@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/dist/modules/communication_channels/notifications.handlers.js

@@ -0,0 +1,53 @@
+const CHANNEL_REQUIRES_REAUTH_EVENT = "om:communication_channels:channel-requires-reauth";
+const MESSAGE_RECEIVED_EVENT = "om:communication_channels:message-received";
+const notificationHandlers = [
+  {
+    id: "communication_channels.channel-requires-reauth-toast",
+    notificationType: "communication_channels.channel.requires_reauth",
+    features: ["communication_channels.connect_user_channel"],
+    priority: 110,
+    handle(notification, context) {
+      context.toast({
+        title: notification.title,
+        body: notification.body ?? void 0,
+        severity: "warning",
+        action: {
+          label: context.t?.(
+            "communication_channels.notifications.channel_requires_reauth.reconnect",
+            "Reconnect"
+          ) ?? "Reconnect",
+          onClick: () => {
+            const channelId = notification.sourceEntityId;
+            const target = channelId ? `/backend/profile/communication-channels?reconnect=${encodeURIComponent(channelId)}` : "/backend/profile/communication-channels";
+            context.navigate(target);
+          }
+        }
+      });
+      context.emitEvent(CHANNEL_REQUIRES_REAUTH_EVENT, {
+        notificationId: notification.id,
+        channelId: notification.sourceEntityId ?? null
+      });
+      context.refreshNotifications();
+    }
+  },
+  {
+    id: "communication_channels.message-received-event",
+    notificationType: "communication_channels.message.received",
+    features: ["communication_channels.view"],
+    priority: 100,
+    handle(notification, context) {
+      context.emitEvent(MESSAGE_RECEIVED_EVENT, {
+        notificationId: notification.id,
+        messageId: notification.sourceEntityId ?? null
+      });
+    }
+  }
+];
+var notifications_handlers_default = notificationHandlers;
+export {
+  CHANNEL_REQUIRES_REAUTH_EVENT,
+  MESSAGE_RECEIVED_EVENT,
+  notifications_handlers_default as default,
+  notificationHandlers
+};
+//# sourceMappingURL=notifications.handlers.js.map

package/dist/modules/communication_channels/notifications.handlers.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/communication_channels/notifications.handlers.ts"],
+  "sourcesContent": ["import type { NotificationHandler } from '@open-mercato/shared/modules/notifications/handler'\n\n/**\n * Reactive notification handlers for the Communications Hub (Phase 4 of the\n * email integration spec).\n *\n * These handlers fire on the browser when the matching notification arrives via\n * the notifications stream. They run in addition to (not instead of) the static\n * UI surfaces:\n *\n *   - The notification appears in the user's bell dropdown via\n *     `notifications.client.ts` renderers (already wired in slice 2a).\n *   - The dropdown's primary action navigates to the reconnect URL.\n *\n * What the handlers add:\n *   - **Toast**: surfaces the message even when the user isn't looking at the\n *     bell. The reauth toast is the highest-signal interruption \u2014 without\n *     reauth the channel goes silent.\n *   - **Event emit**: lets the profile page / channel admin DataTable hook in\n *     via `useAppEvent(...)` (DOM Event Bridge) so they auto-refresh when the\n *     state flips without requiring a manual reload.\n *   - **Refresh notifications**: keeps the bell badge accurate.\n *\n * Custom event names emitted here on the DOM Event Bridge. They are published\n * for any page that opts in via `useAppEvent(...)`; no surface subscribes to\n * them today (the unified inbox auto-refreshes from the `messages.message.*`\n * bridge, and the reconnect flow is driven by the bell notification + its\n * reconnect action). Kept as forward-compatible hooks for future\n * row-highlight / refetch UX.\n */\n\nexport const CHANNEL_REQUIRES_REAUTH_EVENT = 'om:communication_channels:channel-requires-reauth'\nexport const MESSAGE_RECEIVED_EVENT = 'om:communication_channels:message-received'\n\nexport const notificationHandlers: NotificationHandler[] = [\n  {\n    id: 'communication_channels.channel-requires-reauth-toast',\n    notificationType: 'communication_channels.channel.requires_reauth',\n    features: ['communication_channels.connect_user_channel'],\n    priority: 110,\n    handle(notification, context) {\n      context.toast({\n        title: notification.title,\n        body: notification.body ?? undefined,\n        severity: 'warning',\n        action: {\n          label:\n            context.t?.(\n              'communication_channels.notifications.channel_requires_reauth.reconnect',\n              'Reconnect',\n            ) ?? 'Reconnect',\n          onClick: () => {\n            const channelId = notification.sourceEntityId\n            const target = channelId\n              ? `/backend/profile/communication-channels?reconnect=${encodeURIComponent(channelId)}`\n              : '/backend/profile/communication-channels'\n            context.navigate(target)\n          },\n        },\n      })\n      context.emitEvent(CHANNEL_REQUIRES_REAUTH_EVENT, {\n        notificationId: notification.id,\n        channelId: notification.sourceEntityId ?? null,\n      })\n      context.refreshNotifications()\n    },\n  },\n  {\n    id: 'communication_channels.message-received-event',\n    notificationType: 'communication_channels.message.received',\n    features: ['communication_channels.view'],\n    priority: 100,\n    handle(notification, context) {\n      // Inbox refresh is the only side effect \u2014 the user's bell dropdown already\n      // shows the notification entry. A toast here would be noisy because the\n      // bell badge increments anyway, and inbound email lands in the unified\n      // inbox where the user expects it.\n      context.emitEvent(MESSAGE_RECEIVED_EVENT, {\n        notificationId: notification.id,\n        messageId: notification.sourceEntityId ?? null,\n      })\n    },\n  },\n]\n\nexport default notificationHandlers\n"],
+  "mappings": "AA+BO,MAAM,gCAAgC;AACtC,MAAM,yBAAyB;AAE/B,MAAM,uBAA8C;AAAA,EACzD;AAAA,IACE,IAAI;AAAA,IACJ,kBAAkB;AAAA,IAClB,UAAU,CAAC,6CAA6C;AAAA,IACxD,UAAU;AAAA,IACV,OAAO,cAAc,SAAS;AAC5B,cAAQ,MAAM;AAAA,QACZ,OAAO,aAAa;AAAA,QACpB,MAAM,aAAa,QAAQ;AAAA,QAC3B,UAAU;AAAA,QACV,QAAQ;AAAA,UACN,OACE,QAAQ;AAAA,YACN;AAAA,YACA;AAAA,UACF,KAAK;AAAA,UACP,SAAS,MAAM;AACb,kBAAM,YAAY,aAAa;AAC/B,kBAAM,SAAS,YACX,qDAAqD,mBAAmB,SAAS,CAAC,KAClF;AACJ,oBAAQ,SAAS,MAAM;AAAA,UACzB;AAAA,QACF;AAAA,MACF,CAAC;AACD,cAAQ,UAAU,+BAA+B;AAAA,QAC/C,gBAAgB,aAAa;AAAA,QAC7B,WAAW,aAAa,kBAAkB;AAAA,MAC5C,CAAC;AACD,cAAQ,qBAAqB;AAAA,IAC/B;AAAA,EACF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,kBAAkB;AAAA,IAClB,UAAU,CAAC,6BAA6B;AAAA,IACxC,UAAU;AAAA,IACV,OAAO,cAAc,SAAS;AAK5B,cAAQ,UAAU,wBAAwB;AAAA,QACxC,gBAAgB,aAAa;AAAA,QAC7B,WAAW,aAAa,kBAAkB;AAAA,MAC5C,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,IAAO,iCAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/notifications.js

@@ -0,0 +1,56 @@
+const notificationTypes = [
+  {
+    type: "communication_channels.message.received",
+    module: "communication_channels",
+    titleKey: "communication_channels.notifications.message_received.title",
+    bodyKey: "communication_channels.notifications.message_received.body",
+    icon: "message-circle",
+    severity: "info",
+    actions: [
+      {
+        id: "view",
+        labelKey: "common.view",
+        variant: "outline",
+        href: "/backend/messages/{sourceEntityId}",
+        icon: "external-link"
+      }
+    ],
+    linkHref: "/backend/messages/{sourceEntityId}",
+    expiresAfterHours: 168
+    // 7 days
+  },
+  {
+    /**
+     * Channel-agnostic notification raised when an adapter loses authorization
+     * (OAuth refresh token revoked, IMAP/SMTP password rotated, WhatsApp token expired).
+     * Persisted by the `channel-requires-reauth-notification` subscriber in
+     * response to the `communication_channels.channel.requires_reauth` event
+     * (emitted by the poll worker and outbound delivery). Consumed by the email
+     * integration spec's reconnect flow.
+     */
+    type: "communication_channels.channel.requires_reauth",
+    module: "communication_channels",
+    titleKey: "communication_channels.notifications.channel_requires_reauth.title",
+    bodyKey: "communication_channels.notifications.channel_requires_reauth.body",
+    icon: "alert-triangle",
+    severity: "warning",
+    actions: [
+      {
+        id: "reconnect",
+        labelKey: "communication_channels.notifications.channel_requires_reauth.reconnect",
+        variant: "outline",
+        href: "/backend/profile/communication-channels?reconnect={sourceEntityId}",
+        icon: "refresh-cw"
+      }
+    ],
+    linkHref: "/backend/profile/communication-channels?reconnect={sourceEntityId}",
+    expiresAfterHours: 720
+    // 30 days — auth issues should be addressed promptly
+  }
+];
+var notifications_default = notificationTypes;
+export {
+  notifications_default as default,
+  notificationTypes
+};
+//# sourceMappingURL=notifications.js.map

package/dist/modules/communication_channels/notifications.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/communication_channels/notifications.ts"],
+  "sourcesContent": ["import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'\n\nexport const notificationTypes: NotificationTypeDefinition[] = [\n  {\n    type: 'communication_channels.message.received',\n    module: 'communication_channels',\n    titleKey: 'communication_channels.notifications.message_received.title',\n    bodyKey: 'communication_channels.notifications.message_received.body',\n    icon: 'message-circle',\n    severity: 'info',\n    actions: [\n      {\n        id: 'view',\n        labelKey: 'common.view',\n        variant: 'outline',\n        href: '/backend/messages/{sourceEntityId}',\n        icon: 'external-link',\n      },\n    ],\n    linkHref: '/backend/messages/{sourceEntityId}',\n    expiresAfterHours: 168, // 7 days\n  },\n  {\n    /**\n     * Channel-agnostic notification raised when an adapter loses authorization\n     * (OAuth refresh token revoked, IMAP/SMTP password rotated, WhatsApp token expired).\n     * Persisted by the `channel-requires-reauth-notification` subscriber in\n     * response to the `communication_channels.channel.requires_reauth` event\n     * (emitted by the poll worker and outbound delivery). Consumed by the email\n     * integration spec's reconnect flow.\n     */\n    type: 'communication_channels.channel.requires_reauth',\n    module: 'communication_channels',\n    titleKey: 'communication_channels.notifications.channel_requires_reauth.title',\n    bodyKey: 'communication_channels.notifications.channel_requires_reauth.body',\n    icon: 'alert-triangle',\n    severity: 'warning',\n    actions: [\n      {\n        id: 'reconnect',\n        labelKey: 'communication_channels.notifications.channel_requires_reauth.reconnect',\n        variant: 'outline',\n        href: '/backend/profile/communication-channels?reconnect={sourceEntityId}',\n        icon: 'refresh-cw',\n      },\n    ],\n    linkHref: '/backend/profile/communication-channels?reconnect={sourceEntityId}',\n    expiresAfterHours: 720, // 30 days \u2014 auth issues should be addressed promptly\n  },\n]\n\nexport default notificationTypes\n"],
+  "mappings": "AAEO,MAAM,oBAAkD;AAAA,EAC7D;AAAA,IACE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASE,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,SAAS;AAAA,IACT,MAAM;AAAA,IACN,UAAU;AAAA,IACV,SAAS;AAAA,MACP;AAAA,QACE,IAAI;AAAA,QACJ,UAAU;AAAA,QACV,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,UAAU;AAAA,IACV,mBAAmB;AAAA;AAAA,EACrB;AACF;AAEA,IAAO,wBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/setup.js

@@ -0,0 +1,105 @@
+import { createHash } from "node:crypto";
+import { COMMUNICATION_CHANNELS_QUEUES } from "./lib/queue.js";
+const POLL_TICK_INTERVAL_SECONDS = Math.max(
+  10,
+  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? "60", 10) || 60
+);
+function stableScheduleUuid(stableKey) {
+  const hex = createHash("sha256").update(stableKey).digest("hex");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`;
+}
+function stablePollTickScheduleId(organizationId) {
+  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`);
+}
+const setup = {
+  defaultRoleFeatures: {
+    superadmin: [
+      "communication_channels.view",
+      "communication_channels.manage",
+      "communication_channels.react",
+      "communication_channels.assign",
+      "communication_channels.connect_user_channel",
+      "communication_channels.admin",
+      "communication_channels.channel.import_history",
+      "communication_channels.channel.push.manage"
+    ],
+    admin: [
+      "communication_channels.view",
+      "communication_channels.manage",
+      "communication_channels.react",
+      "communication_channels.assign",
+      "communication_channels.connect_user_channel",
+      "communication_channels.admin",
+      "communication_channels.channel.import_history",
+      "communication_channels.channel.push.manage"
+    ],
+    manager: [
+      "communication_channels.view",
+      "communication_channels.manage",
+      "communication_channels.react",
+      "communication_channels.assign",
+      "communication_channels.connect_user_channel"
+    ],
+    employee: [
+      "communication_channels.view",
+      "communication_channels.react",
+      "communication_channels.connect_user_channel"
+    ]
+  },
+  async seedDefaults({ container, organizationId, tenantId }) {
+    const cradle = container;
+    if (typeof cradle.hasRegistration !== "function" || !cradle.hasRegistration("schedulerService")) {
+      return;
+    }
+    const schedulerService = container.resolve("schedulerService");
+    try {
+      await schedulerService.register({
+        id: stablePollTickScheduleId(organizationId),
+        name: "Communication channels poll tick",
+        description: `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,
+        scopeType: "organization",
+        organizationId,
+        tenantId,
+        scheduleType: "interval",
+        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,
+        timezone: "UTC",
+        targetType: "queue",
+        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
+        targetPayload: {
+          scope: { tenantId, organizationId }
+        },
+        sourceType: "module",
+        sourceModule: "communication_channels",
+        isEnabled: true
+      });
+      await schedulerService.register({
+        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),
+        name: "Gmail watch renewal",
+        description: "Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.",
+        scopeType: "organization",
+        organizationId,
+        tenantId,
+        scheduleType: "cron",
+        scheduleValue: "0 4 * * *",
+        timezone: "UTC",
+        targetType: "queue",
+        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,
+        targetPayload: { scope: { tenantId, organizationId } },
+        sourceType: "module",
+        sourceModule: "communication_channels",
+        isEnabled: true
+      });
+    } catch (error) {
+      console.warn(
+        "[communication_channels] Failed to register module schedules:",
+        error instanceof Error ? error.message : error
+      );
+    }
+  }
+};
+var setup_default = setup;
+export {
+  setup_default as default,
+  setup
+};
+//# sourceMappingURL=setup.js.map

package/dist/modules/communication_channels/setup.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/modules/communication_channels/setup.ts"],
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\n/**\n * Tick interval in seconds. Default 60s per email integration spec\n * \u00A7 Hub Deltas \u2192 Delta 6 (scheduler mechanism).\n */\nconst POLL_TICK_INTERVAL_SECONDS = Math.max(\n  10,\n  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? '60', 10) || 60,\n)\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * seedDefaults instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stablePollTickScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    admin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    manager: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n    ],\n    employee: [\n      'communication_channels.view',\n      'communication_channels.react',\n      'communication_channels.connect_user_channel',\n    ],\n  },\n\n  async seedDefaults({ container, organizationId, tenantId }) {\n    /**\n     * Register the per-channel polling tick with `@open-mercato/scheduler`.\n     *\n     * Per email integration spec \u00A7 Hub Deltas \u2192 Delta 6: every\n     * `POLL_TICK_INTERVAL_SECONDS` (default 60s), enqueue a single\n     * `communication-channels-poll-tick` job that enumerates due channels and\n     * fans out to the `communication-channels-poll` queue.\n     *\n     * The registration is per-organization (one tick row per org/tenant pair)\n     * so multi-tenant deploys schedule independently. Skipped silently when the\n     * scheduler module isn't enabled \u2014 keeps the hub usable in scheduler-less\n     * test harnesses.\n     */\n    const cradle = container as { hasRegistration?: (name: string) => boolean }\n    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n      return\n    }\n    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n    // Best-effort: a scheduler failure must not abort tenant initialization for\n    // every other module (mirrors the ai_assistant setup pattern). The schedule\n    // ids are deterministic uuids so re-runs upsert idempotently.\n    try {\n      await schedulerService.register({\n        id: stablePollTickScheduleId(organizationId),\n        name: 'Communication channels poll tick',\n        description:\n          `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'interval',\n        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,\n        targetPayload: {\n          scope: { tenantId, organizationId },\n        },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n\n      // Spec C \u00A7 Phase C4 \u2014 Gmail watch renewal cron, per-org so multi-tenant\n      // deploys schedule independently.\n      await schedulerService.register({\n        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),\n        name: 'Gmail watch renewal',\n        description:\n          'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'cron',\n        scheduleValue: '0 4 * * *',\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,\n        targetPayload: { scope: { tenantId, organizationId } },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n    } catch (error) {\n      console.warn(\n        '[communication_channels] Failed to register module schedules:',\n        error instanceof Error ? error.message : error,\n      )\n    }\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,qCAAqC;AA0B9C,MAAM,6BAA6B,KAAK;AAAA,EACtC;AAAA,EACA,OAAO,SAAS,QAAQ,IAAI,sCAAsC,MAAM,EAAE,KAAK;AACjF;AAQA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,oCAAoC,cAAc,EAAE;AAChF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,gBAAgB,SAAS,GAAG;AAc1D,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F;AAAA,IACF;AACA,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAI7D,QAAI;AACF,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,yBAAyB,cAAc;AAAA,QAC3C,MAAM;AAAA,QACN,aACE,4CAA4C,0BAA0B;AAAA,QACxE,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe,GAAG,0BAA0B;AAAA,QAC5C,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe;AAAA,UACb,OAAO,EAAE,UAAU,eAAe;AAAA,QACpC;AAAA,QACA,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAID,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,mBAAmB,4CAA4C,cAAc,EAAE;AAAA,QACnF,MAAM;AAAA,QACN,aACE;AAAA,QACF,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe;AAAA,QACf,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe,EAAE,OAAO,EAAE,UAAU,eAAe,EAAE;AAAA,QACrD,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,OAAO;AACd,cAAQ;AAAA,QACN;AAAA,QACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,MAC3C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/subscribers/channel-requires-reauth-notification.js

@@ -0,0 +1,71 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../data/entities.js";
+import { notificationTypes } from "../notifications.js";
+import {
+  buildNotificationFromType,
+  buildFeatureNotificationFromType
+} from "../../notifications/lib/notificationBuilder.js";
+import { resolveNotificationService } from "../../notifications/lib/notificationService.js";
+const metadata = {
+  event: "communication_channels.channel.requires_reauth",
+  persistent: true,
+  id: "communication_channels:channel-requires-reauth-notification"
+};
+const NOTIFICATION_TYPE = "communication_channels.channel.requires_reauth";
+const MANAGE_FEATURE = "communication_channels.manage";
+function resolveFromCtx(ctx, name) {
+  if (typeof ctx?.resolve === "function") return ctx.resolve(name);
+  if (ctx?.container && typeof ctx.container.resolve === "function") {
+    return ctx.container.resolve(name);
+  }
+  throw new Error(
+    `channel-requires-reauth-notification: subscriber context has no resolver (looking for '${name}')`
+  );
+}
+async function handler(payload, ctx) {
+  if (!payload?.channelId || !payload.tenantId) {
+    return;
+  }
+  const typeDef = notificationTypes.find((type) => type.type === NOTIFICATION_TYPE);
+  if (!typeDef) return;
+  const scope = {
+    tenantId: payload.tenantId,
+    organizationId: payload.organizationId ?? null
+  };
+  const em = resolveFromCtx(ctx, "em").fork();
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: payload.channelId,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+      deletedAt: null
+    },
+    void 0,
+    scope
+  );
+  if (!channel) return;
+  const notificationService = resolveNotificationService(ctx);
+  const common = {
+    sourceEntityType: "communication_channel",
+    sourceEntityId: payload.channelId,
+    groupKey: payload.channelId
+  };
+  if (channel.userId) {
+    await notificationService.create(
+      buildNotificationFromType(typeDef, { ...common, recipientUserId: channel.userId }),
+      scope
+    );
+    return;
+  }
+  await notificationService.createForFeature(
+    buildFeatureNotificationFromType(typeDef, { ...common, requiredFeature: MANAGE_FEATURE }),
+    scope
+  );
+}
+export {
+  handler as default,
+  metadata
+};
+//# sourceMappingURL=channel-requires-reauth-notification.js.map

package/dist/modules/communication_channels/subscribers/channel-requires-reauth-notification.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/subscribers/channel-requires-reauth-notification.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { notificationTypes } from '../notifications'\nimport {\n  buildNotificationFromType,\n  buildFeatureNotificationFromType,\n} from '../../notifications/lib/notificationBuilder'\nimport { resolveNotificationService } from '../../notifications/lib/notificationService'\n\n/**\n * Subscriber: re-authentication notification.\n *\n * Listens to `communication_channels.channel.requires_reauth` (emitted by the\n * poll worker and outbound delivery when an\n * adapter loses authorization) and raises the in-app\n * `communication_channels.channel.requires_reauth` notification so the affected\n * user sees a bell entry + reconnect CTA and the reactive toast handler\n * (`notifications.handlers.ts`) fires. This is the producer half of the\n * notification contract declared in `notifications.ts` /\n * `notifications.client.ts` \u2014 without it the notification is never persisted.\n *\n * Recipient: per-user channels notify the channel owner (`channel.userId`) \u2014 the\n * only person who can complete their own OAuth/credential reconnect. Tenant-wide\n * (shared) channels have no owner, so operators holding\n * `communication_channels.manage` are notified instead.\n *\n * Idempotency: `groupKey = channelId` collapses repeated reauth events for the\n * same channel onto one notification (the notification service dedupes by\n * tenant/org/recipient/type/groupKey under an advisory lock), so a flapping\n * channel or a subscriber retry never spams the bell.\n */\nexport const metadata = {\n  event: 'communication_channels.channel.requires_reauth',\n  persistent: true,\n  id: 'communication_channels:channel-requires-reauth-notification',\n}\n\nconst NOTIFICATION_TYPE = 'communication_channels.channel.requires_reauth'\nconst MANAGE_FEATURE = 'communication_channels.manage'\n\ntype RequiresReauthPayload = {\n  channelId?: string\n  providerKey?: string\n  channelType?: string\n  reason?: string\n  tenantId?: string\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n  container?: { resolve: <T = unknown>(name: string) => T }\n}\n\nfunction resolveFromCtx<T = unknown>(ctx: SubscriberContext, name: string): T {\n  if (typeof ctx?.resolve === 'function') return ctx.resolve<T>(name)\n  if (ctx?.container && typeof ctx.container.resolve === 'function') {\n    return ctx.container.resolve<T>(name)\n  }\n  throw new Error(\n    `channel-requires-reauth-notification: subscriber context has no resolver (looking for '${name}')`,\n  )\n}\n\nexport default async function handler(\n  payload: RequiresReauthPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  if (!payload?.channelId || !payload.tenantId) {\n    return\n  }\n\n  const typeDef = notificationTypes.find((type) => type.type === NOTIFICATION_TYPE)\n  if (!typeDef) return\n\n  const scope = {\n    tenantId: payload.tenantId,\n    organizationId: payload.organizationId ?? null,\n  }\n\n  const em = resolveFromCtx<EntityManager>(ctx, 'em').fork()\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: payload.channelId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!channel) return\n\n  const notificationService = resolveNotificationService(ctx)\n  const common = {\n    sourceEntityType: 'communication_channel',\n    sourceEntityId: payload.channelId,\n    groupKey: payload.channelId,\n  }\n\n  if (channel.userId) {\n    await notificationService.create(\n      buildNotificationFromType(typeDef, { ...common, recipientUserId: channel.userId }),\n      scope,\n    )\n    return\n  }\n\n  // Tenant-wide (shared) channel \u2014 no single owner. Notify operators who can\n  // reconnect it on behalf of the tenant.\n  await notificationService.createForFeature(\n    buildFeatureNotificationFromType(typeDef, { ...common, requiredFeature: MANAGE_FEATURE }),\n    scope,\n  )\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kCAAkC;AAwBpC,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAEA,MAAM,oBAAoB;AAC1B,MAAM,iBAAiB;AAgBvB,SAAS,eAA4B,KAAwB,MAAiB;AAC5E,MAAI,OAAO,KAAK,YAAY,WAAY,QAAO,IAAI,QAAW,IAAI;AAClE,MAAI,KAAK,aAAa,OAAO,IAAI,UAAU,YAAY,YAAY;AACjE,WAAO,IAAI,UAAU,QAAW,IAAI;AAAA,EACtC;AACA,QAAM,IAAI;AAAA,IACR,0FAA0F,IAAI;AAAA,EAChG;AACF;AAEA,eAAO,QACL,SACA,KACe;AACf,MAAI,CAAC,SAAS,aAAa,CAAC,QAAQ,UAAU;AAC5C;AAAA,EACF;AAEA,QAAM,UAAU,kBAAkB,KAAK,CAAC,SAAS,KAAK,SAAS,iBAAiB;AAChF,MAAI,CAAC,QAAS;AAEd,QAAM,QAAQ;AAAA,IACZ,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ,kBAAkB;AAAA,EAC5C;AAEA,QAAM,KAAK,eAA8B,KAAK,IAAI,EAAE,KAAK;AACzD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AAEd,QAAM,sBAAsB,2BAA2B,GAAG;AAC1D,QAAM,SAAS;AAAA,IACb,kBAAkB;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ;AAAA,EACpB;AAEA,MAAI,QAAQ,QAAQ;AAClB,UAAM,oBAAoB;AAAA,MACxB,0BAA0B,SAAS,EAAE,GAAG,QAAQ,iBAAiB,QAAQ,OAAO,CAAC;AAAA,MACjF;AAAA,IACF;AACA;AAAA,EACF;AAIA,QAAM,oBAAoB;AAAA,IACxB,iCAAiC,SAAS,EAAE,GAAG,QAAQ,iBAAiB,eAAe,CAAC;AAAA,IACxF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/subscribers/outbound-bridge.js

@@ -0,0 +1,103 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from "../data/entities.js";
+import { Message } from "../../messages/data/entities.js";
+import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from "../lib/queue.js";
+const metadata = {
+  event: "messages.message.sent",
+  persistent: true,
+  id: "communication_channels:outbound-bridge"
+};
+function resolveFromCtx(ctx, name) {
+  if (typeof ctx?.resolve === "function") return ctx.resolve(name);
+  if (ctx?.container && typeof ctx.container.resolve === "function") {
+    return ctx.container.resolve(name);
+  }
+  throw new Error(`outbound-bridge: subscriber context has no resolver (looking for '${name}')`);
+}
+async function handler(payload, ctx) {
+  if (!payload?.messageId || !payload.tenantId) {
+    return;
+  }
+  const em = resolveFromCtx(ctx, "em").fork();
+  const dscope = {
+    tenantId: payload.tenantId,
+    organizationId: payload.organizationId ?? null
+  };
+  const message = await findOneWithDecryption(
+    em,
+    Message,
+    {
+      id: payload.messageId,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+      deletedAt: null
+    },
+    void 0,
+    dscope
+  );
+  if (!message) return;
+  if (message.sourceEntityType === "communication_channels.send_as_user") {
+    return;
+  }
+  if (message.sourceEntityType === "communication_channels.external_conversation") {
+    return;
+  }
+  if (!message.threadId) return;
+  const mapping = await findOneWithDecryption(
+    em,
+    ChannelThreadMapping,
+    {
+      messageThreadId: message.threadId,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null
+    },
+    void 0,
+    dscope
+  );
+  if (!mapping) return;
+  const existingLink = await findOneWithDecryption(
+    em,
+    MessageChannelLink,
+    {
+      messageId: message.id,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null
+    },
+    void 0,
+    dscope
+  );
+  if (existingLink && (existingLink.deliveryStatus === "queued" || existingLink.deliveryStatus === "pending" || existingLink.deliveryStatus === "sent" || existingLink.deliveryStatus === "delivered" || existingLink.deliveryStatus === "read")) {
+    return;
+  }
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: mapping.channelId,
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+      deletedAt: null
+    },
+    void 0,
+    dscope
+  );
+  if (!channel) return;
+  if (channel.userId != null && channel.userId !== message.senderUserId) {
+    return;
+  }
+  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound);
+  const job = {
+    messageId: message.id,
+    scope: {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null
+    },
+    attempt: 1
+  };
+  await queue.enqueue(job);
+}
+export {
+  handler as default,
+  metadata
+};
+//# sourceMappingURL=outbound-bridge.js.map

package/dist/modules/communication_channels/subscribers/outbound-bridge.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/subscribers/outbound-bridge.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from '../data/entities'\nimport { Message } from '../../messages/data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\n\n/**\n * Subscriber: outbound bridge.\n *\n * Listens to `messages.message.sent` and, when the Message lives in a channel-linked\n * thread, enqueues a delivery job to the `communication-channels-outbound` queue.\n *\n * Per the pre-implementation analysis we **re-fetch the Message by ID** rather than\n * trusting the event payload \u2014 this keeps the subscriber decoupled from the\n * `messages.message.sent` payload shape, so any future addition/removal of fields\n * in the messages module doesn't break this bridge.\n *\n * Idempotency: we check for an existing `MessageChannelLink` with `direction='outbound'`\n * and `deliveryStatus IN ('queued','pending','sent','delivered','read')`. If found, we\n * skip \u2014 the message is already delivered or has a delivery in flight. Including the\n * in-flight states ('queued'/'pending') stops a replayed `messages.message.sent` from\n * enqueueing a second delivery job while the worker is mid-send. The command-side check\n * is the authoritative gate, but this cheap subscriber-level check avoids redundant jobs.\n *\n * Internal-only messages (no `ChannelThreadMapping` for the threadId) are skipped\n * silently \u2014 this is the expected steady-state for the majority of platform messages.\n */\nexport const metadata = {\n  event: 'messages.message.sent',\n  persistent: true,\n  id: 'communication_channels:outbound-bridge',\n}\n\ntype MessageSentPayload = {\n  messageId: string\n  senderUserId?: string\n  recipientUserIds?: string[]\n  sendViaEmail?: boolean\n  externalEmail?: string | null\n  tenantId: string\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  /** Canonical event-bus context: `resolve` is exposed directly (no `.container` wrapper). */\n  resolve: <T = unknown>(name: string) => T\n  /** Some callers wrap in a `container` \u2014 supported for forward-compat. */\n  container?: { resolve: <T = unknown>(name: string) => T }\n}\n\nfunction resolveFromCtx<T = unknown>(ctx: SubscriberContext, name: string): T {\n  if (typeof ctx?.resolve === 'function') return ctx.resolve<T>(name)\n  if (ctx?.container && typeof ctx.container.resolve === 'function') {\n    return ctx.container.resolve<T>(name)\n  }\n  throw new Error(`outbound-bridge: subscriber context has no resolver (looking for '${name}')`)\n}\n\nexport default async function handler(\n  payload: MessageSentPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  if (!payload?.messageId || !payload.tenantId) {\n    return\n  }\n\n  const em = (resolveFromCtx<EntityManager>(ctx, 'em')).fork()\n  const dscope = {\n    tenantId: payload.tenantId,\n    organizationId: payload.organizationId ?? null,\n  }\n\n  // (a) Re-fetch the Message \u2014 no payload-shape coupling.\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: payload.messageId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!message) return\n  if (message.sourceEntityType === 'communication_channels.send_as_user') {\n    return\n  }\n  // Inbound ingest path: when `ingest-inbound-message` composes a new platform\n  // Message for an incoming email, the messages module also emits\n  // `messages.message.sent` (the Message row is fresh and marked sent). Without\n  // this guard, we'd treat it as outbound and queue a redundant SMTP delivery \u2014\n  // which fails because inbound MCLs carry recipient info in `channelPayload`,\n  // not `channelMetadata`, and the failure marker then leaks back onto the\n  // inbound link itself.\n  if (message.sourceEntityType === 'communication_channels.external_conversation') {\n    return\n  }\n  if (!message.threadId) return // Internal-only; no channel routing.\n\n  // (b) Look up the channel mapping by threadId.\n  const mapping = await findOneWithDecryption(\n    em,\n    ChannelThreadMapping,\n    {\n      messageThreadId: message.threadId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!mapping) return // Internal-only thread; skip silently.\n\n  // (c) Idempotency \u2014 skip if already delivered.\n  const existingLink = await findOneWithDecryption(\n    em,\n    MessageChannelLink,\n    {\n      messageId: message.id,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  if (\n    existingLink &&\n    (existingLink.deliveryStatus === 'queued' ||\n      existingLink.deliveryStatus === 'pending' ||\n      existingLink.deliveryStatus === 'sent' ||\n      existingLink.deliveryStatus === 'delivered' ||\n      existingLink.deliveryStatus === 'read')\n  ) {\n    return\n  }\n\n  // (c2) Per-user ownership gate. Outbound delivery sends with the CHANNEL\n  // OWNER's credentials (workers/outbound-delivery \u2192 deliver-outbound-message),\n  // so we may only bridge a platform message into a per-user channel when the\n  // message's sender OWNS that channel. Tenant-wide channels (userId == null \u2014\n  // shared inboxes) accept any sender. Without this, composing into another\n  // user's channel-linked thread would send from their connected account\n  // (impersonation). Mirrors lib/send-as-user and the reaction ownership gate.\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: mapping.channelId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) return\n  if (channel.userId != null && channel.userId !== message.senderUserId) {\n    return\n  }\n\n  // (d) Enqueue the delivery worker.\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const job: OutboundDeliveryPayload = {\n    messageId: message.id,\n    scope: {\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    attempt: 1,\n  }\n  await queue.enqueue(job as unknown as Record<string, unknown>)\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,sBAAsB,sBAAsB,0BAA0B;AAC/E,SAAS,eAAe;AACxB,SAAS,+BAA+B,qCAAqC;AAwBtE,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAmBA,SAAS,eAA4B,KAAwB,MAAiB;AAC5E,MAAI,OAAO,KAAK,YAAY,WAAY,QAAO,IAAI,QAAW,IAAI;AAClE,MAAI,KAAK,aAAa,OAAO,IAAI,UAAU,YAAY,YAAY;AACjE,WAAO,IAAI,UAAU,QAAW,IAAI;AAAA,EACtC;AACA,QAAM,IAAI,MAAM,qEAAqE,IAAI,IAAI;AAC/F;AAEA,eAAO,QACL,SACA,KACe;AACf,MAAI,CAAC,SAAS,aAAa,CAAC,QAAQ,UAAU;AAC5C;AAAA,EACF;AAEA,QAAM,KAAM,eAA8B,KAAK,IAAI,EAAG,KAAK;AAC3D,QAAM,SAAS;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ,kBAAkB;AAAA,EAC5C;AAGA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,qBAAqB,uCAAuC;AACtE;AAAA,EACF;AAQA,MAAI,QAAQ,qBAAqB,gDAAgD;AAC/E;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAU;AAGvB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,iBAAiB,QAAQ;AAAA,MACzB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AAGd,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MACE,iBACC,aAAa,mBAAmB,YAC/B,aAAa,mBAAmB,aAChC,aAAa,mBAAmB,UAChC,aAAa,mBAAmB,eAChC,aAAa,mBAAmB,SAClC;AACA;AAAA,EACF;AASA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,QAAQ,cAAc;AACrE;AAAA,EACF;AAGA,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,MAA+B;AAAA,IACnC,WAAW,QAAQ;AAAA,IACnB,OAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,GAAyC;AAC/D;",
+  "names": []
+}

package/dist/modules/communication_channels/subscribers/user-deleted-cascade.js

@@ -0,0 +1,51 @@
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../data/entities.js";
+const metadata = {
+  event: "auth.user.deleted",
+  persistent: true,
+  id: "communication_channels:user-deleted-cascade"
+};
+async function handler(payload, ctx) {
+  if (!payload || typeof payload.userId !== "string" || !payload.userId) {
+    return;
+  }
+  if (typeof payload.tenantId !== "string" || !payload.tenantId) {
+    return;
+  }
+  const em = ctx.resolve("em").fork();
+  const channels = await findWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      userId: payload.userId,
+      tenantId: payload.tenantId,
+      ...payload.organizationId !== void 0 ? { organizationId: payload.organizationId ?? null } : {},
+      deletedAt: null
+    },
+    void 0,
+    {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null
+    }
+  );
+  if (channels.length === 0) return;
+  let touched = 0;
+  for (const channel of channels) {
+    if (channel.status === "disconnected" && channel.isActive === false) continue;
+    channel.status = "disconnected";
+    channel.isActive = false;
+    channel.credentialsRef = null;
+    channel.lastError = "user-deleted";
+    channel.isPrimary = false;
+    channel.lastPolledAt = /* @__PURE__ */ new Date();
+    touched += 1;
+  }
+  if (touched > 0) {
+    await em.flush();
+  }
+}
+export {
+  handler as default,
+  metadata
+};
+//# sourceMappingURL=user-deleted-cascade.js.map

package/dist/modules/communication_channels/subscribers/user-deleted-cascade.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/subscribers/user-deleted-cascade.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\n\n/**\n * Subscriber: cascade-disconnect a user's communication channels when the user\n * is deleted (`auth.user.deleted` event).\n *\n * Why a subscriber, not a foreign-key CASCADE: per root `AGENTS.md`, modules\n * don't form direct ORM relationships across the auth module boundary \u2014\n * `CommunicationChannel.userId` is a plain `uuid` column, not a FK. The\n * cascade must therefore happen at the event-bridge layer, here, in response\n * to the auth module's lifecycle event.\n *\n * Effects per matched channel:\n *   1. `status = 'disconnected'`        \u2014 stops the polling worker (slice 3b\n *                                          skips channels not in `connected`).\n *   2. `is_active = false`              \u2014 hides the channel from the hub admin\n *                                          UI and stops adapter resolution.\n *   3. `credentials_ref = null`         \u2014 orphans the encrypted credentials\n *                                          blob in `integration_credentials`\n *                                          (the integrations module's own\n *                                          retention policy then sweeps it).\n *   4. `last_error = 'user-deleted'`    \u2014 diagnostic breadcrumb.\n *\n * The channel row itself is NOT hard-deleted \u2014 keeping it preserves the audit\n * trail of which user owned it and the conversation history that still lives\n * in `external_messages` / `messages`. A future tenant-level GDPR sweep can\n * hard-delete on a schedule.\n *\n * Idempotency: the update is conditional on `status != 'disconnected'`, so\n * replays from the event bus are no-ops.\n */\nexport const metadata = {\n  event: 'auth.user.deleted',\n  persistent: true,\n  id: 'communication_channels:user-deleted-cascade',\n}\n\ntype AuthUserDeletedPayload = {\n  userId: string\n  tenantId?: string\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport default async function handler(\n  payload: AuthUserDeletedPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  if (!payload || typeof payload.userId !== 'string' || !payload.userId) {\n    return\n  }\n  // tenantId MUST be present: an unscoped cascade would touch rows in arbitrary\n  // tenants if two tenants ever happened to share a userId (impossible under\n  // UUIDv4 but possible after backup-restore). Fail-closed: skip when missing\n  // and let an out-of-band sweep clean up.\n  if (typeof payload.tenantId !== 'string' || !payload.tenantId) {\n    return\n  }\n  const em = (ctx.resolve('em') as EntityManager).fork()\n\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      userId: payload.userId,\n      tenantId: payload.tenantId,\n      ...(payload.organizationId !== undefined\n        ? { organizationId: payload.organizationId ?? null }\n        : {}),\n      deletedAt: null,\n    },\n    undefined,\n    {\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n  )\n  if (channels.length === 0) return\n\n  let touched = 0\n  for (const channel of channels) {\n    // Already disconnected \u2192 idempotent skip.\n    if (channel.status === 'disconnected' && channel.isActive === false) continue\n    channel.status = 'disconnected'\n    channel.isActive = false\n    channel.credentialsRef = null\n    channel.lastError = 'user-deleted'\n    channel.isPrimary = false\n    channel.lastPolledAt = new Date()\n    touched += 1\n  }\n  if (touched > 0) {\n    await em.flush()\n  }\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AA+B9B,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAYA,eAAO,QACL,SACA,KACe;AACf,MAAI,CAAC,WAAW,OAAO,QAAQ,WAAW,YAAY,CAAC,QAAQ,QAAQ;AACrE;AAAA,EACF;AAKA,MAAI,OAAO,QAAQ,aAAa,YAAY,CAAC,QAAQ,UAAU;AAC7D;AAAA,EACF;AACA,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AAErD,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,QAAQ,QAAQ;AAAA,MAChB,UAAU,QAAQ;AAAA,MAClB,GAAI,QAAQ,mBAAmB,SAC3B,EAAE,gBAAgB,QAAQ,kBAAkB,KAAK,IACjD,CAAC;AAAA,MACL,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,EACF;AACA,MAAI,SAAS,WAAW,EAAG;AAE3B,MAAI,UAAU;AACd,aAAW,WAAW,UAAU;AAE9B,QAAI,QAAQ,WAAW,kBAAkB,QAAQ,aAAa,MAAO;AACrE,YAAQ,SAAS;AACjB,YAAQ,WAAW;AACnB,YAAQ,iBAAiB;AACzB,YAAQ,YAAY;AACpB,YAAQ,YAAY;AACpB,YAAQ,eAAe,oBAAI,KAAK;AAChC,eAAW;AAAA,EACb;AACA,MAAI,UAAU,GAAG;AACf,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/widgets/components.js

@@ -0,0 +1,7 @@
+const componentOverrides = [];
+var components_default = componentOverrides;
+export {
+  componentOverrides,
+  components_default as default
+};
+//# sourceMappingURL=components.js.map

package/dist/modules/communication_channels/widgets/components.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/widgets/components.ts"],
+  "sourcesContent": ["import type { ComponentOverride } from '@open-mercato/shared/modules/widgets/component-registry'\n\n/**\n * Component override scaffold for the Communications Hub.\n *\n * Phase 4 of the email integration spec (`2026-05-21-email-integration-foundation`)\n * adds a `MessagesThreadDetailHeader` override for `channelType=email`. The shipping\n * Messages module renders the header via `MainMessageHeader` and does not yet expose\n * a registered component id \u2014 the header is rendered as a regular React component\n * in `MessageDetailPageClient.tsx`. The override mechanism (this file, plus the\n * `widgets/components.ts` auto-discovery convention) is wired and ready for the\n * Messages module to opt in by registering the component.\n *\n * Today, email-specific affordances (subject / Cc list / attachment count / Gmail\n * labels) are delivered to the Messages thread view via the\n * existing `detail:messages:message:body:after` injection spot's\n * `channel-payload-renderer` widget (slice 2e/2f). That widget renders the same\n * affordances the spec lists as header content, just below the header rather than\n * inside it. Surfacing them inside the header is the v2 upgrade path.\n *\n * Forward-compatible handle ids the hub will target once Messages exposes them:\n *   - `section:messages.detail.header`   \u2014 primary slot; the email override\n *                                         wraps it with the email banner above\n *                                         the default header.\n *   - `data-table:messages:row`          \u2014 secondary slot; email-channel rows\n *                                         get a small inline preview of the\n *                                         first-from name + envelope icon.\n *\n * Until Messages calls `registerComponent({ id: 'section:messages.detail.header', ... })`,\n * this file exports an empty array \u2014 the hub honors the override-mechanism\n * contract (downstream apps can target hub-side handles) without inventing\n * fictional component ids the Messages module doesn't surface.\n */\nexport const componentOverrides: ComponentOverride[] = []\n\nexport default componentOverrides\n"],
+  "mappings": "AAiCO,MAAM,qBAA0C,CAAC;AAExD,IAAO,qBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/widgets/injection/channel-badge/widget.client.js

@@ -0,0 +1,18 @@
+"use client";
+import { jsx } from "react/jsx-runtime";
+import { Tag } from "@open-mercato/ui/primitives/tag";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function ChannelBadgeWidget({ channel }) {
+  const t = useT();
+  if (!channel) return null;
+  const providerLabel = channel.providerKey ?? channel.channelType ?? "";
+  const variant = channel.direction === "outbound" ? "info" : "success";
+  return /* @__PURE__ */ jsx(Tag, { variant, dot: true, children: t(
+    `communication_channels.channel.providers.${providerLabel}`,
+    providerLabel
+  ) });
+}
+export {
+  ChannelBadgeWidget as default
+};
+//# sourceMappingURL=widget.client.js.map

package/dist/modules/communication_channels/widgets/injection/channel-badge/widget.client.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/communication_channels/widgets/injection/channel-badge/widget.client.tsx"],
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype ChannelEnrichment = {\n  providerKey?: string\n  channelType?: string\n  direction?: 'inbound' | 'outbound' | string\n  deliveryStatus?: string | null\n}\n\nexport type ChannelBadgeProps = {\n  channel: ChannelEnrichment | null | undefined\n}\n\n/**\n * Pure presentational badge \u2014 renders the channel provider/type as a `<Tag>`\n * pill. The host (declarative column injection \u2014 see `widget.ts`) feeds the\n * `_channel` enrichment in.\n */\nexport default function ChannelBadgeWidget({ channel }: ChannelBadgeProps) {\n  const t = useT()\n  if (!channel) return null\n\n  const providerLabel = channel.providerKey ?? channel.channelType ?? ''\n  const variant: 'success' | 'info' = channel.direction === 'outbound' ? 'info' : 'success'\n\n  return (\n    <Tag variant={variant} dot>\n      {t(\n        `communication_channels.channel.providers.${providerLabel}`,\n        providerLabel,\n      )}\n    </Tag>\n  )\n}\n"],
+  "mappings": ";AA8BI;AA3BJ,SAAS,WAAW;AACpB,SAAS,YAAY;AAkBN,SAAR,mBAAoC,EAAE,QAAQ,GAAsB;AACzE,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,gBAAgB,QAAQ,eAAe,QAAQ,eAAe;AACpE,QAAM,UAA8B,QAAQ,cAAc,aAAa,SAAS;AAEhF,SACE,oBAAC,OAAI,SAAkB,KAAG,MACvB;AAAA,IACC,4CAA4C,aAAa;AAAA,IACzD;AAAA,EACF,GACF;AAEJ;",
+  "names": []
+}

package/dist/modules/communication_channels/widgets/injection/channel-badge/widget.js

@@ -0,0 +1,30 @@
+import * as React from "react";
+import ChannelBadgeWidget from "./widget.client.js";
+const widget = {
+  metadata: {
+    id: "communication_channels.injection.channel-badge",
+    title: "Channel badge",
+    description: "Renders a channel-type/provider badge inline in the messages list. Visible whenever a message has an associated MessageChannelLink (= the message was bridged from or to an external channel).",
+    features: ["communication_channels.view"],
+    priority: 100,
+    enabled: true
+  },
+  columns: [
+    {
+      id: "communication_channels.channel-badge",
+      header: "communication_channels.columns.provider",
+      accessorKey: "_channel",
+      size: 140,
+      cell: ({ getValue }) => {
+        const channel = getValue();
+        if (!channel) return null;
+        return React.createElement(ChannelBadgeWidget, { channel });
+      }
+    }
+  ]
+};
+var widget_default = widget;
+export {
+  widget_default as default
+};
+//# sourceMappingURL=widget.js.map