQyxNQUFNb0IsTUFBTTVDLEdBQUksQ0FBQyx3Q0FBd0MsRUFBRStDLFFBQVFjLFFBQVEsQ0FBQzs4RUFDSixFQUFFckQsTUFBTU8sS0FBSyxDQUFDOzBCQUNsRSxFQUFFUCxNQUFNYSxTQUFTLENBQUM7MEZBQzhDLEVBQUViLE1BQU1nQixJQUFJLENBQUM7K0VBQ3hCLENBQUM7UUFDNUU7UUFDQSxNQUFNc0MsU0FBUztZQUNiWDtZQUFJM0IsTUFBTWhCLE1BQU1nQixJQUFJO1lBQUVHLFlBQVluQixNQUFNbUIsVUFBVTtZQUFFUCxXQUFXWixNQUFNWSxTQUFTO1FBQ2hGO1FBQ0EsTUFBTTJDLFdBQVdDLEtBQUtDLEtBQUssQ0FBQyxBQUFDeEQsQ0FBQUEsUUFBUyxLQUFLLFFBQVEsSUFBSztRQUN4RCxNQUFNbUMsTUFBTTVDLEdBQUksQ0FBQyxPQUFPLEVBQUU7WUFDeEJrRSxNQUFNZjtZQUFJcEMsT0FBT1AsTUFBTU8sS0FBSztZQUFFd0M7WUFBYVIsU0FBU2U7WUFBUUM7UUFDOUQsRUFBRSxzQkFBc0IsQ0FBQztRQUN6QixNQUFNbkIsTUFBTTVDLEdBQUksQ0FBQyxPQUFPLEVBQUU7WUFDeEJtRSxPQUFPLENBQUMscUJBQXFCLEVBQUUzRCxNQUFNWSxTQUFTLEVBQUU7WUFBRThDLE1BQU1mO1lBQ3hEaUIsS0FBSyxDQUFDLG1CQUFtQixFQUFFakIsSUFBSTtZQUFFcEMsT0FBT1AsTUFBTU8sS0FBSztZQUFFZ0Q7UUFDdkQsRUFBRSx3QkFBd0IsQ0FBQztRQUMzQixNQUFNbkIsTUFBTTVDLEdBQUksQ0FBQyxPQUFPLEVBQUVRLE1BQU1ZLFNBQVMsQ0FBQztNQUN4QyxFQUFFMkIsUUFBUXNCLGtCQUFrQixJQUFJN0QsTUFBTW1CLFVBQVUsQ0FBQyxxQkFBcUIsRUFBRW5CLE1BQU1TLGlCQUFpQixDQUFDOzRCQUMxRSxDQUFDO1FBQ3pCLE1BQU1zQixHQUFHb0IsTUFBTTtRQUNmLE9BQU9HO0lBQ1QsRUFBRSxPQUFNUSxPQUFPO1FBQ2IsTUFBTS9CLEdBQUdnQyxLQUFLO1FBQ2QsTUFBTUQ7SUFDUjtBQUNGLEVBQUUifQ==

package/lib/actions/supportEmailHandoff.d.ts

@@ -0,0 +1,114 @@
+import { sesSend } from './email.js';
+import type { ApiContext } from '../types/auth.types.js';
+import type { SupportConversationInput } from './supportConversation.js';
+export interface SupportEmailPreviewInput extends SupportConversationInput {
+    body: string;
+    expectedConversationRevision: string;
+    idempotencyKey: string;
+    subject: string;
+}
+export interface SupportEmailReceipt {
+    appId: string;
+    contentStatus: 'current' | 'redacted';
+    conversationRevision: string;
+    createdAt: number;
+    expiresAt: number;
+    id: string;
+    maxActions: 1;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    revision: string;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'accepted';
+    ticketId: string;
+    ticketRevision: string;
+}
+/** Current exact email target review; no inferred channel binding or inbound provider provenance. */
+export declare const readSupportEmailHandoffTarget: (context: ApiContext, input: SupportConversationInput, now?: () => number) => Promise<{
+    appId: string;
+    conversationRevision: string;
+    recipient: string;
+    sender: string;
+    ticketId: string;
+    ticketRevision: string;
+    validUntil: number;
+}>;
+/** Own bounded conversation revision plus a separately consented exact email recipient/body. */
+export declare const previewSupportEmailHandoff: (context: ApiContext, input: SupportEmailPreviewInput, now?: () => number) => Promise<{
+    appId: string;
+    contentStatus: 'current' | 'redacted';
+    conversationRevision: string;
+    createdAt: number;
+    expiresAt: number;
+    id: string;
+    maxActions: 1;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    revision: string;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'accepted';
+    ticketId: string;
+    ticketRevision: string;
+    body?: string;
+    recipient?: string;
+    sender?: string;
+    subject?: string;
+}>;
+/** Inspection redacts private content immediately when any current source/authority fails. */
+export declare const getSupportEmailHandoff: (context: ApiContext, appId: string, id: string, now?: () => number) => Promise<{
+    appId: string;
+    contentStatus: 'current' | 'redacted';
+    conversationRevision: string;
+    createdAt: number;
+    expiresAt: number;
+    id: string;
+    maxActions: 1;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    revision: string;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'accepted';
+    ticketId: string;
+    ticketRevision: string;
+    body?: string;
+    recipient?: string;
+    sender?: string;
+    subject?: string;
+}>;
+/** Separate explicit revision-bound approval/rejection; never granted by an Ads plan. */
+export declare const decideSupportEmailHandoff: (context: ApiContext, appId: string, id: string, revision: string, decision: 'approved' | 'rejected', now?: () => number) => Promise<{
+    appId: string;
+    contentStatus: 'current' | 'redacted';
+    conversationRevision: string;
+    createdAt: number;
+    expiresAt: number;
+    id: string;
+    maxActions: 1;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    revision: string;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'accepted';
+    ticketId: string;
+    ticketRevision: string;
+    body?: string;
+    recipient?: string;
+    sender?: string;
+    subject?: string;
+}>;
+/** Durable claim precedes exactly one SES attempt. Missing/ambiguous acknowledgement is a permanent hold. */
+export declare const executeSupportEmailHandoff: (context: ApiContext, appId: string, id: string, revision: string, now?: () => number, send?: typeof sesSend) => Promise<{
+    appId: string;
+    contentStatus: 'current' | 'redacted';
+    conversationRevision: string;
+    createdAt: number;
+    expiresAt: number;
+    id: string;
+    maxActions: 1;
+    providerAcceptedAt?: number;
+    providerMessageId?: string;
+    revision: string;
+    state: 'pending' | 'approved' | 'rejected' | 'submitting' | 'unknown' | 'accepted';
+    ticketId: string;
+    ticketRevision: string;
+    body?: string;
+    recipient?: string;
+    sender?: string;
+    subject?: string;
+}>;