@open-mercato/core 0.6.6-develop.6465.1.019f0fb26f → 0.6.6-develop.6471.1.9ab5bdd79a

package/dist/modules/communication_channels/commands/deliver-outbound-message.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/deliver-outbound-message.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => console.warn(...args),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      console.warn(\n        '[communication_channels:deliver-outbound] thread token unavailable, proceeding without it:',\n        tokenErr instanceof Error ? tokenErr.message : tokenErr,\n      )\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          ...baseMetadata,\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...(converted.metadata ?? {}),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AAEjD,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAMP,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAyCF,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAIA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC1D,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,QAAQ,KAAK,GAAG,IAAI;AAAA,MAC3C;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,cAAQ;AAAA,QACN;AAAA,QACA,oBAAoB,QAAQ,SAAS,UAAU;AAAA,MACjD;AAAA,IACF;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA,UACnB,GAAG;AAAA,UACH,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,QACtD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAI,UAAU,YAAY,CAAC;AAAA,QAC3B,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA,UACX,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst moduleLogger = createLogger('communication_channels').child({ component: 'deliver-outbound-message' })\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => moduleLogger.warn('credential refresh diagnostic', { details: args }),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      moduleLogger.warn('thread token unavailable, proceeding without it', { err: tokenErr })\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          ...baseMetadata,\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...(converted.metadata ?? {}),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AAEjD,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,eAAe,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,2BAA2B,CAAC;AAM3G,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAyCF,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAIA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,MAC1D,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,aAAa,KAAK,iCAAiC,EAAE,SAAS,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,mBAAa,KAAK,mDAAmD,EAAE,KAAK,SAAS,CAAC;AAAA,IACxF;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA,UACnB,GAAG;AAAA,UACH,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,QACtD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,QAC5D;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAI,UAAU,YAAY,CAAC;AAAA,QAC3B,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA,UACX,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/disconnect-channel.js

@@ -5,6 +5,8 @@ import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find"
 import { CommunicationChannel } from "../data/entities.js";
 import { emitCommunicationChannelsEvent } from "../events.js";
 import { pushUnregister } from "./push-unregister.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "disconnect-channel" });
 const disconnectChannelSchema = z.object({
   channelId: z.string().uuid(),
   userId: z.string().uuid(),
@@ -68,9 +70,7 @@ const disconnectChannelCommand = {
           input: { channelId: channel.id }
         });
       } catch (err) {
-        console.warn(
-          `[disconnect-channel] push unregister failed for ${channel.id}: ${err instanceof Error ? err.message : String(err)}`
-        );
+        logger.warn("push unregister failed for channel", { channelId: channel.id, err });
       }
     }
     channel.status = "disconnected";

package/dist/modules/communication_channels/commands/disconnect-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/disconnect-channel.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { pushUnregister } from './push-unregister'\n\nconst disconnectChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type DisconnectChannelInput = z.infer<typeof disconnectChannelSchema>\n\nexport type DisconnectChannelResult =\n  | {\n      status: 'disconnected'\n      channelId: string\n      undo: DisconnectChannelUndoSnapshot\n    }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_owner'; reason: string }\n\nexport interface DisconnectChannelUndoSnapshot {\n  channelId: string\n  // Optional for backward compatibility with log entries written before tenant\n  // scoping was added to the undo lookup; new snapshots always set it.\n  tenantId?: string\n  previousStatus: string\n  previousIsActive: boolean\n  previousIsPrimary: boolean\n  previousCredentialsRef: string | null\n  previousLastError: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_DISCONNECT_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.disconnect'\n\n/**\n * Disconnect a per-user channel.\n *\n * Setting `status='disconnected'` halts the polling worker (slice 3b filters by\n * status) and clears the credentials reference so the adapter can't pick the\n * channel up by accident. `isPrimary` is cleared too \u2014 keeping it set would\n * leave the user without a working primary and any future `send-as-user` call\n * would 404 the lookup. The `credentials_ref` row in `integration_credentials`\n * is left orphaned; the integrations module's retention policy sweeps it.\n *\n * The command is undoable: the `before` snapshot captures the four-tuple\n * (status, is_active, is_primary, credentials_ref) so undo can restore the\n * channel atomically. Undo is gated by the `beforeUndo` interceptor in\n * `commands/interceptors.ts` \u2014 if another channel became primary while this\n * one was disconnected, undo is blocked to avoid violating the partial-unique\n * \"one primary per user\" constraint.\n */\nconst disconnectChannelCommand: CommandHandler<\n  DisconnectChannelInput,\n  DisconnectChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_DISCONNECT_CHANNEL_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = disconnectChannelSchema.parse(rawInput) as DisconnectChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      return { status: 'noop', reason: 'channel not found' }\n    }\n    if (channel.userId !== input.userId) {\n      return { status: 'not_owner', reason: 'channel is not owned by the current user' }\n    }\n    if (channel.status === 'disconnected' && !channel.isActive) {\n      return { status: 'noop', reason: 'channel is already disconnected' }\n    }\n\n    const undo: DisconnectChannelUndoSnapshot = {\n      channelId: channel.id,\n      tenantId: channel.tenantId,\n      previousStatus: channel.status,\n      previousIsActive: channel.isActive,\n      previousIsPrimary: channel.isPrimary,\n      previousCredentialsRef: channel.credentialsRef ?? null,\n      previousLastError: channel.lastError ?? null,\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 tear down provider-side push delivery BEFORE we\n    // clear `credentialsRef`. Best-effort: any failure (404, expired token,\n    // adapter error) is logged inside `pushUnregister` and never re-raised.\n    // The teardown needs valid credentials, which we still have at this\n    // point \u2014 clearing them below would make it impossible.\n    if (input.scope.organizationId) {\n      try {\n        await pushUnregister({\n          container: ctx.container,\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId,\n            userId: input.userId,\n          },\n          input: { channelId: channel.id },\n        })\n      } catch (err) {\n        console.warn(\n          `[disconnect-channel] push unregister failed for ${channel.id}: ${\n            err instanceof Error ? err.message : String(err)\n          }`,\n        )\n      }\n    }\n\n    channel.status = 'disconnected'\n    channel.isActive = false\n    channel.isPrimary = false\n    channel.credentialsRef = null\n    channel.lastError = 'user-disconnected'\n    channel.lastPolledAt = new Date()\n    await em.flush()\n\n    // Emit AFTER flush so subscribers observe a committed state. Persistent\n    // delivery so workflows/audit/UI refresh can retry on failure.\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.disconnected',\n      {\n        channelId: channel.id,\n        userId: input.userId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return { status: 'disconnected', channelId: channel.id, undo }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() would silently no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'disconnected') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.channelId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n      snapshotBefore: result.undo,\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Never resolve by bare id (cross-tenant). New snapshots always carry\n    // tenantId; refuse the undo if a legacy snapshot lacks it.\n    if (!snapshot.tenantId) return\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      { id: snapshot.channelId, tenantId: snapshot.tenantId },\n      undefined,\n      { tenantId: snapshot.tenantId, organizationId: null },\n    )\n    if (!channel) return\n\n    channel.status = snapshot.previousStatus as CommunicationChannel['status']\n    channel.isActive = snapshot.previousIsActive\n    channel.isPrimary = snapshot.previousIsPrimary\n    channel.credentialsRef = snapshot.previousCredentialsRef\n    channel.lastError = snapshot.previousLastError\n    await em.flush()\n  },\n}\n\n/**\n * Read the undo payload defensively \u2014 wraps the shared\n * `@open-mercato/shared/lib/commands/undo.ts` helper with a narrow-by-shape\n * validation so callers get a strongly-typed snapshot or `null`.\n *\n * Kept as a separate export for test ergonomics (tests can mock the snapshot\n * shape directly without round-tripping through a CommandLogEntry).\n */\nexport function extractUndoPayload(value: unknown): DisconnectChannelUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.channelId !== 'string') return null\n  return {\n    channelId: obj.channelId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n    previousStatus: typeof obj.previousStatus === 'string' ? obj.previousStatus : 'connected',\n    previousIsActive: typeof obj.previousIsActive === 'boolean' ? obj.previousIsActive : true,\n    previousIsPrimary: typeof obj.previousIsPrimary === 'boolean' ? obj.previousIsPrimary : false,\n    previousCredentialsRef:\n      typeof obj.previousCredentialsRef === 'string' ? obj.previousCredentialsRef : null,\n    previousLastError: typeof obj.previousLastError === 'string' ? obj.previousLastError : null,\n  }\n}\n\n/**\n * Pulls the disconnect snapshot from a command log entry \u2014 first via the\n * shared `extractUndoPayload` helper, then through the local shape-validator.\n * Always falls back to `null` so the undo handler can no-op safely.\n */\nexport function extractSnapshotFromLog(logEntry: unknown): DisconnectChannelUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<DisconnectChannelUndoSnapshot>(\n    (logEntry ?? null) as never,\n  )\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(disconnectChannelCommand)\n\nexport default disconnectChannelCommand\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAE/B,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAyBM,MAAM,uDACX;AAmBF,MAAM,2BAGF;AAAA,EACF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,wBAAwB,MAAM,QAAQ;AACpD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,QAAQ,QAAQ,QAAQ,oBAAoB;AAAA,IACvD;AACA,QAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,aAAO,EAAE,QAAQ,aAAa,QAAQ,2CAA2C;AAAA,IACnF;AACA,QAAI,QAAQ,WAAW,kBAAkB,CAAC,QAAQ,UAAU;AAC1D,aAAO,EAAE,QAAQ,QAAQ,QAAQ,kCAAkC;AAAA,IACrE;AAEA,UAAM,OAAsC;AAAA,MAC1C,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,kBAAkB,QAAQ;AAAA,MAC1B,mBAAmB,QAAQ;AAAA,MAC3B,wBAAwB,QAAQ,kBAAkB;AAAA,MAClD,mBAAmB,QAAQ,aAAa;AAAA,IAC1C;AAOA,QAAI,MAAM,MAAM,gBAAgB;AAC9B,UAAI;AACF,cAAM,eAAe;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM;AAAA,YAC5B,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,gBAAQ;AAAA,UACN,mDAAmD,QAAQ,EAAE,KAC3D,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CACjD;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,SAAS;AACjB,YAAQ,WAAW;AACnB,YAAQ,YAAY;AACpB,YAAQ,iBAAiB;AACzB,YAAQ,YAAY;AACpB,YAAQ,eAAe,oBAAI,KAAK;AAChC,UAAM,GAAG,MAAM;AAIf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO,EAAE,QAAQ,gBAAgB,WAAW,QAAQ,IAAI,KAAK;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,eAAgB,QAAO;AAC7C,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,MAC7B,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,SAAU;AACf,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,QAAI,CAAC,SAAS,SAAU;AACxB,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS;AAAA,MACtD;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAAA,IACtD;AACA,QAAI,CAAC,QAAS;AAEd,YAAQ,SAAS,SAAS;AAC1B,YAAQ,WAAW,SAAS;AAC5B,YAAQ,YAAY,SAAS;AAC7B,YAAQ,iBAAiB,SAAS;AAClC,YAAQ,YAAY,SAAS;AAC7B,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAUO,SAAS,mBAAmB,OAAsD;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAAkD,QAAQ;AAC7E,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,cAAc,SAAU,QAAO;AAC9C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,IAC5D,gBAAgB,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB;AAAA,IAC9E,kBAAkB,OAAO,IAAI,qBAAqB,YAAY,IAAI,mBAAmB;AAAA,IACrF,mBAAmB,OAAO,IAAI,sBAAsB,YAAY,IAAI,oBAAoB;AAAA,IACxF,wBACE,OAAO,IAAI,2BAA2B,WAAW,IAAI,yBAAyB;AAAA,IAChF,mBAAmB,OAAO,IAAI,sBAAsB,WAAW,IAAI,oBAAoB;AAAA,EACzF;AACF;AAOO,SAAS,uBAAuB,UAAyD;AAC9F,QAAM,OAAO;AAAA,IACV,YAAY;AAAA,EACf;AACA,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,wBAAwB;AAExC,IAAO,6BAAQ;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { extractUndoPayload as extractSharedUndoPayload } from '@open-mercato/shared/lib/commands/undo'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { pushUnregister } from './push-unregister'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'disconnect-channel' })\n\nconst disconnectChannelSchema = z.object({\n  channelId: z.string().uuid(),\n  userId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n})\n\nexport type DisconnectChannelInput = z.infer<typeof disconnectChannelSchema>\n\nexport type DisconnectChannelResult =\n  | {\n      status: 'disconnected'\n      channelId: string\n      undo: DisconnectChannelUndoSnapshot\n    }\n  | { status: 'noop'; reason: string }\n  | { status: 'not_owner'; reason: string }\n\nexport interface DisconnectChannelUndoSnapshot {\n  channelId: string\n  // Optional for backward compatibility with log entries written before tenant\n  // scoping was added to the undo lookup; new snapshots always set it.\n  tenantId?: string\n  previousStatus: string\n  previousIsActive: boolean\n  previousIsPrimary: boolean\n  previousCredentialsRef: string | null\n  previousLastError: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_DISCONNECT_CHANNEL_COMMAND_ID =\n  'communication_channels.channel.disconnect'\n\n/**\n * Disconnect a per-user channel.\n *\n * Setting `status='disconnected'` halts the polling worker (slice 3b filters by\n * status) and clears the credentials reference so the adapter can't pick the\n * channel up by accident. `isPrimary` is cleared too \u2014 keeping it set would\n * leave the user without a working primary and any future `send-as-user` call\n * would 404 the lookup. The `credentials_ref` row in `integration_credentials`\n * is left orphaned; the integrations module's retention policy sweeps it.\n *\n * The command is undoable: the `before` snapshot captures the four-tuple\n * (status, is_active, is_primary, credentials_ref) so undo can restore the\n * channel atomically. Undo is gated by the `beforeUndo` interceptor in\n * `commands/interceptors.ts` \u2014 if another channel became primary while this\n * one was disconnected, undo is blocked to avoid violating the partial-unique\n * \"one primary per user\" constraint.\n */\nconst disconnectChannelCommand: CommandHandler<\n  DisconnectChannelInput,\n  DisconnectChannelResult\n> = {\n  id: COMMUNICATION_CHANNELS_DISCONNECT_CHANNEL_COMMAND_ID,\n  // Explicitly undoable (the bus also infers this from `undo` below, but\n  // declaring it keeps undoability from silently dropping under a refactor).\n  isUndoable: true,\n  async execute(rawInput, ctx) {\n    const input = disconnectChannelSchema.parse(rawInput) as DisconnectChannelInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      return { status: 'noop', reason: 'channel not found' }\n    }\n    if (channel.userId !== input.userId) {\n      return { status: 'not_owner', reason: 'channel is not owned by the current user' }\n    }\n    if (channel.status === 'disconnected' && !channel.isActive) {\n      return { status: 'noop', reason: 'channel is already disconnected' }\n    }\n\n    const undo: DisconnectChannelUndoSnapshot = {\n      channelId: channel.id,\n      tenantId: channel.tenantId,\n      previousStatus: channel.status,\n      previousIsActive: channel.isActive,\n      previousIsPrimary: channel.isPrimary,\n      previousCredentialsRef: channel.credentialsRef ?? null,\n      previousLastError: channel.lastError ?? null,\n    }\n\n    // Spec C \u00A7 Phase C5 \u2014 tear down provider-side push delivery BEFORE we\n    // clear `credentialsRef`. Best-effort: any failure (404, expired token,\n    // adapter error) is logged inside `pushUnregister` and never re-raised.\n    // The teardown needs valid credentials, which we still have at this\n    // point \u2014 clearing them below would make it impossible.\n    if (input.scope.organizationId) {\n      try {\n        await pushUnregister({\n          container: ctx.container,\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId,\n            userId: input.userId,\n          },\n          input: { channelId: channel.id },\n        })\n      } catch (err) {\n        logger.warn('push unregister failed for channel', { channelId: channel.id, err })\n      }\n    }\n\n    channel.status = 'disconnected'\n    channel.isActive = false\n    channel.isPrimary = false\n    channel.credentialsRef = null\n    channel.lastError = 'user-disconnected'\n    channel.lastPolledAt = new Date()\n    await em.flush()\n\n    // Emit AFTER flush so subscribers observe a committed state. Persistent\n    // delivery so workflows/audit/UI refresh can retry on failure.\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.disconnected',\n      {\n        channelId: channel.id,\n        userId: input.userId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return { status: 'disconnected', channelId: channel.id, undo }\n  },\n  // Persist the undo snapshot into the action log. Without this, the command bus\n  // mints an undo token (so the UI offers \"Undo\") but the snapshot returned from\n  // execute() is never stored, and undo() would silently no-op.\n  async buildLog({ input, result }) {\n    if (result.status !== 'disconnected') return null\n    return {\n      resourceKind: 'communication_channels.channel',\n      resourceId: result.channelId,\n      tenantId: result.undo.tenantId ?? input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n      payload: { undo: result.undo },\n      snapshotBefore: result.undo,\n    }\n  },\n  async undo({ ctx, logEntry }) {\n    const snapshot = extractSnapshotFromLog(logEntry)\n    if (!snapshot) return\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    // Never resolve by bare id (cross-tenant). New snapshots always carry\n    // tenantId; refuse the undo if a legacy snapshot lacks it.\n    if (!snapshot.tenantId) return\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      { id: snapshot.channelId, tenantId: snapshot.tenantId },\n      undefined,\n      { tenantId: snapshot.tenantId, organizationId: null },\n    )\n    if (!channel) return\n\n    channel.status = snapshot.previousStatus as CommunicationChannel['status']\n    channel.isActive = snapshot.previousIsActive\n    channel.isPrimary = snapshot.previousIsPrimary\n    channel.credentialsRef = snapshot.previousCredentialsRef\n    channel.lastError = snapshot.previousLastError\n    await em.flush()\n  },\n}\n\n/**\n * Read the undo payload defensively \u2014 wraps the shared\n * `@open-mercato/shared/lib/commands/undo.ts` helper with a narrow-by-shape\n * validation so callers get a strongly-typed snapshot or `null`.\n *\n * Kept as a separate export for test ergonomics (tests can mock the snapshot\n * shape directly without round-tripping through a CommandLogEntry).\n */\nexport function extractUndoPayload(value: unknown): DisconnectChannelUndoSnapshot | null {\n  if (!value || typeof value !== 'object') return null\n  const candidate = (value as { undo?: unknown; channelId?: unknown }).undo ?? value\n  if (!candidate || typeof candidate !== 'object') return null\n  const obj = candidate as Record<string, unknown>\n  if (typeof obj.channelId !== 'string') return null\n  return {\n    channelId: obj.channelId,\n    tenantId: typeof obj.tenantId === 'string' ? obj.tenantId : undefined,\n    previousStatus: typeof obj.previousStatus === 'string' ? obj.previousStatus : 'connected',\n    previousIsActive: typeof obj.previousIsActive === 'boolean' ? obj.previousIsActive : true,\n    previousIsPrimary: typeof obj.previousIsPrimary === 'boolean' ? obj.previousIsPrimary : false,\n    previousCredentialsRef:\n      typeof obj.previousCredentialsRef === 'string' ? obj.previousCredentialsRef : null,\n    previousLastError: typeof obj.previousLastError === 'string' ? obj.previousLastError : null,\n  }\n}\n\n/**\n * Pulls the disconnect snapshot from a command log entry \u2014 first via the\n * shared `extractUndoPayload` helper, then through the local shape-validator.\n * Always falls back to `null` so the undo handler can no-op safely.\n */\nexport function extractSnapshotFromLog(logEntry: unknown): DisconnectChannelUndoSnapshot | null {\n  const undo = extractSharedUndoPayload<DisconnectChannelUndoSnapshot>(\n    (logEntry ?? null) as never,\n  )\n  if (undo) return extractUndoPayload(undo)\n  return extractUndoPayload(logEntry)\n}\n\nregisterCommand(disconnectChannelCommand)\n\nexport default disconnectChannelCommand\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,sBAAsB,gCAAgC;AAC/D,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAC/B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAE/F,MAAM,0BAA0B,EAAE,OAAO;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AACH,CAAC;AAyBM,MAAM,uDACX;AAmBF,MAAM,2BAGF;AAAA,EACF,IAAI;AAAA;AAAA;AAAA,EAGJ,YAAY;AAAA,EACZ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,wBAAwB,MAAM,QAAQ;AACpD,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,QAAQ,QAAQ,QAAQ,oBAAoB;AAAA,IACvD;AACA,QAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,aAAO,EAAE,QAAQ,aAAa,QAAQ,2CAA2C;AAAA,IACnF;AACA,QAAI,QAAQ,WAAW,kBAAkB,CAAC,QAAQ,UAAU;AAC1D,aAAO,EAAE,QAAQ,QAAQ,QAAQ,kCAAkC;AAAA,IACrE;AAEA,UAAM,OAAsC;AAAA,MAC1C,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,kBAAkB,QAAQ;AAAA,MAC1B,mBAAmB,QAAQ;AAAA,MAC3B,wBAAwB,QAAQ,kBAAkB;AAAA,MAClD,mBAAmB,QAAQ,aAAa;AAAA,IAC1C;AAOA,QAAI,MAAM,MAAM,gBAAgB;AAC9B,UAAI;AACF,cAAM,eAAe;AAAA,UACnB,WAAW,IAAI;AAAA,UACf,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM;AAAA,YAC5B,QAAQ,MAAM;AAAA,UAChB;AAAA,UACA,OAAO,EAAE,WAAW,QAAQ,GAAG;AAAA,QACjC,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,eAAO,KAAK,sCAAsC,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,MAClF;AAAA,IACF;AAEA,YAAQ,SAAS;AACjB,YAAQ,WAAW;AACnB,YAAQ,YAAY;AACpB,YAAQ,iBAAiB;AACzB,YAAQ,YAAY;AACpB,YAAQ,eAAe,oBAAI,KAAK;AAChC,UAAM,GAAG,MAAM;AAIf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,QAAQ,MAAM;AAAA,QACd,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO,EAAE,QAAQ,gBAAgB,WAAW,QAAQ,IAAI,KAAK;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA,EAIA,MAAM,SAAS,EAAE,OAAO,OAAO,GAAG;AAChC,QAAI,OAAO,WAAW,eAAgB,QAAO;AAC7C,WAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,UAAU,OAAO,KAAK,YAAY,MAAM,MAAM;AAAA,MAC9C,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAC9C,SAAS,EAAE,MAAM,OAAO,KAAK;AAAA,MAC7B,gBAAgB,OAAO;AAAA,IACzB;AAAA,EACF;AAAA,EACA,MAAM,KAAK,EAAE,KAAK,SAAS,GAAG;AAC5B,UAAM,WAAW,uBAAuB,QAAQ;AAChD,QAAI,CAAC,SAAU;AACf,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG/D,QAAI,CAAC,SAAS,SAAU;AACxB,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,SAAS,WAAW,UAAU,SAAS,SAAS;AAAA,MACtD;AAAA,MACA,EAAE,UAAU,SAAS,UAAU,gBAAgB,KAAK;AAAA,IACtD;AACA,QAAI,CAAC,QAAS;AAEd,YAAQ,SAAS,SAAS;AAC1B,YAAQ,WAAW,SAAS;AAC5B,YAAQ,YAAY,SAAS;AAC7B,YAAQ,iBAAiB,SAAS;AAClC,YAAQ,YAAY,SAAS;AAC7B,UAAM,GAAG,MAAM;AAAA,EACjB;AACF;AAUO,SAAS,mBAAmB,OAAsD;AACvF,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,YAAa,MAAkD,QAAQ;AAC7E,MAAI,CAAC,aAAa,OAAO,cAAc,SAAU,QAAO;AACxD,QAAM,MAAM;AACZ,MAAI,OAAO,IAAI,cAAc,SAAU,QAAO;AAC9C,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,OAAO,IAAI,aAAa,WAAW,IAAI,WAAW;AAAA,IAC5D,gBAAgB,OAAO,IAAI,mBAAmB,WAAW,IAAI,iBAAiB;AAAA,IAC9E,kBAAkB,OAAO,IAAI,qBAAqB,YAAY,IAAI,mBAAmB;AAAA,IACrF,mBAAmB,OAAO,IAAI,sBAAsB,YAAY,IAAI,oBAAoB;AAAA,IACxF,wBACE,OAAO,IAAI,2BAA2B,WAAW,IAAI,yBAAyB;AAAA,IAChF,mBAAmB,OAAO,IAAI,sBAAsB,WAAW,IAAI,oBAAoB;AAAA,EACzF;AACF;AAOO,SAAS,uBAAuB,UAAyD;AAC9F,QAAM,OAAO;AAAA,IACV,YAAY;AAAA,EACf;AACA,MAAI,KAAM,QAAO,mBAAmB,IAAI;AACxC,SAAO,mBAAmB,QAAQ;AACpC;AAEA,gBAAgB,wBAAwB;AAExC,IAAO,6BAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/ingest-inbound-message.js

@@ -15,6 +15,8 @@ import {
 import { normalizedInboundMessageSchema } from "../data/validators.js";
 import { resolveCommunicationChannelsSystemUserId } from "../lib/system-user.js";
 import { isUniqueViolation } from "../lib/pg-errors.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "ingest-inbound-message" });
 const ingestInputSchema = z.object({
   channelId: z.string().uuid(),
   providerKey: z.string().min(1),
@@ -93,10 +95,7 @@ const ingestInboundMessageCommand = {
           };
         }
       } catch (dedupErr) {
-        console.warn(
-          "[communication_channels:ingest-inbound] sent-folder dedup query failed, continuing:",
-          dedupErr instanceof Error ? dedupErr.message : dedupErr
-        );
+        logger.warn("sent-folder dedup query failed, continuing", { err: dedupErr });
       }
     }
     const channel = await findOneWithDecryption(
@@ -188,10 +187,7 @@ const ingestInboundMessageCommand = {
         { em }
       );
     } catch (matcherErr) {
-      console.warn(
-        "[communication_channels:ingest-inbound] thread matcher failed, falling back to conversation mapping:",
-        matcherErr instanceof Error ? matcherErr.message : matcherErr
-      );
+      logger.warn("thread matcher failed, falling back to conversation mapping", { err: matcherErr });
     }
     let contactHint = null;
     try {
@@ -211,10 +207,7 @@ const ingestInboundMessageCommand = {
         { container: ctx.container }
       );
     } catch (contactErr) {
-      console.warn(
-        "[communication_channels:ingest-inbound] contact resolution failed, continuing without a CRM match:",
-        contactErr instanceof Error ? contactErr.message : contactErr
-      );
+      logger.warn("contact resolution failed, continuing without a CRM match", { err: contactErr });
       contactHint = null;
     }
     const matchedPersonId = contactHint?.matchedPersonId ?? null;

package/dist/modules/communication_channels/commands/ingest-inbound-message.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/ingest-inbound-message.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus, CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { resolveContact } from '../lib/contact-resolver'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { matchThread, type ThreadMatch } from '../lib/thread-matcher'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { normalizedInboundMessageSchema } from '../data/validators'\nimport { resolveCommunicationChannelsSystemUserId } from '../lib/system-user'\nimport { isUniqueViolation } from '../lib/pg-errors'\n\nconst ingestInputSchema = z.object({\n  channelId: z.string().uuid(),\n  providerKey: z.string().min(1),\n  channelType: z.string().min(1),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  message: normalizedInboundMessageSchema,\n})\n\nexport type IngestInboundMessageInput = z.infer<typeof ingestInputSchema>\n\nexport type IngestInboundMessageResult = {\n  status: 'created' | 'duplicate'\n  messageId?: string\n  externalConversationId?: string\n  externalMessageId?: string\n  channelLinkId?: string\n  threadMappingId?: string\n  contactPersonId?: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID = 'communication_channels.message.ingest_inbound'\n\n/**\n * Idempotently ingest a normalized inbound channel message.\n *\n * Steps (per SPEC-045d \u00A76):\n *   1. Dedup by `(channel_id, external_message_id)` \u2014 if a MessageChannelLink already\n *      exists for that pair, return `{ status: 'duplicate' }` without side effects.\n *   2. Create or load `ExternalConversation` by `(channel_id, external_conversation_id)`.\n *   3. Create or load `ChannelThreadMapping` (1:1 with ExternalConversation).\n *   4. Resolve CRM contact via adapter + QueryEngine (best-effort).\n *   5. Compose the platform `Message` via `messages.messages.compose` (separate transaction).\n *   6. Create `ExternalMessage` + `MessageChannelLink`.\n *   7. Emit `communication_channels.message.received` (and `.conversation.created` / `.contact.resolved` when applicable).\n *\n * The two-transaction model (compose-message-then-record-link) is acceptable for v1;\n * the link's unique-on-message-id constraint is the safety net against orphans. See\n * the pre-implementation analysis for a discussion of single-transaction alternatives.\n */\nconst ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, IngestInboundMessageResult> = {\n  id: COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = ingestInputSchema.parse(rawInput) as IngestInboundMessageInput\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Dedup: short-circuit if we've already processed this provider message.\n    // The unique constraint is on `messageId`, not (channel, externalMessageId).\n    // We must dedup by joining against ExternalMessage which IS uniquely indexed by\n    // (channel_id, external_message_id). Hub-side dedup is the authoritative gate.\n    const existingExternal = await findOneWithDecryption(\n      em,\n      ExternalMessage,\n      {\n        channelId: input.channelId,\n        externalMessageId: input.message.externalMessageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (existingExternal) {\n      return {\n        status: 'duplicate',\n        externalConversationId: existingExternal.conversationId,\n        externalMessageId: existingExternal.id,\n      }\n    }\n\n    // (1b) Spec B \u00A7 Sent-folder dedup.\n    //\n    // When an outbound message lands in the user's IMAP Sent folder (or\n    // when Gmail's \"send and archive\" deposits it in All Mail), the next\n    // poll will re-fetch it from INBOX as if it were inbound. Skip it\n    // here using the RFC 5322 `Message-ID` header \u2014 we recorded it on the\n    // outbound `MessageChannelLink.channelMetadata.messageId` at send time.\n    //\n    // We dedup ONLY on outbound links (direction='outbound') for the same\n    // channel \u2014 that way an inbound copy of someone ELSE's email that\n    // happens to share a Message-ID is still ingested normally.\n    const incomingMessageId = (() => {\n      const fromMeta = (input.message.channelMetadata as Record<string, unknown> | undefined)?.messageId\n      if (typeof fromMeta === 'string' && fromMeta.length > 0) return fromMeta\n      return null\n    })()\n    if (incomingMessageId) {\n      // MikroORM v7 dropped the Knex builder in favour of Kysely/raw SQL.\n      // We use a positional-placeholder raw query for the JSONB\n      // `channel_metadata->>messageId` comparison.\n      try {\n        const sentFolderHit = await em.getConnection().execute<Array<{ id: string }>>(\n          `SELECT link.id FROM message_channel_links AS link\n             INNER JOIN external_conversations AS conv\n               ON conv.id = link.external_conversation_id\n            WHERE link.tenant_id = ?\n              AND ((?::uuid IS NULL AND link.organization_id IS NULL) OR link.organization_id = ?::uuid)\n              AND conv.tenant_id = ?\n              AND ((?::uuid IS NULL AND conv.organization_id IS NULL) OR conv.organization_id = ?::uuid)\n              AND conv.channel_id = ?\n              AND link.direction = 'outbound'\n              AND link.channel_metadata->>'messageId' = ?\n            LIMIT 1`,\n          [\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.channelId,\n            incomingMessageId,\n          ],\n        )\n        if (Array.isArray(sentFolderHit) && sentFolderHit.length > 0) {\n          return {\n            status: 'duplicate',\n            externalConversationId: input.message.externalConversationId,\n            externalMessageId: input.message.externalMessageId,\n          }\n        }\n      } catch (dedupErr) {\n        // Sent-folder dedup is best-effort \u2014 a failure here must not abort\n        // ingest (better a possible duplicate than a lost inbound message).\n        console.warn(\n          '[communication_channels:ingest-inbound] sent-folder dedup query failed, continuing:',\n          dedupErr instanceof Error ? dedupErr.message : dedupErr,\n        )\n      }\n    }\n\n    // Channel + adapter lookup (the channel must exist + be active).\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${input.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${input.channelId} is inactive; refusing to ingest`)\n    }\n\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${input.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (2) ExternalConversation upsert by (channel_id, externalConversationId).\n    const m = input.message\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    let conversationCreated = false\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        subject: m.subject ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        lastMessageAt: m.timestamp ?? new Date(),\n      })\n      em.persist(conversation)\n      conversationCreated = true\n    }\n\n    // (3) ChannelThreadMapping upsert (1:1 with ExternalConversation per tenant).\n    let mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n\n    // Last-activity bump on an existing conversation. Applied AFTER the mapping\n    // lookup, immediately before the flush, so the scalar mutation and its flush\n    // stay adjacent with no query in between (core flush-ordering rule \u2014 a query\n    // between a scalar mutation and `em.flush()` can drop the change under some\n    // flush modes / subscriber configurations).\n    if (\n      !conversationCreated &&\n      m.timestamp &&\n      (!conversation.lastMessageAt || m.timestamp > conversation.lastMessageAt)\n    ) {\n      conversation.lastMessageAt = m.timestamp\n    }\n    // We'll fill `messageThreadId` after composing the platform Message (since the\n    // first inbound message becomes the thread root in the messages module).\n    await em.flush()\n\n    // (3b) Spec B \u2014 layered thread match.\n    //\n    // Resolve the inbound message to an existing platform thread using\n    // (in priority order):\n    //   1. Crypto token in References / In-Reply-To header (high confidence)\n    //   2. Crypto token in body hidden span or plain-text marker (high)\n    //   3. JWZ on Message-Id \u2194 stored `MessageChannelLink.channelMetadata.messageId` (medium)\n    //   4. Subject + participants in last 30 days, same channel (low)\n    //\n    // The matcher returns `null` when nothing hits \u2014 in that case we fall\n    // back to the existing `ChannelThreadMapping`-by-conversation-id lookup\n    // (which also returns null on first-ever inbound, in which case the\n    // compose command opens a new thread).\n    const metaForMatcher = (m.channelMetadata ?? {}) as Record<string, unknown>\n    let threadMatch: ThreadMatch | null = null\n    try {\n      threadMatch = await matchThread(\n        {\n          channelId: input.channelId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          messageId: extractStringFromMeta(metaForMatcher, 'messageId') ?? m.externalMessageId,\n          inReplyTo:\n            m.replyToExternalId ?? extractStringFromMeta(metaForMatcher, 'inReplyTo'),\n          references: extractStringArrayFromMeta(metaForMatcher, 'references'),\n          subject: m.subject ?? '',\n          fromAddress:\n            extractStringFromMeta(metaForMatcher, 'from') ?? m.senderIdentifier,\n          toAddresses: extractStringArrayFromMeta(metaForMatcher, 'to'),\n          ccAddresses: extractStringArrayFromMeta(metaForMatcher, 'cc'),\n          bodyPlain: m.bodyFormat === 'html' ? null : m.body ?? null,\n          bodyHtml: m.bodyFormat === 'html' ? m.body ?? null : null,\n          receivedAt: m.timestamp ?? new Date(),\n        },\n        { em },\n      )\n    } catch (matcherErr) {\n      // Matcher failure must not block ingest \u2014 fall back to the existing\n      // conversation-based thread mapping so the message still lands.\n      console.warn(\n        '[communication_channels:ingest-inbound] thread matcher failed, falling back to conversation mapping:',\n        matcherErr instanceof Error ? matcherErr.message : matcherErr,\n      )\n    }\n\n    // (4) Contact resolution (best-effort, advisory).\n    let contactHint: {\n      matchedPersonId?: string | null\n      email?: string\n      displayName?: string\n    } | null = null\n    try {\n      contactHint = await resolveContact(\n        {\n          adapter,\n          senderIdentifier: m.senderIdentifier,\n          senderDisplayName: m.senderDisplayName,\n          channelMetadata: m.channelMetadata,\n          credentials: {}, // credentials decrypted at the webhook route; resolver doesn't re-fetch\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? input.scope.tenantId,\n          },\n        },\n        { container: ctx.container },\n      )\n    } catch (contactErr) {\n      // Best-effort: contact resolution is advisory and must not abort ingest.\n      // Log like the sibling dedup/matcher catches so a misbehaving resolver is\n      // visible in operator logs instead of failing silently.\n      console.warn(\n        '[communication_channels:ingest-inbound] contact resolution failed, continuing without a CRM match:',\n        contactErr instanceof Error ? contactErr.message : contactErr,\n      )\n      contactHint = null\n    }\n    const matchedPersonId = contactHint?.matchedPersonId ?? null\n    if (matchedPersonId && conversation.contactPersonId !== matchedPersonId) {\n      conversation.contactPersonId = matchedPersonId\n      // Flush this scalar mutation before the system-user lookup below queries the\n      // same EntityManager. SPEC-018: a query between a scalar mutation and its\n      // flush can silently discard the pending UPDATE (mirrors the lastMessageAt\n      // bump above).\n      await em.flush()\n    }\n\n    // (5) Compose the platform Message via the messages module command.\n    //\n    // Sanitize against the `messages` module's validators (max 50_000 char body\n    // + non-empty subject) so real-world emails don't get rejected mid-ingest:\n    //   - HTML emails routinely exceed 50k (Gmail signatures, marketing\n    //     templates, RFC 5322 multipart). Truncate with a marker rather than\n    //     drop the whole message \u2014 the full raw body is still in\n    //     ExternalMessage.rawPayload if needed for forensic / forward use.\n    //   - Some legitimate messages have no subject (notifications, bounce\n    //     digests). Substitute a placeholder instead of failing ingest.\n    const MAX_COMPOSE_BODY = 50_000\n    const TRUNCATE_MARKER =\n      '\\n\\n[\u2026message truncated by Open Mercato \u2014 full body preserved in ExternalMessage.rawPayload]'\n    const rawBody = m.body ?? ''\n    const truncatedBody =\n      rawBody.length > MAX_COMPOSE_BODY\n        ? rawBody.slice(0, MAX_COMPOSE_BODY - TRUNCATE_MARKER.length) + TRUNCATE_MARKER\n        : rawBody\n    const safeSubject = (m.subject ?? '').trim() || '(no subject)'\n\n    const composeInput = {\n      type: `channel.${input.providerKey}`,\n      visibility: 'public' as const,\n      sourceEntityType: 'communication_channels.external_conversation',\n      sourceEntityId: conversation.id,\n      externalEmail: contactHint?.email ?? undefined,\n      externalName: contactHint?.displayName ?? m.senderDisplayName,\n      recipients: mapping?.assignedUserId\n        ? [{ userId: mapping.assignedUserId, type: 'to' as const }]\n        : [],\n      subject: safeSubject,\n      body: truncatedBody,\n      bodyFormat: (m.bodyFormat === 'html' ? 'text' : m.bodyFormat) as 'text' | 'markdown',\n      priority: 'normal' as const,\n      sendViaEmail: false,\n      // Spec B: matcher-resolved thread id takes priority over the existing\n      // conversation-based mapping. Falls through to `mapping?.messageThreadId`\n      // when the matcher returned null (no token / JWZ / subject hit).\n      parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,\n      isDraft: false,\n      // Stable dedup key so a retried ingest (after a transient failure between\n      // compose and the ExternalMessage anchor insert) reuses the message\n      // composed by the first attempt instead of duplicating it. Mirrors the\n      // (channel, externalMessageId) ExternalMessage anchor's natural key.\n      idempotencyKey: m.externalMessageId\n        ? `cc:${input.channelId}:${m.externalMessageId}`\n        : undefined,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId,\n      userId: await resolveCommunicationChannelsSystemUserId(\n        em,\n        input.scope.tenantId,\n        mapping?.assignedUserId ?? null,\n      ),\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const composeResult = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: passthroughCommandCtx(ctx, input.scope),\n      },\n    )\n    const message = composeResult.result\n    if (!message?.id) {\n      throw new Error('messages.messages.compose did not return a message id')\n    }\n\n    // (3 continued) Create or update ChannelThreadMapping now that we have a threadId.\n    if (!mapping) {\n      mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId: message.threadId ?? message.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        externalThreadRef: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(mapping)\n    }\n\n    // (6) Create ExternalMessage + MessageChannelLink (hub-side records).\n    //\n    // The PrimaryKey for both uses `defaultRaw: 'gen_random_uuid()'` \u2014 a\n    // Postgres-side default that doesn't populate the entity's `id` field\n    // until after the INSERT returns. If we let MikroORM generate both, then\n    // `em.create(MessageChannelLink, { externalMessageId: externalMessage.id })`\n    // reads `undefined` for `externalMessage.id` (it hasn't been flushed yet)\n    // and writes NULL to `message_channel_links.external_message_id`,\n    // breaking the FK and causing downstream joins to silently return 0 rows.\n    //\n    // Pre-generating both UUIDs client-side fixes the cross-row reference\n    // problem and keeps the single-transaction flush semantics intact.\n    const externalMessageRowId = randomUUID()\n    const channelLinkRowId = randomUUID()\n    const externalMessage = em.create(ExternalMessage, {\n      id: externalMessageRowId,\n      channelId: input.channelId,\n      conversationId: conversation.id,\n      externalMessageId: m.externalMessageId,\n      direction: 'inbound',\n      senderIdentifier: m.senderIdentifier,\n      senderDisplayName: m.senderDisplayName ?? null,\n      providerTimestamp: m.timestamp,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(externalMessage)\n\n    // Spec B: annotate the link with which thread-matcher strategy resolved\n    // this message (or `'new-thread'` when matcher returned null and we\n    // opened a fresh thread). Surfaced to observability + future UI (\"this\n    // thread match is low-confidence \u2014 confirm or move\").\n    const matcherAnnotatedMetadata: Record<string, unknown> = {\n      ...((m.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n      threadMatchStrategy: threadMatch?.matchedBy ?? 'new-thread',\n      threadMatchConfidence: threadMatch?.confidence ?? 'low',\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      id: channelLinkRowId,\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessageRowId,\n      providerKey: input.providerKey,\n      channelType: input.channelType,\n      direction: 'inbound',\n      deliveryStatus: 'received',\n      channelPayload: m.channelPayload,\n      channelContentType: m.channelContentType,\n      channelMetadata: matcherAnnotatedMetadata,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(channelLink)\n\n    try {\n      await em.flush()\n    } catch (flushErr) {\n      // Concurrency guard: the pre-check at (1) is not atomic with this insert,\n      // so a poll re-fetch racing a push notification (or two push deliveries)\n      // can both pass the check and reach here. The `(channel_id,\n      // external_message_id)` unique index rejects the loser with a 23505. Treat\n      // that as a duplicate \u2014 returning here (instead of throwing) prevents the\n      // message from being dead-lettered and retried forever. The winning job\n      // already recorded the message + link.\n      if (isUniqueViolation(flushErr)) {\n        return {\n          status: 'duplicate',\n          externalConversationId: conversation.id,\n          externalMessageId: m.externalMessageId,\n        }\n      }\n      throw flushErr\n    }\n\n    // (7) Emit events \u2014 order matters for downstream subscribers.\n    if (conversationCreated) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.conversation.created',\n        {\n          conversationId: conversation.id,\n          channelId: input.channelId,\n          providerKey: input.providerKey,\n          channelType: input.channelType,\n          externalConversationId: m.externalConversationId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    if (matchedPersonId) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.contact.resolved',\n        {\n          conversationId: conversation.id,\n          contactPersonId: matchedPersonId,\n          providerKey: input.providerKey,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    await emitCommunicationChannelsEvent(\n      'communication_channels.message.received',\n      {\n        messageId: message.id,\n        externalMessageId: externalMessage.id,\n        channelLinkId: channelLink.id,\n        conversationId: conversation.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        channelType: input.channelType,\n        direction: 'inbound',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'created',\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessage.id,\n      channelLinkId: channelLink.id,\n      threadMappingId: mapping.id,\n      contactPersonId: matchedPersonId,\n    }\n  },\n}\n\n\n/**\n * Build a runtime context for the nested `messages.messages.compose` call.\n *\n * The compose command expects a `CommandRuntimeContext`. For inbound webhook\n * processing there is no platform user; we pass `auth: null` and use the tenant\n * scope from our input.\n */\nfunction passthroughCommandCtx(\n  parent: CommandRuntimeContext,\n  scope: IngestInboundMessageInput['scope'],\n): CommandRuntimeContext {\n  return {\n    container: parent.container,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n}\n\n/**\n * Pull a string value from the provider's `channelMetadata` map. Returns\n * `null` (not `undefined`) when the key is absent or the value isn't a\n * string \u2014 keeps the matcher's input shape predictable.\n */\nfunction extractStringFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string | null {\n  const value = meta[key]\n  if (typeof value === 'string' && value.length > 0) return value\n  return null\n}\n\n/**\n * Pull a string[] value from the provider's `channelMetadata` map.\n * Filters out non-string entries defensively. Returns an empty array\n * when the key is absent or the value isn't an array.\n */\nfunction extractStringArrayFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string[] {\n  const value = meta[key]\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is string => typeof item === 'string')\n}\n\nregisterCommand(ingestInboundMessageCommand)\n\nexport default ingestInboundMessageCommand\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAG/B,SAAS,mBAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gDAAgD;AACzD,SAAS,yBAAyB;AAElC,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA,EACD,SAAS;AACX,CAAC;AAcM,MAAM,mDAAmD;AAmBhE,MAAM,8BAAqG;AAAA,EACzG,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAE9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAMA,UAAM,mBAAmB,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,mBAAmB,MAAM,QAAQ;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,wBAAwB,iBAAiB;AAAA,QACzC,mBAAmB,iBAAiB;AAAA,MACtC;AAAA,IACF;AAaA,UAAM,qBAAqB,MAAM;AAC/B,YAAM,WAAY,MAAM,QAAQ,iBAAyD;AACzF,UAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,aAAO;AAAA,IACT,GAAG;AACH,QAAI,mBAAmB;AAIrB,UAAI;AACF,cAAM,gBAAgB,MAAM,GAAG,cAAc,EAAE;AAAA,UAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWA;AAAA,YACE,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS,GAAG;AAC5D,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,wBAAwB,MAAM,QAAQ;AAAA,YACtC,mBAAmB,MAAM,QAAQ;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,UAAU;AAGjB,gBAAQ;AAAA,UACN;AAAA,UACA,oBAAoB,QAAQ,SAAS,UAAU;AAAA,QACjD;AAAA,MACF;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,MAAM,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACpF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,MAAM,SAAS,kCAAkC;AAAA,IACzF;AAEA,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,MAAM,WAAW;AAAA,MAE/E;AAAA,IACF;AAGA,UAAM,IAAI,MAAM;AAChB,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,sBAAsB;AAC1B,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,SAAS,EAAE,WAAW;AAAA,QACtB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,eAAe,EAAE,aAAa,oBAAI,KAAK;AAAA,MACzC,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,4BAAsB;AAAA,IACxB;AAGA,QAAI,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAOA,QACE,CAAC,uBACD,EAAE,cACD,CAAC,aAAa,iBAAiB,EAAE,YAAY,aAAa,gBAC3D;AACA,mBAAa,gBAAgB,EAAE;AAAA,IACjC;AAGA,UAAM,GAAG,MAAM;AAef,UAAM,iBAAkB,EAAE,mBAAmB,CAAC;AAC9C,QAAI,cAAkC;AACtC,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,sBAAsB,gBAAgB,WAAW,KAAK,EAAE;AAAA,UACnE,WACE,EAAE,qBAAqB,sBAAsB,gBAAgB,WAAW;AAAA,UAC1E,YAAY,2BAA2B,gBAAgB,YAAY;AAAA,UACnE,SAAS,EAAE,WAAW;AAAA,UACtB,aACE,sBAAsB,gBAAgB,MAAM,KAAK,EAAE;AAAA,UACrD,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,WAAW,EAAE,eAAe,SAAS,OAAO,EAAE,QAAQ;AAAA,UACtD,UAAU,EAAE,eAAe,SAAS,EAAE,QAAQ,OAAO;AAAA,UACrD,YAAY,EAAE,aAAa,oBAAI,KAAK;AAAA,QACtC;AAAA,QACA,EAAE,GAAG;AAAA,MACP;AAAA,IACF,SAAS,YAAY;AAGnB,cAAQ;AAAA,QACN;AAAA,QACA,sBAAsB,QAAQ,WAAW,UAAU;AAAA,MACrD;AAAA,IACF;AAGA,QAAI,cAIO;AACX,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE;AAAA,UACA,kBAAkB,EAAE;AAAA,UACpB,mBAAmB,EAAE;AAAA,UACrB,iBAAiB,EAAE;AAAA,UACnB,aAAa,CAAC;AAAA;AAAA,UACd,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,EAAE,WAAW,IAAI,UAAU;AAAA,MAC7B;AAAA,IACF,SAAS,YAAY;AAInB,cAAQ;AAAA,QACN;AAAA,QACA,sBAAsB,QAAQ,WAAW,UAAU;AAAA,MACrD;AACA,oBAAc;AAAA,IAChB;AACA,UAAM,kBAAkB,aAAa,mBAAmB;AACxD,QAAI,mBAAmB,aAAa,oBAAoB,iBAAiB;AACvE,mBAAa,kBAAkB;AAK/B,YAAM,GAAG,MAAM;AAAA,IACjB;AAYA,UAAM,mBAAmB;AACzB,UAAM,kBACJ;AACF,UAAM,UAAU,EAAE,QAAQ;AAC1B,UAAM,gBACJ,QAAQ,SAAS,mBACb,QAAQ,MAAM,GAAG,mBAAmB,gBAAgB,MAAM,IAAI,kBAC9D;AACN,UAAM,eAAe,EAAE,WAAW,IAAI,KAAK,KAAK;AAEhD,UAAM,eAAe;AAAA,MACnB,MAAM,WAAW,MAAM,WAAW;AAAA,MAClC,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB,gBAAgB,aAAa;AAAA,MAC7B,eAAe,aAAa,SAAS;AAAA,MACrC,cAAc,aAAa,eAAe,EAAE;AAAA,MAC5C,YAAY,SAAS,iBACjB,CAAC,EAAE,QAAQ,QAAQ,gBAAgB,MAAM,KAAc,CAAC,IACxD,CAAC;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,YAAa,EAAE,eAAe,SAAS,SAAS,EAAE;AAAA,MAClD,UAAU;AAAA,MACV,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,iBAAiB,aAAa,mBAAmB,SAAS;AAAA,MAC1D,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKT,gBAAgB,EAAE,oBACd,MAAM,MAAM,SAAS,IAAI,EAAE,iBAAiB,KAC5C;AAAA,MACJ,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,SAAS,kBAAkB;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,gBAAgB,MAAM,WAAW;AAAA,MACrC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,sBAAsB,KAAK,MAAM,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAGA,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,OAAO,sBAAsB;AAAA,QACxC,wBAAwB,aAAa;AAAA,QACrC,iBAAiB,QAAQ,YAAY,QAAQ;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAcA,UAAM,uBAAuB,WAAW;AACxC,UAAM,mBAAmB,WAAW;AACpC,UAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,MACjD,IAAI;AAAA,MACJ,WAAW,MAAM;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,mBAAmB,EAAE;AAAA,MACrB,WAAW;AAAA,MACX,kBAAkB,EAAE;AAAA,MACpB,mBAAmB,EAAE,qBAAqB;AAAA,MAC1C,mBAAmB,EAAE;AAAA,MACrB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,eAAe;AAM1B,UAAM,2BAAoD;AAAA,MACxD,GAAK,EAAE,mBAA2D,CAAC;AAAA,MACnE,qBAAqB,aAAa,aAAa;AAAA,MAC/C,uBAAuB,aAAa,cAAc;AAAA,IACpD;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD,IAAI;AAAA,MACJ,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB,EAAE;AAAA,MAClB,oBAAoB,EAAE;AAAA,MACtB,iBAAiB;AAAA,MACjB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,WAAW;AAEtB,QAAI;AACF,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,UAAU;AAQjB,UAAI,kBAAkB,QAAQ,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,wBAAwB,aAAa;AAAA,UACrC,mBAAmB,EAAE;AAAA,QACvB;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,qBAAqB;AACvB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB,wBAAwB,EAAE;AAAA,UAC1B,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,iBAAiB;AACnB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,iBAAiB;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,mBAAmB,gBAAgB;AAAA,QACnC,eAAe,YAAY;AAAA,QAC3B,gBAAgB,aAAa;AAAA,QAC7B,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB,gBAAgB;AAAA,MACnC,eAAe,YAAY;AAAA,MAC3B,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF;AAUA,SAAS,sBACP,QACA,OACuB;AACvB,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AACF;AAOA,SAAS,sBACP,MACA,KACe;AACf,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAO;AACT;AAOA,SAAS,2BACP,MACA,KACU;AACV,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,gBAAgB,2BAA2B;AAE3C,IAAO,iCAAQ;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus, CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { resolveContact } from '../lib/contact-resolver'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { matchThread, type ThreadMatch } from '../lib/thread-matcher'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { normalizedInboundMessageSchema } from '../data/validators'\nimport { resolveCommunicationChannelsSystemUserId } from '../lib/system-user'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'ingest-inbound-message' })\n\nconst ingestInputSchema = z.object({\n  channelId: z.string().uuid(),\n  providerKey: z.string().min(1),\n  channelType: z.string().min(1),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  message: normalizedInboundMessageSchema,\n})\n\nexport type IngestInboundMessageInput = z.infer<typeof ingestInputSchema>\n\nexport type IngestInboundMessageResult = {\n  status: 'created' | 'duplicate'\n  messageId?: string\n  externalConversationId?: string\n  externalMessageId?: string\n  channelLinkId?: string\n  threadMappingId?: string\n  contactPersonId?: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID = 'communication_channels.message.ingest_inbound'\n\n/**\n * Idempotently ingest a normalized inbound channel message.\n *\n * Steps (per SPEC-045d \u00A76):\n *   1. Dedup by `(channel_id, external_message_id)` \u2014 if a MessageChannelLink already\n *      exists for that pair, return `{ status: 'duplicate' }` without side effects.\n *   2. Create or load `ExternalConversation` by `(channel_id, external_conversation_id)`.\n *   3. Create or load `ChannelThreadMapping` (1:1 with ExternalConversation).\n *   4. Resolve CRM contact via adapter + QueryEngine (best-effort).\n *   5. Compose the platform `Message` via `messages.messages.compose` (separate transaction).\n *   6. Create `ExternalMessage` + `MessageChannelLink`.\n *   7. Emit `communication_channels.message.received` (and `.conversation.created` / `.contact.resolved` when applicable).\n *\n * The two-transaction model (compose-message-then-record-link) is acceptable for v1;\n * the link's unique-on-message-id constraint is the safety net against orphans. See\n * the pre-implementation analysis for a discussion of single-transaction alternatives.\n */\nconst ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, IngestInboundMessageResult> = {\n  id: COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = ingestInputSchema.parse(rawInput) as IngestInboundMessageInput\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Dedup: short-circuit if we've already processed this provider message.\n    // The unique constraint is on `messageId`, not (channel, externalMessageId).\n    // We must dedup by joining against ExternalMessage which IS uniquely indexed by\n    // (channel_id, external_message_id). Hub-side dedup is the authoritative gate.\n    const existingExternal = await findOneWithDecryption(\n      em,\n      ExternalMessage,\n      {\n        channelId: input.channelId,\n        externalMessageId: input.message.externalMessageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (existingExternal) {\n      return {\n        status: 'duplicate',\n        externalConversationId: existingExternal.conversationId,\n        externalMessageId: existingExternal.id,\n      }\n    }\n\n    // (1b) Spec B \u00A7 Sent-folder dedup.\n    //\n    // When an outbound message lands in the user's IMAP Sent folder (or\n    // when Gmail's \"send and archive\" deposits it in All Mail), the next\n    // poll will re-fetch it from INBOX as if it were inbound. Skip it\n    // here using the RFC 5322 `Message-ID` header \u2014 we recorded it on the\n    // outbound `MessageChannelLink.channelMetadata.messageId` at send time.\n    //\n    // We dedup ONLY on outbound links (direction='outbound') for the same\n    // channel \u2014 that way an inbound copy of someone ELSE's email that\n    // happens to share a Message-ID is still ingested normally.\n    const incomingMessageId = (() => {\n      const fromMeta = (input.message.channelMetadata as Record<string, unknown> | undefined)?.messageId\n      if (typeof fromMeta === 'string' && fromMeta.length > 0) return fromMeta\n      return null\n    })()\n    if (incomingMessageId) {\n      // MikroORM v7 dropped the Knex builder in favour of Kysely/raw SQL.\n      // We use a positional-placeholder raw query for the JSONB\n      // `channel_metadata->>messageId` comparison.\n      try {\n        const sentFolderHit = await em.getConnection().execute<Array<{ id: string }>>(\n          `SELECT link.id FROM message_channel_links AS link\n             INNER JOIN external_conversations AS conv\n               ON conv.id = link.external_conversation_id\n            WHERE link.tenant_id = ?\n              AND ((?::uuid IS NULL AND link.organization_id IS NULL) OR link.organization_id = ?::uuid)\n              AND conv.tenant_id = ?\n              AND ((?::uuid IS NULL AND conv.organization_id IS NULL) OR conv.organization_id = ?::uuid)\n              AND conv.channel_id = ?\n              AND link.direction = 'outbound'\n              AND link.channel_metadata->>'messageId' = ?\n            LIMIT 1`,\n          [\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.channelId,\n            incomingMessageId,\n          ],\n        )\n        if (Array.isArray(sentFolderHit) && sentFolderHit.length > 0) {\n          return {\n            status: 'duplicate',\n            externalConversationId: input.message.externalConversationId,\n            externalMessageId: input.message.externalMessageId,\n          }\n        }\n      } catch (dedupErr) {\n        // Sent-folder dedup is best-effort \u2014 a failure here must not abort\n        // ingest (better a possible duplicate than a lost inbound message).\n        logger.warn('sent-folder dedup query failed, continuing', { err: dedupErr })\n      }\n    }\n\n    // Channel + adapter lookup (the channel must exist + be active).\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${input.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${input.channelId} is inactive; refusing to ingest`)\n    }\n\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${input.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (2) ExternalConversation upsert by (channel_id, externalConversationId).\n    const m = input.message\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    let conversationCreated = false\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        subject: m.subject ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        lastMessageAt: m.timestamp ?? new Date(),\n      })\n      em.persist(conversation)\n      conversationCreated = true\n    }\n\n    // (3) ChannelThreadMapping upsert (1:1 with ExternalConversation per tenant).\n    let mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n\n    // Last-activity bump on an existing conversation. Applied AFTER the mapping\n    // lookup, immediately before the flush, so the scalar mutation and its flush\n    // stay adjacent with no query in between (core flush-ordering rule \u2014 a query\n    // between a scalar mutation and `em.flush()` can drop the change under some\n    // flush modes / subscriber configurations).\n    if (\n      !conversationCreated &&\n      m.timestamp &&\n      (!conversation.lastMessageAt || m.timestamp > conversation.lastMessageAt)\n    ) {\n      conversation.lastMessageAt = m.timestamp\n    }\n    // We'll fill `messageThreadId` after composing the platform Message (since the\n    // first inbound message becomes the thread root in the messages module).\n    await em.flush()\n\n    // (3b) Spec B \u2014 layered thread match.\n    //\n    // Resolve the inbound message to an existing platform thread using\n    // (in priority order):\n    //   1. Crypto token in References / In-Reply-To header (high confidence)\n    //   2. Crypto token in body hidden span or plain-text marker (high)\n    //   3. JWZ on Message-Id \u2194 stored `MessageChannelLink.channelMetadata.messageId` (medium)\n    //   4. Subject + participants in last 30 days, same channel (low)\n    //\n    // The matcher returns `null` when nothing hits \u2014 in that case we fall\n    // back to the existing `ChannelThreadMapping`-by-conversation-id lookup\n    // (which also returns null on first-ever inbound, in which case the\n    // compose command opens a new thread).\n    const metaForMatcher = (m.channelMetadata ?? {}) as Record<string, unknown>\n    let threadMatch: ThreadMatch | null = null\n    try {\n      threadMatch = await matchThread(\n        {\n          channelId: input.channelId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          messageId: extractStringFromMeta(metaForMatcher, 'messageId') ?? m.externalMessageId,\n          inReplyTo:\n            m.replyToExternalId ?? extractStringFromMeta(metaForMatcher, 'inReplyTo'),\n          references: extractStringArrayFromMeta(metaForMatcher, 'references'),\n          subject: m.subject ?? '',\n          fromAddress:\n            extractStringFromMeta(metaForMatcher, 'from') ?? m.senderIdentifier,\n          toAddresses: extractStringArrayFromMeta(metaForMatcher, 'to'),\n          ccAddresses: extractStringArrayFromMeta(metaForMatcher, 'cc'),\n          bodyPlain: m.bodyFormat === 'html' ? null : m.body ?? null,\n          bodyHtml: m.bodyFormat === 'html' ? m.body ?? null : null,\n          receivedAt: m.timestamp ?? new Date(),\n        },\n        { em },\n      )\n    } catch (matcherErr) {\n      // Matcher failure must not block ingest \u2014 fall back to the existing\n      // conversation-based thread mapping so the message still lands.\n      logger.warn('thread matcher failed, falling back to conversation mapping', { err: matcherErr })\n    }\n\n    // (4) Contact resolution (best-effort, advisory).\n    let contactHint: {\n      matchedPersonId?: string | null\n      email?: string\n      displayName?: string\n    } | null = null\n    try {\n      contactHint = await resolveContact(\n        {\n          adapter,\n          senderIdentifier: m.senderIdentifier,\n          senderDisplayName: m.senderDisplayName,\n          channelMetadata: m.channelMetadata,\n          credentials: {}, // credentials decrypted at the webhook route; resolver doesn't re-fetch\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? input.scope.tenantId,\n          },\n        },\n        { container: ctx.container },\n      )\n    } catch (contactErr) {\n      // Best-effort: contact resolution is advisory and must not abort ingest.\n      // Log like the sibling dedup/matcher catches so a misbehaving resolver is\n      // visible in operator logs instead of failing silently.\n      logger.warn('contact resolution failed, continuing without a CRM match', { err: contactErr })\n      contactHint = null\n    }\n    const matchedPersonId = contactHint?.matchedPersonId ?? null\n    if (matchedPersonId && conversation.contactPersonId !== matchedPersonId) {\n      conversation.contactPersonId = matchedPersonId\n      // Flush this scalar mutation before the system-user lookup below queries the\n      // same EntityManager. SPEC-018: a query between a scalar mutation and its\n      // flush can silently discard the pending UPDATE (mirrors the lastMessageAt\n      // bump above).\n      await em.flush()\n    }\n\n    // (5) Compose the platform Message via the messages module command.\n    //\n    // Sanitize against the `messages` module's validators (max 50_000 char body\n    // + non-empty subject) so real-world emails don't get rejected mid-ingest:\n    //   - HTML emails routinely exceed 50k (Gmail signatures, marketing\n    //     templates, RFC 5322 multipart). Truncate with a marker rather than\n    //     drop the whole message \u2014 the full raw body is still in\n    //     ExternalMessage.rawPayload if needed for forensic / forward use.\n    //   - Some legitimate messages have no subject (notifications, bounce\n    //     digests). Substitute a placeholder instead of failing ingest.\n    const MAX_COMPOSE_BODY = 50_000\n    const TRUNCATE_MARKER =\n      '\\n\\n[\u2026message truncated by Open Mercato \u2014 full body preserved in ExternalMessage.rawPayload]'\n    const rawBody = m.body ?? ''\n    const truncatedBody =\n      rawBody.length > MAX_COMPOSE_BODY\n        ? rawBody.slice(0, MAX_COMPOSE_BODY - TRUNCATE_MARKER.length) + TRUNCATE_MARKER\n        : rawBody\n    const safeSubject = (m.subject ?? '').trim() || '(no subject)'\n\n    const composeInput = {\n      type: `channel.${input.providerKey}`,\n      visibility: 'public' as const,\n      sourceEntityType: 'communication_channels.external_conversation',\n      sourceEntityId: conversation.id,\n      externalEmail: contactHint?.email ?? undefined,\n      externalName: contactHint?.displayName ?? m.senderDisplayName,\n      recipients: mapping?.assignedUserId\n        ? [{ userId: mapping.assignedUserId, type: 'to' as const }]\n        : [],\n      subject: safeSubject,\n      body: truncatedBody,\n      bodyFormat: (m.bodyFormat === 'html' ? 'text' : m.bodyFormat) as 'text' | 'markdown',\n      priority: 'normal' as const,\n      sendViaEmail: false,\n      // Spec B: matcher-resolved thread id takes priority over the existing\n      // conversation-based mapping. Falls through to `mapping?.messageThreadId`\n      // when the matcher returned null (no token / JWZ / subject hit).\n      parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,\n      isDraft: false,\n      // Stable dedup key so a retried ingest (after a transient failure between\n      // compose and the ExternalMessage anchor insert) reuses the message\n      // composed by the first attempt instead of duplicating it. Mirrors the\n      // (channel, externalMessageId) ExternalMessage anchor's natural key.\n      idempotencyKey: m.externalMessageId\n        ? `cc:${input.channelId}:${m.externalMessageId}`\n        : undefined,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId,\n      userId: await resolveCommunicationChannelsSystemUserId(\n        em,\n        input.scope.tenantId,\n        mapping?.assignedUserId ?? null,\n      ),\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const composeResult = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: passthroughCommandCtx(ctx, input.scope),\n      },\n    )\n    const message = composeResult.result\n    if (!message?.id) {\n      throw new Error('messages.messages.compose did not return a message id')\n    }\n\n    // (3 continued) Create or update ChannelThreadMapping now that we have a threadId.\n    if (!mapping) {\n      mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId: message.threadId ?? message.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        externalThreadRef: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(mapping)\n    }\n\n    // (6) Create ExternalMessage + MessageChannelLink (hub-side records).\n    //\n    // The PrimaryKey for both uses `defaultRaw: 'gen_random_uuid()'` \u2014 a\n    // Postgres-side default that doesn't populate the entity's `id` field\n    // until after the INSERT returns. If we let MikroORM generate both, then\n    // `em.create(MessageChannelLink, { externalMessageId: externalMessage.id })`\n    // reads `undefined` for `externalMessage.id` (it hasn't been flushed yet)\n    // and writes NULL to `message_channel_links.external_message_id`,\n    // breaking the FK and causing downstream joins to silently return 0 rows.\n    //\n    // Pre-generating both UUIDs client-side fixes the cross-row reference\n    // problem and keeps the single-transaction flush semantics intact.\n    const externalMessageRowId = randomUUID()\n    const channelLinkRowId = randomUUID()\n    const externalMessage = em.create(ExternalMessage, {\n      id: externalMessageRowId,\n      channelId: input.channelId,\n      conversationId: conversation.id,\n      externalMessageId: m.externalMessageId,\n      direction: 'inbound',\n      senderIdentifier: m.senderIdentifier,\n      senderDisplayName: m.senderDisplayName ?? null,\n      providerTimestamp: m.timestamp,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(externalMessage)\n\n    // Spec B: annotate the link with which thread-matcher strategy resolved\n    // this message (or `'new-thread'` when matcher returned null and we\n    // opened a fresh thread). Surfaced to observability + future UI (\"this\n    // thread match is low-confidence \u2014 confirm or move\").\n    const matcherAnnotatedMetadata: Record<string, unknown> = {\n      ...((m.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n      threadMatchStrategy: threadMatch?.matchedBy ?? 'new-thread',\n      threadMatchConfidence: threadMatch?.confidence ?? 'low',\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      id: channelLinkRowId,\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessageRowId,\n      providerKey: input.providerKey,\n      channelType: input.channelType,\n      direction: 'inbound',\n      deliveryStatus: 'received',\n      channelPayload: m.channelPayload,\n      channelContentType: m.channelContentType,\n      channelMetadata: matcherAnnotatedMetadata,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(channelLink)\n\n    try {\n      await em.flush()\n    } catch (flushErr) {\n      // Concurrency guard: the pre-check at (1) is not atomic with this insert,\n      // so a poll re-fetch racing a push notification (or two push deliveries)\n      // can both pass the check and reach here. The `(channel_id,\n      // external_message_id)` unique index rejects the loser with a 23505. Treat\n      // that as a duplicate \u2014 returning here (instead of throwing) prevents the\n      // message from being dead-lettered and retried forever. The winning job\n      // already recorded the message + link.\n      if (isUniqueViolation(flushErr)) {\n        return {\n          status: 'duplicate',\n          externalConversationId: conversation.id,\n          externalMessageId: m.externalMessageId,\n        }\n      }\n      throw flushErr\n    }\n\n    // (7) Emit events \u2014 order matters for downstream subscribers.\n    if (conversationCreated) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.conversation.created',\n        {\n          conversationId: conversation.id,\n          channelId: input.channelId,\n          providerKey: input.providerKey,\n          channelType: input.channelType,\n          externalConversationId: m.externalConversationId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    if (matchedPersonId) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.contact.resolved',\n        {\n          conversationId: conversation.id,\n          contactPersonId: matchedPersonId,\n          providerKey: input.providerKey,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    await emitCommunicationChannelsEvent(\n      'communication_channels.message.received',\n      {\n        messageId: message.id,\n        externalMessageId: externalMessage.id,\n        channelLinkId: channelLink.id,\n        conversationId: conversation.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        channelType: input.channelType,\n        direction: 'inbound',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'created',\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessage.id,\n      channelLinkId: channelLink.id,\n      threadMappingId: mapping.id,\n      contactPersonId: matchedPersonId,\n    }\n  },\n}\n\n\n/**\n * Build a runtime context for the nested `messages.messages.compose` call.\n *\n * The compose command expects a `CommandRuntimeContext`. For inbound webhook\n * processing there is no platform user; we pass `auth: null` and use the tenant\n * scope from our input.\n */\nfunction passthroughCommandCtx(\n  parent: CommandRuntimeContext,\n  scope: IngestInboundMessageInput['scope'],\n): CommandRuntimeContext {\n  return {\n    container: parent.container,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n}\n\n/**\n * Pull a string value from the provider's `channelMetadata` map. Returns\n * `null` (not `undefined`) when the key is absent or the value isn't a\n * string \u2014 keeps the matcher's input shape predictable.\n */\nfunction extractStringFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string | null {\n  const value = meta[key]\n  if (typeof value === 'string' && value.length > 0) return value\n  return null\n}\n\n/**\n * Pull a string[] value from the provider's `channelMetadata` map.\n * Filters out non-string entries defensively. Returns an empty array\n * when the key is absent or the value isn't an array.\n */\nfunction extractStringArrayFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string[] {\n  const value = meta[key]\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is string => typeof item === 'string')\n}\n\nregisterCommand(ingestInboundMessageCommand)\n\nexport default ingestInboundMessageCommand\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAG/B,SAAS,mBAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gDAAgD;AACzD,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAEnG,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA,EACD,SAAS;AACX,CAAC;AAcM,MAAM,mDAAmD;AAmBhE,MAAM,8BAAqG;AAAA,EACzG,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAE9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAMA,UAAM,mBAAmB,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,mBAAmB,MAAM,QAAQ;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,wBAAwB,iBAAiB;AAAA,QACzC,mBAAmB,iBAAiB;AAAA,MACtC;AAAA,IACF;AAaA,UAAM,qBAAqB,MAAM;AAC/B,YAAM,WAAY,MAAM,QAAQ,iBAAyD;AACzF,UAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,aAAO;AAAA,IACT,GAAG;AACH,QAAI,mBAAmB;AAIrB,UAAI;AACF,cAAM,gBAAgB,MAAM,GAAG,cAAc,EAAE;AAAA,UAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWA;AAAA,YACE,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS,GAAG;AAC5D,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,wBAAwB,MAAM,QAAQ;AAAA,YACtC,mBAAmB,MAAM,QAAQ;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,UAAU;AAGjB,eAAO,KAAK,8CAA8C,EAAE,KAAK,SAAS,CAAC;AAAA,MAC7E;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,MAAM,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACpF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,MAAM,SAAS,kCAAkC;AAAA,IACzF;AAEA,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,MAAM,WAAW;AAAA,MAE/E;AAAA,IACF;AAGA,UAAM,IAAI,MAAM;AAChB,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,sBAAsB;AAC1B,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,SAAS,EAAE,WAAW;AAAA,QACtB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,eAAe,EAAE,aAAa,oBAAI,KAAK;AAAA,MACzC,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,4BAAsB;AAAA,IACxB;AAGA,QAAI,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAOA,QACE,CAAC,uBACD,EAAE,cACD,CAAC,aAAa,iBAAiB,EAAE,YAAY,aAAa,gBAC3D;AACA,mBAAa,gBAAgB,EAAE;AAAA,IACjC;AAGA,UAAM,GAAG,MAAM;AAef,UAAM,iBAAkB,EAAE,mBAAmB,CAAC;AAC9C,QAAI,cAAkC;AACtC,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,sBAAsB,gBAAgB,WAAW,KAAK,EAAE;AAAA,UACnE,WACE,EAAE,qBAAqB,sBAAsB,gBAAgB,WAAW;AAAA,UAC1E,YAAY,2BAA2B,gBAAgB,YAAY;AAAA,UACnE,SAAS,EAAE,WAAW;AAAA,UACtB,aACE,sBAAsB,gBAAgB,MAAM,KAAK,EAAE;AAAA,UACrD,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,WAAW,EAAE,eAAe,SAAS,OAAO,EAAE,QAAQ;AAAA,UACtD,UAAU,EAAE,eAAe,SAAS,EAAE,QAAQ,OAAO;AAAA,UACrD,YAAY,EAAE,aAAa,oBAAI,KAAK;AAAA,QACtC;AAAA,QACA,EAAE,GAAG;AAAA,MACP;AAAA,IACF,SAAS,YAAY;AAGnB,aAAO,KAAK,+DAA+D,EAAE,KAAK,WAAW,CAAC;AAAA,IAChG;AAGA,QAAI,cAIO;AACX,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE;AAAA,UACA,kBAAkB,EAAE;AAAA,UACpB,mBAAmB,EAAE;AAAA,UACrB,iBAAiB,EAAE;AAAA,UACnB,aAAa,CAAC;AAAA;AAAA,UACd,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,EAAE,WAAW,IAAI,UAAU;AAAA,MAC7B;AAAA,IACF,SAAS,YAAY;AAInB,aAAO,KAAK,6DAA6D,EAAE,KAAK,WAAW,CAAC;AAC5F,oBAAc;AAAA,IAChB;AACA,UAAM,kBAAkB,aAAa,mBAAmB;AACxD,QAAI,mBAAmB,aAAa,oBAAoB,iBAAiB;AACvE,mBAAa,kBAAkB;AAK/B,YAAM,GAAG,MAAM;AAAA,IACjB;AAYA,UAAM,mBAAmB;AACzB,UAAM,kBACJ;AACF,UAAM,UAAU,EAAE,QAAQ;AAC1B,UAAM,gBACJ,QAAQ,SAAS,mBACb,QAAQ,MAAM,GAAG,mBAAmB,gBAAgB,MAAM,IAAI,kBAC9D;AACN,UAAM,eAAe,EAAE,WAAW,IAAI,KAAK,KAAK;AAEhD,UAAM,eAAe;AAAA,MACnB,MAAM,WAAW,MAAM,WAAW;AAAA,MAClC,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB,gBAAgB,aAAa;AAAA,MAC7B,eAAe,aAAa,SAAS;AAAA,MACrC,cAAc,aAAa,eAAe,EAAE;AAAA,MAC5C,YAAY,SAAS,iBACjB,CAAC,EAAE,QAAQ,QAAQ,gBAAgB,MAAM,KAAc,CAAC,IACxD,CAAC;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,YAAa,EAAE,eAAe,SAAS,SAAS,EAAE;AAAA,MAClD,UAAU;AAAA,MACV,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,iBAAiB,aAAa,mBAAmB,SAAS;AAAA,MAC1D,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKT,gBAAgB,EAAE,oBACd,MAAM,MAAM,SAAS,IAAI,EAAE,iBAAiB,KAC5C;AAAA,MACJ,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,SAAS,kBAAkB;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,gBAAgB,MAAM,WAAW;AAAA,MACrC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,sBAAsB,KAAK,MAAM,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAGA,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,OAAO,sBAAsB;AAAA,QACxC,wBAAwB,aAAa;AAAA,QACrC,iBAAiB,QAAQ,YAAY,QAAQ;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAcA,UAAM,uBAAuB,WAAW;AACxC,UAAM,mBAAmB,WAAW;AACpC,UAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,MACjD,IAAI;AAAA,MACJ,WAAW,MAAM;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,mBAAmB,EAAE;AAAA,MACrB,WAAW;AAAA,MACX,kBAAkB,EAAE;AAAA,MACpB,mBAAmB,EAAE,qBAAqB;AAAA,MAC1C,mBAAmB,EAAE;AAAA,MACrB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,eAAe;AAM1B,UAAM,2BAAoD;AAAA,MACxD,GAAK,EAAE,mBAA2D,CAAC;AAAA,MACnE,qBAAqB,aAAa,aAAa;AAAA,MAC/C,uBAAuB,aAAa,cAAc;AAAA,IACpD;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD,IAAI;AAAA,MACJ,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB,EAAE;AAAA,MAClB,oBAAoB,EAAE;AAAA,MACtB,iBAAiB;AAAA,MACjB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,WAAW;AAEtB,QAAI;AACF,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,UAAU;AAQjB,UAAI,kBAAkB,QAAQ,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,wBAAwB,aAAa;AAAA,UACrC,mBAAmB,EAAE;AAAA,QACvB;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,qBAAqB;AACvB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB,wBAAwB,EAAE;AAAA,UAC1B,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,iBAAiB;AACnB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,iBAAiB;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,mBAAmB,gBAAgB;AAAA,QACnC,eAAe,YAAY;AAAA,QAC3B,gBAAgB,aAAa;AAAA,QAC7B,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB,gBAAgB;AAAA,MACnC,eAAe,YAAY;AAAA,MAC3B,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF;AAUA,SAAS,sBACP,QACA,OACuB;AACvB,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AACF;AAOA,SAAS,sBACP,MACA,KACe;AACf,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAO;AACT;AAOA,SAAS,2BACP,MACA,KACU;AACV,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,gBAAgB,2BAA2B;AAE3C,IAAO,iCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/push-unregister.js

@@ -5,6 +5,8 @@ import { getChannelAdapterRegistry } from "../lib/adapter-registry-singleton.js"
 import { refreshCredentialsIfNeeded } from "../lib/credential-refresh.js";
 import { POLLING_ONLY_DEFAULT_INTERVAL_SECONDS } from "../lib/connect-channel.js";
 import { emitCommunicationChannelsEvent } from "../events.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "push-unregister" });
 const pushUnregisterSchema = z.object({
   channelId: z.string().uuid()
 });
@@ -72,9 +74,7 @@ async function pushUnregister(params) {
     });
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.warn(
-      `[push-unregister] adapter.unregisterPush failed for channel ${channel.id}: ${message}`
-    );
+    logger.warn("adapter.unregisterPush failed for channel", { channelId: channel.id, reason: message });
     return {
       channelId: channel.id,
       status: "failed",

package/dist/modules/communication_channels/commands/push-unregister.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/push-unregister.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { AwilixContainer } from 'awilix'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../data/entities'\nimport { getChannelAdapterRegistry } from '../lib/adapter-registry-singleton'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { POLLING_ONLY_DEFAULT_INTERVAL_SECONDS } from '../lib/connect-channel'\nimport { emitCommunicationChannelsEvent } from '../events'\n\n/**\n * Spec C \u00A7 Phase C5 \u2014 Tear down a previously-registered push delivery.\n *\n * Called from `disconnect-channel.ts` (per-user disconnect path) so the\n * provider-side `users.watch` subscription doesn't keep firing\n * notifications at a webhook that no longer recognises the channel.\n *\n * Idempotent + best-effort: a missing registration, a 404 from the provider,\n * or any adapter error is logged but never raised. The caller still proceeds\n * with the disconnect (the channel row is cleared regardless of whether the\n * provider-side teardown succeeded).\n *\n * Companion to `commands/push-register.ts` \u2014 same lib-style helper shape,\n * not a `registerCommand`-style command (push lifecycle has no undo).\n */\n\nexport const pushUnregisterSchema = z.object({\n  channelId: z.string().uuid(),\n})\n\nexport interface PushUnregisterScope {\n  tenantId: string\n  organizationId: string\n  userId?: string | null\n}\n\nexport interface PushUnregisterResult {\n  channelId: string\n  status: 'unregistered' | 'noop' | 'failed'\n  error?: { code: string; message: string }\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\nexport async function pushUnregister(params: {\n  container: AwilixContainer\n  scope: PushUnregisterScope\n  input: { channelId: string }\n}): Promise<PushUnregisterResult> {\n  const input = pushUnregisterSchema.parse(params.input)\n  const { container, scope } = params\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: input.channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) {\n    return { channelId: input.channelId, status: 'noop' }\n  }\n\n  const adapter = getChannelAdapterRegistry().get(channel.providerKey)\n  if (!adapter || typeof adapter.unregisterPush !== 'function') {\n    return { channelId: channel.id, status: 'noop' }\n  }\n\n  const channelState = (channel.channelState as Record<string, unknown> | null) ?? {}\n  const pushStatus = typeof channelState.pushStatus === 'string' ? channelState.pushStatus : null\n  if (!pushStatus || pushStatus === 'inactive') {\n    return { channelId: channel.id, status: 'noop' }\n  }\n\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  try {\n    const refreshed = await refreshCredentialsIfNeeded(\n      { adapter, channelId: channel.id, credentials, scope: credentialsScope },\n      { credentialsService },\n    )\n    credentials = refreshed.credentials\n  } catch {\n    // Refresh failure is non-fatal \u2014 unregister tolerates expired tokens\n    // because the provider will simply return 401, which the adapter swallows\n    // or we ignore below.\n  }\n\n  try {\n    await adapter.unregisterPush({\n      channelId: channel.id,\n      credentials,\n      scope: { tenantId: scope.tenantId, organizationId: scope.organizationId },\n      channelState,\n    })\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    console.warn(\n      `[push-unregister] adapter.unregisterPush failed for channel ${channel.id}: ${message}`,\n    )\n    return {\n      channelId: channel.id,\n      status: 'failed',\n      error: { code: 'adapter_unregister_failed', message: message.slice(0, 500) },\n    }\n  }\n\n  // Clear push markers from channel state so a subsequent reconnect starts\n  // fresh.\n  channel.channelState = {\n    ...channelState,\n    pushStatus: 'inactive',\n    watchExpirationMs: null,\n  }\n  // Restore the polling-only default cadence (matching connect) so the channel\n  // keeps working until disconnect itself flips `isActive: false`.\n  channel.pollIntervalSeconds = POLLING_ONLY_DEFAULT_INTERVAL_SECONDS\n  await em.flush()\n\n  await emitCommunicationChannelsEvent(\n    'communication_channels.push.deactivated',\n    {\n      channelId: channel.id,\n      providerKey: channel.providerKey,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      reason: 'unregistered',\n    },\n    { persistent: true },\n  )\n\n  return { channelId: channel.id, status: 'unregistered' }\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,6BAA6B;AAEtC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,SAAS,6CAA6C;AACtD,SAAS,sCAAsC;AAkBxC,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AA0BD,eAAsB,eAAe,QAIH;AAChC,QAAM,QAAQ,qBAAqB,MAAM,OAAO,KAAK;AACrD,QAAM,EAAE,WAAW,MAAM,IAAI;AAE7B,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,SAAS,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAEhF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,WAAW,MAAM,WAAW,QAAQ,OAAO;AAAA,EACtD;AAEA,QAAM,UAAU,0BAA0B,EAAE,IAAI,QAAQ,WAAW;AACnE,MAAI,CAAC,WAAW,OAAO,QAAQ,mBAAmB,YAAY;AAC5D,WAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,OAAO;AAAA,EACjD;AAEA,QAAM,eAAgB,QAAQ,gBAAmD,CAAC;AAClF,QAAM,aAAa,OAAO,aAAa,eAAe,WAAW,aAAa,aAAa;AAC3F,MAAI,CAAC,cAAc,eAAe,YAAY;AAC5C,WAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,OAAO;AAAA,EACjD;AAEA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAQ,+BAA+B;AAAA,EACxE,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,MAAI;AACF,UAAM,YAAY,MAAM;AAAA,MACtB,EAAE,SAAS,WAAW,QAAQ,IAAI,aAAa,OAAO,iBAAiB;AAAA,MACvE,EAAE,mBAAmB;AAAA,IACvB;AACA,kBAAc,UAAU;AAAA,EAC1B,QAAQ;AAAA,EAIR;AAEA,MAAI;AACF,UAAM,QAAQ,eAAe;AAAA,MAC3B,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACxE;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,YAAQ;AAAA,MACN,+DAA+D,QAAQ,EAAE,KAAK,OAAO;AAAA,IACvF;AACA,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,OAAO,EAAE,MAAM,6BAA6B,SAAS,QAAQ,MAAM,GAAG,GAAG,EAAE;AAAA,IAC7E;AAAA,EACF;AAIA,UAAQ,eAAe;AAAA,IACrB,GAAG;AAAA,IACH,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAGA,UAAQ,sBAAsB;AAC9B,QAAM,GAAG,MAAM;AAEf,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe;AACzD;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { AwilixContainer } from 'awilix'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../data/entities'\nimport { getChannelAdapterRegistry } from '../lib/adapter-registry-singleton'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { POLLING_ONLY_DEFAULT_INTERVAL_SECONDS } from '../lib/connect-channel'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'push-unregister' })\n\n/**\n * Spec C \u00A7 Phase C5 \u2014 Tear down a previously-registered push delivery.\n *\n * Called from `disconnect-channel.ts` (per-user disconnect path) so the\n * provider-side `users.watch` subscription doesn't keep firing\n * notifications at a webhook that no longer recognises the channel.\n *\n * Idempotent + best-effort: a missing registration, a 404 from the provider,\n * or any adapter error is logged but never raised. The caller still proceeds\n * with the disconnect (the channel row is cleared regardless of whether the\n * provider-side teardown succeeded).\n *\n * Companion to `commands/push-register.ts` \u2014 same lib-style helper shape,\n * not a `registerCommand`-style command (push lifecycle has no undo).\n */\n\nexport const pushUnregisterSchema = z.object({\n  channelId: z.string().uuid(),\n})\n\nexport interface PushUnregisterScope {\n  tenantId: string\n  organizationId: string\n  userId?: string | null\n}\n\nexport interface PushUnregisterResult {\n  channelId: string\n  status: 'unregistered' | 'noop' | 'failed'\n  error?: { code: string; message: string }\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\nexport async function pushUnregister(params: {\n  container: AwilixContainer\n  scope: PushUnregisterScope\n  input: { channelId: string }\n}): Promise<PushUnregisterResult> {\n  const input = pushUnregisterSchema.parse(params.input)\n  const { container, scope } = params\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: input.channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) {\n    return { channelId: input.channelId, status: 'noop' }\n  }\n\n  const adapter = getChannelAdapterRegistry().get(channel.providerKey)\n  if (!adapter || typeof adapter.unregisterPush !== 'function') {\n    return { channelId: channel.id, status: 'noop' }\n  }\n\n  const channelState = (channel.channelState as Record<string, unknown> | null) ?? {}\n  const pushStatus = typeof channelState.pushStatus === 'string' ? channelState.pushStatus : null\n  if (!pushStatus || pushStatus === 'inactive') {\n    return { channelId: channel.id, status: 'noop' }\n  }\n\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  try {\n    const refreshed = await refreshCredentialsIfNeeded(\n      { adapter, channelId: channel.id, credentials, scope: credentialsScope },\n      { credentialsService },\n    )\n    credentials = refreshed.credentials\n  } catch {\n    // Refresh failure is non-fatal \u2014 unregister tolerates expired tokens\n    // because the provider will simply return 401, which the adapter swallows\n    // or we ignore below.\n  }\n\n  try {\n    await adapter.unregisterPush({\n      channelId: channel.id,\n      credentials,\n      scope: { tenantId: scope.tenantId, organizationId: scope.organizationId },\n      channelState,\n    })\n  } catch (err) {\n    const message = err instanceof Error ? err.message : String(err)\n    logger.warn('adapter.unregisterPush failed for channel', { channelId: channel.id, reason: message })\n    return {\n      channelId: channel.id,\n      status: 'failed',\n      error: { code: 'adapter_unregister_failed', message: message.slice(0, 500) },\n    }\n  }\n\n  // Clear push markers from channel state so a subsequent reconnect starts\n  // fresh.\n  channel.channelState = {\n    ...channelState,\n    pushStatus: 'inactive',\n    watchExpirationMs: null,\n  }\n  // Restore the polling-only default cadence (matching connect) so the channel\n  // keeps working until disconnect itself flips `isActive: false`.\n  channel.pollIntervalSeconds = POLLING_ONLY_DEFAULT_INTERVAL_SECONDS\n  await em.flush()\n\n  await emitCommunicationChannelsEvent(\n    'communication_channels.push.deactivated',\n    {\n      channelId: channel.id,\n      providerKey: channel.providerKey,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      reason: 'unregistered',\n    },\n    { persistent: true },\n  )\n\n  return { channelId: channel.id, status: 'unregistered' }\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,6BAA6B;AAEtC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C,SAAS,kCAAkC;AAC3C,SAAS,6CAA6C;AACtD,SAAS,sCAAsC;AAC/C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAkBrF,MAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,KAAK;AAC7B,CAAC;AA0BD,eAAsB,eAAe,QAIH;AAChC,QAAM,QAAQ,qBAAqB,MAAM,OAAO,KAAK;AACrD,QAAM,EAAE,WAAW,MAAM,IAAI;AAE7B,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,SAAS,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAEhF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,MAAM;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,WAAW,MAAM,WAAW,QAAQ,OAAO;AAAA,EACtD;AAEA,QAAM,UAAU,0BAA0B,EAAE,IAAI,QAAQ,WAAW;AACnE,MAAI,CAAC,WAAW,OAAO,QAAQ,mBAAmB,YAAY;AAC5D,WAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,OAAO;AAAA,EACjD;AAEA,QAAM,eAAgB,QAAQ,gBAAmD,CAAC;AAClF,QAAM,aAAa,OAAO,aAAa,eAAe,WAAW,aAAa,aAAa;AAC3F,MAAI,CAAC,cAAc,eAAe,YAAY;AAC5C,WAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,OAAO;AAAA,EACjD;AAEA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAQ,+BAA+B;AAAA,EACxE,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,MAAI;AACF,UAAM,YAAY,MAAM;AAAA,MACtB,EAAE,SAAS,WAAW,QAAQ,IAAI,aAAa,OAAO,iBAAiB;AAAA,MACvE,EAAE,mBAAmB;AAAA,IACvB;AACA,kBAAc,UAAU;AAAA,EAC1B,QAAQ;AAAA,EAIR;AAEA,MAAI;AACF,UAAM,QAAQ,eAAe;AAAA,MAC3B,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,MACxE;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,KAAK,6CAA6C,EAAE,WAAW,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AACnG,WAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,QAAQ;AAAA,MACR,OAAO,EAAE,MAAM,6BAA6B,SAAS,QAAQ,MAAM,GAAG,GAAG,EAAE;AAAA,IAC7E;AAAA,EACF;AAIA,UAAQ,eAAe;AAAA,IACrB,GAAG;AAAA,IACH,YAAY;AAAA,IACZ,mBAAmB;AAAA,EACrB;AAGA,UAAQ,sBAAsB;AAC9B,QAAM,GAAG,MAAM;AAEf,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ;AAAA,IACV;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe;AACzD;",
   "names": []
 }

package/dist/modules/communication_channels/commands/reassign-conversation.js

@@ -4,6 +4,8 @@ import { extractUndoPayload as extractSharedUndoPayload } from "@open-mercato/sh
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { ChannelThreadMapping, ExternalConversation } from "../data/entities.js";
 import { emitCommunicationChannelsEvent } from "../events.js";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const logger = createLogger("communication_channels").child({ component: "reassign-conversation" });
 const reassignConversationSchema = z.object({
   threadId: z.string().uuid(),
   /** Set to `null` to unassign the conversation. */
@@ -101,9 +103,9 @@ const reassignConversationCommand = {
         { persistent: true }
       );
     } catch (emitErr) {
-      console.warn(
-        "[communication_channels:reassign-conversation] reassigned event emit failed:",
-        emitErr instanceof Error ? emitErr.message : emitErr
+      logger.warn(
+        "reassigned event emit failed",
+        { err: emitErr }
       );
     }
     const undo = {