@open-mercato/core 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/dist/modules/communication_channels/api/post/channels/[id]/push/register/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../../src/modules/communication_channels/api/post/channels/%5Bid%5D/push/register/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { CrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { CommunicationChannel } from '../../../../../../data/entities'\nimport { ChannelAccessDeniedError, assertCanManageChannel } from '../../../../../../lib/access-control'\nimport { pushRegister } from '../../../../../../commands/push-register'\nimport { validateRouteMutationGuard } from '../../../../../../lib/route-mutation-guard'\n\ntype RbacServiceLike = {\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>\n}\n\n/**\n * Spec C \u00A7 Phase C5 \u2014 Operator-facing \"Re-register push\" endpoint.\n *\n * Owner self-service: a user may (re-)register push on their OWN mailbox (gated\n * by `connect_user_channel`). Registering push on a shared/tenant-wide channel\n * still requires `communication_channels.channel.push.manage` \u2014 enforced per\n * channel type by `assertCanManageChannel` in the handler. Used by the profile\n * page and the channel detail page's `PushStatusSection` to recover from a\n * `pushStatus='failed'` state.\n */\nexport const metadata = {\n  path: '/communication_channels/channels/[id]/push/register',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id } = await context.params\n  if (!z.string().uuid().safeParse(id).success) {\n    return NextResponse.json({ error: 'Invalid channel id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  if (!organizationId) {\n    return NextResponse.json({ error: 'No organization scope' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n\n  // Defense-in-depth: `push.manage` is admin-default, but enforce per-user\n  // ownership anyway so a non-admin operator who is granted `push.manage`\n  // cannot re-register push on another user's channel. Admins (and tenant-wide\n  // channels) pass via `assertCanAccessChannel`. Automatic callers (OAuth\n  // callback, connect, renew worker) invoke `pushRegister` directly and are\n  // intentionally not subject to this user-facing guard.\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id, tenantId: auth.tenantId as string, organizationId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId },\n  )\n  if (!channel) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n  let userFeatures: string[] = []\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const acl = await rbac.loadAcl(auth.sub as string, {\n      tenantId: auth.tenantId as string,\n      organizationId,\n    })\n    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []\n  } catch {\n    userFeatures = []\n  }\n  try {\n    assertCanManageChannel(\n      { userId: (channel as { userId?: string | null }).userId },\n      auth.sub as string,\n      userFeatures,\n      'communication_channels.channel.push.manage',\n    )\n  } catch (err) {\n    if (err instanceof ChannelAccessDeniedError) {\n      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n    }\n    throw err\n  }\n\n  const guard = await validateRouteMutationGuard({\n    container,\n    req,\n    auth,\n    input: {\n      resourceKind: 'communication_channels.channel',\n      resourceId: id,\n      operation: 'custom',\n      mutationPayload: { pushStatus: 'register' },\n    },\n  })\n  if ('response' in guard) return guard.response\n\n  try {\n    const result = await pushRegister({\n      container,\n      scope: { tenantId: auth.tenantId as string, organizationId, userId: auth.sub as string },\n      input: { channelId: id },\n    })\n    await guard.afterSuccess()\n    return NextResponse.json({ ok: true, ...result }, { status: 202 })\n  } catch (err) {\n    const candidate = err as CrudFormError\n    if (candidate && typeof candidate.status === 'number') {\n      return NextResponse.json(\n        { error: candidate.message, fieldErrors: candidate.fieldErrors },\n        { status: candidate.status },\n      )\n    }\n    console.error(`[push-register] failed for channel ${id}:`, err)\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Failed to register push' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Force-register push delivery for a channel (Spec C \u00A7 Phase C5)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Push registration attempted; check result.pushStatus' },\n        { status: 400, description: 'Invalid id or unsupported provider' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing push.manage feature' },\n        { status: 404, description: 'Channel not found' },\n        { status: 409, description: 'Provider does not support push (IMAP)' },\n        { status: 502, description: 'Provider returned an error during registration' },\n        { status: 503, description: 'Webhook base URL or Pub/Sub topic not configured' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AAEtC,SAAS,4BAA4B;AACrC,SAAS,0BAA0B,8BAA8B;AACjE,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAmBpC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAMA,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS;AAC5C,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAkB,KAAmC,SAAS;AACpE,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAQ/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,KAAK,UAAoB,gBAAgB,WAAW,KAAK;AAAA,IACzE;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,eAAe;AAAA,EACtD;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,MAAI,eAAyB,CAAC;AAC9B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAe;AAAA,MACjD,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,mBAAe,KAAK,eAAe,CAAC,GAAG,IAAI,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,EAC5F,QAAQ;AACN,mBAAe,CAAC;AAAA,EAClB;AACA,MAAI;AACF;AAAA,MACE,EAAE,QAAS,QAAuC,OAAO;AAAA,MACzD,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM;AAAA,EACR;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,YAAY,WAAW;AAAA,IAC5C;AAAA,EACF,CAAC;AACD,MAAI,cAAc,MAAO,QAAO,MAAM;AAEtC,MAAI;AACF,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,KAAK,UAAoB,gBAAgB,QAAQ,KAAK,IAAc;AAAA,MACvF,OAAO,EAAE,WAAW,GAAG;AAAA,IACzB,CAAC;AACD,UAAM,MAAM,aAAa;AACzB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAG,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE,SAAS,KAAK;AACZ,UAAM,YAAY;AAClB,QAAI,aAAa,OAAO,UAAU,WAAW,UAAU;AACrD,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,SAAS,aAAa,UAAU,YAAY;AAAA,QAC/D,EAAE,QAAQ,UAAU,OAAO;AAAA,MAC7B;AAAA,IACF;AACA,YAAQ,MAAM,sCAAsC,EAAE,KAAK,GAAG;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uDAAuD;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,iDAAiD;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,mDAAmD;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { CrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'\nimport { CommunicationChannel } from '../../../../../../data/entities'\nimport { ChannelAccessDeniedError, assertCanManageChannel } from '../../../../../../lib/access-control'\nimport { pushRegister } from '../../../../../../commands/push-register'\nimport { validateRouteMutationGuard } from '../../../../../../lib/route-mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'push-register' })\n\ntype RbacServiceLike = {\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>\n}\n\n/**\n * Spec C \u00A7 Phase C5 \u2014 Operator-facing \"Re-register push\" endpoint.\n *\n * Owner self-service: a user may (re-)register push on their OWN mailbox (gated\n * by `connect_user_channel`). Registering push on a shared/tenant-wide channel\n * still requires `communication_channels.channel.push.manage` \u2014 enforced per\n * channel type by `assertCanManageChannel` in the handler. Used by the profile\n * page and the channel detail page's `PushStatusSection` to recover from a\n * `pushStatus='failed'` state.\n */\nexport const metadata = {\n  path: '/communication_channels/channels/[id]/push/register',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id } = await context.params\n  if (!z.string().uuid().safeParse(id).success) {\n    return NextResponse.json({ error: 'Invalid channel id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  if (!organizationId) {\n    return NextResponse.json({ error: 'No organization scope' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n\n  // Defense-in-depth: `push.manage` is admin-default, but enforce per-user\n  // ownership anyway so a non-admin operator who is granted `push.manage`\n  // cannot re-register push on another user's channel. Admins (and tenant-wide\n  // channels) pass via `assertCanAccessChannel`. Automatic callers (OAuth\n  // callback, connect, renew worker) invoke `pushRegister` directly and are\n  // intentionally not subject to this user-facing guard.\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id, tenantId: auth.tenantId as string, organizationId, deletedAt: null },\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId },\n  )\n  if (!channel) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n  let userFeatures: string[] = []\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const acl = await rbac.loadAcl(auth.sub as string, {\n      tenantId: auth.tenantId as string,\n      organizationId,\n    })\n    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []\n  } catch {\n    userFeatures = []\n  }\n  try {\n    assertCanManageChannel(\n      { userId: (channel as { userId?: string | null }).userId },\n      auth.sub as string,\n      userFeatures,\n      'communication_channels.channel.push.manage',\n    )\n  } catch (err) {\n    if (err instanceof ChannelAccessDeniedError) {\n      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n    }\n    throw err\n  }\n\n  const guard = await validateRouteMutationGuard({\n    container,\n    req,\n    auth,\n    input: {\n      resourceKind: 'communication_channels.channel',\n      resourceId: id,\n      operation: 'custom',\n      mutationPayload: { pushStatus: 'register' },\n    },\n  })\n  if ('response' in guard) return guard.response\n\n  try {\n    const result = await pushRegister({\n      container,\n      scope: { tenantId: auth.tenantId as string, organizationId, userId: auth.sub as string },\n      input: { channelId: id },\n    })\n    await guard.afterSuccess()\n    return NextResponse.json({ ok: true, ...result }, { status: 202 })\n  } catch (err) {\n    const candidate = err as CrudFormError\n    if (candidate && typeof candidate.status === 'number') {\n      return NextResponse.json(\n        { error: candidate.message, fieldErrors: candidate.fieldErrors },\n        { status: candidate.status },\n      )\n    }\n    logger.error('push register failed for channel', { channelId: id, err })\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Failed to register push' },\n      { status: 500 },\n    )\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Force-register push delivery for a channel (Spec C \u00A7 Phase C5)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Push registration attempted; check result.pushStatus' },\n        { status: 400, description: 'Invalid id or unsupported provider' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing push.manage feature' },\n        { status: 404, description: 'Channel not found' },\n        { status: 409, description: 'Provider does not support push (IMAP)' },\n        { status: 502, description: 'Provider returned an error during registration' },\n        { status: 503, description: 'Webhook base URL or Pub/Sub topic not configured' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AAEtC,SAAS,4BAA4B;AACrC,SAAS,0BAA0B,8BAA8B;AACjE,SAAS,oBAAoB;AAC7B,SAAS,kCAAkC;AAC3C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAmBnF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAMA,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS;AAC5C,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,iBAAkB,KAAmC,SAAS;AACpE,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAQ/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,KAAK,UAAoB,gBAAgB,WAAW,KAAK;AAAA,IACzE;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,eAAe;AAAA,EACtD;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,MAAI,eAAyB,CAAC;AAC9B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAe;AAAA,MACjD,UAAU,KAAK;AAAA,MACf;AAAA,IACF,CAAC;AACD,mBAAe,KAAK,eAAe,CAAC,GAAG,IAAI,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,EAC5F,QAAQ;AACN,mBAAe,CAAC;AAAA,EAClB;AACA,MAAI;AACF;AAAA,MACE,EAAE,QAAS,QAAuC,OAAO;AAAA,MACzD,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM;AAAA,EACR;AAEA,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,YAAY,WAAW;AAAA,IAC5C;AAAA,EACF,CAAC;AACD,MAAI,cAAc,MAAO,QAAO,MAAM;AAEtC,MAAI;AACF,UAAM,SAAS,MAAM,aAAa;AAAA,MAChC;AAAA,MACA,OAAO,EAAE,UAAU,KAAK,UAAoB,gBAAgB,QAAQ,KAAK,IAAc;AAAA,MACvF,OAAO,EAAE,WAAW,GAAG;AAAA,IACzB,CAAC;AACD,UAAM,MAAM,aAAa;AACzB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,GAAG,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnE,SAAS,KAAK;AACZ,UAAM,YAAY;AAClB,QAAI,aAAa,OAAO,UAAU,WAAW,UAAU;AACrD,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,UAAU,SAAS,aAAa,UAAU,YAAY;AAAA,QAC/D,EAAE,QAAQ,UAAU,OAAO;AAAA,MAC7B;AAAA,IACF;AACA,WAAO,MAAM,oCAAoC,EAAE,WAAW,IAAI,IAAI,CAAC;AACvE,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,MACxE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uDAAuD;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,qCAAqC;AAAA,QACjE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,iDAAiD;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,mDAAmD;AAAA,MACjF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js

@@ -7,6 +7,8 @@ import {
   COMMUNICATION_CHANNELS_QUEUES,
   getCommunicationChannelsQueue
 } from "../../../../lib/queue.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "inbound-webhook" });
 const metadata = {
   path: "/communication_channels/webhook/[provider]",
   POST: {
@@ -143,9 +145,9 @@ async function POST(req, { params }) {
     await queue.enqueue(jobPayload);
     return NextResponse.json({ received: true, queued: true, kind: "message" }, { status: 202 });
   } catch (error) {
-    console.warn(
-      "[communication_channels] inbound webhook verification failed:",
-      error instanceof Error ? error.message : error
+    logger.warn(
+      "inbound webhook verification failed",
+      { err: error }
     );
     return NextResponse.json({ error: "verification_failed" }, { status: 401 });
   }

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhook/%5Bprovider%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    console.warn(\n      '[communication_channels] inbound webhook verification failed:',\n      error instanceof Error ? error.message : error,\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAqBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,YAAQ;AAAA,MACN;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'inbound-webhook' })\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    logger.warn(\n      'inbound webhook verification failed',\n      { err: error },\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAkBrF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK,MAAM;AAAA,IACf;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js

@@ -11,6 +11,8 @@ import {
   getGmailPubSubVerifier,
   GmailPubSubJwtError
 } from "../../../../lib/gmail-pubsub-jwt.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "gmail-webhook" });
 const metadata = {
   path: "/communication_channels/webhooks/gmail",
   // Unauthenticated at the platform layer (a Google-signed JWT is the auth).
@@ -22,9 +24,7 @@ async function POST(req) {
   const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE;
   const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL;
   if (!expectedAudience || !expectedEmail) {
-    console.error(
-      "[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set"
-    );
+    logger.error("OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set");
     return NextResponse.json({ error: "webhook not configured" }, { status: 503 });
   }
   const verifier = getGmailPubSubVerifier();
@@ -89,9 +89,9 @@ async function POST(req) {
     try {
       await queue.enqueue(job);
     } catch (err) {
-      console.error(
-        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,
-        err
+      logger.error(
+        "failed to enqueue history-sync for channel",
+        { channelId: channel.id, err }
       );
     }
   }

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhooks/gmail/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   2. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   3. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   4. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    console.error(\n      '[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set',\n    )\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      console.error(\n        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,\n        err,\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAoBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,8DAA8D,QAAQ,EAAE;AAAA,QACxE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'gmail-webhook' })\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   2. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   3. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   4. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    logger.error('OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set')\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      logger.error(\n        'failed to enqueue history-sync for channel',\n        { channelId: channel.id, err },\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAoBnF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,WAAO,MAAM,0EAA0E;AACvF,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,aAAO;AAAA,QACL;AAAA,QACA,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/connect-credential-channel.js

@@ -1,6 +1,8 @@
 import { z } from "zod";
 import { registerCommand } from "@open-mercato/shared/lib/commands";
 import { createConnectedChannelRow, MailboxAlreadyConnectedError } from "../lib/connect-channel.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "connect-credential-channel" });
 const connectCredentialChannelSchema = z.object({
   providerKey: z.string().min(1).max(64),
   displayName: z.string().min(1).max(255),
@@ -66,9 +68,7 @@ const connectCredentialChannelCommand = {
         );
         credentialsPersisted = true;
       } catch (err) {
-        console.warn(
-          `[communication_channels:connect_credential] credentials persist failed for ${input.providerKey}: ${err instanceof Error ? err.message : String(err)}`
-        );
+        logger.warn("credentials persist failed for provider", { providerKey: input.providerKey, err });
       }
       if (credentialsPersisted) {
         try {
@@ -136,9 +136,7 @@ const connectCredentialChannelCommand = {
             input: { channelId: channel.id }
           });
         } catch (err) {
-          console.warn(
-            `[connect-credential-channel] best-effort pushRegister failed for ${channel.id}: ${err instanceof Error ? err.message : String(err)}`
-          );
+          logger.warn("best-effort pushRegister failed for channel", { channelId: channel.id, err });
         }
       }
     }

package/dist/modules/communication_channels/commands/connect-credential-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/connect-credential-channel.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createConnectedChannelRow, MailboxAlreadyConnectedError } from '../lib/connect-channel'\n\nconst connectCredentialChannelSchema = z.object({\n  providerKey: z.string().min(1).max(64),\n  displayName: z.string().min(1).max(255),\n  /** Provider-specific credential fields \u2014 opaque to the hub; the adapter validates. */\n  credentials: z.record(z.string(), z.unknown()),\n  /** Optional polling interval (seconds) \u2014 set when adapter is polling-based. */\n  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type ConnectCredentialChannelInput = z.infer<typeof connectCredentialChannelSchema>\n\nexport type ConnectCredentialChannelResult =\n  | { status: 'connected'; channelId: string; externalIdentifier: string | null }\n  | { status: 'validation_failed'; errors: Record<string, string> }\n  | { status: 'no_adapter'; reason: string }\n  | { status: 'duplicate_mailbox'; externalIdentifier: string; existingProviderKey: string }\n\nexport const COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.connect_credential'\n\ntype CredentialsServiceLike = {\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<string | void>\n}\n\n/**\n * Connect a per-user credential-based channel (IMAP, and future basic-auth providers).\n *\n * Flow:\n *   1. Resolve the adapter for `providerKey`.\n *   2. Call `adapter.validateCredentials?` \u2014 adapters that don't implement it\n *      are accepted optimistically (the hub trusts the adapter to fail on first\n *      use). Adapters with the method return field-level errors via Zod-like\n *      `{ ok: false, errors: { fieldName: 'message' } }`; we forward those to\n *      the caller for `createCrudFormError`.\n *   3. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.\n *   4. Create the `CommunicationChannel` row with `userId = currentUser.id`,\n *      `status = 'connected'`, and the adapter's declared capabilities snapshot.\n *\n * The route handler binds the `userId` field from the authenticated session;\n * the command refuses inputs whose `userId` doesn't pass UUID validation.\n */\nconst connectCredentialChannelCommand: CommandHandler<\n  ConnectCredentialChannelInput,\n  ConnectCredentialChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = connectCredentialChannelSchema.parse(rawInput) as ConnectCredentialChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      return {\n        status: 'no_adapter',\n        reason: `No adapter registered for provider '${input.providerKey}'`,\n      }\n    }\n\n    // Optional credential validation.\n    if (typeof adapter.validateCredentials === 'function') {\n      const validation = await adapter.validateCredentials({\n        providerKey: input.providerKey,\n        credentials: input.credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n      })\n      if (!validation.ok) {\n        return {\n          status: 'validation_failed',\n          errors: validation.errors ?? { _form: 'Credential validation failed' },\n        }\n      }\n    }\n\n    // Persist credentials best-effort.\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve('integrationCredentialsService') as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Arg order MUST be (integrationId, credentials, scope) \u2014 matches the real\n    // CredentialsService signature. The legacy reversed order swapped the scope\n    // object into the credentials field; see review C1 (2026-05-26).\n    //\n    // `scope.userId` is set so the credentials service writes a per-user row.\n    // Without this, two users on the same tenant share one credentials row\n    // (see review R2-C1 / N1, 2026-05-26).\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? input.scope.tenantId,\n      userId: input.userId,\n    }\n    let credentialsRefId: string | null = null\n    let credentialsPersisted = false\n    if (credentialsService?.save) {\n      try {\n        await credentialsService.save(\n          `channel_${input.providerKey}`,\n          { ...input.credentials, userId: input.userId },\n          credentialsScope,\n        )\n        credentialsPersisted = true\n      } catch (err) {\n        console.warn(\n          `[communication_channels:connect_credential] credentials persist failed for ${input.providerKey}: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n      // Resolve the saved row id so we can link channel.credentialsRef. Best-effort.\n      if (credentialsPersisted) {\n        try {\n          const { IntegrationCredentials } = await import(\n            '@open-mercato/core/modules/integrations/data/entities'\n          )\n          const { findOneWithDecryption } = await import(\n            '@open-mercato/shared/lib/encryption/find'\n          )\n          const row = await findOneWithDecryption(\n            em,\n            IntegrationCredentials,\n            {\n              integrationId: `channel_${input.providerKey}`,\n              tenantId: credentialsScope.tenantId,\n              organizationId: credentialsScope.organizationId,\n              userId: credentialsScope.userId,\n              deletedAt: null,\n            },\n            undefined,\n            credentialsScope,\n          )\n          credentialsRefId = (row as { id?: string } | null)?.id ?? null\n        } catch {\n          credentialsRefId = null\n        }\n      }\n    }\n\n    // Mailbox identity for this channel: the email address. IMAP/SMTP credentials\n    // carry it as `fromAddress`; other credential providers may use `username` or\n    // `email`. Normalize emails to lowercase so the cross-provider duplicate guard\n    // and the per-(tenant,user,provider,mailbox) heal index match canonically.\n    const credBag = input.credentials as Record<string, unknown>\n    const rawIdentifier =\n      (typeof credBag.username === 'string' && credBag.username.length > 0 ? credBag.username : null) ??\n      (typeof credBag.email === 'string' && credBag.email.length > 0 ? credBag.email : null) ??\n      (typeof credBag.fromAddress === 'string' && credBag.fromAddress.length > 0\n        ? credBag.fromAddress\n        : null)\n    const externalIdentifier =\n      rawIdentifier && rawIdentifier.includes('@') ? rawIdentifier.toLowerCase() : rawIdentifier\n\n    // Fail-safe: if credentials persistence failed (no `credentialsRef`), the\n    // channel is created in `requires_reauth` + isActive=false so workers\n    // don't poll a channel that has no usable credentials. The user can\n    // reconnect to recover (see review R2-H4 / F6, 2026-05-26).\n    const credentialsAvailable = credentialsRefId !== null\n    let channel\n    try {\n      channel = await createConnectedChannelRow({\n        em,\n        adapter,\n        providerKey: input.providerKey,\n        displayName: input.displayName,\n        externalIdentifier,\n        credentialsRefId,\n        userId: input.userId,\n        scope: { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId ?? null },\n        pollIntervalSeconds: input.pollIntervalSeconds,\n      })\n    } catch (err) {\n      // Same mailbox already connected via another provider \u2014 reject so we don't\n      // create a second channel that double-ingests every message.\n      if (err instanceof MailboxAlreadyConnectedError) {\n        return {\n          status: 'duplicate_mailbox',\n          externalIdentifier: err.externalIdentifier,\n          existingProviderKey: err.existingProviderKey,\n        }\n      }\n      throw err\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 best-effort push registration for providers that\n    // support it (Gmail). Failures persist as `pushStatus='failed'`\n    // on the channel state but do NOT fail the connect \u2014 polling fallback\n    // covers the channel until the operator clicks \"Re-register push\".\n    // Imported lazily to avoid a circular module load (push-register reads\n    // the channel adapter registry, which is initialised after this module).\n    if (credentialsAvailable && input.providerKey === 'gmail') {\n      const adapterSupportsPush =\n        typeof adapter.registerPush === 'function' && typeof adapter.unregisterPush === 'function'\n      const organizationId = input.scope.organizationId\n      if (adapterSupportsPush && organizationId) {\n        try {\n          const { pushRegister } = await import('./push-register')\n          await pushRegister({\n            container: ctx.container,\n            scope: {\n              tenantId: input.scope.tenantId,\n              organizationId,\n              userId: input.userId,\n            },\n            input: { channelId: channel.id },\n          })\n        } catch (err) {\n          // Never fail the connect on push errors \u2014 operator can manually\n          // re-register via the dedicated route. Log + continue.\n          console.warn(\n            `[connect-credential-channel] best-effort pushRegister failed for ${channel.id}: ${\n              err instanceof Error ? err.message : String(err)\n            }`,\n          )\n        }\n      }\n    }\n\n    return { status: 'connected', channelId: channel.id, externalIdentifier }\n  },\n}\n\nregisterCommand(connectCredentialChannelCommand)\n\nexport default connectCredentialChannelCommand\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAEhC,SAAS,2BAA2B,oCAAoC;AAExE,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEtC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA;AAAA,EAE7C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,SAAS;AAAA,EACtE,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAUM,MAAM,+DACX;AA2BF,MAAM,kCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,QAAQ;AAC3D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,uCAAuC,MAAM,WAAW;AAAA,MAClE;AAAA,IACF;AAGA,QAAI,OAAO,QAAQ,wBAAwB,YAAY;AACrD,YAAM,aAAa,MAAM,QAAQ,oBAAoB;AAAA,QACnD,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,WAAW,UAAU,EAAE,OAAO,+BAA+B;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU,QAAQ,+BAA+B;AAAA,IAC5E,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAQA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC1D,QAAQ,MAAM;AAAA,IAChB;AACA,QAAI,mBAAkC;AACtC,QAAI,uBAAuB;AAC3B,QAAI,oBAAoB,MAAM;AAC5B,UAAI;AACF,cAAM,mBAAmB;AAAA,UACvB,WAAW,MAAM,WAAW;AAAA,UAC5B,EAAE,GAAG,MAAM,aAAa,QAAQ,MAAM,OAAO;AAAA,UAC7C;AAAA,QACF;AACA,+BAAuB;AAAA,MACzB,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,8EAA8E,MAAM,WAAW,KAC7F,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAEA,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,EAAE,uBAAuB,IAAI,MAAM,OACvC,uDACF;AACA,gBAAM,EAAE,sBAAsB,IAAI,MAAM,OACtC,0CACF;AACA,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,cACE,eAAe,WAAW,MAAM,WAAW;AAAA,cAC3C,UAAU,iBAAiB;AAAA,cAC3B,gBAAgB,iBAAiB;AAAA,cACjC,QAAQ,iBAAiB;AAAA,cACzB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,6BAAoB,KAAgC,MAAM;AAAA,QAC5D,QAAQ;AACN,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAMA,UAAM,UAAU,MAAM;AACtB,UAAM,iBACH,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,SAAS,IAAI,QAAQ,WAAW,UACzF,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,UAChF,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,SAAS,IACrE,QAAQ,cACR;AACN,UAAM,qBACJ,iBAAiB,cAAc,SAAS,GAAG,IAAI,cAAc,YAAY,IAAI;AAM/E,UAAM,uBAAuB,qBAAqB;AAClD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,0BAA0B;AAAA,QACxC;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,kBAAkB,KAAK;AAAA,QAC5F,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH,SAAS,KAAK;AAGZ,UAAI,eAAe,8BAA8B;AAC/C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoB,IAAI;AAAA,UACxB,qBAAqB,IAAI;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAQA,QAAI,wBAAwB,MAAM,gBAAgB,SAAS;AACzD,YAAM,sBACJ,OAAO,QAAQ,iBAAiB,cAAc,OAAO,QAAQ,mBAAmB;AAClF,YAAM,iBAAiB,MAAM,MAAM;AACnC,UAAI,uBAAuB,gBAAgB;AACzC,YAAI;AACF,gBAAM,EAAE,aAAa,IAAI,MAAM,OAAO,iBAAiB;AACvD,gBAAM,aAAa;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,OAAO;AAAA,cACL,UAAU,MAAM,MAAM;AAAA,cACtB;AAAA,cACA,QAAQ,MAAM;AAAA,YAChB;AAAA,YACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AAGZ,kBAAQ;AAAA,YACN,oEAAoE,QAAQ,EAAE,KAC5E,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa,WAAW,QAAQ,IAAI,mBAAmB;AAAA,EAC1E;AACF;AAEA,gBAAgB,+BAA+B;AAE/C,IAAO,qCAAQ;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createConnectedChannelRow, MailboxAlreadyConnectedError } from '../lib/connect-channel'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'connect-credential-channel' })\n\nconst connectCredentialChannelSchema = z.object({\n  providerKey: z.string().min(1).max(64),\n  displayName: z.string().min(1).max(255),\n  /** Provider-specific credential fields \u2014 opaque to the hub; the adapter validates. */\n  credentials: z.record(z.string(), z.unknown()),\n  /** Optional polling interval (seconds) \u2014 set when adapter is polling-based. */\n  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type ConnectCredentialChannelInput = z.infer<typeof connectCredentialChannelSchema>\n\nexport type ConnectCredentialChannelResult =\n  | { status: 'connected'; channelId: string; externalIdentifier: string | null }\n  | { status: 'validation_failed'; errors: Record<string, string> }\n  | { status: 'no_adapter'; reason: string }\n  | { status: 'duplicate_mailbox'; externalIdentifier: string; existingProviderKey: string }\n\nexport const COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.connect_credential'\n\ntype CredentialsServiceLike = {\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<string | void>\n}\n\n/**\n * Connect a per-user credential-based channel (IMAP, and future basic-auth providers).\n *\n * Flow:\n *   1. Resolve the adapter for `providerKey`.\n *   2. Call `adapter.validateCredentials?` \u2014 adapters that don't implement it\n *      are accepted optimistically (the hub trusts the adapter to fail on first\n *      use). Adapters with the method return field-level errors via Zod-like\n *      `{ ok: false, errors: { fieldName: 'message' } }`; we forward those to\n *      the caller for `createCrudFormError`.\n *   3. Persist the credentials encrypted via `integrationCredentialsService.save?` if available.\n *   4. Create the `CommunicationChannel` row with `userId = currentUser.id`,\n *      `status = 'connected'`, and the adapter's declared capabilities snapshot.\n *\n * The route handler binds the `userId` field from the authenticated session;\n * the command refuses inputs whose `userId` doesn't pass UUID validation.\n */\nconst connectCredentialChannelCommand: CommandHandler<\n  ConnectCredentialChannelInput,\n  ConnectCredentialChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = connectCredentialChannelSchema.parse(rawInput) as ConnectCredentialChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      return {\n        status: 'no_adapter',\n        reason: `No adapter registered for provider '${input.providerKey}'`,\n      }\n    }\n\n    // Optional credential validation.\n    if (typeof adapter.validateCredentials === 'function') {\n      const validation = await adapter.validateCredentials({\n        providerKey: input.providerKey,\n        credentials: input.credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n      })\n      if (!validation.ok) {\n        return {\n          status: 'validation_failed',\n          errors: validation.errors ?? { _form: 'Credential validation failed' },\n        }\n      }\n    }\n\n    // Persist credentials best-effort.\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve('integrationCredentialsService') as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Arg order MUST be (integrationId, credentials, scope) \u2014 matches the real\n    // CredentialsService signature. The legacy reversed order swapped the scope\n    // object into the credentials field; see review C1 (2026-05-26).\n    //\n    // `scope.userId` is set so the credentials service writes a per-user row.\n    // Without this, two users on the same tenant share one credentials row\n    // (see review R2-C1 / N1, 2026-05-26).\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? input.scope.tenantId,\n      userId: input.userId,\n    }\n    let credentialsRefId: string | null = null\n    let credentialsPersisted = false\n    if (credentialsService?.save) {\n      try {\n        await credentialsService.save(\n          `channel_${input.providerKey}`,\n          { ...input.credentials, userId: input.userId },\n          credentialsScope,\n        )\n        credentialsPersisted = true\n      } catch (err) {\n        logger.warn('credentials persist failed for provider', { providerKey: input.providerKey, err })\n      }\n      // Resolve the saved row id so we can link channel.credentialsRef. Best-effort.\n      if (credentialsPersisted) {\n        try {\n          const { IntegrationCredentials } = await import(\n            '@open-mercato/core/modules/integrations/data/entities'\n          )\n          const { findOneWithDecryption } = await import(\n            '@open-mercato/shared/lib/encryption/find'\n          )\n          const row = await findOneWithDecryption(\n            em,\n            IntegrationCredentials,\n            {\n              integrationId: `channel_${input.providerKey}`,\n              tenantId: credentialsScope.tenantId,\n              organizationId: credentialsScope.organizationId,\n              userId: credentialsScope.userId,\n              deletedAt: null,\n            },\n            undefined,\n            credentialsScope,\n          )\n          credentialsRefId = (row as { id?: string } | null)?.id ?? null\n        } catch {\n          credentialsRefId = null\n        }\n      }\n    }\n\n    // Mailbox identity for this channel: the email address. IMAP/SMTP credentials\n    // carry it as `fromAddress`; other credential providers may use `username` or\n    // `email`. Normalize emails to lowercase so the cross-provider duplicate guard\n    // and the per-(tenant,user,provider,mailbox) heal index match canonically.\n    const credBag = input.credentials as Record<string, unknown>\n    const rawIdentifier =\n      (typeof credBag.username === 'string' && credBag.username.length > 0 ? credBag.username : null) ??\n      (typeof credBag.email === 'string' && credBag.email.length > 0 ? credBag.email : null) ??\n      (typeof credBag.fromAddress === 'string' && credBag.fromAddress.length > 0\n        ? credBag.fromAddress\n        : null)\n    const externalIdentifier =\n      rawIdentifier && rawIdentifier.includes('@') ? rawIdentifier.toLowerCase() : rawIdentifier\n\n    // Fail-safe: if credentials persistence failed (no `credentialsRef`), the\n    // channel is created in `requires_reauth` + isActive=false so workers\n    // don't poll a channel that has no usable credentials. The user can\n    // reconnect to recover (see review R2-H4 / F6, 2026-05-26).\n    const credentialsAvailable = credentialsRefId !== null\n    let channel\n    try {\n      channel = await createConnectedChannelRow({\n        em,\n        adapter,\n        providerKey: input.providerKey,\n        displayName: input.displayName,\n        externalIdentifier,\n        credentialsRefId,\n        userId: input.userId,\n        scope: { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId ?? null },\n        pollIntervalSeconds: input.pollIntervalSeconds,\n      })\n    } catch (err) {\n      // Same mailbox already connected via another provider \u2014 reject so we don't\n      // create a second channel that double-ingests every message.\n      if (err instanceof MailboxAlreadyConnectedError) {\n        return {\n          status: 'duplicate_mailbox',\n          externalIdentifier: err.externalIdentifier,\n          existingProviderKey: err.existingProviderKey,\n        }\n      }\n      throw err\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 best-effort push registration for providers that\n    // support it (Gmail). Failures persist as `pushStatus='failed'`\n    // on the channel state but do NOT fail the connect \u2014 polling fallback\n    // covers the channel until the operator clicks \"Re-register push\".\n    // Imported lazily to avoid a circular module load (push-register reads\n    // the channel adapter registry, which is initialised after this module).\n    if (credentialsAvailable && input.providerKey === 'gmail') {\n      const adapterSupportsPush =\n        typeof adapter.registerPush === 'function' && typeof adapter.unregisterPush === 'function'\n      const organizationId = input.scope.organizationId\n      if (adapterSupportsPush && organizationId) {\n        try {\n          const { pushRegister } = await import('./push-register')\n          await pushRegister({\n            container: ctx.container,\n            scope: {\n              tenantId: input.scope.tenantId,\n              organizationId,\n              userId: input.userId,\n            },\n            input: { channelId: channel.id },\n          })\n        } catch (err) {\n          // Never fail the connect on push errors \u2014 operator can manually\n          // re-register via the dedicated route. Log + continue.\n          logger.warn('best-effort pushRegister failed for channel', { channelId: channel.id, err })\n        }\n      }\n    }\n\n    return { status: 'connected', channelId: channel.id, externalIdentifier }\n  },\n}\n\nregisterCommand(connectCredentialChannelCommand)\n\nexport default connectCredentialChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAEhC,SAAS,2BAA2B,oCAAoC;AACxE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,6BAA6B,CAAC;AAEvG,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EACrC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA;AAAA,EAEtC,aAAa,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA;AAAA,EAE7C,qBAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,KAAM,EAAE,SAAS;AAAA,EACtE,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAUM,MAAM,+DACX;AA2BF,MAAM,kCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,QAAQ;AAC3D,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,QAAQ,uCAAuC,MAAM,WAAW;AAAA,MAClE;AAAA,IACF;AAGA,QAAI,OAAO,QAAQ,wBAAwB,YAAY;AACrD,YAAM,aAAa,MAAM,QAAQ,oBAAoB;AAAA,QACnD,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,MACF,CAAC;AACD,UAAI,CAAC,WAAW,IAAI;AAClB,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,QAAQ,WAAW,UAAU,EAAE,OAAO,+BAA+B;AAAA,QACvE;AAAA,MACF;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU,QAAQ,+BAA+B;AAAA,IAC5E,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAQA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC1D,QAAQ,MAAM;AAAA,IAChB;AACA,QAAI,mBAAkC;AACtC,QAAI,uBAAuB;AAC3B,QAAI,oBAAoB,MAAM;AAC5B,UAAI;AACF,cAAM,mBAAmB;AAAA,UACvB,WAAW,MAAM,WAAW;AAAA,UAC5B,EAAE,GAAG,MAAM,aAAa,QAAQ,MAAM,OAAO;AAAA,UAC7C;AAAA,QACF;AACA,+BAAuB;AAAA,MACzB,SAAS,KAAK;AACZ,eAAO,KAAK,2CAA2C,EAAE,aAAa,MAAM,aAAa,IAAI,CAAC;AAAA,MAChG;AAEA,UAAI,sBAAsB;AACxB,YAAI;AACF,gBAAM,EAAE,uBAAuB,IAAI,MAAM,OACvC,uDACF;AACA,gBAAM,EAAE,sBAAsB,IAAI,MAAM,OACtC,0CACF;AACA,gBAAM,MAAM,MAAM;AAAA,YAChB;AAAA,YACA;AAAA,YACA;AAAA,cACE,eAAe,WAAW,MAAM,WAAW;AAAA,cAC3C,UAAU,iBAAiB;AAAA,cAC3B,gBAAgB,iBAAiB;AAAA,cACjC,QAAQ,iBAAiB;AAAA,cACzB,WAAW;AAAA,YACb;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,6BAAoB,KAAgC,MAAM;AAAA,QAC5D,QAAQ;AACN,6BAAmB;AAAA,QACrB;AAAA,MACF;AAAA,IACF;AAMA,UAAM,UAAU,MAAM;AACtB,UAAM,iBACH,OAAO,QAAQ,aAAa,YAAY,QAAQ,SAAS,SAAS,IAAI,QAAQ,WAAW,UACzF,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,SAAS,IAAI,QAAQ,QAAQ,UAChF,OAAO,QAAQ,gBAAgB,YAAY,QAAQ,YAAY,SAAS,IACrE,QAAQ,cACR;AACN,UAAM,qBACJ,iBAAiB,cAAc,SAAS,GAAG,IAAI,cAAc,YAAY,IAAI;AAM/E,UAAM,uBAAuB,qBAAqB;AAClD,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,0BAA0B;AAAA,QACxC;AAAA,QACA;AAAA,QACA,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,QAAQ,MAAM;AAAA,QACd,OAAO,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,kBAAkB,KAAK;AAAA,QAC5F,qBAAqB,MAAM;AAAA,MAC7B,CAAC;AAAA,IACH,SAAS,KAAK;AAGZ,UAAI,eAAe,8BAA8B;AAC/C,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,oBAAoB,IAAI;AAAA,UACxB,qBAAqB,IAAI;AAAA,QAC3B;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAQA,QAAI,wBAAwB,MAAM,gBAAgB,SAAS;AACzD,YAAM,sBACJ,OAAO,QAAQ,iBAAiB,cAAc,OAAO,QAAQ,mBAAmB;AAClF,YAAM,iBAAiB,MAAM,MAAM;AACnC,UAAI,uBAAuB,gBAAgB;AACzC,YAAI;AACF,gBAAM,EAAE,aAAa,IAAI,MAAM,OAAO,iBAAiB;AACvD,gBAAM,aAAa;AAAA,YACjB,WAAW,IAAI;AAAA,YACf,OAAO;AAAA,cACL,UAAU,MAAM,MAAM;AAAA,cACtB;AAAA,cACA,QAAQ,MAAM;AAAA,YAChB;AAAA,YACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,UACjC,CAAC;AAAA,QACH,SAAS,KAAK;AAGZ,iBAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,aAAa,WAAW,QAAQ,IAAI,mBAAmB;AAAA,EAC1E;AACF;AAEA,gBAAgB,+BAA+B;AAE/C,IAAO,qCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/delete-channel.js

@@ -5,6 +5,8 @@ import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find"
 import { CommunicationChannel } from "../data/entities.js";
 import { pushUnregister } from "./push-unregister.js";
 import { emitCommunicationChannelsEvent } from "../events.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "delete-channel" });
 const deleteChannelSchema = z.object({
   channelId: z.string().uuid(),
   userId: z.string().uuid(),
@@ -56,9 +58,7 @@ const deleteChannelCommand = {
           input: { channelId: channel.id }
         });
       } catch (err) {
-        console.warn(
-          `[delete-channel] push unregister failed for ${channel.id}: ${err instanceof Error ? err.message : String(err)}`
-        );
+        logger.warn("push unregister failed for channel", { channelId: channel.id, err });
       }
     }
     channel.deletedAt = /* @__PURE__ */ new Date();

package/dist/modules/communication_channels/commands/delete-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/delete-channel.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { pushUnregister } from './push-unregister'\nimport { emitCommunicationChannelsEvent } from '../events'\n\nconst deleteChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type DeleteChannelInput = z.infer<typeof deleteChannelSchema>\n\nexport type DeleteChannelResult =\n  | { status: 'deleted'; channelId: string; undo: DeleteChannelUndoSnapshot }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_owner'; reason: string }\n\nexport interface DeleteChannelUndoSnapshot {\n  channelId: string\n  // Optional only for back-compat with any pre-existing log entries; new\n  // snapshots always set it so the undo lookup stays tenant-scoped.\n  tenantId?: string\n}\n\nexport const COMMUNICATION_CHANNELS_DELETE_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.delete'\n\n/**\n * Soft-delete a per-user channel (sets `deleted_at`) \u2014 the channel row only.\n * Channel re-resolution (polling scheduler, inbound routing) and the\n * one-primary-per-user unique index already filter `deleted_at IS NULL`, so the\n * soft-delete stops new ingest into this channel. It does NOT cascade: existing\n * conversation / message / thread / reaction read-models carry `channelId` /\n * `conversationId` but are not channel-gated, so they remain readable via joins\n * until a future retention sweep. `is_primary` is cleared so a later undo cannot\n * resurrect a second primary for the user (the partial-unique index would\n * otherwise reject the restore).\n *\n * Provider-side push delivery is torn down best-effort BEFORE the soft-delete,\n * while `credentialsRef` is still present \u2014 mirrors `disconnect-channel`.\n *\n * Undoable: undo clears `deleted_at` to restore the row. It intentionally does\n * NOT re-claim primary status (would risk the one-primary-per-user constraint);\n * the owner re-selects a primary after a restore.\n */\nconst deleteChannelCommand: CommandHandler<DeleteChannelInput, DeleteChannelResult> = {\n  id: COMMUNICATION_CHANNELS_DELETE_CHANNEL_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = deleteChannelSchema.parse(rawInput) as DeleteChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      return { status: 'noop', reason: 'channel not found' }\n    }\n    if (channel.userId !== input.userId) {\n      return { status: 'not_owner', reason: 'channel is not owned by the current user' }\n    }\n\n    // Tear down provider-side push delivery before the soft-delete, while\n    // credentials are still resolvable. Best-effort \u2014 failures are logged inside\n    // pushUnregister and never re-raised.\n    if (input.scope.organizationId) {\n      try {\n        await pushUnregister({\n          container: ctx.container,\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId,\n            userId: input.userId,\n          },\n          input: { channelId: channel.id },\n        })\n      } catch (err) {\n        console.warn(\n          `[delete-channel] push unregister failed for ${channel.id}: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    }\n\n    channel.deletedAt = new Date()\n    channel.isPrimary = false\n    await em.flush()\n\n    // Emit AFTER flush so subscribers observe the committed soft-delete.\n    // Lifecycle parity with `disconnect` (which emits `channel.disconnected`) so\n    // workflows/audit can observe the full channel lifecycle. Persistent so the\n    // delivery can retry on failure.\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.deleted',\n      {\n        channelId: channel.id,\n        userId: input.userId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'deleted',\n      channelId: channel.id,\n      undo: { channelId: channel.id, tenantId: channel.tenantId },\n    }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() (which clears deleted_at) would no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'deleted') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.channelId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot || !snapshot.tenantId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Re-find WITHOUT the `deletedAt: null` filter \u2014 the row we are restoring is\n    // soft-deleted. Tenant-scoped to avoid cross-tenant resolution by bare id.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      { id: snapshot.channelId, tenantId: snapshot.tenantId },\n      undefined,\n      { tenantId: snapshot.tenantId, organizationId: null },\n    )\n    if (!channel) return\n    channel.deletedAt = null\n    await em.flush()\n  },\n}\n\n/**\n * Defensive shape-validator for the delete snapshot \u2014 mirrors the helper in\n * `disconnect-channel.ts` so tests can construct snapshots directly.\n */\nexport function extractUndoPayload(value: unknown): DeleteChannelUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.channelId !== 'string') return null\n  return {\n    channelId: obj.channelId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n  }\n}\n\nfunction extractSnapshotFromLog(logEntry: unknown): DeleteChannelUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<DeleteChannelUndoSnapshot>((logEntry ?? null) as never)\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(deleteChannelCommand)\n\nexport default deleteChannelCommand\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,sCAAsC;AAE/C,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAgBM,MAAM,mDACX;AAoBF,MAAM,uBAAgF;AAAA,EACpF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,oBAAoB,MAAM,QAAQ;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,QAAQ,QAAQ,QAAQ,oBAAoB;AAAA,IACvD;AACA,QAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,aAAO,EAAE,QAAQ,aAAa,QAAQ,2CAA2C;AAAA,IACnF;AAKA,QAAI,MAAM,MAAM,gBAAgB;AAC9B,UAAI;AACF,cAAM,eAAe;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM;AAAA,YAC5B,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,+CAA+C,QAAQ,EAAE,KACvD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,YAAY,oBAAI,KAAK;AAC7B,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAMf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,MAAM,EAAE,WAAW,QAAQ,IAAI,UAAU,QAAQ,SAAS;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,UAAW,QAAO;AACxC,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,YAAY,CAAC,SAAS,SAAU;AACrC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS;AAAA,MACtD;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAAA,IACtD;AACA,QAAI,CAAC,QAAS;AACd,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAMO,SAAS,mBAAmB,OAAkD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAAkD,QAAQ;AAC7E,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,cAAc,SAAU,QAAO;AAC9C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,EAC9D;AACF;AAEA,SAAS,uBAAuB,UAAqD;AACnF,QAAM,OAAO,yBAAqD,YAAY,IAAc;AAC5F,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,oBAAoB;AAEpC,IAAO,yBAAQ;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { pushUnregister } from './push-unregister'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'delete-channel' })\n\nconst deleteChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type DeleteChannelInput = z.infer<typeof deleteChannelSchema>\n\nexport type DeleteChannelResult =\n  | { status: 'deleted'; channelId: string; undo: DeleteChannelUndoSnapshot }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_owner'; reason: string }\n\nexport interface DeleteChannelUndoSnapshot {\n  channelId: string\n  // Optional only for back-compat with any pre-existing log entries; new\n  // snapshots always set it so the undo lookup stays tenant-scoped.\n  tenantId?: string\n}\n\nexport const COMMUNICATION_CHANNELS_DELETE_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.delete'\n\n/**\n * Soft-delete a per-user channel (sets `deleted_at`) \u2014 the channel row only.\n * Channel re-resolution (polling scheduler, inbound routing) and the\n * one-primary-per-user unique index already filter `deleted_at IS NULL`, so the\n * soft-delete stops new ingest into this channel. It does NOT cascade: existing\n * conversation / message / thread / reaction read-models carry `channelId` /\n * `conversationId` but are not channel-gated, so they remain readable via joins\n * until a future retention sweep. `is_primary` is cleared so a later undo cannot\n * resurrect a second primary for the user (the partial-unique index would\n * otherwise reject the restore).\n *\n * Provider-side push delivery is torn down best-effort BEFORE the soft-delete,\n * while `credentialsRef` is still present \u2014 mirrors `disconnect-channel`.\n *\n * Undoable: undo clears `deleted_at` to restore the row. It intentionally does\n * NOT re-claim primary status (would risk the one-primary-per-user constraint);\n * the owner re-selects a primary after a restore.\n */\nconst deleteChannelCommand: CommandHandler<DeleteChannelInput, DeleteChannelResult> = {\n  id: COMMUNICATION_CHANNELS_DELETE_CHANNEL_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = deleteChannelSchema.parse(rawInput) as DeleteChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      return { status: 'noop', reason: 'channel not found' }\n    }\n    if (channel.userId !== input.userId) {\n      return { status: 'not_owner', reason: 'channel is not owned by the current user' }\n    }\n\n    // Tear down provider-side push delivery before the soft-delete, while\n    // credentials are still resolvable. Best-effort \u2014 failures are logged inside\n    // pushUnregister and never re-raised.\n    if (input.scope.organizationId) {\n      try {\n        await pushUnregister({\n          container: ctx.container,\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId,\n            userId: input.userId,\n          },\n          input: { channelId: channel.id },\n        })\n      } catch (err) {\n        logger.warn('push unregister failed for channel', { channelId: channel.id, err })\n      }\n    }\n\n    channel.deletedAt = new Date()\n    channel.isPrimary = false\n    await em.flush()\n\n    // Emit AFTER flush so subscribers observe the committed soft-delete.\n    // Lifecycle parity with `disconnect` (which emits `channel.disconnected`) so\n    // workflows/audit can observe the full channel lifecycle. Persistent so the\n    // delivery can retry on failure.\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.deleted',\n      {\n        channelId: channel.id,\n        userId: input.userId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'deleted',\n      channelId: channel.id,\n      undo: { channelId: channel.id, tenantId: channel.tenantId },\n    }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() (which clears deleted_at) would no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'deleted') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.channelId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot || !snapshot.tenantId) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Re-find WITHOUT the `deletedAt: null` filter \u2014 the row we are restoring is\n    // soft-deleted. Tenant-scoped to avoid cross-tenant resolution by bare id.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      { id: snapshot.channelId, tenantId: snapshot.tenantId },\n      undefined,\n      { tenantId: snapshot.tenantId, organizationId: null },\n    )\n    if (!channel) return\n    channel.deletedAt = null\n    await em.flush()\n  },\n}\n\n/**\n * Defensive shape-validator for the delete snapshot \u2014 mirrors the helper in\n * `disconnect-channel.ts` so tests can construct snapshots directly.\n */\nexport function extractUndoPayload(value: unknown): DeleteChannelUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.channelId !== 'string') return null\n  return {\n    channelId: obj.channelId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n  }\n}\n\nfunction extractSnapshotFromLog(logEntry: unknown): DeleteChannelUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<DeleteChannelUndoSnapshot>((logEntry ?? null) as never)\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(deleteChannelCommand)\n\nexport default deleteChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,sBAAsB;AAC/B,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,iBAAiB,CAAC;AAE3F,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAgBM,MAAM,mDACX;AAoBF,MAAM,uBAAgF;AAAA,EACpF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,oBAAoB,MAAM,QAAQ;AAChD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,QAAQ,QAAQ,QAAQ,oBAAoB;AAAA,IACvD;AACA,QAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,aAAO,EAAE,QAAQ,aAAa,QAAQ,2CAA2C;AAAA,IACnF;AAKA,QAAI,MAAM,MAAM,gBAAgB;AAC9B,UAAI;AACF,cAAM,eAAe;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM;AAAA,YAC5B,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,KAAK,sCAAsC,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAEA,YAAQ,YAAY,oBAAI,KAAK;AAC7B,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAMf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,MAAM,EAAE,WAAW,QAAQ,IAAI,UAAU,QAAQ,SAAS;AAAA,IAC5D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,UAAW,QAAO;AACxC,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,IAC/B;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,YAAY,CAAC,SAAS,SAAU;AACrC,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS;AAAA,MACtD;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAAA,IACtD;AACA,QAAI,CAAC,QAAS;AACd,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAMO,SAAS,mBAAmB,OAAkD;AACnF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAAkD,QAAQ;AAC7E,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,cAAc,SAAU,QAAO;AAC9C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,EAC9D;AACF;AAEA,SAAS,uBAAuB,UAAqD;AACnF,QAAM,OAAO,yBAAqD,YAAY,IAAc;AAC5F,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,oBAAoB;AAEpC,IAAO,yBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/deliver-outbound-message.js

@@ -19,6 +19,8 @@ import {
   ExternalMessage,
   MessageChannelLink
 } from "../data/entities.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const moduleLogger = createLogger("communication_channels").child({ component: "deliver-outbound-message" });
 const NO_THREAD_MAPPING_RESULT = { status: "no_channel_link" };
 const deliverInputSchema = z.object({
   messageId: z.string().uuid(),
@@ -194,7 +196,7 @@ const deliverOutboundMessageCommand = {
       },
       {
         credentialsService,
-        logger: (...args) => console.warn(...args)
+        logger: (...args) => moduleLogger.warn("credential refresh diagnostic", { details: args })
       }
     );
     credentials = refreshResult.credentials;
@@ -207,10 +209,7 @@ const deliverOutboundMessageCommand = {
       });
       threadToken = token;
     } catch (tokenErr) {
-      console.warn(
-        "[communication_channels:deliver-outbound] thread token unavailable, proceeding without it:",
-        tokenErr instanceof Error ? tokenErr.message : tokenErr
-      );
+      moduleLogger.warn("thread token unavailable, proceeding without it", { err: tokenErr });
     }
     try {
       const outboundPayload = link.channelPayload ?? {};