@open-mercato/core 0.6.5-develop.4384.1.ce2ec6eaaa → 0.6.5-develop.4393.1.de282b5dfd

package/src/modules/communication_channels/workers/poll-tick.ts

@@ -0,0 +1,210 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CommunicationChannel } from '../data/entities'
+import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'
+import type { PollChannelJobPayload } from './poll-channel'
+
+/**
+ * Scheduler tick payload. Fired by the `@open-mercato/scheduler` cron entry
+ * registered in the hub's `setup.ts` (`communication_channels:poll-tick` schedule).
+ */
+export type PollTickPayload = {
+  scope: {
+    tenantId: string
+    organizationId: string | null
+  }
+}
+
+const POLL_ENUMERATION_CAP = Math.max(
+  1,
+  Number.parseInt(process.env.COMMUNICATION_CHANNELS_POLL_ENUMERATION_CAP ?? '500', 10) || 500,
+)
+
+export const metadata: WorkerMeta = {
+  queue: COMMUNICATION_CHANNELS_QUEUES.pollTick,
+  id: 'communication_channels:poll-tick',
+  concurrency: 1, // single-flight per tenant — one tick at a time
+}
+
+type HandlerContext = JobContext & {
+  resolve: <T = unknown>(name: string) => T
+}
+
+/**
+ * Enumerate channels due for polling and enqueue per-channel jobs.
+ *
+ * Per email integration spec § Hub Deltas → Delta 6:
+ *   SELECT id FROM communication_channels
+ *   WHERE is_active = true
+ *     AND deleted_at IS NULL
+ *     AND status = 'connected'
+ *     AND poll_interval_seconds IS NOT NULL
+ *     AND (last_polled_at IS NULL
+ *          OR last_polled_at + poll_interval_seconds * '1 sec' <= NOW())
+ *   ORDER BY last_polled_at NULLS FIRST
+ *   LIMIT 500
+ *
+ * Implementation note: MikroORM's QueryBuilder is the canonical entry point;
+ * the raw SQL above is the conceptual query. We use the entity-level filter to
+ * keep things portable and let MikroORM compile it.
+ */
+export default async function handle(
+  job: QueuedJob<PollTickPayload>,
+  ctx: HandlerContext,
+): Promise<void> {
+  // The scheduler module (`@open-mercato/scheduler`) spreads the configured
+  // `targetPayload` and then adds `tenantId` / `organizationId` at the TOP
+  // level of the enqueued payload (see
+  // packages/scheduler/.../execute-schedule.worker.ts). Our setup.ts originally
+  // stored `{ scope: { tenantId, organizationId } }` under targetPayload, so
+  // at runtime the payload looks like:
+  //   { scope: { tenantId, organizationId }, tenantId, organizationId, _idempotencyKey }
+  // Accept either path so the handler is robust to both how operators originally
+  // configured the schedule (nested `scope`) and how the scheduler flattens it.
+  const raw = (job?.payload ?? {}) as Partial<PollTickPayload> & {
+    tenantId?: string | null
+    organizationId?: string | null
+  }
+  const tenantId = raw.scope?.tenantId ?? raw.tenantId ?? null
+  const organizationId =
+    raw.scope?.organizationId ?? raw.organizationId ?? null
+  if (!tenantId) {
+    console.warn(
+      '[communication_channels:poll-tick] skipping tick — payload has no tenantId',
+      { payload: raw },
+    )
+    return
+  }
+  const scope = { tenantId, organizationId }
+  const em = (ctx.resolve('em') as EntityManager).fork()
+
+  const now = new Date()
+  // Find candidate channels — we enumerate two pools:
+  //   (1) status='connected' channels due for their normal poll cycle.
+  //   (2) Spec B § Auto-recovery sweep: status='error' channels whose
+  //       `lastPolledAt` is older than OM_CHANNEL_AUTO_RECOVER_MINUTES
+  //       (default 30 min). At most one retry per recovery window per
+  //       channel — when we enqueue a recovery job below we bump that
+  //       channel's `lastPolledAt` to `now` so it falls back under the
+  //       cutoff and is NOT re-selected on the immediately-following ticks
+  //       (poll-channel only advances `lastPolledAt` on a SUCCESSFUL poll,
+  //       so without this a persistently-failing channel would re-enqueue
+  //       every tick). On success `poll-channel` flips the status back to
+  //       'connected' so the channel rejoins the normal pool.
+  //
+  // Due-ness for (1) is computed in JS to avoid cross-DB interval
+  // arithmetic; the (2) cutoff is a single timestamp compare.
+  const connectedCandidates = await findWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId ?? null,
+      isActive: true,
+      deletedAt: null,
+      status: 'connected',
+      pollIntervalSeconds: { $ne: null },
+    },
+    {
+      limit: POLL_ENUMERATION_CAP,
+      orderBy: { lastPolledAt: 'asc' },
+    },
+    scope,
+  )
+
+  const recoverMinutesRaw = Number.parseInt(
+    process.env.OM_CHANNEL_AUTO_RECOVER_MINUTES ?? '',
+    10,
+  )
+  // `0` is a valid override meaning "recover on the very next tick" (used by
+  // TC-CHANNEL-EMAIL-027 and operators who want aggressive recovery). Only a
+  // negative or non-numeric value falls back to the 30-minute default.
+  const recoverMinutes =
+    Number.isFinite(recoverMinutesRaw) && recoverMinutesRaw >= 0 ? recoverMinutesRaw : 30
+  const recoverCutoff = new Date(now.getTime() - recoverMinutes * 60 * 1000)
+  const errorCandidates = await findWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId ?? null,
+      isActive: true,
+      deletedAt: null,
+      status: 'error',
+      // Polling channels only. Push-only channels (Gmail) have
+      // `pollIntervalSeconds = null` and are intentionally excluded: poll-channel
+      // returns early for push providers, so their recovery is owner-driven
+      // (re-register push / reconnect), not this poll-recovery sweep.
+      pollIntervalSeconds: { $ne: null },
+      // `lastPolledAt` advances only on a SUCCESSFUL poll (poll-channel does
+      // not touch it in `handlePollError`). To keep recovery to one retry per
+      // window — rather than re-enqueuing a persistently-failing channel every
+      // tick — the recovery-enqueue loop below bumps `lastPolledAt` to `now`
+      // when it schedules a recovery job, so the channel only re-enters this
+      // pool after another `recoverMinutes` have elapsed.
+      //
+      // A channel that fails its FIRST poll (before any success) still has
+      // `lastPolledAt = null`; a bare `$lt` would exclude it forever (SQL
+      // `NULL < ts` is NULL, not true), stranding it in `error`. Include the
+      // null case so never-polled error channels get their first recovery
+      // attempt on the next tick (the enqueue bump below then throttles it).
+      $or: [{ lastPolledAt: null }, { lastPolledAt: { $lt: recoverCutoff } }],
+    },
+    {
+      limit: POLL_ENUMERATION_CAP,
+      orderBy: { lastPolledAt: 'asc' },
+    },
+    scope,
+  )
+
+  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.poll)
+  let enqueued = 0
+  let recovered = 0
+  for (const channel of connectedCandidates as CommunicationChannel[]) {
+    const intervalSeconds = channel.pollIntervalSeconds
+    if (!intervalSeconds || intervalSeconds <= 0) continue
+    if (!isDue(channel.lastPolledAt ?? null, intervalSeconds, now)) continue
+    const payload: PollChannelJobPayload = {
+      channelId: channel.id,
+      scope: {
+        tenantId: channel.tenantId,
+        organizationId: channel.organizationId ?? scope.organizationId ?? null,
+      },
+      attempt: 1,
+    }
+    await queue.enqueue(payload as unknown as Record<string, unknown>)
+    enqueued += 1
+  }
+  // Auto-recovery: at most one retry per recovery window per error-state
+  // channel. We bump `lastPolledAt` to `now` as we enqueue so the same channel
+  // drops back under `recoverCutoff` and is NOT re-selected on the next ticks
+  // (poll-channel leaves `lastPolledAt` untouched on failure, so without this a
+  // persistently-failing channel would be re-enqueued every tick).
+  for (const channel of errorCandidates as CommunicationChannel[]) {
+    const payload: PollChannelJobPayload = {
+      channelId: channel.id,
+      scope: {
+        tenantId: channel.tenantId,
+        organizationId: channel.organizationId ?? scope.organizationId ?? null,
+      },
+      attempt: 1,
+    }
+    await queue.enqueue(payload as unknown as Record<string, unknown>)
+    channel.lastPolledAt = now
+    recovered += 1
+  }
+  if (recovered > 0) await em.flush()
+
+  if (enqueued > 0 || recovered > 0) {
+    console.log(
+      `[communication_channels:poll-tick] enqueued ${enqueued} normal + ${recovered} auto-recover poll job(s) for tenant ${scope.tenantId}`,
+    )
+  }
+}
+
+function isDue(lastPolledAt: Date | null, intervalSeconds: number, now: Date): boolean {
+  if (!lastPolledAt) return true
+  const dueAt = new Date(lastPolledAt.getTime() + intervalSeconds * 1000)
+  return now >= dueAt
+}

package/src/modules/communication_channels/workers/reaction-processor.ts

@@ -0,0 +1,264 @@
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import {
+  COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,
+  type ProcessInboundReactionInput,
+  type ProcessInboundReactionResult,
+} from '../commands/process-inbound-reaction'
+import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'
+import { classifyOutboundError, computeBackoffMs } from '../lib/error-classification'
+import { CommunicationChannel } from '../data/entities'
+import {
+  REACTION_PROCESSOR_MAX_ATTEMPTS,
+  type ReactionInboundJob,
+  type ReactionOutboundRemoveJob,
+  type ReactionOutboundSendJob,
+  type ReactionProcessorPayload,
+} from '../lib/reaction-processor-types'
+import { refreshCredentialsIfNeeded } from '../lib/credential-refresh'
+import type { ChannelAdapterRegistry } from '../lib/registry'
+
+export type { ReactionProcessorPayload }
+
+export const metadata: WorkerMeta = {
+  queue: COMMUNICATION_CHANNELS_QUEUES.reactions,
+  id: 'communication_channels:reaction-processor',
+  concurrency: 10,
+}
+
+type HandlerContext = JobContext & {
+  resolve: <T = unknown>(name: string) => T
+}
+
+/**
+ * Unified reaction worker — handles inbound, outbound-send, and outbound-remove
+ * jobs from the `communication-channels-reactions` queue via a discriminated payload.
+ *
+ *   - `inbound` — dispatches the `process_inbound_reaction` command which
+ *     applies provider semantics and emits `.reaction.added/.removed`.
+ *   - `outbound_send` — calls `adapter.sendReaction?(...)`. The local
+ *     `MessageReaction` row was already created by the API/command layer
+ *     for UX responsiveness; this worker just notifies the provider.
+ *   - `outbound_remove` — calls `adapter.removeReaction?(...)`. The local
+ *     row was already deleted by the API/command layer.
+ *
+ * Retry: transient failures re-enqueue with exponential backoff up to
+ * `REACTION_PROCESSOR_MAX_ATTEMPTS = 3`. Permanent failures stop. Reactions
+ * are inherently low-stakes (a missed reaction is annoying, not data loss),
+ * so we do not surface failures via a dedicated event; provider errors are
+ * logged through `integrationLogService` when available.
+ */
+export default async function handle(
+  job: QueuedJob<ReactionProcessorPayload>,
+  ctx: HandlerContext,
+): Promise<void> {
+  switch (job.payload.kind) {
+    case 'inbound':
+      await handleInbound(job.payload, ctx)
+      return
+    case 'outbound_send':
+      await handleOutboundSend(job.payload, ctx)
+      return
+    case 'outbound_remove':
+      await handleOutboundRemove(job.payload, ctx)
+      return
+    default: {
+      // exhaustiveness check
+      const exhaustive: never = job.payload
+      throw new Error(`Unknown reaction job kind: ${JSON.stringify(exhaustive)}`)
+    }
+  }
+}
+
+async function handleInbound(payload: ReactionInboundJob, ctx: HandlerContext): Promise<void> {
+  const commandBus = ctx.resolve<CommandBus>('commandBus')
+  const containerProxy = { resolve: ctx.resolve.bind(ctx) }
+  const commandCtx = {
+    container: containerProxy as never,
+    auth: null,
+    organizationScope: null,
+    selectedOrganizationId: payload.scope.organizationId ?? null,
+    organizationIds: payload.scope.organizationId ? [payload.scope.organizationId] : null,
+  }
+  const input: ProcessInboundReactionInput = {
+    channelId: payload.channelId,
+    providerKey: payload.providerKey,
+    channelType: payload.channelType,
+    scope: payload.scope,
+    event: payload.event,
+  }
+  await commandBus.execute<ProcessInboundReactionInput, ProcessInboundReactionResult>(
+    COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,
+    { input, ctx: commandCtx as never },
+  )
+}
+
+async function handleOutboundSend(payload: ReactionOutboundSendJob, ctx: HandlerContext): Promise<void> {
+  const result = await callAdapterOutbound(payload, ctx, 'send')
+  await maybeRetry(result, payload, ctx)
+}
+
+async function handleOutboundRemove(
+  payload: ReactionOutboundRemoveJob,
+  ctx: HandlerContext,
+): Promise<void> {
+  const result = await callAdapterOutbound(payload, ctx, 'remove')
+  await maybeRetry(result, payload, ctx)
+}
+
+type AdapterCallResult =
+  | { status: 'ok' }
+  | { status: 'no_adapter'; message: string }
+  | { status: 'channel_inactive'; message: string }
+  | { status: 'failed'; transient: boolean; message: string }
+
+async function callAdapterOutbound(
+  payload: ReactionOutboundSendJob | ReactionOutboundRemoveJob,
+  ctx: HandlerContext,
+  action: 'send' | 'remove',
+): Promise<AdapterCallResult> {
+  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')
+  const adapter = adapterRegistry?.get(payload.providerKey)
+  if (!adapter) {
+    return { status: 'no_adapter', message: `No adapter for provider '${payload.providerKey}'` }
+  }
+  const em = (ctx.resolve('em') as EntityManager).fork()
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: payload.channelId,
+      tenantId: payload.scope.tenantId,
+      organizationId: payload.scope.organizationId ?? null,
+      deletedAt: null,
+    },
+    undefined,
+    payload.scope,
+  )
+  if (!channel) {
+    return { status: 'no_adapter', message: `Channel ${payload.channelId} not found` }
+  }
+  if (!channel.isActive) {
+    return { status: 'channel_inactive', message: `Channel ${payload.channelId} is inactive` }
+  }
+
+  // Credentials. Per-user scoping via `channel.userId` (review R2-C1 / N1).
+  type CredentialsServiceLike = {
+    resolve: (
+      integrationId: string,
+      scope: { organizationId: string; tenantId: string; userId?: string | null },
+    ) => Promise<Record<string, unknown> | null>
+    save?: (
+      integrationId: string,
+      credentials: Record<string, unknown>,
+      scope: { organizationId: string; tenantId: string; userId?: string | null },
+    ) => Promise<void>
+  }
+  let credentials: Record<string, unknown> = {}
+  let credentialsService: CredentialsServiceLike | null = null
+  try {
+    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')
+  } catch {
+    credentialsService = null
+  }
+  const credentialsScope = {
+    tenantId: payload.scope.tenantId,
+    organizationId: payload.scope.organizationId ?? payload.scope.tenantId,
+    userId: channel.userId ?? null,
+  }
+  if (channel.credentialsRef && credentialsService) {
+    try {
+      credentials =
+        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}
+    } catch {
+      credentials = {}
+    }
+  }
+  const refreshed = await refreshCredentialsIfNeeded(
+    {
+      adapter,
+      channelId: channel.id,
+      credentials,
+      scope: credentialsScope,
+    },
+    { credentialsService },
+  )
+  credentials = refreshed.credentials
+
+  try {
+    if (action === 'send') {
+      if (typeof adapter.sendReaction !== 'function') {
+        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no sendReaction` }
+      }
+      const sendPayload = payload as ReactionOutboundSendJob
+      await adapter.sendReaction({
+        externalMessageId: sendPayload.messageId, // platform message id; the adapter maps to provider id via its own channel-link lookup if needed
+        conversationId: sendPayload.conversationId ?? '',
+        emoji: sendPayload.emoji,
+        credentials,
+        scope: {
+          tenantId: payload.scope.tenantId,
+          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,
+        },
+      })
+    } else {
+      if (typeof adapter.removeReaction !== 'function') {
+        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no removeReaction` }
+      }
+      const removePayload = payload as ReactionOutboundRemoveJob
+      await adapter.removeReaction({
+        externalMessageId: removePayload.externalReactionId ?? removePayload.messageId,
+        conversationId: removePayload.conversationId ?? '',
+        emoji: removePayload.emoji,
+        credentials,
+        scope: {
+          tenantId: payload.scope.tenantId,
+          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,
+        },
+      })
+    }
+    return { status: 'ok' }
+  } catch (err) {
+    const classification = classifyOutboundError(err)
+    return {
+      status: 'failed',
+      transient: classification.transient,
+      message: classification.message,
+    }
+  }
+}
+
+async function maybeRetry(
+  result: AdapterCallResult,
+  payload: ReactionProcessorPayload,
+  ctx: HandlerContext,
+): Promise<void> {
+  if (result.status === 'ok') return
+  if (result.status === 'no_adapter' || result.status === 'channel_inactive') {
+    // Permanent — log and stop.
+    console.error(
+      `[communication_channels:reaction-processor] ${result.status}: ${result.message}`,
+    )
+    return
+  }
+  if (!result.transient) {
+    console.error(
+      `[communication_channels:reaction-processor] permanent failure: ${result.message}`,
+    )
+    return
+  }
+  const attempt = payload.attempt ?? 1
+  if (attempt >= REACTION_PROCESSOR_MAX_ATTEMPTS) {
+    console.error(
+      `[communication_channels:reaction-processor] giving up after attempt ${attempt}: ${result.message}`,
+    )
+    return
+  }
+  const next: ReactionProcessorPayload = { ...payload, attempt: attempt + 1 }
+  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)
+  await queue.enqueue(next as unknown as Record<string, unknown>, {
+    delayMs: computeBackoffMs(attempt),
+  })
+}

package/src/modules/customers/acl.ts

@@ -78,6 +78,24 @@ export const features = [
     module: 'customers',
     dependsOn: ['customers.roles.view'],
   },
+  // Email integration (2026-05-27)
+  {
+    id: 'customers.email.compose',
+    title: 'Compose / send emails from CRM',
+    module: 'customers',
+    dependsOn: ['customers.people.view'],
+  },
+  // Reserved for a future v2 admin-oversight capability. In v1 the email
+  // privacy model is strict owner-only with NO admin bypass, so this feature is
+  // declared but INERT — granting it does not unlock other users' private emails
+  // (the visibility filter and the visibility-change gate ignore it). See
+  // .ai/specs/2026-05-27-crm-email-integration.md (v1 strict owner-only).
+  {
+    id: 'customers.email.view_private',
+    title: 'View other users\' private emails (reserved — inert in v1)',
+    module: 'customers',
+    dependsOn: ['customers.interactions.view'],
+  },
 ]
 
 export default features

package/src/modules/customers/api/activities/route.ts

@@ -28,6 +28,7 @@ import { resolveCustomerInteractionFeatureFlags } from '../../lib/interactionFea
 import { resolveCustomersRequestContext } from '../../lib/interactionRequestContext'
 import { hydrateCanonicalInteractions } from '../../lib/interactionReadModel'
 import { resolveCanonicalActivityTargetId } from '../../lib/legacyActivityBridge'
+import { buildEmailVisibilityMikroFilter } from '../../lib/visibilityFilter'
 
 const listSchema = z.object({
   page: z.coerce.number().min(1).default(1),
@@ -291,6 +292,18 @@ async function listCanonicalActivities(
     where.source = Array.isArray(options.source) ? { $in: options.source } : options.source
   }
 
+  // Per-user email privacy: exclude other users' private email interactions from
+  // the deprecated /activities surface (mirrors the /interactions Layer-1 filter).
+  // v1 strict owner-only — no admin bypass (the filter ignores caller features).
+  const activitiesViewerUserId = auth.keyId ? null : (auth.sub ?? auth.userId ?? null)
+  Object.assign(
+    where,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: activitiesViewerUserId,
+      userFeatures: undefined,
+    }),
+  )
+
   const findOptions = {
     orderBy: buildCanonicalOrderBy(query.sortField, query.sortDir ?? 'desc'),
     ...(options?.paginate === false

package/src/modules/customers/api/companies/[id]/route.ts

@@ -37,6 +37,7 @@ import {
 } from '../../../lib/interactionCompatibility'
 import { resolveCustomerInteractionFeatureFlags } from '../../../lib/interactionFeatureFlags'
 import { hydrateCanonicalInteractions } from '../../../lib/interactionReadModel'
+import { buildEmailVisibilityMikroFilter } from '../../../lib/visibilityFilter'
 import type { QueryEngine } from '@open-mercato/shared/lib/query/types'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -396,6 +397,20 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     organizationId: company.organizationId ?? scope?.selectedId ?? auth.orgId ?? null,
   }
 
+  // Per-user email privacy (CRM email integration): exclude private email
+  // interactions owned by other users from every read path that returns
+  // customer_interactions. Non-email rows, shared emails, and legacy
+  // null-visibility rows pass through. v1 is strict owner-only: there is NO
+  // admin bypass — the filter ignores caller features, and
+  // `customers.email.view_private` is reserved (inert) for v2 oversight.
+  // Mirrors the people detail route. API-key callers resolve to null
+  // (no author match — shared/non-email rows only).
+  const viewerUserId = auth.isApiKey ? null : (auth.sub ?? null)
+  const emailVisibilityFilter = buildEmailVisibilityMikroFilter({
+    currentUserId: viewerUserId,
+    userFeatures: undefined,
+  })
+
   const profile = company.companyProfile
     ? await findOneWithDecryption(
         em,
@@ -480,11 +495,13 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
               tenantId: company.tenantId,
               organizationId: company.organizationId,
               deletedAt: null,
+              ...emailVisibilityFilter,
             }
           : {
               entity: company.id,
               tenantId: company.tenantId,
               organizationId: company.organizationId,
+              ...emailVisibilityFilter,
             },
         { orderBy: { scheduledAt: 'asc', createdAt: 'desc' }, limit: 100 },
         companyScope,
@@ -523,6 +540,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
             deletedAt: null,
             status: 'planned',
             interactionType: { $ne: 'task' },
+            ...emailVisibilityFilter,
           },
           { orderBy: { scheduledAt: 'ASC', createdAt: 'ASC' }, limit: plannedPreviewLimit },
           companyScope,
@@ -609,7 +627,6 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       if (comment.authorUserId) authorIds.add(comment.authorUserId)
     }
   }
-  const viewerUserId = auth.isApiKey ? null : auth.sub ?? null
   if (viewerUserId) authorIds.add(viewerUserId)
 
   let userMap = new Map<string, { name: string | null; email: string | null }>()
@@ -795,12 +812,14 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     tenantId: company.tenantId,
     deletedAt: null,
     interactionType: { $ne: 'task' },
+    ...emailVisibilityFilter,
   })
   const interactionCount = await em.count(CustomerInteraction, {
     entity: company.id,
     organizationId: company.organizationId,
     tenantId: company.tenantId,
     deletedAt: null,
+    ...emailVisibilityFilter,
   })
   const todoCount = interactionFlags.unified
     ? await em.count(CustomerInteraction, {
@@ -858,6 +877,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
           organizationId: company.organizationId,
           tenantId: company.tenantId,
           deletedAt: null,
+          ...emailVisibilityFilter,
         },
         {
           fields: ['id', 'occurredAt', 'scheduledAt', 'createdAt'],