@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/dist/modules/communication_channels/api/post/test-seed/route.js

@@ -3,14 +3,7 @@ import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
-import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import {
-  ChannelThreadMapping,
-  CommunicationChannel,
-  ExternalConversation,
-  MessageChannelLink
-} from "../../../data/entities.js";
-import { ChannelAccessDeniedError, assertCanManageChannel } from "../../../lib/access-control.js";
+import { ChannelThreadMapping, ExternalConversation, MessageChannelLink } from "../../../data/entities.js";
 import {
   COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID
 } from "../../../commands/connect-credential-channel.js";
@@ -129,46 +122,6 @@ async function POST(req) {
   }
   const em = container.resolve("em").fork();
   const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY;
-  const ownedChannel = await findOneWithDecryption(
-    em,
-    CommunicationChannel,
-    {
-      id: body.channelId,
-      tenantId,
-      organizationId,
-      deletedAt: null
-    },
-    void 0,
-    { tenantId, organizationId }
-  );
-  if (!ownedChannel) {
-    return NextResponse.json({ error: "Channel not found" }, { status: 404 });
-  }
-  let userFeatures = [];
-  try {
-    const rbac = container.resolve("rbacService");
-    const acl = await rbac.loadAcl(userId, { tenantId, organizationId });
-    userFeatures = acl?.isSuperAdmin ? ["*"] : Array.isArray(acl?.features) ? acl.features : [];
-  } catch {
-    userFeatures = [];
-  }
-  try {
-    assertCanManageChannel(
-      { userId: ownedChannel.userId },
-      userId,
-      userFeatures,
-      "communication_channels.manage"
-    );
-  } catch (err) {
-    if (err instanceof ChannelAccessDeniedError) {
-      return NextResponse.json({ error: "Channel not found" }, { status: 404 });
-    }
-    const status = err.statusCode ?? 403;
-    return NextResponse.json(
-      { error: err instanceof Error ? err.message : "Access denied" },
-      { status }
-    );
-  }
   const conversation = em.create(ExternalConversation, {
     channelId: body.channelId,
     externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,
@@ -268,10 +221,7 @@ const openApi = {
       responses: [
         { status: 201, description: "Channel seeded / inbound message emitted" },
         { status: 401, description: "Unauthorized" },
-        {
-          status: 404,
-          description: "Test channel seeding disabled (production default), or the requested channel does not belong to the caller"
-        },
+        { status: 404, description: "Test channel seeding disabled (production default)" },
         { status: 422, description: "Invalid request body" },
         { status: 500, description: "Seed failed" }
       ]

package/dist/modules/communication_channels/api/post/test-seed/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/communication_channels/api/post/test-seed/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../../../data/entities'\nimport { ChannelAccessDeniedError, assertCanManageChannel } from '../../../lib/access-control'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../commands/connect-credential-channel'\nimport { emitCommunicationChannelsEvent } from '../../../events'\nimport {\n  TEST_SEED_PROVIDER_KEY,\n  ensureTestSeedAdapterRegistered,\n  isTestChannelSeedingEnabled,\n} from '../../../lib/test-seed'\n\n/**\n * TEST-ONLY channel seeding endpoint.\n *\n * Gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` \u2014 when the flag is unset (the\n * production default) every request returns 404, so this route is invisible and\n * inert in production. See `lib/test-seed.ts` for the full rationale.\n *\n * Two actions, both scoped to the caller's tenant/org:\n *   - `connect-channel`: connect a network-free `__test_seed__` channel owned by\n *     the caller (delegates to the real connect-credential command so the channel\n *     persists credentials + lands in `status='connected'`). Enables the outbound\n *     compose \u2192 deliver \u2192 `.sent` chain to complete in CI.\n *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`\n *     row for threading) and emit `communication_channels.message.received` so the\n *     customers link-channel-message subscriber runs against real Postgres. Enables\n *     the inbound auto-link tests (TC-CRM-EMAIL-002..005).\n */\ntype RbacServiceLike = {\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>\n}\n\nexport const metadata = {\n  path: '/communication_channels/test-seed',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\nconst addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() })\nconst addressFieldSchema = z.union([\n  z.string(),\n  addressObjectSchema,\n  z.array(z.union([z.string(), addressObjectSchema])),\n])\n\nconst connectChannelSchema = z.object({\n  action: z.literal('connect-channel'),\n  displayName: z.string().min(1).max(255).optional(),\n  externalIdentifier: z.string().min(1).max(255).optional(),\n})\n\nconst emitInboundSchema = z.object({\n  action: z.literal('emit-inbound'),\n  /** Channel that owns the inbound message; controls authorUserId + default visibility. */\n  channelId: z.string().uuid(),\n  /** Provider key persisted on the link (defaults to the stub provider). */\n  providerKey: z.string().min(1).max(64).optional(),\n  /** Normalized inbound addresses (stored under channelPayload). */\n  from: addressFieldSchema.optional(),\n  to: addressFieldSchema.optional(),\n  cc: addressFieldSchema.optional(),\n  subject: z.string().max(500).optional(),\n  bodyText: z.string().max(200_000).optional(),\n  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */\n  messageId: z.string().max(500).optional(),\n  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */\n  inReplyTo: z.string().max(500).optional(),\n  references: z.array(z.string().max(500)).max(50).optional(),\n  /**\n   * Open Mercato `messages.message` thread id this inbound message belongs to.\n   * When set, a `messages.message` row is created with this `threadId` so the\n   * hub-thread inheritance join can resolve a Person from a sibling message.\n   */\n  messageThreadId: z.string().uuid().optional(),\n  /**\n   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The\n   * reaction (`/messages/[id]/reactions`) and thread-assign\n   * (`/threads/[id]/assign`) routes resolve the owning channel through this\n   * mapping and return 409/404 without it. Opt-in so the existing CRM-link\n   * seeds (which don't need a mapping) keep their current mapping-free shape.\n   */\n  createThreadMapping: z.boolean().optional(),\n})\n\nconst bodySchema = z.discriminatedUnion('action', [connectChannelSchema, emitInboundSchema])\n\nexport async function POST(req: Request): Promise<Response> {\n  // Fail-closed: invisible in production. Mirrors an unknown route (404) rather\n  // than 403 so the surface leaks nothing when the flag is off.\n  if (!isTestChannelSeedingEnabled()) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  // Defensive: make sure the stub adapter is registered for this process even if\n  // a worker-only node skipped module di registration.\n  ensureTestSeedAdapterRegistered()\n\n  const tenantId = auth.tenantId as string\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const userId = auth.sub as string\n\n  if (body.action === 'connect-channel') {\n    const stamp = Date.now()\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const input: ConnectCredentialChannelInput = {\n      providerKey: TEST_SEED_PROVIDER_KEY,\n      displayName: body.displayName ?? `Test Seed Channel ${stamp}`,\n      credentials: {\n        username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n        fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n      },\n      userId,\n      scope: { tenantId, organizationId },\n    }\n    const { result } = await commandBus.execute<\n      ConnectCredentialChannelInput,\n      ConnectCredentialChannelResult\n    >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    if (result.status !== 'connected') {\n      return NextResponse.json(\n        { error: '[internal] test-seed connect failed', detail: result },\n        { status: 500 },\n      )\n    }\n    return NextResponse.json(\n      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },\n      { status: 201 },\n    )\n  }\n\n  // action === 'emit-inbound'\n  const em = (container.resolve('em') as EntityManager).fork()\n  const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY\n\n  // `channelId` is caller-supplied, so confirm it names a channel this tenant/org\n  // actually owns before seeding rows that reference it. Mirrors the ownership\n  // lookup every other per-channel route performs (see channels/[id]/test-send).\n  const ownedChannel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: body.channelId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId, organizationId },\n  )\n  if (!ownedChannel) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n\n  // Tenant/org scope alone does not authorize: `connect_user_channel` is granted\n  // broadly, so a same-tenant caller could otherwise seed against a colleague's\n  // personal mailbox. Enforce the module's owner-only contract \u2014 personal\n  // channels are owner-restricted, shared channels need `manage`.\n  let userFeatures: string[] = []\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const acl = await rbac.loadAcl(userId, { tenantId, organizationId })\n    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []\n  } catch {\n    userFeatures = []\n  }\n  try {\n    assertCanManageChannel(\n      { userId: ownedChannel.userId },\n      userId,\n      userFeatures,\n      'communication_channels.manage',\n    )\n  } catch (err) {\n    if (err instanceof ChannelAccessDeniedError) {\n      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n    }\n    const status = (err as { statusCode?: number }).statusCode ?? 403\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Access denied' },\n      { status },\n    )\n  }\n\n  // A MessageChannelLink requires a non-null external_conversation_id (FK) and\n  // message_id. Create a synthetic conversation + (optionally threaded) message\n  // so the link is shaped like a real inbound row the subscriber can consume.\n  const conversation = em.create(ExternalConversation, {\n    channelId: body.channelId,\n    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,\n    subject: body.subject ?? null,\n    tenantId,\n    organizationId,\n    lastMessageAt: new Date(),\n  })\n  em.persist(conversation)\n  await em.flush()\n\n  // Insert the platform `messages.message` row via raw SQL rather than importing\n  // the messages module's entity class (cross-module ORM coupling rule). Only\n  // `thread_id` matters for the hub-thread inheritance join (TC-CRM-EMAIL-005);\n  // the rest satisfy NOT NULL constraints.\n  const messageRows = (await em.getConnection().execute(\n    `INSERT INTO messages\n       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,\n        is_draft, sent_at, visibility, source_entity_type, source_entity_id,\n        tenant_id, organization_id, created_at, updated_at)\n     VALUES\n       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',\n        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,\n        ?, ?, now(), now())\n     RETURNING id`,\n    [\n      `channel.${providerKey}`,\n      body.messageThreadId ?? null,\n      userId,\n      body.subject ?? '(no subject)',\n      body.bodyText ?? '',\n      body.channelId,\n      tenantId,\n      organizationId,\n    ],\n  )) as Array<{ id: string }>\n  const messageId = messageRows[0]?.id\n  if (!messageId) {\n    return NextResponse.json({ error: '[internal] failed to seed message row' }, { status: 500 })\n  }\n\n  const link = em.create(MessageChannelLink, {\n    messageId,\n    externalConversationId: conversation.id,\n    providerKey,\n    channelType: 'email',\n    direction: 'inbound',\n    deliveryStatus: 'delivered',\n    channelPayload: {\n      ...(body.from !== undefined ? { from: body.from } : {}),\n      ...(body.to !== undefined ? { to: body.to } : {}),\n      ...(body.cc !== undefined ? { cc: body.cc } : {}),\n      ...(body.subject !== undefined ? { subject: body.subject } : {}),\n      ...(body.bodyText !== undefined ? { text: body.bodyText } : {}),\n      ...(body.inReplyTo !== undefined ? { inReplyTo: body.inReplyTo } : {}),\n      ...(body.references !== undefined ? { references: body.references } : {}),\n    },\n    channelContentType: 'text/plain',\n    channelMetadata: {\n      ...(body.messageId !== undefined ? { messageId: body.messageId } : {}),\n    },\n    tenantId,\n    organizationId,\n  })\n  em.persist(link)\n  await em.flush()\n\n  // Optionally mirror `ingest-inbound-message`: a real inbound message always\n  // lands a ChannelThreadMapping that the reaction + thread-assign routes use to\n  // resolve the owning channel. Seeded inbound messages skip it by default; opt\n  // in for tests that exercise those routes. Keyed by `messageThreadId ?? messageId`\n  // to match how those commands resolve the mapping (`message.threadId ?? message.id`).\n  if (body.createThreadMapping) {\n    const mapping = em.create(ChannelThreadMapping, {\n      externalConversationId: conversation.id,\n      messageThreadId: body.messageThreadId ?? messageId,\n      channelId: body.channelId,\n      providerKey,\n      externalThreadRef: conversation.externalConversationId,\n      tenantId,\n      organizationId,\n    })\n    em.persist(mapping)\n    await em.flush()\n  }\n\n  // Emit the hub event through the real event bus so the persistent customers\n  // link-channel-message-received subscriber is enqueued to the `events` queue.\n  await emitCommunicationChannelsEvent(\n    'communication_channels.message.received',\n    {\n      channelLinkId: link.id,\n      channelId: body.channelId,\n      providerKey,\n      direction: 'inbound',\n      tenantId,\n      organizationId,\n    },\n    { persistent: true },\n  )\n\n  return NextResponse.json(\n    { channelLinkId: link.id, messageId, conversationId: conversation.id },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Test-only: seed a connected channel or emit an inbound message (env-gated)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel seeded / inbound message emitted' },\n        { status: 401, description: 'Unauthorized' },\n        {\n          status: 404,\n          description:\n            'Test channel seeding disabled (production default), or the requested channel does not belong to the caller',\n        },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Seed failed' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B,8BAA8B;AACjE;AAAA,EACE;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA0BA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzF,MAAM,qBAAqB,EAAE,MAAM;AAAA,EACjC,EAAE,OAAO;AAAA,EACT;AAAA,EACA,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC1D,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,QAAQ,EAAE,QAAQ,cAAc;AAAA;AAAA,EAEhC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,MAAM,mBAAmB,SAAS;AAAA,EAClC,IAAI,mBAAmB,SAAS;AAAA,EAChC,IAAI,mBAAmB,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,aAAa,EAAE,mBAAmB,UAAU,CAAC,sBAAsB,iBAAiB,CAAC;AAE3F,eAAsB,KAAK,KAAiC;AAG1D,MAAI,CAAC,4BAA4B,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAG/C,kCAAgC;AAEhC,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,SAAS,KAAK;AAEpB,MAAI,KAAK,WAAW,mBAAmB;AACrC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,QAAuC;AAAA,MAC3C,aAAa;AAAA,MACb,aAAa,KAAK,eAAe,qBAAqB,KAAK;AAAA,MAC3D,aAAa;AAAA,QACX,UAAU,KAAK,sBAAsB,aAAa,KAAK;AAAA,QACvD,aAAa,KAAK,sBAAsB,aAAa,KAAK;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,uCAAuC,QAAQ,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,WAAW,OAAO,WAAW,oBAAoB,OAAO,mBAAmB;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,cAAc,KAAK,eAAe;AAKxC,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAMA,MAAI,eAAyB,CAAC;AAC9B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,EAAE,UAAU,eAAe,CAAC;AACnE,mBAAe,KAAK,eAAe,CAAC,GAAG,IAAI,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,EAC5F,QAAQ;AACN,mBAAe,CAAC;AAAA,EAClB;AACA,MAAI;AACF;AAAA,MACE,EAAE,QAAQ,aAAa,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM,SAAU,IAAgC,cAAc;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,gBAAgB;AAAA,MAC9D,EAAE,OAAO;AAAA,IACX;AAAA,EACF;AAKA,QAAM,eAAe,GAAG,OAAO,sBAAsB;AAAA,IACnD,WAAW,KAAK;AAAA,IAChB,wBAAwB,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IAC5F,SAAS,KAAK,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA,eAAe,oBAAI,KAAK;AAAA,EAC1B,CAAC;AACD,KAAG,QAAQ,YAAY;AACvB,QAAM,GAAG,MAAM;AAMf,QAAM,cAAe,MAAM,GAAG,cAAc,EAAE;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA;AAAA,MACE,WAAW,WAAW;AAAA,MACtB,KAAK,mBAAmB;AAAA,MACxB;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,KAAK,YAAY;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,YAAY,CAAC,GAAG;AAClC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,OAAO,GAAG,OAAO,oBAAoB;AAAA,IACzC;AAAA,IACA,wBAAwB,aAAa;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,MACd,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,aAAa,SAAY,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzE;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAOf,MAAI,KAAK,qBAAqB;AAC5B,UAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,MAC9C,wBAAwB,aAAa;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,MACzC,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,mBAAmB,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,OAAO;AAClB,UAAM,GAAG,MAAM;AAAA,EACjB;AAIA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,aAAa;AAAA,IAClB,EAAE,eAAe,KAAK,IAAI,WAAW,gBAAgB,aAAa,GAAG;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,QACJ;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { ChannelThreadMapping, ExternalConversation, MessageChannelLink } from '../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../commands/connect-credential-channel'\nimport { emitCommunicationChannelsEvent } from '../../../events'\nimport {\n  TEST_SEED_PROVIDER_KEY,\n  ensureTestSeedAdapterRegistered,\n  isTestChannelSeedingEnabled,\n} from '../../../lib/test-seed'\n\n/**\n * TEST-ONLY channel seeding endpoint.\n *\n * Gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` \u2014 when the flag is unset (the\n * production default) every request returns 404, so this route is invisible and\n * inert in production. See `lib/test-seed.ts` for the full rationale.\n *\n * Two actions, both scoped to the caller's tenant/org:\n *   - `connect-channel`: connect a network-free `__test_seed__` channel owned by\n *     the caller (delegates to the real connect-credential command so the channel\n *     persists credentials + lands in `status='connected'`). Enables the outbound\n *     compose \u2192 deliver \u2192 `.sent` chain to complete in CI.\n *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`\n *     row for threading) and emit `communication_channels.message.received` so the\n *     customers link-channel-message subscriber runs against real Postgres. Enables\n *     the inbound auto-link tests (TC-CRM-EMAIL-002..005).\n */\nexport const metadata = {\n  path: '/communication_channels/test-seed',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\nconst addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() })\nconst addressFieldSchema = z.union([\n  z.string(),\n  addressObjectSchema,\n  z.array(z.union([z.string(), addressObjectSchema])),\n])\n\nconst connectChannelSchema = z.object({\n  action: z.literal('connect-channel'),\n  displayName: z.string().min(1).max(255).optional(),\n  externalIdentifier: z.string().min(1).max(255).optional(),\n})\n\nconst emitInboundSchema = z.object({\n  action: z.literal('emit-inbound'),\n  /** Channel that owns the inbound message; controls authorUserId + default visibility. */\n  channelId: z.string().uuid(),\n  /** Provider key persisted on the link (defaults to the stub provider). */\n  providerKey: z.string().min(1).max(64).optional(),\n  /** Normalized inbound addresses (stored under channelPayload). */\n  from: addressFieldSchema.optional(),\n  to: addressFieldSchema.optional(),\n  cc: addressFieldSchema.optional(),\n  subject: z.string().max(500).optional(),\n  bodyText: z.string().max(200_000).optional(),\n  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */\n  messageId: z.string().max(500).optional(),\n  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */\n  inReplyTo: z.string().max(500).optional(),\n  references: z.array(z.string().max(500)).max(50).optional(),\n  /**\n   * Open Mercato `messages.message` thread id this inbound message belongs to.\n   * When set, a `messages.message` row is created with this `threadId` so the\n   * hub-thread inheritance join can resolve a Person from a sibling message.\n   */\n  messageThreadId: z.string().uuid().optional(),\n  /**\n   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The\n   * reaction (`/messages/[id]/reactions`) and thread-assign\n   * (`/threads/[id]/assign`) routes resolve the owning channel through this\n   * mapping and return 409/404 without it. Opt-in so the existing CRM-link\n   * seeds (which don't need a mapping) keep their current mapping-free shape.\n   */\n  createThreadMapping: z.boolean().optional(),\n})\n\nconst bodySchema = z.discriminatedUnion('action', [connectChannelSchema, emitInboundSchema])\n\nexport async function POST(req: Request): Promise<Response> {\n  // Fail-closed: invisible in production. Mirrors an unknown route (404) rather\n  // than 403 so the surface leaks nothing when the flag is off.\n  if (!isTestChannelSeedingEnabled()) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  // Defensive: make sure the stub adapter is registered for this process even if\n  // a worker-only node skipped module di registration.\n  ensureTestSeedAdapterRegistered()\n\n  const tenantId = auth.tenantId as string\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const userId = auth.sub as string\n\n  if (body.action === 'connect-channel') {\n    const stamp = Date.now()\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const input: ConnectCredentialChannelInput = {\n      providerKey: TEST_SEED_PROVIDER_KEY,\n      displayName: body.displayName ?? `Test Seed Channel ${stamp}`,\n      credentials: {\n        username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n        fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n      },\n      userId,\n      scope: { tenantId, organizationId },\n    }\n    const { result } = await commandBus.execute<\n      ConnectCredentialChannelInput,\n      ConnectCredentialChannelResult\n    >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    if (result.status !== 'connected') {\n      return NextResponse.json(\n        { error: '[internal] test-seed connect failed', detail: result },\n        { status: 500 },\n      )\n    }\n    return NextResponse.json(\n      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },\n      { status: 201 },\n    )\n  }\n\n  // action === 'emit-inbound'\n  const em = (container.resolve('em') as EntityManager).fork()\n  const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY\n\n  // A MessageChannelLink requires a non-null external_conversation_id (FK) and\n  // message_id. Create a synthetic conversation + (optionally threaded) message\n  // so the link is shaped like a real inbound row the subscriber can consume.\n  const conversation = em.create(ExternalConversation, {\n    channelId: body.channelId,\n    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,\n    subject: body.subject ?? null,\n    tenantId,\n    organizationId,\n    lastMessageAt: new Date(),\n  })\n  em.persist(conversation)\n  await em.flush()\n\n  // Insert the platform `messages.message` row via raw SQL rather than importing\n  // the messages module's entity class (cross-module ORM coupling rule). Only\n  // `thread_id` matters for the hub-thread inheritance join (TC-CRM-EMAIL-005);\n  // the rest satisfy NOT NULL constraints.\n  const messageRows = (await em.getConnection().execute(\n    `INSERT INTO messages\n       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,\n        is_draft, sent_at, visibility, source_entity_type, source_entity_id,\n        tenant_id, organization_id, created_at, updated_at)\n     VALUES\n       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',\n        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,\n        ?, ?, now(), now())\n     RETURNING id`,\n    [\n      `channel.${providerKey}`,\n      body.messageThreadId ?? null,\n      userId,\n      body.subject ?? '(no subject)',\n      body.bodyText ?? '',\n      body.channelId,\n      tenantId,\n      organizationId,\n    ],\n  )) as Array<{ id: string }>\n  const messageId = messageRows[0]?.id\n  if (!messageId) {\n    return NextResponse.json({ error: '[internal] failed to seed message row' }, { status: 500 })\n  }\n\n  const link = em.create(MessageChannelLink, {\n    messageId,\n    externalConversationId: conversation.id,\n    providerKey,\n    channelType: 'email',\n    direction: 'inbound',\n    deliveryStatus: 'delivered',\n    channelPayload: {\n      ...(body.from !== undefined ? { from: body.from } : {}),\n      ...(body.to !== undefined ? { to: body.to } : {}),\n      ...(body.cc !== undefined ? { cc: body.cc } : {}),\n      ...(body.subject !== undefined ? { subject: body.subject } : {}),\n      ...(body.bodyText !== undefined ? { text: body.bodyText } : {}),\n      ...(body.inReplyTo !== undefined ? { inReplyTo: body.inReplyTo } : {}),\n      ...(body.references !== undefined ? { references: body.references } : {}),\n    },\n    channelContentType: 'text/plain',\n    channelMetadata: {\n      ...(body.messageId !== undefined ? { messageId: body.messageId } : {}),\n    },\n    tenantId,\n    organizationId,\n  })\n  em.persist(link)\n  await em.flush()\n\n  // Optionally mirror `ingest-inbound-message`: a real inbound message always\n  // lands a ChannelThreadMapping that the reaction + thread-assign routes use to\n  // resolve the owning channel. Seeded inbound messages skip it by default; opt\n  // in for tests that exercise those routes. Keyed by `messageThreadId ?? messageId`\n  // to match how those commands resolve the mapping (`message.threadId ?? message.id`).\n  if (body.createThreadMapping) {\n    const mapping = em.create(ChannelThreadMapping, {\n      externalConversationId: conversation.id,\n      messageThreadId: body.messageThreadId ?? messageId,\n      channelId: body.channelId,\n      providerKey,\n      externalThreadRef: conversation.externalConversationId,\n      tenantId,\n      organizationId,\n    })\n    em.persist(mapping)\n    await em.flush()\n  }\n\n  // Emit the hub event through the real event bus so the persistent customers\n  // link-channel-message-received subscriber is enqueued to the `events` queue.\n  await emitCommunicationChannelsEvent(\n    'communication_channels.message.received',\n    {\n      channelLinkId: link.id,\n      channelId: body.channelId,\n      providerKey,\n      direction: 'inbound',\n      tenantId,\n      organizationId,\n    },\n    { persistent: true },\n  )\n\n  return NextResponse.json(\n    { channelLinkId: link.id, messageId, conversationId: conversation.id },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Test-only: seed a connected channel or emit an inbound message (env-gated)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel seeded / inbound message emitted' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Test channel seeding disabled (production default)' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Seed failed' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB,sBAAsB,0BAA0B;AAC/E;AAAA,EACE;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzF,MAAM,qBAAqB,EAAE,MAAM;AAAA,EACjC,EAAE,OAAO;AAAA,EACT;AAAA,EACA,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC1D,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,QAAQ,EAAE,QAAQ,cAAc;AAAA;AAAA,EAEhC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,MAAM,mBAAmB,SAAS;AAAA,EAClC,IAAI,mBAAmB,SAAS;AAAA,EAChC,IAAI,mBAAmB,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,aAAa,EAAE,mBAAmB,UAAU,CAAC,sBAAsB,iBAAiB,CAAC;AAE3F,eAAsB,KAAK,KAAiC;AAG1D,MAAI,CAAC,4BAA4B,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAG/C,kCAAgC;AAEhC,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,SAAS,KAAK;AAEpB,MAAI,KAAK,WAAW,mBAAmB;AACrC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,QAAuC;AAAA,MAC3C,aAAa;AAAA,MACb,aAAa,KAAK,eAAe,qBAAqB,KAAK;AAAA,MAC3D,aAAa;AAAA,QACX,UAAU,KAAK,sBAAsB,aAAa,KAAK;AAAA,QACvD,aAAa,KAAK,sBAAsB,aAAa,KAAK;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,uCAAuC,QAAQ,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,WAAW,OAAO,WAAW,oBAAoB,OAAO,mBAAmB;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,cAAc,KAAK,eAAe;AAKxC,QAAM,eAAe,GAAG,OAAO,sBAAsB;AAAA,IACnD,WAAW,KAAK;AAAA,IAChB,wBAAwB,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IAC5F,SAAS,KAAK,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA,eAAe,oBAAI,KAAK;AAAA,EAC1B,CAAC;AACD,KAAG,QAAQ,YAAY;AACvB,QAAM,GAAG,MAAM;AAMf,QAAM,cAAe,MAAM,GAAG,cAAc,EAAE;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA;AAAA,MACE,WAAW,WAAW;AAAA,MACtB,KAAK,mBAAmB;AAAA,MACxB;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,KAAK,YAAY;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,YAAY,CAAC,GAAG;AAClC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,OAAO,GAAG,OAAO,oBAAoB;AAAA,IACzC;AAAA,IACA,wBAAwB,aAAa;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,MACd,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,aAAa,SAAY,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzE;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAOf,MAAI,KAAK,qBAAqB;AAC5B,UAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,MAC9C,wBAAwB,aAAa;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,MACzC,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,mBAAmB,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,OAAO;AAClB,UAAM,GAAG,MAAM;AAAA,EACjB;AAIA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,aAAa;AAAA,IAClB,EAAE,eAAe,KAAK,IAAI,WAAW,gBAAgB,aAAa,GAAG;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,qDAAqD;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js

@@ -8,7 +8,6 @@ import {
   getCommunicationChannelsQueue
 } from "../../../../lib/queue.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from "@open-mercato/shared/lib/webhooks";
 const logger = createLogger("communication_channels").child({ component: "inbound-webhook" });
 const metadata = {
   path: "/communication_channels/webhook/[provider]",
@@ -32,15 +31,7 @@ async function POST(req, { params }) {
       { status: 404 }
     );
   }
-  let rawBody;
-  try {
-    rawBody = await readBoundedRequestBody(req);
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: "Webhook payload too large" }, { status: 413 });
-    }
-    throw error;
-  }
+  const rawBody = await req.text();
   const headers = {};
   req.headers.forEach((value, key) => {
     headers[key] = value;
@@ -171,7 +162,6 @@ const openApi = {
       responses: [
         { status: 202, description: "Webhook accepted for async processing" },
         { status: 401, description: "Signature verification failed against every candidate channel" },
-        { status: 413, description: "Webhook payload too large" },
         { status: 404, description: "Unknown provider" }
       ]
     }

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhook/%5Bprovider%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('communication_channels').child({ component: 'inbound-webhook' })\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await readBoundedRequestBody(req)\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    throw error\n  }\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    logger.warn(\n      'inbound webhook verification failed',\n      { err: error },\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAkBrF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,uBAAuB,GAAG;AAAA,EAC5C,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,UAAM;AAAA,EACR;AACA,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK,MAAM;AAAA,IACf;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'inbound-webhook' })\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    logger.warn(\n      'inbound webhook verification failed',\n      { err: error },\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAIP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,kBAAkB,CAAC;AAkBrF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,WAAO;AAAA,MACL;AAAA,MACA,EAAE,KAAK,MAAM;AAAA,IACf;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js

@@ -12,7 +12,6 @@ import {
   GmailPubSubJwtError
 } from "../../../../lib/gmail-pubsub-jwt.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
-import { readBoundedRequestBody, WebhookBodyTooLargeError } from "@open-mercato/shared/lib/webhooks";
 const logger = createLogger("communication_channels").child({ component: "gmail-webhook" });
 const metadata = {
   path: "/communication_channels/webhooks/gmail",
@@ -28,15 +27,6 @@ async function POST(req) {
     logger.error("OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set");
     return NextResponse.json({ error: "webhook not configured" }, { status: 503 });
   }
-  let rawBody;
-  try {
-    rawBody = await readBoundedRequestBody(req);
-  } catch (error) {
-    if (error instanceof WebhookBodyTooLargeError) {
-      return NextResponse.json({ error: "Webhook payload too large" }, { status: 413 });
-    }
-    return NextResponse.json({ error: "unreadable_body" }, { status: 400 });
-  }
   const verifier = getGmailPubSubVerifier();
   try {
     await verifier.verify({
@@ -51,6 +41,12 @@ async function POST(req) {
     }
     throw err;
   }
+  let rawBody;
+  try {
+    rawBody = await req.text();
+  } catch {
+    return NextResponse.json({ error: "unreadable_body" }, { status: 400 });
+  }
   let payload;
   try {
     payload = decodeGmailPubSubBody(rawBody);
@@ -112,7 +108,6 @@ const openApi = {
         { status: 400, description: "Body not a valid Pub/Sub envelope" },
         { status: 401, description: "Invalid JWT or email claim" },
         { status: 403, description: "Wrong audience" },
-        { status: 413, description: "Webhook payload too large" },
         { status: 503, description: "Webhook not configured / Google certs unreachable" }
       ]
     }

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhooks/gmail/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('communication_channels').child({ component: 'gmail-webhook' })\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Bound the raw request body before cryptographic work.\n *   2. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   3. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   4. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   5. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    logger.error('OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set')\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await readBoundedRequestBody(req)\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })\n    }\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      logger.error(\n        'failed to enqueue history-sync for channel',\n        { channelId: channel.id, err },\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 413, description: 'Webhook payload too large' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,gCAAgC;AAEjE,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAqBnF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,WAAO,MAAM,0EAA0E;AACvF,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,uBAAuB,GAAG;AAAA,EAC5C,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,aAAO;AAAA,QACL;AAAA,QACA,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,4BAA4B;AAAA,QACxD,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'gmail-webhook' })\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   2. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   3. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   4. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    logger.error('OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set')\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      logger.error(\n        'failed to enqueue history-sync for channel',\n        { channelId: channel.id, err },\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,gBAAgB,CAAC;AAoBnF,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,WAAO,MAAM,0EAA0E;AACvF,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,aAAO;AAAA,QACL;AAAA,QACA,EAAE,WAAW,QAAQ,IAAI,IAAI;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/backend/communication_channels/channels/page.js

@@ -1,7 +1,6 @@
 "use client";
 import { jsx } from "react/jsx-runtime";
 import * as React from "react";
-import { extensionPoints } from "@open-mercato/core/modules/communication_channels/extension-points";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
 import { Tag } from "@open-mercato/ui/primitives/tag";
@@ -83,7 +82,7 @@ function ChannelsListPage() {
     DataTable,
     {
       title: t("communication_channels.nav.title", "Communication Channels"),
-      extensionTableId: extensionPoints.hosts.channelsTable.tableId,
+      extensionTableId: "communication_channels.channels",
       columns,
       data: rows,
       isLoading,

package/dist/modules/communication_channels/backend/communication_channels/channels/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/communication_channels/backend/communication_channels/channels/page.tsx"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype ChannelRow = {\n  id: string\n  providerKey: string\n  channelType: string\n  displayName: string\n  externalIdentifier: string | null\n  isActive: boolean\n  capabilities: Record<string, unknown> | null\n  createdAt: string | null\n}\n\ntype ChannelListResponse = {\n  items?: ChannelRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function ChannelsListPage() {\n  const t = useT()\n  const [rows, setRows] = React.useState<ChannelRow[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [page, setPage] = React.useState(1)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n  const pageSize = 50\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setErrorMessage(null)\n      const response = await apiCall<ChannelListResponse>(\n        `/api/communication_channels/channels?page=${page}&pageSize=${pageSize}`,\n      ).catch((err: unknown) => {\n        return {\n          ok: false,\n          result: { error: err instanceof Error ? err.message : 'Failed to load channels' },\n        }\n      })\n      if (cancelled) return\n      if (!response.ok) {\n        const errBody = response.result as { error?: string } | undefined\n        setErrorMessage(\n          errBody?.error ?? t('communication_channels.errors.loadList', 'Failed to load channels'),\n        )\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n      } else {\n        const data = (response.result ?? {}) as ChannelListResponse\n        setRows(Array.isArray(data.items) ? data.items : [])\n        setTotal(typeof data.total === 'number' ? data.total : 0)\n        setTotalPages(typeof data.totalPages === 'number' ? data.totalPages : 1)\n      }\n      setIsLoading(false)\n    }\n    void load()\n    return () => {\n      cancelled = true\n    }\n  }, [page, t])\n\n  const columns = React.useMemo<ColumnDef<ChannelRow>[]>(\n    () => [\n      {\n        header: t('communication_channels.columns.displayName', 'Channel'),\n        accessorKey: 'displayName',\n      },\n      {\n        header: t('communication_channels.columns.provider', 'Provider'),\n        accessorKey: 'providerKey',\n      },\n      {\n        header: t('communication_channels.columns.type', 'Type'),\n        accessorKey: 'channelType',\n      },\n      {\n        header: t('communication_channels.columns.identifier', 'External ID'),\n        accessorKey: 'externalIdentifier',\n        cell: ({ row }) => row.original.externalIdentifier ?? '\u2014',\n        meta: { truncate: true, maxWidth: 240 },\n      },\n      {\n        header: t('communication_channels.columns.status', 'Status'),\n        accessorKey: 'isActive',\n        cell: ({ row }) =>\n          row.original.isActive ? (\n            <Tag variant=\"success\" dot>\n              {t('communication_channels.status.active', 'Active')}\n            </Tag>\n          ) : (\n            <Tag variant=\"neutral\">\n              {t('communication_channels.status.inactive', 'Inactive')}\n            </Tag>\n          ),\n      },\n    ],\n    [t],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<ChannelRow>\n          title={t('communication_channels.nav.title', 'Communication Channels')}\n          extensionTableId={extensionPoints.hosts.channelsTable.tableId}\n          columns={columns}\n          data={rows}\n          isLoading={isLoading}\n          error={errorMessage}\n          emptyState={t(\n            'communication_channels.emptyState',\n            'No shared channels yet. This page lists shared, tenant-wide channels. Your personal email mailbox is private \u2014 connect and manage it under Profile \u2192 Communication Channels.',\n          )}\n          pagination={{\n            page,\n            pageSize,\n            total,\n            totalPages,\n            onPageChange: setPage,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAmGY;AAjGZ,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAEhC,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,WAAW;AACpB,SAAS,eAAe;AACxB,SAAS,YAAY;AAmBN,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAC1E,QAAM,WAAW;AAEjB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,sBAAgB,IAAI;AACpB,YAAM,WAAW,MAAM;AAAA,QACrB,6CAA6C,IAAI,aAAa,QAAQ;AAAA,MACxE,EAAE,MAAM,CAAC,QAAiB;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,QAClF;AAAA,MACF,CAAC;AACD,UAAI,UAAW;AACf,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS;AACzB;AAAA,UACE,SAAS,SAAS,EAAE,0CAA0C,yBAAyB;AAAA,QACzF;AACA,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AAAA,MACjB,OAAO;AACL,cAAM,OAAQ,SAAS,UAAU,CAAC;AAClC,gBAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnD,iBAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,CAAC;AACxD,sBAAc,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,CAAC;AAAA,MACzE;AACA,mBAAa,KAAK;AAAA,IACpB;AACA,SAAK,KAAK;AACV,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,UAAU,MAAM;AAAA,IACpB,MAAM;AAAA,MACJ;AAAA,QACE,QAAQ,EAAE,8CAA8C,SAAS;AAAA,QACjE,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,2CAA2C,UAAU;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,uCAAuC,MAAM;AAAA,QACvD,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,6CAA6C,aAAa;AAAA,QACpE,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,sBAAsB;AAAA,QACtD,MAAM,EAAE,UAAU,MAAM,UAAU,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,yCAAyC,QAAQ;AAAA,QAC3D,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,OAAI,SAAQ,WAAU,KAAG,MACvB,YAAE,wCAAwC,QAAQ,GACrD,IAEA,oBAAC,OAAI,SAAQ,WACV,YAAE,0CAA0C,UAAU,GACzD;AAAA,MAEN;AAAA,IACF;AAAA,IACA,CAAC,CAAC;AAAA,EACJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,wBAAwB;AAAA,MACrE,kBAAkB,gBAAgB,MAAM,cAAc;AAAA,MACtD;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport { Tag } from '@open-mercato/ui/primitives/tag'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype ChannelRow = {\n  id: string\n  providerKey: string\n  channelType: string\n  displayName: string\n  externalIdentifier: string | null\n  isActive: boolean\n  capabilities: Record<string, unknown> | null\n  createdAt: string | null\n}\n\ntype ChannelListResponse = {\n  items?: ChannelRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function ChannelsListPage() {\n  const t = useT()\n  const [rows, setRows] = React.useState<ChannelRow[]>([])\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [page, setPage] = React.useState(1)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [errorMessage, setErrorMessage] = React.useState<string | null>(null)\n  const pageSize = 50\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setErrorMessage(null)\n      const response = await apiCall<ChannelListResponse>(\n        `/api/communication_channels/channels?page=${page}&pageSize=${pageSize}`,\n      ).catch((err: unknown) => {\n        return {\n          ok: false,\n          result: { error: err instanceof Error ? err.message : 'Failed to load channels' },\n        }\n      })\n      if (cancelled) return\n      if (!response.ok) {\n        const errBody = response.result as { error?: string } | undefined\n        setErrorMessage(\n          errBody?.error ?? t('communication_channels.errors.loadList', 'Failed to load channels'),\n        )\n        setRows([])\n        setTotal(0)\n        setTotalPages(1)\n      } else {\n        const data = (response.result ?? {}) as ChannelListResponse\n        setRows(Array.isArray(data.items) ? data.items : [])\n        setTotal(typeof data.total === 'number' ? data.total : 0)\n        setTotalPages(typeof data.totalPages === 'number' ? data.totalPages : 1)\n      }\n      setIsLoading(false)\n    }\n    void load()\n    return () => {\n      cancelled = true\n    }\n  }, [page, t])\n\n  const columns = React.useMemo<ColumnDef<ChannelRow>[]>(\n    () => [\n      {\n        header: t('communication_channels.columns.displayName', 'Channel'),\n        accessorKey: 'displayName',\n      },\n      {\n        header: t('communication_channels.columns.provider', 'Provider'),\n        accessorKey: 'providerKey',\n      },\n      {\n        header: t('communication_channels.columns.type', 'Type'),\n        accessorKey: 'channelType',\n      },\n      {\n        header: t('communication_channels.columns.identifier', 'External ID'),\n        accessorKey: 'externalIdentifier',\n        cell: ({ row }) => row.original.externalIdentifier ?? '\u2014',\n        meta: { truncate: true, maxWidth: 240 },\n      },\n      {\n        header: t('communication_channels.columns.status', 'Status'),\n        accessorKey: 'isActive',\n        cell: ({ row }) =>\n          row.original.isActive ? (\n            <Tag variant=\"success\" dot>\n              {t('communication_channels.status.active', 'Active')}\n            </Tag>\n          ) : (\n            <Tag variant=\"neutral\">\n              {t('communication_channels.status.inactive', 'Inactive')}\n            </Tag>\n          ),\n      },\n    ],\n    [t],\n  )\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<ChannelRow>\n          title={t('communication_channels.nav.title', 'Communication Channels')}\n          extensionTableId=\"communication_channels.channels\"\n          columns={columns}\n          data={rows}\n          isLoading={isLoading}\n          error={errorMessage}\n          emptyState={t(\n            'communication_channels.emptyState',\n            'No shared channels yet. This page lists shared, tenant-wide channels. Your personal email mailbox is private \u2014 connect and manage it under Profile \u2192 Communication Channels.',\n          )}\n          pagination={{\n            page,\n            pageSize,\n            total,\n            totalPages,\n            onPageChange: setPage,\n          }}\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAkGY;AAhGZ,YAAY,WAAW;AAEvB,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAC1B,SAAS,WAAW;AACpB,SAAS,eAAe;AACxB,SAAS,YAAY;AAmBN,SAAR,mBAAoC;AACzC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAuB,CAAC,CAAC;AACvD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAwB,IAAI;AAC1E,QAAM,WAAW;AAEjB,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,sBAAgB,IAAI;AACpB,YAAM,WAAW,MAAM;AAAA,QACrB,6CAA6C,IAAI,aAAa,QAAQ;AAAA,MACxE,EAAE,MAAM,CAAC,QAAiB;AACxB,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,QAAQ,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,0BAA0B;AAAA,QAClF;AAAA,MACF,CAAC;AACD,UAAI,UAAW;AACf,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,SAAS;AACzB;AAAA,UACE,SAAS,SAAS,EAAE,0CAA0C,yBAAyB;AAAA,QACzF;AACA,gBAAQ,CAAC,CAAC;AACV,iBAAS,CAAC;AACV,sBAAc,CAAC;AAAA,MACjB,OAAO;AACL,cAAM,OAAQ,SAAS,UAAU,CAAC;AAClC,gBAAQ,MAAM,QAAQ,KAAK,KAAK,IAAI,KAAK,QAAQ,CAAC,CAAC;AACnD,iBAAS,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ,CAAC;AACxD,sBAAc,OAAO,KAAK,eAAe,WAAW,KAAK,aAAa,CAAC;AAAA,MACzE;AACA,mBAAa,KAAK;AAAA,IACpB;AACA,SAAK,KAAK;AACV,WAAO,MAAM;AACX,kBAAY;AAAA,IACd;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,UAAU,MAAM;AAAA,IACpB,MAAM;AAAA,MACJ;AAAA,QACE,QAAQ,EAAE,8CAA8C,SAAS;AAAA,QACjE,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,2CAA2C,UAAU;AAAA,QAC/D,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,uCAAuC,MAAM;AAAA,QACvD,aAAa;AAAA,MACf;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,6CAA6C,aAAa;AAAA,QACpE,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,sBAAsB;AAAA,QACtD,MAAM,EAAE,UAAU,MAAM,UAAU,IAAI;AAAA,MACxC;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,yCAAyC,QAAQ;AAAA,QAC3D,aAAa;AAAA,QACb,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,OAAI,SAAQ,WAAU,KAAG,MACvB,YAAE,wCAAwC,QAAQ,GACrD,IAEA,oBAAC,OAAI,SAAQ,WACV,YAAE,0CAA0C,UAAU,GACzD;AAAA,MAEN;AAAA,IACF;AAAA,IACA,CAAC,CAAC;AAAA,EACJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,EAAE,oCAAoC,wBAAwB;AAAA,MACrE,kBAAiB;AAAA,MACjB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,YAAY;AAAA,QACV;AAAA,QACA;AAAA,MACF;AAAA,MACA,YAAY;AAAA,QACV;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc;AAAA,MAChB;AAAA;AAAA,EACF,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/communication_channels/backend/profile/communication-channels/page.js

@@ -1,7 +1,6 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
-import { extensionPoints } from "@open-mercato/core/modules/communication_channels/extension-points";
 import { useRouter, useSearchParams } from "next/navigation";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
@@ -381,7 +380,7 @@ function ProfileCommunicationChannelsPage() {
       /* @__PURE__ */ jsx(
         InjectionSpot,
         {
-          spotId: extensionPoints.hosts.profileConnect.spotId,
+          spotId: "profile:communication-channels:connect",
           context: { reload: () => setReloadKey((k) => k + 1) },
           data: {}
         }
@@ -396,7 +395,7 @@ function ProfileCommunicationChannelsPage() {
       DataTable,
       {
         title: t("communication_channels.profile.tableTitle", "Your channels"),
-        extensionTableId: extensionPoints.hosts.profileChannelsTable.tableId,
+        extensionTableId: "communication_channels.profile.channels",
         columns,
         data: rows,
         isLoading,
@@ -709,7 +708,7 @@ function DisconnectChannelDialog({
     /* @__PURE__ */ jsxs(DialogFooter, { children: [
       /* @__PURE__ */ jsx("span", { className: "mr-auto text-xs text-muted-foreground", children: /* @__PURE__ */ jsx(KbdShortcut, { keys: ["\u2318", "Enter"] }) }),
       /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", onClick: onClose, disabled: submitting, children: t("communication_channels.profile.disconnect.cancel", "Cancel") }),
-      /* @__PURE__ */ jsx(Button, { type: "button", variant: "destructive-solid", onClick: () => void handleConfirm(), disabled: submitting, children: submitting ? t("communication_channels.profile.disconnect.submitting", "Disconnecting\u2026") : t("communication_channels.profile.disconnect.confirm", "Disconnect") })
+      /* @__PURE__ */ jsx(Button, { type: "button", variant: "destructive", onClick: () => void handleConfirm(), disabled: submitting, children: submitting ? t("communication_channels.profile.disconnect.submitting", "Disconnecting\u2026") : t("communication_channels.profile.disconnect.confirm", "Disconnect") })
     ] })
   ] }) });
 }