@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/dist/modules/communication_channels/lib/pg-errors.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/pg-errors.ts"],
+  "sourcesContent": ["/**\n * Detect a Postgres unique-constraint violation (SQLSTATE 23505) regardless of\n * the ORM/driver layer that surfaces it. Shared across the hub's commands and\n * lib helpers so duplicate-insert handling stays consistent module-wide.\n */\nexport function isUniqueViolation(err: unknown): boolean {\n  if (!err || typeof err !== 'object') return false\n  const code = (err as { code?: string }).code\n  if (code === '23505') return true // Postgres unique_violation\n  const message = (err as { message?: string }).message\n  return typeof message === 'string' && /duplicate key value|unique constraint/i.test(message)\n}\n"],
+  "mappings": "AAKO,SAAS,kBAAkB,KAAuB;AACvD,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,OAAQ,IAA0B;AACxC,MAAI,SAAS,QAAS,QAAO;AAC7B,QAAM,UAAW,IAA6B;AAC9C,SAAO,OAAO,YAAY,YAAY,yCAAyC,KAAK,OAAO;AAC7F;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/provider-health.js

@@ -0,0 +1,24 @@
+function makeClientConfigHealthCheck(options) {
+  return {
+    async check(credentials) {
+      const parsed = options.schema.safeParse(credentials ?? {});
+      if (!parsed.success) {
+        const first = parsed.error.issues[0];
+        return {
+          status: "unhealthy",
+          message: `${options.providerLabel} OAuth client config invalid: ${first?.message ?? "unknown validation error"}`,
+          details: { reason: "invalid_oauth_client" }
+        };
+      }
+      return {
+        status: "healthy",
+        message: `${options.providerLabel} OAuth client configured`,
+        details: { clientIdConfigured: true, ...options.healthyDetails?.(parsed.data) ?? {} }
+      };
+    }
+  };
+}
+export {
+  makeClientConfigHealthCheck
+};
+//# sourceMappingURL=provider-health.js.map

package/dist/modules/communication_channels/lib/provider-health.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/provider-health.ts"],
+  "sourcesContent": ["import type { ZodType } from 'zod'\nimport type { IntegrationScope } from '@open-mercato/shared/modules/integrations/types'\n\nexport type EmailHealthStatus = 'healthy' | 'degraded' | 'unhealthy'\n\nexport interface EmailHealthCheckResult {\n  status: EmailHealthStatus\n  message?: string\n  details?: Record<string, unknown>\n}\n\nexport interface EmailHealthCheck {\n  check: (credentials: Record<string, unknown> | null, scope: IntegrationScope) => Promise<EmailHealthCheckResult>\n}\n\n/**\n * Build a liveness probe for an OAuth-client-config integration. There is no\n * access token at this layer (the hub passes the tenant-scoped OAuth client\n * config, not per-user channel tokens), so a network call would always 401. The\n * cheap, deterministic probe is: confirm the client config is present and\n * well-formed. Per-user token validity is exercised on the channel itself\n * (send / poll surface `requires_reauth`).\n */\nexport function makeClientConfigHealthCheck<T>(options: {\n  schema: ZodType<T>\n  providerLabel: string\n  healthyDetails?: (parsed: T) => Record<string, unknown>\n}): EmailHealthCheck {\n  return {\n    async check(credentials) {\n      const parsed = options.schema.safeParse(credentials ?? {})\n      if (!parsed.success) {\n        const first = parsed.error.issues[0]\n        return {\n          status: 'unhealthy',\n          message: `${options.providerLabel} OAuth client config invalid: ${first?.message ?? 'unknown validation error'}`,\n          details: { reason: 'invalid_oauth_client' },\n        }\n      }\n      return {\n        status: 'healthy',\n        message: `${options.providerLabel} OAuth client configured`,\n        details: { clientIdConfigured: true, ...(options.healthyDetails?.(parsed.data) ?? {}) },\n      }\n    },\n  }\n}\n"],
+  "mappings": "AAuBO,SAAS,4BAA+B,SAI1B;AACnB,SAAO;AAAA,IACL,MAAM,MAAM,aAAa;AACvB,YAAM,SAAS,QAAQ,OAAO,UAAU,eAAe,CAAC,CAAC;AACzD,UAAI,CAAC,OAAO,SAAS;AACnB,cAAM,QAAQ,OAAO,MAAM,OAAO,CAAC;AACnC,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,SAAS,GAAG,QAAQ,aAAa,iCAAiC,OAAO,WAAW,0BAA0B;AAAA,UAC9G,SAAS,EAAE,QAAQ,uBAAuB;AAAA,QAC5C;AAAA,MACF;AACA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,SAAS,GAAG,QAAQ,aAAa;AAAA,QACjC,SAAS,EAAE,oBAAoB,MAAM,GAAI,QAAQ,iBAAiB,OAAO,IAAI,KAAK,CAAC,EAAG;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/push-state.js

@@ -0,0 +1,19 @@
+const PUSH_STATE_KEYS = [
+  "pushStatus",
+  "watchExpirationMs",
+  "pubsubTopic",
+  "lastPushError"
+];
+function preservePushState(previous, next) {
+  const prev = previous && typeof previous === "object" && !Array.isArray(previous) ? previous : {};
+  const merged = { ...next };
+  for (const key of PUSH_STATE_KEYS) {
+    if (!(key in merged) && key in prev) merged[key] = prev[key];
+  }
+  return merged;
+}
+export {
+  PUSH_STATE_KEYS,
+  preservePushState
+};
+//# sourceMappingURL=push-state.js.map

package/dist/modules/communication_channels/lib/push-state.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/push-state.ts"],
+  "sourcesContent": ["/**\n * Channel-state keys owned by the push-delivery lifecycle (Spec C), written by the\n * push register/renew commands rather than the sync cursor. They must survive a\n * sync-cursor replacement so watch/subscription renewal keeps working.\n */\nexport const PUSH_STATE_KEYS = [\n  'pushStatus',\n  'watchExpirationMs',\n  'pubsubTopic',\n  'lastPushError',\n] as const\n\n/**\n * Replace the channel sync-cursor state with the adapter's freshly decoded cursor\n * while carrying forward the hub-owned push keys the cursor does not manage.\n *\n * This MUST be a full replace, never a `{ ...previous, ...next }` spread: adapters\n * signal \"drain finished\" by OMITTING the mid-drain resumption tokens\n * (`pendingHistoryPageToken`, `pendingMessagesPageToken`) from\n * `next` (they are set to `undefined`, which `JSON.stringify` drops from the encoded\n * cursor). A spread would retain a stale token from `previous` and mis-route the\n * next push/poll cycle, so the poll worker and both push-sync workers share this\n * helper to stay consistent.\n */\nexport function preservePushState(\n  previous: unknown,\n  next: Record<string, unknown>,\n): Record<string, unknown> {\n  const prev =\n    previous && typeof previous === 'object' && !Array.isArray(previous)\n      ? (previous as Record<string, unknown>)\n      : {}\n  const merged: Record<string, unknown> = { ...next }\n  for (const key of PUSH_STATE_KEYS) {\n    if (!(key in merged) && key in prev) merged[key] = prev[key]\n  }\n  return merged\n}\n"],
+  "mappings": "AAKO,MAAM,kBAAkB;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAcO,SAAS,kBACd,UACA,MACyB;AACzB,QAAM,OACJ,YAAY,OAAO,aAAa,YAAY,CAAC,MAAM,QAAQ,QAAQ,IAC9D,WACD,CAAC;AACP,QAAM,SAAkC,EAAE,GAAG,KAAK;AAClD,aAAW,OAAO,iBAAiB;AACjC,QAAI,EAAE,OAAO,WAAW,OAAO,KAAM,QAAO,GAAG,IAAI,KAAK,GAAG;AAAA,EAC7D;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/queue.js

@@ -0,0 +1,54 @@
+import { createModuleQueue } from "@open-mercato/queue";
+const queues = /* @__PURE__ */ new Map();
+function getCommunicationChannelsQueue(queueName) {
+  const existing = queues.get(queueName);
+  if (existing) return existing;
+  const concurrency = Math.min(
+    20,
+    Math.max(
+      1,
+      Number.parseInt(process.env.COMMUNICATION_CHANNELS_QUEUE_CONCURRENCY ?? "10", 10) || 10
+    )
+  );
+  const created = createModuleQueue(queueName, { concurrency });
+  queues.set(queueName, created);
+  return created;
+}
+const COMMUNICATION_CHANNELS_QUEUES = {
+  inbound: "communication-channels-inbound",
+  outbound: "communication-channels-outbound",
+  reactions: "communication-channels-reactions",
+  /**
+   * Per-channel polling queue (email integration spec — Phase 0 Delta 6).
+   * Populated by `poll-tick` every scheduler tick; one entry per due channel.
+   * Processed by `workers/poll-channel.ts`.
+   */
+  poll: "communication-channels-poll",
+  /**
+   * Hub-internal tick queue (email integration spec — Phase 0 Delta 6).
+   * One job per scheduler tick (60s default); worker enumerates due channels
+   * and fans out to the `poll` queue.
+   */
+  pollTick: "communication-channels-poll-tick",
+  /**
+   * Operator-triggered channel-history import queue (Spec B § Phase B6).
+   * One job per `/import-history` call; worker `channel-import-history` runs
+   * with concurrency 1 to avoid hammering the provider with parallel scans.
+   */
+  importHistory: "communication-channels-import-history",
+  /**
+   * Spec C § Phase C2 — Gmail Pub/Sub push delivery. The webhook enqueues
+   * one job per verified notification; the worker calls
+   * `adapter.applyPushNotification` (which delegates to `history.list`).
+   */
+  gmailHistorySync: "communication-channels-gmail-history-sync",
+  /**
+   * Spec C § Phase C4 — Renewal cron queues (daily / 2h cadence).
+   */
+  gmailRenewWatch: "communication-channels-gmail-renew-watch"
+};
+export {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+};
+//# sourceMappingURL=queue.js.map

package/dist/modules/communication_channels/lib/queue.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/queue.ts"],
+  "sourcesContent": ["import { createModuleQueue, type Queue } from '@open-mercato/queue'\n\n/**\n * Queue helper for the communication_channels hub. Mirrors the\n * shipping_carriers pattern (`getShippingCarrierQueue`) so the route\n * and the worker share the same queue instance.\n *\n * Worker concurrency is also tunable via env (`COMMUNICATION_CHANNELS_QUEUE_CONCURRENCY`)\n * with a sensible default of 10 (per SPEC-045d \u00A76 inbound flow) and a hard ceiling of\n * 20 (ARCHITECTURE \u00A719 caps queue/worker concurrency at 20).\n */\nconst queues = new Map<string, Queue<Record<string, unknown>>>()\n\nexport function getCommunicationChannelsQueue(queueName: string): Queue<Record<string, unknown>> {\n  const existing = queues.get(queueName)\n  if (existing) return existing\n\n  const concurrency = Math.min(\n    20,\n    Math.max(\n      1,\n      Number.parseInt(process.env.COMMUNICATION_CHANNELS_QUEUE_CONCURRENCY ?? '10', 10) || 10,\n    ),\n  )\n  const created = createModuleQueue<Record<string, unknown>>(queueName, { concurrency })\n  queues.set(queueName, created)\n  return created\n}\n\n/** Canonical queue names exposed by the hub. */\nexport const COMMUNICATION_CHANNELS_QUEUES = {\n  inbound: 'communication-channels-inbound',\n  outbound: 'communication-channels-outbound',\n  reactions: 'communication-channels-reactions',\n  /**\n   * Per-channel polling queue (email integration spec \u2014 Phase 0 Delta 6).\n   * Populated by `poll-tick` every scheduler tick; one entry per due channel.\n   * Processed by `workers/poll-channel.ts`.\n   */\n  poll: 'communication-channels-poll',\n  /**\n   * Hub-internal tick queue (email integration spec \u2014 Phase 0 Delta 6).\n   * One job per scheduler tick (60s default); worker enumerates due channels\n   * and fans out to the `poll` queue.\n   */\n  pollTick: 'communication-channels-poll-tick',\n  /**\n   * Operator-triggered channel-history import queue (Spec B \u00A7 Phase B6).\n   * One job per `/import-history` call; worker `channel-import-history` runs\n   * with concurrency 1 to avoid hammering the provider with parallel scans.\n   */\n  importHistory: 'communication-channels-import-history',\n  /**\n   * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push delivery. The webhook enqueues\n   * one job per verified notification; the worker calls\n   * `adapter.applyPushNotification` (which delegates to `history.list`).\n   */\n  gmailHistorySync: 'communication-channels-gmail-history-sync',\n  /**\n   * Spec C \u00A7 Phase C4 \u2014 Renewal cron queues (daily / 2h cadence).\n   */\n  gmailRenewWatch: 'communication-channels-gmail-renew-watch',\n} as const\n\nexport type CommunicationChannelsQueueName =\n  (typeof COMMUNICATION_CHANNELS_QUEUES)[keyof typeof COMMUNICATION_CHANNELS_QUEUES]\n"],
+  "mappings": "AAAA,SAAS,yBAAqC;AAW9C,MAAM,SAAS,oBAAI,IAA4C;AAExD,SAAS,8BAA8B,WAAmD;AAC/F,QAAM,WAAW,OAAO,IAAI,SAAS;AACrC,MAAI,SAAU,QAAO;AAErB,QAAM,cAAc,KAAK;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH;AAAA,MACA,OAAO,SAAS,QAAQ,IAAI,4CAA4C,MAAM,EAAE,KAAK;AAAA,IACvF;AAAA,EACF;AACA,QAAM,UAAU,kBAA2C,WAAW,EAAE,YAAY,CAAC;AACrF,SAAO,IAAI,WAAW,OAAO;AAC7B,SAAO;AACT;AAGO,MAAM,gCAAgC;AAAA,EAC3C,SAAS;AAAA,EACT,UAAU;AAAA,EACV,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMX,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMN,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,eAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMf,kBAAkB;AAAA;AAAA;AAAA;AAAA,EAIlB,iBAAiB;AACnB;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/reaction-processor-types.js

@@ -0,0 +1,5 @@
+const REACTION_PROCESSOR_MAX_ATTEMPTS = 3;
+export {
+  REACTION_PROCESSOR_MAX_ATTEMPTS
+};
+//# sourceMappingURL=reaction-processor-types.js.map

package/dist/modules/communication_channels/lib/reaction-processor-types.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/reaction-processor-types.ts"],
+  "sourcesContent": ["import type { InboundReactionEvent } from './adapter'\n\n/**\n * Discriminated union of reaction-queue job payloads.\n *\n * Split into its own file so command modules can reference these types without\n * forming a circular import with the worker module (which references commands).\n */\n\nexport type ReactionScope = {\n  tenantId: string\n  organizationId: string | null\n}\n\nexport type ReactionJobBase = {\n  providerKey: string\n  channelId: string\n  scope: ReactionScope\n  /** Attempt number, 1-based. */\n  attempt?: number\n}\n\nexport type ReactionInboundJob = ReactionJobBase & {\n  kind: 'inbound'\n  channelType: string\n  event: InboundReactionEvent\n}\n\nexport type ReactionOutboundSendJob = ReactionJobBase & {\n  kind: 'outbound_send'\n  messageId: string\n  reactionId: string\n  emoji: string\n  /** External conversation reference for the provider call (e.g. Slack thread_ts). */\n  conversationId?: string\n}\n\nexport type ReactionOutboundRemoveJob = ReactionJobBase & {\n  kind: 'outbound_remove'\n  messageId: string\n  emoji: string\n  externalReactionId: string | null\n  conversationId?: string\n}\n\nexport type ReactionProcessorPayload =\n  | ReactionInboundJob\n  | ReactionOutboundSendJob\n  | ReactionOutboundRemoveJob\n\nexport const REACTION_PROCESSOR_MAX_ATTEMPTS = 3\n"],
+  "mappings": "AAkDO,MAAM,kCAAkC;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/reaction-semantics.js

@@ -0,0 +1,11 @@
+function allowsMultipleReactionsPerUser(capabilities) {
+  return capabilities?.multiReactionPerUser === true;
+}
+function resolveInboundAddMutation(capabilities) {
+  return allowsMultipleReactionsPerUser(capabilities) ? "insert" : "replace";
+}
+export {
+  allowsMultipleReactionsPerUser,
+  resolveInboundAddMutation
+};
+//# sourceMappingURL=reaction-semantics.js.map

package/dist/modules/communication_channels/lib/reaction-semantics.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/reaction-semantics.ts"],
+  "sourcesContent": ["import type { ChannelCapabilities } from './adapter'\n\n/**\n * Reaction semantics \u2014 capability-driven decisions about how the hub applies an\n * incoming or outgoing reaction.\n *\n * The platform-side `MessageReaction` table can record any number of rows per\n * (messageId, reactor); the channel-specific semantics decide whether to keep\n * existing reactions when a new one arrives:\n *\n *   - **Multi-per-user** (Slack default; `multiReactionPerUser: true`):\n *     keep all existing reactions from the same reactor; just insert the new one.\n *\n *   - **Single-per-user** (WhatsApp default; `multiReactionPerUser: false`):\n *     delete all existing reactions from the same reactor for the same message,\n *     then insert the new one. This matches WhatsApp's \"one reaction per user\"\n *     UI behaviour.\n *\n * The helper functions here are pure \u2014 they don't talk to the database. The\n * command layer that consumes them is responsible for the actual DELETE/INSERT.\n */\n\n/**\n * Returns true when the channel's capabilities allow multiple reactions from\n * the same reactor on the same message (Slack-like).\n */\nexport function allowsMultipleReactionsPerUser(\n  capabilities: Pick<ChannelCapabilities, 'multiReactionPerUser'> | null | undefined,\n): boolean {\n  // Default to false for safety \u2014 a missing capability declaration should not\n  // accidentally enable multi-reactions. Real adapters explicitly declare both\n  // booleans per SPEC-045d \u00A71.1.\n  return capabilities?.multiReactionPerUser === true\n}\n\n/**\n * Computes what mutation a new inbound `added` reaction implies, given the\n * channel's capabilities. Pure \u2014 no DB calls. The caller maps the result to\n * SQL.\n *\n * @returns `'insert'` to just persist the new reaction; `'replace'` to delete\n *   every reaction from the same reactor for the same message before inserting.\n */\nexport function resolveInboundAddMutation(\n  capabilities: Pick<ChannelCapabilities, 'multiReactionPerUser'> | null | undefined,\n): 'insert' | 'replace' {\n  return allowsMultipleReactionsPerUser(capabilities) ? 'insert' : 'replace'\n}\n"],
+  "mappings": "AA0BO,SAAS,+BACd,cACS;AAIT,SAAO,cAAc,yBAAyB;AAChD;AAUO,SAAS,0BACd,cACsB;AACtB,SAAO,+BAA+B,YAAY,IAAI,WAAW;AACnE;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/registry.js

@@ -0,0 +1,67 @@
+import { validateAdapterCapabilities } from "./adapter-compat.js";
+const CHANNEL_ADAPTER_REGISTRY_KEY = /* @__PURE__ */ Symbol.for("@open-mercato/communication-channels/adapter-registry");
+function getRegistryMap() {
+  const scope = globalThis;
+  if (!scope[CHANNEL_ADAPTER_REGISTRY_KEY]) {
+    scope[CHANNEL_ADAPTER_REGISTRY_KEY] = /* @__PURE__ */ new Map();
+  }
+  return scope[CHANNEL_ADAPTER_REGISTRY_KEY];
+}
+function registerChannelAdapter(adapter) {
+  validateAdapterCapabilities(adapter);
+  const map = getRegistryMap();
+  if (map.has(adapter.providerKey)) {
+    throw new Error(
+      `ChannelAdapter '${adapter.providerKey}' is already registered. Each provider package must declare a unique providerKey.`
+    );
+  }
+  map.set(adapter.providerKey, adapter);
+  return () => {
+    map.delete(adapter.providerKey);
+  };
+}
+function getChannelAdapter(providerKey) {
+  return getRegistryMap().get(providerKey);
+}
+function listChannelAdapters() {
+  return Array.from(getRegistryMap().values());
+}
+function listChannelAdapterProviderKeys() {
+  return Array.from(getRegistryMap().keys());
+}
+function hasChannelAdapter(providerKey) {
+  return getRegistryMap().has(providerKey);
+}
+function clearChannelAdapters() {
+  getRegistryMap().clear();
+}
+class ChannelAdapterRegistry {
+  register(adapter) {
+    registerChannelAdapter(adapter);
+  }
+  get(providerKey) {
+    return getChannelAdapter(providerKey);
+  }
+  list() {
+    return listChannelAdapters();
+  }
+  providerKeys() {
+    return listChannelAdapterProviderKeys();
+  }
+  has(providerKey) {
+    return hasChannelAdapter(providerKey);
+  }
+  clear() {
+    clearChannelAdapters();
+  }
+}
+export {
+  ChannelAdapterRegistry,
+  clearChannelAdapters,
+  getChannelAdapter,
+  hasChannelAdapter,
+  listChannelAdapterProviderKeys,
+  listChannelAdapters,
+  registerChannelAdapter
+};
+//# sourceMappingURL=registry.js.map

package/dist/modules/communication_channels/lib/registry.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/registry.ts"],
+  "sourcesContent": ["import type { ChannelAdapter } from './adapter'\nimport { validateAdapterCapabilities } from './adapter-compat'\n\n/**\n * Channel adapter registry \u2014 process-level singleton backed by `globalThis`.\n *\n * Mirrors the `shipping_carriers/lib/adapter-registry.ts` pattern so that\n * unauthenticated webhook routes (which have not yet built a tenant-scoped DI\n * container) can resolve adapters by `providerKey`. DI consumers continue to\n * resolve the same registry via the `channelAdapterRegistry` binding declared\n * in `di.ts` \u2014 that binding is a thin proxy over these functions.\n *\n * The registry validates each adapter at registration time (see\n * `validateAdapterCapabilities`) and refuses duplicate `providerKey` registrations.\n */\n\nconst CHANNEL_ADAPTER_REGISTRY_KEY = Symbol.for('@open-mercato/communication-channels/adapter-registry')\n\ntype GlobalWithChannelRegistry = typeof globalThis & {\n  [CHANNEL_ADAPTER_REGISTRY_KEY]?: Map<string, ChannelAdapter>\n}\n\nfunction getRegistryMap(): Map<string, ChannelAdapter> {\n  const scope = globalThis as GlobalWithChannelRegistry\n  if (!scope[CHANNEL_ADAPTER_REGISTRY_KEY]) {\n    scope[CHANNEL_ADAPTER_REGISTRY_KEY] = new Map<string, ChannelAdapter>()\n  }\n  return scope[CHANNEL_ADAPTER_REGISTRY_KEY]!\n}\n\nexport function registerChannelAdapter(adapter: ChannelAdapter): () => void {\n  validateAdapterCapabilities(adapter)\n  const map = getRegistryMap()\n  if (map.has(adapter.providerKey)) {\n    throw new Error(\n      `ChannelAdapter '${adapter.providerKey}' is already registered. ` +\n        'Each provider package must declare a unique providerKey.',\n    )\n  }\n  map.set(adapter.providerKey, adapter)\n  return () => {\n    map.delete(adapter.providerKey)\n  }\n}\n\nexport function getChannelAdapter(providerKey: string): ChannelAdapter | undefined {\n  return getRegistryMap().get(providerKey)\n}\n\nexport function listChannelAdapters(): ChannelAdapter[] {\n  return Array.from(getRegistryMap().values())\n}\n\nexport function listChannelAdapterProviderKeys(): string[] {\n  return Array.from(getRegistryMap().keys())\n}\n\nexport function hasChannelAdapter(providerKey: string): boolean {\n  return getRegistryMap().has(providerKey)\n}\n\n/**\n * Clear the registry. Primarily for tests that need a fresh registry between cases.\n * NOT for production use \u2014 at runtime, adapters are registered once at boot.\n */\nexport function clearChannelAdapters(): void {\n  getRegistryMap().clear()\n}\n\n/**\n * Class wrapper kept for DI consumers and test ergonomics. All instances back\n * onto the same `globalThis` storage so DI consumers and direct module callers\n * see the same registry.\n */\nexport class ChannelAdapterRegistry {\n  register(adapter: ChannelAdapter): void {\n    registerChannelAdapter(adapter)\n  }\n\n  get(providerKey: string): ChannelAdapter | undefined {\n    return getChannelAdapter(providerKey)\n  }\n\n  list(): ChannelAdapter[] {\n    return listChannelAdapters()\n  }\n\n  providerKeys(): string[] {\n    return listChannelAdapterProviderKeys()\n  }\n\n  has(providerKey: string): boolean {\n    return hasChannelAdapter(providerKey)\n  }\n\n  clear(): void {\n    clearChannelAdapters()\n  }\n}\n"],
+  "mappings": "AACA,SAAS,mCAAmC;AAe5C,MAAM,+BAA+B,uBAAO,IAAI,uDAAuD;AAMvG,SAAS,iBAA8C;AACrD,QAAM,QAAQ;AACd,MAAI,CAAC,MAAM,4BAA4B,GAAG;AACxC,UAAM,4BAA4B,IAAI,oBAAI,IAA4B;AAAA,EACxE;AACA,SAAO,MAAM,4BAA4B;AAC3C;AAEO,SAAS,uBAAuB,SAAqC;AAC1E,8BAA4B,OAAO;AACnC,QAAM,MAAM,eAAe;AAC3B,MAAI,IAAI,IAAI,QAAQ,WAAW,GAAG;AAChC,UAAM,IAAI;AAAA,MACR,mBAAmB,QAAQ,WAAW;AAAA,IAExC;AAAA,EACF;AACA,MAAI,IAAI,QAAQ,aAAa,OAAO;AACpC,SAAO,MAAM;AACX,QAAI,OAAO,QAAQ,WAAW;AAAA,EAChC;AACF;AAEO,SAAS,kBAAkB,aAAiD;AACjF,SAAO,eAAe,EAAE,IAAI,WAAW;AACzC;AAEO,SAAS,sBAAwC;AACtD,SAAO,MAAM,KAAK,eAAe,EAAE,OAAO,CAAC;AAC7C;AAEO,SAAS,iCAA2C;AACzD,SAAO,MAAM,KAAK,eAAe,EAAE,KAAK,CAAC;AAC3C;AAEO,SAAS,kBAAkB,aAA8B;AAC9D,SAAO,eAAe,EAAE,IAAI,WAAW;AACzC;AAMO,SAAS,uBAA6B;AAC3C,iBAAe,EAAE,MAAM;AACzB;AAOO,MAAM,uBAAuB;AAAA,EAClC,SAAS,SAA+B;AACtC,2BAAuB,OAAO;AAAA,EAChC;AAAA,EAEA,IAAI,aAAiD;AACnD,WAAO,kBAAkB,WAAW;AAAA,EACtC;AAAA,EAEA,OAAyB;AACvB,WAAO,oBAAoB;AAAA,EAC7B;AAAA,EAEA,eAAyB;AACvB,WAAO,+BAA+B;AAAA,EACxC;AAAA,EAEA,IAAI,aAA8B;AAChC,WAAO,kBAAkB,WAAW;AAAA,EACtC;AAAA,EAEA,QAAc;AACZ,yBAAqB;AAAA,EACvB;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/route-mutation-guard.js

@@ -0,0 +1,43 @@
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
+async function validateRouteMutationGuard(params) {
+  const { auth, container, input, req } = params;
+  if (!auth.sub || !auth.tenantId) {
+    return { result: null, afterSuccess: async () => void 0 };
+  }
+  const base = {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+    userId: auth.sub,
+    resourceKind: input.resourceKind,
+    resourceId: input.resourceId,
+    operation: input.operation ?? "custom",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  };
+  const result = await validateCrudMutationGuard(container, {
+    ...base,
+    mutationPayload: input.mutationPayload ?? null
+  });
+  if (result && !result.ok) {
+    return {
+      response: Response.json(result.body, { status: result.status })
+    };
+  }
+  return {
+    result,
+    afterSuccess: async () => {
+      if (!result?.ok || !result.shouldRunAfterSuccess) return;
+      await runCrudMutationGuardAfterSuccess(container, {
+        ...base,
+        metadata: result.metadata ?? null
+      });
+    }
+  };
+}
+export {
+  validateRouteMutationGuard
+};
+//# sourceMappingURL=route-mutation-guard.js.map

package/dist/modules/communication_channels/lib/route-mutation-guard.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/route-mutation-guard.ts"],
+  "sourcesContent": ["import type { AwilixContainer } from 'awilix'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n  type CrudMutationGuardValidationResult,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\ntype RouteAuth = {\n  sub?: string | null\n  tenantId?: string | null\n  orgId?: string | null\n}\n\ntype RouteMutationGuardInput = {\n  resourceKind: string\n  resourceId: string\n  operation?: 'create' | 'update' | 'delete' | 'custom'\n  mutationPayload?: Record<string, unknown> | null\n}\n\nexport type RouteMutationGuardContext = {\n  result: CrudMutationGuardValidationResult | null\n  afterSuccess: () => Promise<void>\n}\n\nexport async function validateRouteMutationGuard(params: {\n  container: AwilixContainer\n  req: Request\n  auth: RouteAuth\n  input: RouteMutationGuardInput\n}): Promise<RouteMutationGuardContext | { response: Response }> {\n  const { auth, container, input, req } = params\n  if (!auth.sub || !auth.tenantId) {\n    return { result: null, afterSuccess: async () => undefined }\n  }\n\n  const base = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId ?? null,\n    userId: auth.sub,\n    resourceKind: input.resourceKind,\n    resourceId: input.resourceId,\n    operation: input.operation ?? 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  } as const\n\n  const result = await validateCrudMutationGuard(container, {\n    ...base,\n    mutationPayload: input.mutationPayload ?? null,\n  })\n  if (result && !result.ok) {\n    return {\n      response: Response.json(result.body, { status: result.status }),\n    }\n  }\n\n  return {\n    result,\n    afterSuccess: async () => {\n      if (!result?.ok || !result.shouldRunAfterSuccess) return\n      await runCrudMutationGuardAfterSuccess(container, {\n        ...base,\n        metadata: result.metadata ?? null,\n      })\n    },\n  }\n}\n"],
+  "mappings": "AACA;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAoBP,eAAsB,2BAA2B,QAKe;AAC9D,QAAM,EAAE,MAAM,WAAW,OAAO,IAAI,IAAI;AACxC,MAAI,CAAC,KAAK,OAAO,CAAC,KAAK,UAAU;AAC/B,WAAO,EAAE,QAAQ,MAAM,cAAc,YAAY,OAAU;AAAA,EAC7D;AAEA,QAAM,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,SAAS;AAAA,IAC9B,QAAQ,KAAK;AAAA,IACb,cAAc,MAAM;AAAA,IACpB,YAAY,MAAM;AAAA,IAClB,WAAW,MAAM,aAAa;AAAA,IAC9B,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB;AAEA,QAAM,SAAS,MAAM,0BAA0B,WAAW;AAAA,IACxD,GAAG;AAAA,IACH,iBAAiB,MAAM,mBAAmB;AAAA,EAC5C,CAAC;AACD,MAAI,UAAU,CAAC,OAAO,IAAI;AACxB,WAAO;AAAA,MACL,UAAU,SAAS,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,IAChE;AAAA,EACF;AAEA,SAAO;AAAA,IACL;AAAA,IACA,cAAc,YAAY;AACxB,UAAI,CAAC,QAAQ,MAAM,CAAC,OAAO,sBAAuB;AAClD,YAAM,iCAAiC,WAAW;AAAA,QAChD,GAAG;AAAA,QACH,UAAU,OAAO,YAAY;AAAA,MAC/B,CAAC;AAAA,IACH;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/sanitize-channel-html.js

@@ -0,0 +1,96 @@
+import sanitizeHtml from "sanitize-html";
+const ALLOWED_TAGS = [
+  "a",
+  "img",
+  "table",
+  "thead",
+  "tbody",
+  "tfoot",
+  "tr",
+  "td",
+  "th",
+  "p",
+  "br",
+  "hr",
+  "ul",
+  "ol",
+  "li",
+  "h1",
+  "h2",
+  "h3",
+  "h4",
+  "h5",
+  "h6",
+  "strong",
+  "em",
+  "b",
+  "i",
+  "u",
+  "s",
+  "blockquote",
+  "code",
+  "pre",
+  "span",
+  "div"
+];
+const ALLOWED_SCHEMES = ["http", "https", "mailto", "tel"];
+const ALLOWED_SCHEMES_BY_TAG = {
+  img: ["http", "https", "data"]
+};
+const SAFE_CSS_COLOR = /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\(\s*[\d.,\s%]+\)$|^hsla?\(\s*[\d.,\s%]+\)$|^[a-z]+$/i;
+const SANITIZE_OPTIONS = {
+  allowedTags: ALLOWED_TAGS,
+  allowedAttributes: {
+    a: ["href", "title", "class"],
+    img: ["src", "alt", "title", "class", "width", "height"],
+    "*": ["class", "style", "colspan", "rowspan", "width", "height"]
+  },
+  allowedSchemes: ALLOWED_SCHEMES,
+  allowedSchemesByTag: ALLOWED_SCHEMES_BY_TAG,
+  allowedSchemesAppliedToAttributes: ["href", "src"],
+  allowProtocolRelative: false,
+  // disable inline scripts in style attributes
+  allowedStyles: {
+    "*": {
+      "background-color": [SAFE_CSS_COLOR],
+      color: [SAFE_CSS_COLOR],
+      "text-align": [/^left$|^right$|^center$|^justify$/i],
+      "font-size": [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/],
+      "font-weight": [/^\d{3}$|^bold$|^normal$/],
+      "font-style": [/^italic$|^normal$/],
+      "text-decoration": [/^underline$|^line-through$|^none$/],
+      padding: [/^[\d\s.]+(?:px|em|rem|%)?$/],
+      margin: [/^[\d\s.]+(?:px|em|rem|%)?$/],
+      border: [/^[\d\s\w.]+$/],
+      "border-radius": [/^\d+(?:\.\d+)?(?:px|em|rem|%)$/],
+      // Permit only `display:none` so the hidden thread-token footer span
+      // (`buildBodyFooter`) stays hidden when a sent email body is re-rendered.
+      // Every other display value is stripped.
+      display: [/^none$/]
+    }
+  },
+  /**
+   * data:image/<mime>;base64,... URLs in <img src=...> are explicitly allowed so inline
+   * email images render. sanitize-html validates the base64 payload shape; if a future
+   * payload tries to smuggle a non-image MIME type via data URL we strip it.
+   */
+  exclusiveFilter: (frame) => {
+    if (frame.tag === "img" && frame.attribs?.src) {
+      const src = frame.attribs.src;
+      if (src.startsWith("data:") && !/^data:image\/(?:png|jpe?g|gif|webp);base64,/i.test(src)) {
+        return true;
+      }
+    }
+    return false;
+  }
+};
+function sanitizeChannelHtml(html) {
+  if (!html) return "";
+  return sanitizeHtml(html, SANITIZE_OPTIONS);
+}
+var sanitize_channel_html_default = sanitizeChannelHtml;
+export {
+  sanitize_channel_html_default as default,
+  sanitizeChannelHtml
+};
+//# sourceMappingURL=sanitize-channel-html.js.map

package/dist/modules/communication_channels/lib/sanitize-channel-html.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/sanitize-channel-html.ts"],
+  "sourcesContent": ["import sanitizeHtml from 'sanitize-html'\n\n/**\n * HTML sanitizer for channel-supplied payloads (email MIME, Slack rich-text, future channel types).\n *\n * The hub owns this helper; every widget that renders channel HTML \u2014 in the hub itself or in\n * downstream provider packages \u2014 imports it. The Messages module's `channel-payload-renderer`\n * widget calls this before any `dangerouslySetInnerHTML`-style render.\n *\n * Implementation note: backed by `sanitize-html` (CommonJS, server-friendly) rather than\n * DOMPurify so the same code runs in Jest without ESM transform gymnastics. SPEC-045d \u00A74.6\n * specifies \"DOMPurify or equivalent\" \u2014 `sanitize-html` is an allowlist-based equivalent\n * widely used for the same sanitization shape.\n *\n * Allowlist is tuned for email + chat HTML:\n *   - Preserves typical email layout primitives (table-based layouts, inline images, basic typography).\n *   - Strips `<script>`, `<style>`, `<iframe>`, all event-handler attributes (`on*`).\n *   - Blocks `javascript:` and `data:` URLs except `data:image/*;base64,\u2026` (inline base64 images, common in email).\n */\n\nconst ALLOWED_TAGS = [\n  'a',\n  'img',\n  'table',\n  'thead',\n  'tbody',\n  'tfoot',\n  'tr',\n  'td',\n  'th',\n  'p',\n  'br',\n  'hr',\n  'ul',\n  'ol',\n  'li',\n  'h1',\n  'h2',\n  'h3',\n  'h4',\n  'h5',\n  'h6',\n  'strong',\n  'em',\n  'b',\n  'i',\n  'u',\n  's',\n  'blockquote',\n  'code',\n  'pre',\n  'span',\n  'div',\n]\n\nconst ALLOWED_SCHEMES = ['http', 'https', 'mailto', 'tel']\nconst ALLOWED_SCHEMES_BY_TAG = {\n  img: ['http', 'https', 'data'],\n}\n\n/**\n * Safe CSS color value shapes only: hex (#rgb / #rgba / #rrggbb / #rrggbbaa),\n * rgb()/rgba(), hsl()/hsla(), and bare named colors (`red`, `transparent`,\n * `currentcolor`, \u2026). Deliberately rejects any value containing `url(` or\n * `expression(` so a `color`/`background-color` declaration can never smuggle a\n * CSS-based tracking beacon or legacy-IE script expression past the sanitizer.\n */\nconst SAFE_CSS_COLOR =\n  /^#(?:[0-9a-f]{3,4}|[0-9a-f]{6}|[0-9a-f]{8})$|^rgba?\\(\\s*[\\d.,\\s%]+\\)$|^hsla?\\(\\s*[\\d.,\\s%]+\\)$|^[a-z]+$/i\n\nconst SANITIZE_OPTIONS: sanitizeHtml.IOptions = {\n  allowedTags: ALLOWED_TAGS,\n  allowedAttributes: {\n    a: ['href', 'title', 'class'],\n    img: ['src', 'alt', 'title', 'class', 'width', 'height'],\n    '*': ['class', 'style', 'colspan', 'rowspan', 'width', 'height'],\n  },\n  allowedSchemes: ALLOWED_SCHEMES,\n  allowedSchemesByTag: ALLOWED_SCHEMES_BY_TAG,\n  allowedSchemesAppliedToAttributes: ['href', 'src'],\n  allowProtocolRelative: false,\n  // disable inline scripts in style attributes\n  allowedStyles: {\n    '*': {\n      'background-color': [SAFE_CSS_COLOR],\n      color: [SAFE_CSS_COLOR],\n      'text-align': [/^left$|^right$|^center$|^justify$/i],\n      'font-size': [/^\\d+(?:\\.\\d+)?(?:px|em|rem|%)$/],\n      'font-weight': [/^\\d{3}$|^bold$|^normal$/],\n      'font-style': [/^italic$|^normal$/],\n      'text-decoration': [/^underline$|^line-through$|^none$/],\n      padding: [/^[\\d\\s.]+(?:px|em|rem|%)?$/],\n      margin: [/^[\\d\\s.]+(?:px|em|rem|%)?$/],\n      border: [/^[\\d\\s\\w.]+$/],\n      'border-radius': [/^\\d+(?:\\.\\d+)?(?:px|em|rem|%)$/],\n      // Permit only `display:none` so the hidden thread-token footer span\n      // (`buildBodyFooter`) stays hidden when a sent email body is re-rendered.\n      // Every other display value is stripped.\n      display: [/^none$/],\n    },\n  },\n  /**\n   * data:image/<mime>;base64,... URLs in <img src=...> are explicitly allowed so inline\n   * email images render. sanitize-html validates the base64 payload shape; if a future\n   * payload tries to smuggle a non-image MIME type via data URL we strip it.\n   */\n  exclusiveFilter: (frame) => {\n    if (frame.tag === 'img' && frame.attribs?.src) {\n      const src = frame.attribs.src\n      if (src.startsWith('data:') && !/^data:image\\/(?:png|jpe?g|gif|webp);base64,/i.test(src)) {\n        return true\n      }\n    }\n    return false\n  },\n}\n\n/**\n * Sanitize an HTML string for safe rendering.\n *\n * @param html Raw HTML \u2014 may originate from an external channel (email body, Slack mrkdwn rendered to HTML, \u2026).\n * @returns Sanitized HTML safe for `dangerouslySetInnerHTML`.\n */\nexport function sanitizeChannelHtml(html: string): string {\n  if (!html) return ''\n  return sanitizeHtml(html, SANITIZE_OPTIONS)\n}\n\nexport default sanitizeChannelHtml\n"],
+  "mappings": "AAAA,OAAO,kBAAkB;AAoBzB,MAAM,eAAe;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,kBAAkB,CAAC,QAAQ,SAAS,UAAU,KAAK;AACzD,MAAM,yBAAyB;AAAA,EAC7B,KAAK,CAAC,QAAQ,SAAS,MAAM;AAC/B;AASA,MAAM,iBACJ;AAEF,MAAM,mBAA0C;AAAA,EAC9C,aAAa;AAAA,EACb,mBAAmB;AAAA,IACjB,GAAG,CAAC,QAAQ,SAAS,OAAO;AAAA,IAC5B,KAAK,CAAC,OAAO,OAAO,SAAS,SAAS,SAAS,QAAQ;AAAA,IACvD,KAAK,CAAC,SAAS,SAAS,WAAW,WAAW,SAAS,QAAQ;AAAA,EACjE;AAAA,EACA,gBAAgB;AAAA,EAChB,qBAAqB;AAAA,EACrB,mCAAmC,CAAC,QAAQ,KAAK;AAAA,EACjD,uBAAuB;AAAA;AAAA,EAEvB,eAAe;AAAA,IACb,KAAK;AAAA,MACH,oBAAoB,CAAC,cAAc;AAAA,MACnC,OAAO,CAAC,cAAc;AAAA,MACtB,cAAc,CAAC,oCAAoC;AAAA,MACnD,aAAa,CAAC,gCAAgC;AAAA,MAC9C,eAAe,CAAC,yBAAyB;AAAA,MACzC,cAAc,CAAC,mBAAmB;AAAA,MAClC,mBAAmB,CAAC,mCAAmC;AAAA,MACvD,SAAS,CAAC,4BAA4B;AAAA,MACtC,QAAQ,CAAC,4BAA4B;AAAA,MACrC,QAAQ,CAAC,cAAc;AAAA,MACvB,iBAAiB,CAAC,gCAAgC;AAAA;AAAA;AAAA;AAAA,MAIlD,SAAS,CAAC,QAAQ;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,iBAAiB,CAAC,UAAU;AAC1B,QAAI,MAAM,QAAQ,SAAS,MAAM,SAAS,KAAK;AAC7C,YAAM,MAAM,MAAM,QAAQ;AAC1B,UAAI,IAAI,WAAW,OAAO,KAAK,CAAC,+CAA+C,KAAK,GAAG,GAAG;AACxF,eAAO;AAAA,MACT;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF;AAQO,SAAS,oBAAoB,MAAsB;AACxD,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,aAAa,MAAM,gBAAgB;AAC5C;AAEA,IAAO,gCAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/send-as-user.js

@@ -0,0 +1,194 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import {
+  ChannelThreadMapping,
+  CommunicationChannel,
+  ExternalConversation,
+  MessageChannelLink
+} from "../data/entities.js";
+import { ChannelMutationBlockedError, guardOutboundCreate } from "./mutation-guards.js";
+import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from "./queue.js";
+import { htmlToText } from "./email-mime.js";
+async function sendAsUser(container, actor, input) {
+  if (!input.body.plain && !input.body.html) {
+    return { ok: false, status: 422, error: "Either body.plain or body.html is required" };
+  }
+  if (!Array.isArray(input.to) || input.to.length === 0) {
+    return { ok: false, status: 422, error: "At least one recipient is required" };
+  }
+  const em = container.resolve("em").fork();
+  const { tenantId } = actor;
+  const organizationId = actor.organizationId;
+  const dscope = { tenantId, organizationId };
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    { id: input.userChannelId, tenantId, organizationId, deletedAt: null },
+    void 0,
+    dscope
+  );
+  if (!channel) return { ok: false, status: 404, error: "Channel not found" };
+  if (channel.userId !== actor.userId) {
+    return { ok: false, status: 403, error: "You can only send through channels you own" };
+  }
+  try {
+    await guardOutboundCreate(em, { channelId: channel.id, scope: dscope });
+  } catch (err) {
+    if (err instanceof ChannelMutationBlockedError) {
+      return { ok: false, status: 422, error: err.message, fieldErrors: err.errors };
+    }
+    throw err;
+  }
+  if (!channel.isActive || channel.status !== "connected") {
+    return {
+      ok: false,
+      status: 409,
+      error: `Channel is in status '${channel.status}' (not connected)`
+    };
+  }
+  const commandBus = container.resolve("commandBus");
+  const messageBody = input.body.plain ?? htmlToText(input.body.html ?? "");
+  const composeInput = {
+    type: `channel.${channel.providerKey}`,
+    visibility: "public",
+    sourceEntityType: "communication_channels.send_as_user",
+    sourceEntityId: channel.id,
+    externalEmail: input.to[0],
+    externalName: input.subject,
+    recipients: [],
+    subject: input.subject,
+    body: messageBody,
+    bodyFormat: "text",
+    priority: "normal",
+    sendViaEmail: false,
+    parentMessageId: input.parentMessageId,
+    isDraft: false,
+    tenantId,
+    organizationId,
+    userId: actor.userId
+  };
+  let result;
+  try {
+    result = await commandBus.execute(
+      "messages.messages.compose",
+      {
+        input: composeInput,
+        ctx: {
+          container,
+          auth: actor.auth,
+          organizationScope: null,
+          selectedOrganizationId: organizationId,
+          organizationIds: organizationId ? [organizationId] : null
+        }
+      }
+    );
+  } catch (err) {
+    console.error("[communication_channels] send-as-user compose failed", err);
+    return { ok: false, status: 500, error: "[internal] compose failed" };
+  }
+  const messageId = result.result.id;
+  const messageThreadId = result.result.threadId ?? messageId;
+  const externalThreadRef = `outbound:${messageThreadId}`;
+  await em.transactional(async () => {
+    let conversation = await findOneWithDecryption(
+      em,
+      ExternalConversation,
+      {
+        channelId: channel.id,
+        externalConversationId: externalThreadRef,
+        tenantId,
+        organizationId
+      },
+      void 0,
+      dscope
+    );
+    if (!conversation) {
+      conversation = em.create(ExternalConversation, {
+        channelId: channel.id,
+        externalConversationId: externalThreadRef,
+        subject: input.subject,
+        assignedUserId: actor.userId,
+        tenantId,
+        organizationId,
+        lastMessageAt: /* @__PURE__ */ new Date()
+      });
+      em.persist(conversation);
+      await em.flush();
+    } else {
+      conversation.subject = conversation.subject ?? input.subject;
+      conversation.assignedUserId = conversation.assignedUserId ?? actor.userId;
+      conversation.lastMessageAt = /* @__PURE__ */ new Date();
+      await em.flush();
+    }
+    const existingMapping = await findOneWithDecryption(
+      em,
+      ChannelThreadMapping,
+      {
+        externalConversationId: conversation.id,
+        tenantId,
+        organizationId
+      },
+      void 0,
+      dscope
+    );
+    if (!existingMapping) {
+      const mapping = em.create(ChannelThreadMapping, {
+        externalConversationId: conversation.id,
+        messageThreadId,
+        channelId: channel.id,
+        providerKey: channel.providerKey,
+        externalThreadRef,
+        assignedUserId: actor.userId,
+        tenantId,
+        organizationId
+      });
+      em.persist(mapping);
+    }
+    const channelLink = em.create(MessageChannelLink, {
+      messageId,
+      externalConversationId: conversation.id,
+      providerKey: channel.providerKey,
+      channelType: channel.channelType,
+      direction: "outbound",
+      deliveryStatus: "pending",
+      channelPayload: {
+        text: input.body.plain ?? messageBody,
+        ...input.body.html ? { html: input.body.html } : {}
+      },
+      channelContentType: input.body.html ? "text/html" : "text/plain",
+      channelMetadata: {
+        // Caller-supplied pass-through metadata merged FIRST so the validated
+        // routing fields below always win — a caller cannot override the
+        // recipients/subject/threading headers via `channelMetadata`.
+        ...input.channelMetadata ?? {},
+        to: input.to,
+        cc: input.cc ?? [],
+        bcc: input.bcc ?? [],
+        subject: input.subject,
+        inReplyTo: input.inReplyTo ?? null,
+        references: input.references ?? []
+      },
+      tenantId,
+      organizationId
+    });
+    em.persist(channelLink);
+    await em.flush();
+  });
+  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound);
+  const deliveryJob = {
+    messageId,
+    scope: dscope,
+    attempt: 1
+  };
+  await queue.enqueue(deliveryJob);
+  return {
+    ok: true,
+    messageId,
+    threadId: messageThreadId,
+    channelId: channel.id,
+    providerKey: channel.providerKey
+  };
+}
+export {
+  sendAsUser
+};
+//# sourceMappingURL=send-as-user.js.map