@open-mercato/core 0.6.5-develop.4384.1.ce2ec6eaaa → 0.6.5-develop.4393.1.de282b5dfd

package/dist/modules/communication_channels/commands/queue-import-history.js

@@ -0,0 +1,113 @@
+import { z } from "zod";
+import { createCrudFormError } from "@open-mercato/ui/backend/utils/serverErrors";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../data/entities.js";
+import { getChannelAdapterRegistry } from "../lib/adapter-registry-singleton.js";
+import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from "../lib/queue.js";
+const queueImportHistorySchema = z.object({
+  channelId: z.string().uuid(),
+  sinceDays: z.number().int().min(1).max(365).default(30),
+  contactEmails: z.array(z.string().email().max(255)).max(200).optional(),
+  maxMessages: z.number().int().min(1).max(5e3).default(1e3)
+});
+const CHANNEL_IMPORT_HISTORY_JOB_TYPE = "communication_channels.channel.import_history";
+async function queueImportHistory(params) {
+  const input = queueImportHistorySchema.parse(params.input);
+  const { container, scope } = params;
+  const em = container.resolve("em").fork();
+  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId };
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: input.channelId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null
+    },
+    void 0,
+    dscope
+  );
+  if (!channel) {
+    throw createCrudFormError(
+      "Channel not found",
+      { channelId: "Channel not found" },
+      { status: 404 }
+    );
+  }
+  if (!channel.isActive || channel.status !== "connected") {
+    throw createCrudFormError(
+      "Channel is not connected",
+      { channelId: "Channel must be connected to import history" },
+      { status: 409 }
+    );
+  }
+  const adapter = getChannelAdapterRegistry().get(channel.providerKey);
+  if (!adapter) {
+    throw createCrudFormError(
+      "Channel provider is not available",
+      { channelId: `No adapter registered for provider "${channel.providerKey}"` },
+      { status: 400 }
+    );
+  }
+  if (typeof adapter.importHistory !== "function") {
+    throw createCrudFormError(
+      "History import is not supported on this provider",
+      { channelId: `Provider "${channel.providerKey}" does not support history import yet` },
+      { status: 400 }
+    );
+  }
+  const progressService = container.resolve("progressService");
+  const progressContext = {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId ?? null
+  };
+  const active = await progressService.getActiveJobs(progressContext);
+  const conflict = active.find((job) => {
+    if (job.jobType !== CHANNEL_IMPORT_HISTORY_JOB_TYPE) return false;
+    const meta = job.meta ?? {};
+    return meta.channelId === channel.id;
+  });
+  if (conflict) {
+    throw createCrudFormError(
+      "An import is already in progress for this channel",
+      { channelId: "Another history import is already running" },
+      { status: 429 }
+    );
+  }
+  const progressJob = await progressService.createJob(
+    {
+      jobType: CHANNEL_IMPORT_HISTORY_JOB_TYPE,
+      name: `Import history: ${channel.displayName ?? channel.externalIdentifier ?? channel.providerKey}`,
+      description: `Import up to ${input.maxMessages} messages from the last ${input.sinceDays} days`,
+      totalCount: input.maxMessages,
+      cancellable: true,
+      meta: {
+        channelId: channel.id,
+        providerKey: channel.providerKey,
+        sinceDays: input.sinceDays,
+        contactEmailsCount: input.contactEmails?.length ?? 0,
+        maxMessages: input.maxMessages
+      }
+    },
+    progressContext
+  );
+  const payload = {
+    progressJobId: progressJob.id,
+    channelId: channel.id,
+    sinceDays: input.sinceDays,
+    contactEmails: input.contactEmails,
+    maxMessages: input.maxMessages,
+    scope: { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  };
+  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.importHistory);
+  await queue.enqueue(payload);
+  return { progressJobId: progressJob.id, totalCountHint: input.maxMessages };
+}
+export {
+  CHANNEL_IMPORT_HISTORY_JOB_TYPE,
+  queueImportHistory,
+  queueImportHistorySchema
+};
+//# sourceMappingURL=queue-import-history.js.map

package/dist/modules/communication_channels/commands/queue-import-history.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/commands/queue-import-history.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { AwilixContainer } from 'awilix'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type {\n  ProgressService,\n  ProgressServiceContext,\n} from '../../progress/lib/progressService'\nimport { CommunicationChannel } from '../data/entities'\nimport { getChannelAdapterRegistry } from '../lib/adapter-registry-singleton'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\n\n/**\n * Spec B \u00A7 Phase B6 \u2014 operator-triggered backlog import.\n *\n * Validates the channel + adapter capability, creates a `ProgressJob`, then\n * enqueues a `channel-import-history` job. Returns the job id so the UI can\n * track progress via the existing ProgressTopBar.\n *\n * Concurrency guard: at most one in-flight import per channel \u2014 a second call\n * while the first is still running returns a 429 envelope via\n * `createCrudFormError`. The worker itself runs with `concurrency: 1` so a\n * dropped guard is still safe.\n */\n\nexport const queueImportHistorySchema = z.object({\n  channelId: z.string().uuid(),\n  sinceDays: z.number().int().min(1).max(365).default(30),\n  contactEmails: z\n    .array(z.string().email().max(255))\n    .max(200)\n    .optional(),\n  maxMessages: z.number().int().min(1).max(5000).default(1000),\n})\n\nexport type QueueImportHistoryInput = z.infer<typeof queueImportHistorySchema>\n\nexport interface QueueImportHistoryScope {\n  tenantId: string\n  organizationId: string\n  userId?: string | null\n}\n\nexport interface QueueImportHistoryResult {\n  progressJobId: string\n  totalCountHint: number\n}\n\nexport const CHANNEL_IMPORT_HISTORY_JOB_TYPE = 'communication_channels.channel.import_history'\n\nexport interface ChannelImportHistoryJobPayload {\n  progressJobId: string\n  channelId: string\n  sinceDays: number\n  contactEmails?: string[]\n  maxMessages: number\n  scope: { tenantId: string; organizationId: string }\n}\n\nexport async function queueImportHistory(params: {\n  container: AwilixContainer\n  scope: QueueImportHistoryScope\n  input: QueueImportHistoryInput\n}): Promise<QueueImportHistoryResult> {\n  const input = queueImportHistorySchema.parse(params.input)\n  const { container, scope } = params\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: input.channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) {\n    throw createCrudFormError(\n      'Channel not found',\n      { channelId: 'Channel not found' },\n      { status: 404 },\n    )\n  }\n  if (!channel.isActive || channel.status !== 'connected') {\n    // 409 (not 400): the request is well-formed but the channel is in a\n    // conflicting state (requires_reauth / error / disconnected). The UI maps\n    // this to the localized \"reconnect first\" flash; see spec \u00A7 API Contracts.\n    throw createCrudFormError(\n      'Channel is not connected',\n      { channelId: 'Channel must be connected to import history' },\n      { status: 409 },\n    )\n  }\n\n  // Adapter must declare `importHistory` \u2014 Gmail / IMAP adapters gain it\n  // in Spec C. Other providers (chat, SMS) cannot do historical inbox sweeps.\n  const adapter = getChannelAdapterRegistry().get(channel.providerKey)\n  if (!adapter) {\n    throw createCrudFormError(\n      'Channel provider is not available',\n      { channelId: `No adapter registered for provider \"${channel.providerKey}\"` },\n      { status: 400 },\n    )\n  }\n  if (typeof adapter.importHistory !== 'function') {\n    throw createCrudFormError(\n      'History import is not supported on this provider',\n      { channelId: `Provider \"${channel.providerKey}\" does not support history import yet` },\n      { status: 400 },\n    )\n  }\n\n  const progressService = container.resolve('progressService') as ProgressService\n  const progressContext: ProgressServiceContext = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId ?? null,\n  }\n\n  // Concurrency guard (best-effort): refuse if another import is already\n  // in-flight for the same channel. We can't query by meta in a portable way\n  // without DB-specific JSON operators, so we scan the small active-jobs window.\n  // This check and `createJob` below are NOT atomic \u2014 two near-simultaneous\n  // requests for the same channel can both pass and enqueue. That is acceptable,\n  // not corrupting: the import worker runs at concurrency 1 (duplicate jobs run\n  // sequentially, never in parallel) and inbound ingest dedups by the\n  // `(channel_id, external_message_id)` unique index, so the worst case is\n  // wasted re-fetch work, never duplicate rows.\n  const active = await progressService.getActiveJobs(progressContext)\n  const conflict = active.find((job) => {\n    if (job.jobType !== CHANNEL_IMPORT_HISTORY_JOB_TYPE) return false\n    const meta = (job.meta ?? {}) as Record<string, unknown>\n    return meta.channelId === channel.id\n  })\n  if (conflict) {\n    throw createCrudFormError(\n      'An import is already in progress for this channel',\n      { channelId: 'Another history import is already running' },\n      { status: 429 },\n    )\n  }\n\n  const progressJob = await progressService.createJob(\n    {\n      jobType: CHANNEL_IMPORT_HISTORY_JOB_TYPE,\n      name: `Import history: ${channel.displayName ?? channel.externalIdentifier ?? channel.providerKey}`,\n      description: `Import up to ${input.maxMessages} messages from the last ${input.sinceDays} days`,\n      totalCount: input.maxMessages,\n      cancellable: true,\n      meta: {\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        sinceDays: input.sinceDays,\n        contactEmailsCount: input.contactEmails?.length ?? 0,\n        maxMessages: input.maxMessages,\n      },\n    },\n    progressContext,\n  )\n\n  const payload: ChannelImportHistoryJobPayload = {\n    progressJobId: progressJob.id,\n    channelId: channel.id,\n    sinceDays: input.sinceDays,\n    contactEmails: input.contactEmails,\n    maxMessages: input.maxMessages,\n    scope: { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  }\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.importHistory)\n  await queue.enqueue(payload as unknown as Record<string, unknown>)\n\n  return { progressJobId: progressJob.id, totalCountHint: input.maxMessages }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AAKtC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C,SAAS,+BAA+B,qCAAqC;AAetE,MAAM,2BAA2B,EAAE,OAAO;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,eAAe,EACZ,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,EACjC,IAAI,GAAG,EACP,SAAS;AAAA,EACZ,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,QAAQ,GAAI;AAC7D,CAAC;AAeM,MAAM,kCAAkC;AAW/C,eAAsB,mBAAmB,QAIH;AACpC,QAAM,QAAQ,yBAAyB,MAAM,OAAO,KAAK;AACzD,QAAM,EAAE,WAAW,MAAM,IAAI;AAE7B,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,SAAS,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAEhF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,WAAW,oBAAoB;AAAA,MACjC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,aAAa;AAIvD,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,WAAW,8CAA8C;AAAA,MAC3D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAIA,QAAM,UAAU,0BAA0B,EAAE,IAAI,QAAQ,WAAW;AACnE,MAAI,CAAC,SAAS;AACZ,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,WAAW,uCAAuC,QAAQ,WAAW,IAAI;AAAA,MAC3E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,kBAAkB,YAAY;AAC/C,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,WAAW,aAAa,QAAQ,WAAW,wCAAwC;AAAA,MACrF,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,kBAAkB,UAAU,QAAQ,iBAAiB;AAC3D,QAAM,kBAA0C;AAAA,IAC9C,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM,UAAU;AAAA,EAC1B;AAWA,QAAM,SAAS,MAAM,gBAAgB,cAAc,eAAe;AAClE,QAAM,WAAW,OAAO,KAAK,CAAC,QAAQ;AACpC,QAAI,IAAI,YAAY,gCAAiC,QAAO;AAC5D,UAAM,OAAQ,IAAI,QAAQ,CAAC;AAC3B,WAAO,KAAK,cAAc,QAAQ;AAAA,EACpC,CAAC;AACD,MAAI,UAAU;AACZ,UAAM;AAAA,MACJ;AAAA,MACA,EAAE,WAAW,4CAA4C;AAAA,MACzD,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,gBAAgB;AAAA,IACxC;AAAA,MACE,SAAS;AAAA,MACT,MAAM,mBAAmB,QAAQ,eAAe,QAAQ,sBAAsB,QAAQ,WAAW;AAAA,MACjG,aAAa,gBAAgB,MAAM,WAAW,2BAA2B,MAAM,SAAS;AAAA,MACxF,YAAY,MAAM;AAAA,MAClB,aAAa;AAAA,MACb,MAAM;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,WAAW,MAAM;AAAA,QACjB,oBAAoB,MAAM,eAAe,UAAU;AAAA,QACnD,aAAa,MAAM;AAAA,MACrB;AAAA,IACF;AAAA,IACA;AAAA,EACF;AAEA,QAAM,UAA0C;AAAA,IAC9C,eAAe,YAAY;AAAA,IAC3B,WAAW,QAAQ;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,eAAe,MAAM;AAAA,IACrB,aAAa,MAAM;AAAA,IACnB,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EAC1E;AACA,QAAM,QAAQ,8BAA8B,8BAA8B,aAAa;AACvF,QAAM,MAAM,QAAQ,OAA6C;AAEjE,SAAO,EAAE,eAAe,YAAY,IAAI,gBAAgB,MAAM,YAAY;AAC5E;",
+  "names": []
+}

package/dist/modules/communication_channels/commands/reassign-conversation.js

@@ -0,0 +1,193 @@
+import { z } from "zod";
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { extractUndoPayload as extractSharedUndoPayload } from "@open-mercato/shared/lib/commands/undo";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { ChannelThreadMapping, ExternalConversation } from "../data/entities.js";
+import { emitCommunicationChannelsEvent } from "../events.js";
+const reassignConversationSchema = z.object({
+  threadId: z.string().uuid(),
+  /** Set to `null` to unassign the conversation. */
+  assignedUserId: z.string().uuid().nullable(),
+  scope: z.object({
+    tenantId: z.string().uuid(),
+    organizationId: z.string().uuid().nullable()
+  })
+});
+const COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID = "communication_channels.conversation.reassign";
+const reassignConversationCommand = {
+  id: COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID,
+  // Explicitly undoable (the bus also infers this from `undo` below, but
+  // declaring it keeps undoability from silently dropping under a refactor).
+  isUndoable: true,
+  async execute(rawInput, ctx) {
+    const input = reassignConversationSchema.parse(rawInput);
+    const em = ctx.container.resolve("em").fork();
+    const dscope = {
+      tenantId: input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null
+    };
+    const mapping = await findOneWithDecryption(
+      em,
+      ChannelThreadMapping,
+      {
+        messageThreadId: input.threadId,
+        tenantId: input.scope.tenantId,
+        organizationId: input.scope.organizationId ?? null
+      },
+      // `message_thread_id` is non-unique (only `(external_conversation_id,
+      // tenant_id)` is unique). The 1:1 thread↔mapping invariant holds in v1,
+      // but order deterministically so a future many-conversations-per-thread
+      // merge can never resolve an arbitrary mapping here.
+      { orderBy: { createdAt: "asc" } },
+      dscope
+    );
+    if (!mapping) {
+      return {
+        status: "no_channel_link",
+        reason: `no ChannelThreadMapping for thread ${input.threadId}`
+      };
+    }
+    const previousAssignedUserId = mapping.assignedUserId ?? null;
+    if (previousAssignedUserId === input.assignedUserId) {
+      return { status: "noop", reason: "assigned user unchanged" };
+    }
+    if (input.assignedUserId) {
+      const assignee = await findOneWithDecryption(
+        em,
+        "User",
+        { id: input.assignedUserId, tenantId: input.scope.tenantId, deletedAt: null },
+        void 0,
+        dscope
+      );
+      if (!assignee) {
+        return {
+          status: "invalid_assignee",
+          reason: "assigned user is not a member of this tenant"
+        };
+      }
+    }
+    const conversation = await findOneWithDecryption(
+      em,
+      ExternalConversation,
+      {
+        id: mapping.externalConversationId,
+        tenantId: input.scope.tenantId,
+        organizationId: input.scope.organizationId ?? null
+      },
+      void 0,
+      dscope
+    );
+    if (!conversation) {
+      return {
+        status: "no_channel_link",
+        reason: `no ExternalConversation for thread ${input.threadId}`
+      };
+    }
+    mapping.assignedUserId = input.assignedUserId;
+    conversation.assignedUserId = input.assignedUserId;
+    await em.flush();
+    try {
+      await emitCommunicationChannelsEvent(
+        "communication_channels.conversation.reassigned",
+        {
+          conversationId: conversation.id,
+          channelId: mapping.channelId,
+          messageThreadId: input.threadId,
+          previousAssignedUserId,
+          assignedUserId: input.assignedUserId,
+          tenantId: input.scope.tenantId,
+          organizationId: input.scope.organizationId ?? null
+        },
+        { persistent: true }
+      );
+    } catch (emitErr) {
+      console.warn(
+        "[communication_channels:reassign-conversation] reassigned event emit failed:",
+        emitErr instanceof Error ? emitErr.message : emitErr
+      );
+    }
+    const undo = {
+      threadMappingId: mapping.id,
+      conversationId: conversation.id,
+      tenantId: mapping.tenantId,
+      previousAssignedUserId,
+      newAssignedUserId: input.assignedUserId
+    };
+    return {
+      status: "reassigned",
+      threadId: input.threadId,
+      previousAssignedUserId,
+      nextAssignedUserId: input.assignedUserId,
+      conversationId: conversation.id,
+      undo
+    };
+  },
+  // Persist the undo snapshot into the action log. Without this, the command bus
+  // mints an undo token (so the UI offers "Undo") but the snapshot returned from
+  // execute() is never stored, and undo() would silently no-op.
+  async buildLog({ input, result }) {
+    if (result.status !== "reassigned") return null;
+    return {
+      resourceKind: "communication_channels.channel",
+      resourceId: result.conversationId,
+      tenantId: result.undo.tenantId ?? input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null,
+      payload: { undo: result.undo },
+      snapshotBefore: result.undo
+    };
+  },
+  async undo({ ctx, logEntry }) {
+    const snapshot = extractSnapshotFromLog(logEntry);
+    if (!snapshot) return;
+    const em = ctx.container.resolve("em").fork();
+    if (!snapshot.tenantId) return;
+    const dscope = { tenantId: snapshot.tenantId, organizationId: null };
+    const mapping = await findOneWithDecryption(
+      em,
+      ChannelThreadMapping,
+      { id: snapshot.threadMappingId, tenantId: snapshot.tenantId },
+      void 0,
+      dscope
+    );
+    const conversation = await findOneWithDecryption(
+      em,
+      ExternalConversation,
+      { id: snapshot.conversationId, tenantId: snapshot.tenantId },
+      void 0,
+      dscope
+    );
+    if (mapping) mapping.assignedUserId = snapshot.previousAssignedUserId;
+    if (conversation) conversation.assignedUserId = snapshot.previousAssignedUserId;
+    if (mapping || conversation) await em.flush();
+  }
+};
+function extractUndoPayload(value) {
+  if (!value || typeof value !== "object") return null;
+  const candidate = value.undo ?? value;
+  if (!candidate || typeof candidate !== "object") return null;
+  const obj = candidate;
+  if (typeof obj.threadMappingId !== "string" || typeof obj.conversationId !== "string") return null;
+  return {
+    threadMappingId: obj.threadMappingId,
+    conversationId: obj.conversationId,
+    tenantId: typeof obj.tenantId === "string" ? obj.tenantId : void 0,
+    previousAssignedUserId: typeof obj.previousAssignedUserId === "string" ? obj.previousAssignedUserId : null,
+    newAssignedUserId: typeof obj.newAssignedUserId === "string" ? obj.newAssignedUserId : null
+  };
+}
+function extractSnapshotFromLog(logEntry) {
+  const undo = extractSharedUndoPayload(
+    logEntry ?? null
+  );
+  if (undo) return extractUndoPayload(undo);
+  return extractUndoPayload(logEntry);
+}
+registerCommand(reassignConversationCommand);
+var reassign_conversation_default = reassignConversationCommand;
+export {
+  COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID,
+  reassign_conversation_default as default,
+  extractSnapshotFromLog,
+  extractUndoPayload
+};
+//# sourceMappingURL=reassign-conversation.js.map

package/dist/modules/communication_channels/commands/reassign-conversation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/commands/reassign-conversation.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ChannelThreadMapping, ExternalConversation } from '../data/entities'\nimport { emitCommunicationChannelsEvent } from '../events'\n\nconst reassignConversationSchema = z.object({\n  threadId: z.string().uuid(),\n  /** Set to `null` to unassign the conversation. */\n  assignedUserId: z.string().uuid().nullable(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type ReassignConversationInput = z.infer<typeof reassignConversationSchema>\n\nexport type ReassignConversationResult =\n  | {\n      status: 'reassigned'\n      threadId: string\n      previousAssignedUserId: string | null\n      nextAssignedUserId: string | null\n      conversationId: string\n      undo: ReassignConversationUndoSnapshot\n    }\n  | { status: 'no_channel_link'; reason: string }\n  | { status: 'invalid_assignee'; reason: string }\n  | { status: 'noop'; reason: string }\n\nexport interface ReassignConversationUndoSnapshot {\n  threadMappingId: string\n  conversationId: string\n  // Optional for backward compatibility with log entries written before tenant\n  // scoping was added to the undo lookup; new snapshots always set it.\n  tenantId?: string\n  previousAssignedUserId: string | null\n  newAssignedUserId: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID =\n  'communication_channels.conversation.reassign'\n\n/**\n * Reassign the owning user of a channel-linked conversation.\n *\n * Updates both `ChannelThreadMapping.assignedUserId` and the linked\n * `ExternalConversation.assignedUserId` so subscribers (notification handlers,\n * future dashboards) see a consistent owner. No external provider call \u2014\n * reassignment is an internal-routing concern.\n *\n * Idempotent: when the new owner matches the existing one, returns `noop`.\n *\n * The command is undoable: the `before` snapshot captures the previous owner on\n * both rows so undo can restore them atomically.\n */\nconst reassignConversationCommand: CommandHandler<\n  ReassignConversationInput,\n  ReassignConversationResult\n> = {\n  id: COMMUNICATION_CHANNELS_REASSIGN_CONVERSATION_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = reassignConversationSchema.parse(rawInput) as ReassignConversationInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: input.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      // `message_thread_id` is non-unique (only `(external_conversation_id,\n      // tenant_id)` is unique). The 1:1 thread\u2194mapping invariant holds in v1,\n      // but order deterministically so a future many-conversations-per-thread\n      // merge can never resolve an arbitrary mapping here.\n      { orderBy: { createdAt: 'asc' } },\n      dscope,\n    )\n    if (!mapping) {\n      return {\n        status: 'no_channel_link',\n        reason: `no ChannelThreadMapping for thread ${input.threadId}`,\n      }\n    }\n\n    const previousAssignedUserId = mapping.assignedUserId ?? null\n    if (previousAssignedUserId === input.assignedUserId) {\n      return { status: 'noop', reason: 'assigned user unchanged' }\n    }\n\n    // Reject an assignee that is not a live user of this tenant \u2014 a UUID-shaped\n    // body alone must not create a cross-tenant / dangling owner reference.\n    if (input.assignedUserId) {\n      // Reference the `auth` user row by string entity name so this command does\n      // not import the auth module's entities (module independence); `as never`\n      // matches the codebase pattern for cross-module decrypted reads.\n      const assignee = await findOneWithDecryption(\n        em,\n        'User' as never,\n        { id: input.assignedUserId, tenantId: input.scope.tenantId, deletedAt: null } as never,\n        undefined,\n        dscope,\n      )\n      if (!assignee) {\n        return {\n          status: 'invalid_assignee',\n          reason: 'assigned user is not a member of this tenant',\n        }\n      }\n    }\n\n    const conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        id: mapping.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!conversation) {\n      return {\n        status: 'no_channel_link',\n        reason: `no ExternalConversation for thread ${input.threadId}`,\n      }\n    }\n\n    // `assignedUserId` is an advisory routing pointer, not a DB foreign key\n    // (modules don't share ORM relations). The assignee-existence check above\n    // and this write are not atomic, so a user deleted in between leaves a\n    // harmless dangling pointer \u2014 consistent with the module's no-FK design.\n    mapping.assignedUserId = input.assignedUserId\n    conversation.assignedUserId = input.assignedUserId\n    await em.flush()\n\n    try {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.conversation.reassigned',\n        {\n          conversationId: conversation.id,\n          channelId: mapping.channelId,\n          messageThreadId: input.threadId,\n          previousAssignedUserId,\n          assignedUserId: input.assignedUserId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    } catch (emitErr) {\n      // Best-effort lifecycle/workflow-trigger signal \u2014 a bus failure must not\n      // abort the reassignment (the rows are already committed above).\n      console.warn(\n        '[communication_channels:reassign-conversation] reassigned event emit failed:',\n        emitErr instanceof Error ? emitErr.message : emitErr,\n      )\n    }\n\n    const undo: ReassignConversationUndoSnapshot = {\n      threadMappingId: mapping.id,\n      conversationId: conversation.id,\n      tenantId: mapping.tenantId,\n      previousAssignedUserId,\n      newAssignedUserId: input.assignedUserId,\n    }\n\n    return {\n      status: 'reassigned',\n      threadId: input.threadId,\n      previousAssignedUserId,\n      nextAssignedUserId: input.assignedUserId,\n      conversationId: conversation.id,\n      undo,\n    }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() would silently no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'reassigned') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.conversationId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n      snapshotBefore: result.undo,\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Never resolve by bare id (cross-tenant). New snapshots always carry\n    // tenantId; refuse the undo if a legacy snapshot lacks it.\n    if (!snapshot.tenantId) return\n    const dscope = { tenantId: snapshot.tenantId, organizationId: null }\n\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      { id: snapshot.threadMappingId, tenantId: snapshot.tenantId },\n      undefined,\n      dscope,\n    )\n    const conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      { id: snapshot.conversationId, tenantId: snapshot.tenantId },\n      undefined,\n      dscope,\n    )\n    if (mapping) mapping.assignedUserId = snapshot.previousAssignedUserId\n    if (conversation) conversation.assignedUserId = snapshot.previousAssignedUserId\n    if (mapping || conversation) await em.flush()\n  },\n}\n\n/**\n * Read the undo payload defensively \u2014 wraps the shared\n * `@open-mercato/shared/lib/commands/undo.ts` helper with a narrow-by-shape\n * validation so callers get a strongly-typed snapshot or `null`.\n *\n * Kept as a separate export for test ergonomics (tests can mock the snapshot\n * shape directly without round-tripping through a CommandLogEntry).\n */\nexport function extractUndoPayload(value: unknown): ReassignConversationUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.threadMappingId !== 'string' || typeof obj.conversationId !== 'string') return null\n  return {\n    threadMappingId: obj.threadMappingId,\n    conversationId: obj.conversationId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n    previousAssignedUserId:\n      typeof obj.previousAssignedUserId === 'string' ? obj.previousAssignedUserId : null,\n    newAssignedUserId: typeof obj.newAssignedUserId === 'string' ? obj.newAssignedUserId : null,\n  }\n}\n\n/**\n * Pulls the reassignment snapshot from a command log entry \u2014 first via the\n * shared `extractUndoPayload` helper, then through the local shape-validator.\n * Always falls back to `null` so the undo handler can no-op safely.\n */\nexport function extractSnapshotFromLog(logEntry: unknown): ReassignConversationUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<ReassignConversationUndoSnapshot>(\n    (logEntry ?? null) as never,\n  )\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(reassignConversationCommand)\n\nexport default reassignConversationCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,6BAA6B;AACtC,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,sCAAsC;AAE/C,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AA2BM,MAAM,0DACX;AAeF,MAAM,8BAGF;AAAA,EACF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,2BAA2B,MAAM,QAAQ;AACvD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,MAAM;AAAA,QACvB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,sCAAsC,MAAM,QAAQ;AAAA,MAC9D;AAAA,IACF;AAEA,UAAM,yBAAyB,QAAQ,kBAAkB;AACzD,QAAI,2BAA2B,MAAM,gBAAgB;AACnD,aAAO,EAAE,QAAQ,QAAQ,QAAQ,0BAA0B;AAAA,IAC7D;AAIA,QAAI,MAAM,gBAAgB;AAIxB,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,MAAM,gBAAgB,UAAU,MAAM,MAAM,UAAU,WAAW,KAAK;AAAA,QAC5E;AAAA,QACA;AAAA,MACF;AACA,UAAI,CAAC,UAAU;AACb,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAEA,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,sCAAsC,MAAM,QAAQ;AAAA,MAC9D;AAAA,IACF;AAMA,YAAQ,iBAAiB,MAAM;AAC/B,iBAAa,iBAAiB,MAAM;AACpC,UAAM,GAAG,MAAM;AAEf,QAAI;AACF,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,WAAW,QAAQ;AAAA,UACnB,iBAAiB,MAAM;AAAA,UACvB;AAAA,UACA,gBAAgB,MAAM;AAAA,UACtB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF,SAAS,SAAS;AAGhB,cAAQ;AAAA,QACN;AAAA,QACA,mBAAmB,QAAQ,QAAQ,UAAU;AAAA,MAC/C;AAAA,IACF;AAEA,UAAM,OAAyC;AAAA,MAC7C,iBAAiB,QAAQ;AAAA,MACzB,gBAAgB,aAAa;AAAA,MAC7B,UAAU,QAAQ;AAAA,MAClB;AAAA,MACA,mBAAmB,MAAM;AAAA,IAC3B;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,UAAU,MAAM;AAAA,MAChB;AAAA,MACA,oBAAoB,MAAM;AAAA,MAC1B,gBAAgB,aAAa;AAAA,MAC7B;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,aAAc,QAAO;AAC3C,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,MAC7B,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,SAAU;AACf,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,QAAI,CAAC,SAAS,SAAU;AACxB,UAAM,SAAS,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAEnE,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,iBAAiB,UAAU,SAAS,SAAS;AAAA,MAC5D;AAAA,MACA;AAAA,IACF;AACA,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,gBAAgB,UAAU,SAAS,SAAS;AAAA,MAC3D;AAAA,MACA;AAAA,IACF;AACA,QAAI,QAAS,SAAQ,iBAAiB,SAAS;AAC/C,QAAI,aAAc,cAAa,iBAAiB,SAAS;AACzD,QAAI,WAAW,aAAc,OAAM,GAAG,MAAM;AAAA,EAC9C;AACF;AAUO,SAAS,mBAAmB,OAAyD;AAC1F,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAA6B,QAAQ;AACxD,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,oBAAoB,YAAY,OAAO,IAAI,mBAAmB,SAAU,QAAO;AAC9F,SAAO;AAAA,IACL,iBAAiB,IAAI;AAAA,IACrB,gBAAgB,IAAI;AAAA,IACpB,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,IAC5D,wBACE,OAAO,IAAI,2BAA2B,WAAW,IAAI,yBAAyB;AAAA,IAChF,mBAAmB,OAAO,IAAI,sBAAsB,WAAW,IAAI,oBAAoB;AAAA,EACzF;AACF;AAOO,SAAS,uBAAuB,UAA4D;AACjG,QAAM,OAAO;AAAA,IACV,YAAY;AAAA,EACf;AACA,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,2BAA2B;AAE3C,IAAO,gCAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/commands/set-primary-channel.js

@@ -0,0 +1,114 @@
+import { z } from "zod";
+import { registerCommand } from "@open-mercato/shared/lib/commands";
+import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../data/entities.js";
+import { emitCommunicationChannelsEvent } from "../events.js";
+const setPrimaryChannelSchema = z.object({
+  channelId: z.string().uuid(),
+  userId: z.string().uuid(),
+  scope: z.object({
+    tenantId: z.string().uuid(),
+    organizationId: z.string().uuid().nullable()
+  })
+});
+const COMMUNICATION_CHANNELS_SET_PRIMARY_COMMAND_ID = "communication_channels.channel.set_primary";
+const setPrimaryChannelCommand = {
+  id: COMMUNICATION_CHANNELS_SET_PRIMARY_COMMAND_ID,
+  // Intentionally NOT undoable. Restoring a prior primary is order-sensitive
+  // against the partial unique index `communication_channels_one_primary_per_user_uq`
+  // (it would need the same clear-then-set, cross-org, two-phase dance as
+  // `execute`), and a stale snapshot could re-primary a channel the user has
+  // since disconnected. Sibling lifecycle commands (disconnect/delete) likewise
+  // do not re-claim primary on undo. Declared explicitly so the omission reads
+  // as a decision, not an oversight.
+  isUndoable: false,
+  async execute(rawInput, ctx) {
+    const input = setPrimaryChannelSchema.parse(rawInput);
+    const em = ctx.container.resolve("em").fork();
+    const dscope = {
+      tenantId: input.scope.tenantId,
+      organizationId: input.scope.organizationId ?? null
+    };
+    const channel = await findOneWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        id: input.channelId,
+        tenantId: input.scope.tenantId,
+        organizationId: input.scope.organizationId ?? null,
+        deletedAt: null
+      },
+      void 0,
+      dscope
+    );
+    if (!channel) {
+      return { status: "not_owner", reason: "channel not found" };
+    }
+    if (channel.userId !== input.userId) {
+      return { status: "not_owner", reason: "channel is not owned by the current user" };
+    }
+    if (channel.isPrimary) {
+      return { status: "noop", reason: "channel is already primary" };
+    }
+    const previousPrimaries = await findWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        // The one-primary-per-user partial unique index keys on `user_id` only,
+        // so it spans ALL organizations for a user. The prior primary must be
+        // cleared regardless of which org it lives in — otherwise a multi-org
+        // user setting a new primary in org B would collide (23505) with their
+        // existing primary in org A. `CommunicationChannel` has no encrypted
+        // fields, so the cross-org read needs no per-org decryption scope.
+        tenantId: input.scope.tenantId,
+        userId: input.userId,
+        isPrimary: true,
+        deletedAt: null
+      },
+      void 0,
+      dscope
+    );
+    let previousPrimaryChannelId = null;
+    await withAtomicFlush(
+      em,
+      [
+        () => {
+          for (const prev of previousPrimaries) {
+            previousPrimaryChannelId = prev.id;
+            prev.isPrimary = false;
+          }
+        },
+        () => {
+          channel.isPrimary = true;
+        }
+      ],
+      { transaction: true }
+    );
+    await emitCommunicationChannelsEvent(
+      "communication_channels.channel.primary_changed",
+      {
+        channelId: channel.id,
+        userId: input.userId,
+        providerKey: channel.providerKey,
+        channelType: channel.channelType,
+        previousPrimaryChannelId,
+        tenantId: input.scope.tenantId,
+        organizationId: input.scope.organizationId ?? null
+      },
+      { persistent: true }
+    );
+    return {
+      status: "set",
+      channelId: channel.id,
+      previousPrimaryChannelId
+    };
+  }
+};
+registerCommand(setPrimaryChannelCommand);
+var set_primary_channel_default = setPrimaryChannelCommand;
+export {
+  COMMUNICATION_CHANNELS_SET_PRIMARY_COMMAND_ID,
+  set_primary_channel_default as default
+};
+//# sourceMappingURL=set-primary-channel.js.map

package/dist/modules/communication_channels/commands/set-primary-channel.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/commands/set-primary-channel.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { emitCommunicationChannelsEvent } from '../events'\n\nconst setPrimaryChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type SetPrimaryChannelInput = z.infer<typeof setPrimaryChannelSchema>\n\nexport type SetPrimaryChannelResult =\n  | { status: 'set'; channelId: string; previousPrimaryChannelId: string | null }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_owner'; reason: string }\n\nexport const COMMUNICATION_CHANNELS_SET_PRIMARY_COMMAND_ID =\n  'communication_channels.channel.set_primary'\n\n/**\n * Mark a per-user channel as primary. Clears the primary flag on every other\n * channel owned by the same user. Enforced as one-primary-per-user by the\n * partial unique index `communication_channels_one_primary_per_user_uq`.\n *\n * Ownership-checked: refuses to set a primary on someone else's channel.\n */\nconst setPrimaryChannelCommand: CommandHandler<\n  SetPrimaryChannelInput,\n  SetPrimaryChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_SET_PRIMARY_COMMAND_ID,\n  // Intentionally NOT undoable. Restoring a prior primary is order-sensitive\n  // against the partial unique index `communication_channels_one_primary_per_user_uq`\n  // (it would need the same clear-then-set, cross-org, two-phase dance as\n  // `execute`), and a stale snapshot could re-primary a channel the user has\n  // since disconnected. Sibling lifecycle commands (disconnect/delete) likewise\n  // do not re-claim primary on undo. Declared explicitly so the omission reads\n  // as a decision, not an oversight.\n  isUndoable: false,\n  async execute(rawInput, ctx) {\n    const input = setPrimaryChannelSchema.parse(rawInput) as SetPrimaryChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      // Existence masking: a non-existent channel is indistinguishable from one\n      // owned by another user \u2014 both surface as 404 (not_owner) at the route,\n      // consistent with the other channel-scoped routes (import-history, etc.).\n      return { status: 'not_owner', reason: 'channel not found' }\n    }\n    if (channel.userId !== input.userId) {\n      return { status: 'not_owner', reason: 'channel is not owned by the current user' }\n    }\n    if (channel.isPrimary) {\n      return { status: 'noop', reason: 'channel is already primary' }\n    }\n\n    // The partial unique index `communication_channels_one_primary_per_user_uq`\n    // forbids two rows where `is_primary AND user_id = X`. PostgreSQL does NOT\n    // defer partial unique checks \u2014 every UPDATE statement is checked against\n    // the live partial index. So a SINGLE `em.flush()` containing both\n    // `is_primary=false` and `is_primary=true` updates is unsafe: MikroORM\n    // does not guarantee SET-false statements execute before SET-true.\n    //\n    // Fix (review R2-H1 / F2, 2026-05-26): two phases inside one transaction.\n    // `withAtomicFlush` runs each phase and flushes between them (the platform\n    // helper for exactly this multi-phase mutation \u2014 see packages/core/AGENTS.md\n    // \"Entity Update Safety\"). Phase 1 clears + flushes so Postgres observes\n    // `is_primary=false` before Phase 2's UPDATE runs; the transaction wraps both\n    // for all-or-nothing semantics.\n    const previousPrimaries = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        // The one-primary-per-user partial unique index keys on `user_id` only,\n        // so it spans ALL organizations for a user. The prior primary must be\n        // cleared regardless of which org it lives in \u2014 otherwise a multi-org\n        // user setting a new primary in org B would collide (23505) with their\n        // existing primary in org A. `CommunicationChannel` has no encrypted\n        // fields, so the cross-org read needs no per-org decryption scope.\n        tenantId: input.scope.tenantId,\n        userId: input.userId,\n        isPrimary: true,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    let previousPrimaryChannelId: string | null = null\n    await withAtomicFlush(\n      em,\n      [\n        () => {\n          for (const prev of previousPrimaries as CommunicationChannel[]) {\n            previousPrimaryChannelId = prev.id\n            prev.isPrimary = false\n          }\n        },\n        () => {\n          channel.isPrimary = true\n        },\n      ],\n      { transaction: true },\n    )\n\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.primary_changed',\n      {\n        channelId: channel.id,\n        userId: input.userId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        previousPrimaryChannelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'set',\n      channelId: channel.id,\n      previousPrimaryChannelId,\n    }\n  },\n}\n\nregisterCommand(setPrimaryChannelCommand)\n\nexport default setPrimaryChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAChC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,4BAA4B;AACrC,SAAS,sCAAsC;AAE/C,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AASM,MAAM,gDACX;AASF,MAAM,2BAGF;AAAA,EACF,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,wBAAwB,MAAM,QAAQ;AACpD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAIZ,aAAO,EAAE,QAAQ,aAAa,QAAQ,oBAAoB;AAAA,IAC5D;AACA,QAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,aAAO,EAAE,QAAQ,aAAa,QAAQ,2CAA2C;AAAA,IACnF;AACA,QAAI,QAAQ,WAAW;AACrB,aAAO,EAAE,QAAQ,QAAQ,QAAQ,6BAA6B;AAAA,IAChE;AAeA,UAAM,oBAAoB,MAAM;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOE,UAAU,MAAM,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,QACd,WAAW;AAAA,QACX,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,2BAA0C;AAC9C,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,MAAM;AACJ,qBAAW,QAAQ,mBAA6C;AAC9D,uCAA2B,KAAK;AAChC,iBAAK,YAAY;AAAA,UACnB;AAAA,QACF;AAAA,QACA,MAAM;AACJ,kBAAQ,YAAY;AAAA,QACtB;AAAA,MACF;AAAA,MACA,EAAE,aAAa,KAAK;AAAA,IACtB;AAEA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB;AAAA,QACA,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,wBAAwB;AAExC,IAAO,8BAAQ;",
+  "names": []
+}