@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/dist/modules/feature_toggles/components/hooks/useFeatureFlagJson.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/feature_toggles/components/hooks/useFeatureFlagJson.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type UseFeatureFlagJsonOptions = {\n    id: string\n}\n\nexport type UseFeatureFlagJsonResult<T = unknown> = {\n    value: T | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagJson<T = unknown>(options: UseFeatureFlagJsonOptions): UseFeatureFlagJsonResult<T> {\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'json', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<T>>(\n                `/api/feature_toggles/check/json?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n    })\n\n    const value = query.data?.ok ? query.data.value : null\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
-  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AAmB9B,SAAS,mBAAgC,SAAiE;AAC7G,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,QAAQ,SAAS,EAAE;AAAA,IACzD,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,mCAAmC,OAAO,SAAS,CAAC;AAAA,QACpD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,EACvB,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'\n\nexport type UseFeatureFlagJsonOptions<T = unknown> = {\n    id: string\n    /**\n     * Value used while the check is in flight and whenever the toggle cannot be\n     * resolved (undefined toggle, type mismatch, network or permission failure).\n     * Defaults to `null`.\n     */\n    defaultValue?: T | null\n}\n\nexport type UseFeatureFlagJsonResult<T = unknown> = {\n    value: T | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagJson<T = unknown>(options: UseFeatureFlagJsonOptions<T>): UseFeatureFlagJsonResult<T> {\n    const defaultValue = options.defaultValue ?? null\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'json', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<T>>(\n                `/api/feature_toggles/check/json?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n        staleTime: FEATURE_FLAG_STALE_TIME_MS,\n    })\n\n    const value = query.data?.ok ? query.data.value : defaultValue\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
+  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAyBpC,SAAS,mBAAgC,SAAoE;AAChH,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,QAAQ,SAAS,EAAE;AAAA,IACzD,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,mCAAmC,OAAO,SAAS,CAAC;AAAA,QACpD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,IACnB,WAAW;AAAA,EACf,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
   "names": []
 }

package/dist/modules/feature_toggles/components/hooks/useFeatureFlagNumber.js

@@ -1,7 +1,9 @@
 "use client";
 import { useQuery } from "@tanstack/react-query";
 import { readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { FEATURE_FLAG_STALE_TIME_MS } from "./staleTime.js";
 function useFeatureFlagNumber(options) {
+  const defaultValue = options.defaultValue ?? null;
   const query = useQuery({
     queryKey: ["featureToggles", "check", "number", options?.id],
     queryFn: async () => {
@@ -15,9 +17,10 @@ function useFeatureFlagNumber(options) {
       );
       return result;
     },
-    enabled: !!options.id
+    enabled: !!options.id,
+    staleTime: FEATURE_FLAG_STALE_TIME_MS
   });
-  const value = query.data?.ok ? query.data.value : null;
+  const value = query.data?.ok ? query.data.value : defaultValue;
   const isLoading = query.isLoading;
   return {
     value,

package/dist/modules/feature_toggles/components/hooks/useFeatureFlagNumber.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/feature_toggles/components/hooks/useFeatureFlagNumber.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type UseFeatureFlagNumberOptions = {\n    id: string\n}\n\nexport type UseFeatureFlagNumberResult = {\n    value: number | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagNumber(options: UseFeatureFlagNumberOptions): UseFeatureFlagNumberResult {\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'number', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<number>>(\n                `/api/feature_toggles/check/number?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n    })\n\n    const value = query.data?.ok ? query.data.value : null\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
-  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AAmB9B,SAAS,qBAAqB,SAAkE;AACnG,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,UAAU,SAAS,EAAE;AAAA,IAC3D,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,qCAAqC,OAAO,SAAS,CAAC;AAAA,QACtD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,EACvB,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'\n\nexport type UseFeatureFlagNumberOptions = {\n    id: string\n    /**\n     * Value used while the check is in flight and whenever the toggle cannot be\n     * resolved (undefined toggle, type mismatch, network or permission failure).\n     * Defaults to `null`.\n     */\n    defaultValue?: number | null\n}\n\nexport type UseFeatureFlagNumberResult = {\n    value: number | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagNumber(options: UseFeatureFlagNumberOptions): UseFeatureFlagNumberResult {\n    const defaultValue = options.defaultValue ?? null\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'number', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<number>>(\n                `/api/feature_toggles/check/number?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n        staleTime: FEATURE_FLAG_STALE_TIME_MS,\n    })\n\n    const value = query.data?.ok ? query.data.value : defaultValue\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
+  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAyBpC,SAAS,qBAAqB,SAAkE;AACnG,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,UAAU,SAAS,EAAE;AAAA,IAC3D,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,qCAAqC,OAAO,SAAS,CAAC;AAAA,QACtD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,IACnB,WAAW;AAAA,EACf,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
   "names": []
 }

package/dist/modules/feature_toggles/components/hooks/useFeatureFlagString.js

@@ -1,7 +1,9 @@
 "use client";
 import { useQuery } from "@tanstack/react-query";
 import { readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { FEATURE_FLAG_STALE_TIME_MS } from "./staleTime.js";
 function useFeatureFlagString(options) {
+  const defaultValue = options.defaultValue ?? null;
   const query = useQuery({
     queryKey: ["featureToggles", "check", "string", options?.id],
     queryFn: async () => {
@@ -15,9 +17,10 @@ function useFeatureFlagString(options) {
       );
       return result;
     },
-    enabled: !!options.id
+    enabled: !!options.id,
+    staleTime: FEATURE_FLAG_STALE_TIME_MS
   });
-  const value = query.data?.ok ? query.data.value : null;
+  const value = query.data?.ok ? query.data.value : defaultValue;
   const isLoading = query.isLoading;
   return {
     value,

package/dist/modules/feature_toggles/components/hooks/useFeatureFlagString.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/feature_toggles/components/hooks/useFeatureFlagString.ts"],
-  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\n\nexport type UseFeatureFlagStringOptions = {\n    id: string\n}\n\nexport type UseFeatureFlagStringResult = {\n    value: string | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagString(options: UseFeatureFlagStringOptions): UseFeatureFlagStringResult {\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'string', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<string>>(\n                `/api/feature_toggles/check/string?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n    })\n\n    const value = query.data?.ok ? query.data.value : null\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
-  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AAmB9B,SAAS,qBAAqB,SAAkE;AACnG,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,UAAU,SAAS,EAAE;AAAA,IAC3D,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,qCAAqC,OAAO,SAAS,CAAC;AAAA,QACtD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,EACvB,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { useQuery } from '@tanstack/react-query'\nimport { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { FEATURE_FLAG_STALE_TIME_MS } from './staleTime'\n\nexport type UseFeatureFlagStringOptions = {\n    id: string\n    /**\n     * Value used while the check is in flight and whenever the toggle cannot be\n     * resolved (undefined toggle, type mismatch, network or permission failure).\n     * Defaults to `null`.\n     */\n    defaultValue?: string | null\n}\n\nexport type UseFeatureFlagStringResult = {\n    value: string | null\n    isLoading: boolean\n}\n\ntype Result<T> = {\n    ok: true\n    value: T\n} | {\n    ok: false\n    error: unknown\n}\n\nexport function useFeatureFlagString(options: UseFeatureFlagStringOptions): UseFeatureFlagStringResult {\n    const defaultValue = options.defaultValue ?? null\n    const query = useQuery({\n        queryKey: ['featureToggles', 'check', 'string', options?.id],\n        queryFn: async () => {\n            const params = new URLSearchParams({\n                identifier: options.id,\n            })\n\n            const result = await readApiResultOrThrow<Result<string>>(\n                `/api/feature_toggles/check/string?${params.toString()}`,\n                undefined,\n                { errorMessage: 'Failed to check feature flag.' },\n            )\n\n            return result\n        },\n        enabled: !!options.id,\n        staleTime: FEATURE_FLAG_STALE_TIME_MS,\n    })\n\n    const value = query.data?.ok ? query.data.value : defaultValue\n    const isLoading = query.isLoading\n\n    return {\n        value,\n        isLoading,\n    }\n}\n"],
+  "mappings": ";AAEA,SAAS,gBAAgB;AACzB,SAAS,4BAA4B;AACrC,SAAS,kCAAkC;AAyBpC,SAAS,qBAAqB,SAAkE;AACnG,QAAM,eAAe,QAAQ,gBAAgB;AAC7C,QAAM,QAAQ,SAAS;AAAA,IACnB,UAAU,CAAC,kBAAkB,SAAS,UAAU,SAAS,EAAE;AAAA,IAC3D,SAAS,YAAY;AACjB,YAAM,SAAS,IAAI,gBAAgB;AAAA,QAC/B,YAAY,QAAQ;AAAA,MACxB,CAAC;AAED,YAAM,SAAS,MAAM;AAAA,QACjB,qCAAqC,OAAO,SAAS,CAAC;AAAA,QACtD;AAAA,QACA,EAAE,cAAc,gCAAgC;AAAA,MACpD;AAEA,aAAO;AAAA,IACX;AAAA,IACA,SAAS,CAAC,CAAC,QAAQ;AAAA,IACnB,WAAW;AAAA,EACf,CAAC;AAED,QAAM,QAAQ,MAAM,MAAM,KAAK,MAAM,KAAK,QAAQ;AAClD,QAAM,YAAY,MAAM;AAExB,SAAO;AAAA,IACH;AAAA,IACA;AAAA,EACJ;AACJ;",
   "names": []
 }

package/dist/modules/inbox_ops/ai-tools.js

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { runWithCacheTenant } from "@open-mercato/cache";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
-import { hasFeature } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 import { InboxProposal, InboxProposalAction, InboxDiscrepancy } from "./data/entities.js";
 import { inboxProposalCategoryEnum } from "./data/validators.js";
 import { executeAction } from "./lib/executionEngine.js";
@@ -231,7 +231,10 @@ Returns on error: error message with appropriate detail.`,
       return { error: "Action already processed", status: action.status };
     }
     if (action.requiredFeature) {
-      const featureGranted = ctx.isSuperAdmin || hasFeature(ctx.userFeatures, action.requiredFeature);
+      const featureGranted = authorizeFeatures([action.requiredFeature], {
+        grantedFeatures: ctx.userFeatures,
+        unrestricted: ctx.isSuperAdmin
+      });
       if (!featureGranted) {
         return {
           error: "Insufficient permissions",

package/dist/modules/inbox_ops/ai-tools.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/inbox_ops/ai-tools.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { InboxProposal, InboxProposalAction, InboxDiscrepancy } from './data/entities'\nimport { inboxProposalCategoryEnum } from './data/validators'\nimport { executeAction } from './lib/executionEngine'\nimport { resolveConfiguredStructuredModel, withTimeout } from './lib/llmProvider'\nimport { resolveOptionalEventBus } from './lib/eventBus'\n\ntype ToolContext = {\n  tenantId: string | null\n  organizationId: string | null\n  userId: string | null\n  container: AwilixContainer\n  userFeatures: string[]\n  isSuperAdmin: boolean\n}\n\ninterface AiToolDefinition {\n  name: string\n  description: string\n  inputSchema: z.ZodType\n  requiredFeatures?: string[]\n  handler: (input: never, ctx: ToolContext) => Promise<unknown>\n}\n\n// =============================================================================\n// Helpers\n// =============================================================================\n\nfunction requireTenantContext(ctx: ToolContext): { tenantId: string; organizationId: string } {\n  if (!ctx.tenantId || !ctx.organizationId) {\n    throw new Error('Tenant context is required')\n  }\n  return { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n}\n\nfunction resolveCrossModuleEntities(container: ToolContext['container']) {\n  const entities: Record<string, unknown> = {}\n  const keys = [\n    'CustomerEntity',\n    'SalesOrder',\n    'SalesShipment',\n    'SalesChannel',\n    'Dictionary',\n    'DictionaryEntry',\n  ]\n  for (const key of keys) {\n    try {\n      entities[key] = container.resolve(key)\n    } catch {\n      /* module not available */\n    }\n  }\n  return entities\n}\n\n// =============================================================================\n// inbox_ops_list_proposals \u2014 Query proposals by status, category, date range\n// =============================================================================\n\nconst listProposalsTool = {\n  name: 'inbox_ops_list_proposals',\n  description: `List inbox proposals with optional filters by status, category, and date range.\n\nReturns: total count and an array of proposals with id, summary, status, category, confidence, actionCount, and createdAt.`,\n  inputSchema: z.object({\n    status: z\n      .enum(['pending', 'partial', 'accepted', 'rejected'])\n      .optional()\n      .describe('Filter by proposal status'),\n    category: inboxProposalCategoryEnum\n      .optional()\n      .describe('Filter by email category'),\n    limit: z\n      .number()\n      .int()\n      .min(1)\n      .max(50)\n      .optional()\n      .default(10)\n      .describe('Maximum number of proposals to return (default: 10)'),\n    dateFrom: z\n      .string()\n      .optional()\n      .describe('Filter proposals created on or after this date (ISO 8601)'),\n    dateTo: z\n      .string()\n      .optional()\n      .describe('Filter proposals created on or before this date (ISO 8601)'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { status?: string; category?: string; limit?: number; dateFrom?: string; dateTo?: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const where: Record<string, unknown> = {\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      isActive: true,\n      deletedAt: null,\n    }\n\n    if (input.status) {\n      where.status = input.status\n    }\n    if (input.category) {\n      where.category = input.category\n    }\n    if (input.dateFrom || input.dateTo) {\n      const createdAt: Record<string, unknown> = {}\n      if (input.dateFrom) {\n        createdAt.$gte = new Date(input.dateFrom)\n      }\n      if (input.dateTo) {\n        createdAt.$lte = new Date(input.dateTo)\n      }\n      where.createdAt = createdAt\n    }\n\n    const proposals = await findWithDecryption(\n      em,\n      InboxProposal,\n      where,\n      { orderBy: { createdAt: 'DESC' }, limit: input.limit },\n      scope,\n    )\n\n    // Count actions per proposal in a single query\n    const proposalIds = proposals.map((p) => p.id)\n    const actionCountMap = new Map<string, number>()\n\n    if (proposalIds.length > 0) {\n      const actions = await findWithDecryption(\n        em,\n        InboxProposalAction,\n        {\n          proposalId: { $in: proposalIds },\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n      for (const action of actions) {\n        actionCountMap.set(action.proposalId, (actionCountMap.get(action.proposalId) ?? 0) + 1)\n      }\n    }\n\n    // Get total count for the filter\n    const total = await em.count(InboxProposal, where)\n\n    return {\n      total,\n      proposals: proposals.map((p) => ({\n        id: p.id,\n        summary: p.summary,\n        status: p.status,\n        category: p.category ?? null,\n        confidence: Number(p.confidence),\n        actionCount: actionCountMap.get(p.id) ?? 0,\n        createdAt: p.createdAt.toISOString(),\n      })),\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_get_proposal \u2014 Fetch proposal detail with actions and discrepancies\n// =============================================================================\n\nconst getProposalTool = {\n  name: 'inbox_ops_get_proposal',\n  description: `Get full details of an inbox proposal including its actions and discrepancies.\n\nReturns: proposal with id, summary, status, category, confidence, actions array, and discrepancies array.`,\n  inputSchema: z.object({\n    proposalId: z.string().uuid().describe('The UUID of the proposal to retrieve'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { proposalId: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const proposal = await findOneWithDecryption(\n      em,\n      InboxProposal,\n      {\n        id: input.proposalId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        isActive: true,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!proposal) {\n      return { error: 'Proposal not found' }\n    }\n\n    const actions = await findWithDecryption(\n      em,\n      InboxProposalAction,\n      {\n        proposalId: proposal.id,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      { orderBy: { sortOrder: 'ASC' } },\n      scope,\n    )\n\n    const discrepancies = await findWithDecryption(\n      em,\n      InboxDiscrepancy,\n      {\n        proposalId: proposal.id,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    return {\n      proposal: {\n        id: proposal.id,\n        summary: proposal.summary,\n        status: proposal.status,\n        category: proposal.category ?? null,\n        confidence: Number(proposal.confidence),\n        actions: actions.map((a) => ({\n          id: a.id,\n          actionType: a.actionType,\n          description: a.description,\n          status: a.status,\n          confidence: Number(a.confidence),\n          requiredFeature: a.requiredFeature ?? null,\n          sortOrder: a.sortOrder,\n          createdEntityId: a.createdEntityId ?? null,\n          createdEntityType: a.createdEntityType ?? null,\n        })),\n        discrepancies: discrepancies.map((d) => ({\n          id: d.id,\n          type: d.type,\n          severity: d.severity,\n          description: d.description,\n          expectedValue: d.expectedValue ?? null,\n          foundValue: d.foundValue ?? null,\n          resolved: d.resolved,\n        })),\n      },\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_accept_action \u2014 Accept and execute a specific action\n// =============================================================================\n\nconst acceptActionTool = {\n  name: 'inbox_ops_accept_action',\n  description: `Accept and execute a specific action from an inbox proposal. Creates the entity in the target module (e.g., order, contact).\n\nReturns on success: { ok: true, createdEntityId, createdEntityType }\nReturns on error: error message with appropriate detail.`,\n  inputSchema: z.object({\n    proposalId: z.string().uuid().describe('The UUID of the proposal'),\n    actionId: z.string().uuid().describe('The UUID of the action to accept'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.manage'],\n  // Accepting an inbox action creates downstream entities (orders, contacts,\n  // etc.) in target modules \u2014 must surface as a write so any agent that\n  // whitelists it routes through the approval card.\n  isMutation: true,\n  handler: async (input: { proposalId: string; actionId: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    if (!ctx.userId) {\n      throw new Error('User context is required')\n    }\n\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const action = await findOneWithDecryption(\n      em,\n      InboxProposalAction,\n      {\n        id: input.actionId,\n        proposalId: input.proposalId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!action) {\n      return { error: 'Action not found' }\n    }\n\n    // Check if action was already processed\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return { error: 'Action already processed', status: action.status }\n    }\n\n    // Check target module permission\n    if (action.requiredFeature) {\n      const featureGranted =\n        ctx.isSuperAdmin || hasFeature(ctx.userFeatures, action.requiredFeature)\n      if (!featureGranted) {\n        return {\n          error: 'Insufficient permissions',\n          requiredFeature: action.requiredFeature,\n        }\n      }\n    }\n\n    const entities = resolveCrossModuleEntities(ctx.container)\n    const eventBus = resolveOptionalEventBus(ctx.container)\n\n    const result = await executeAction(action, {\n      em,\n      userId: ctx.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      eventBus,\n      container: ctx.container,\n      entities: entities as unknown as import('./lib/executionEngine').CrossModuleEntities,\n    })\n\n    if (!result.success) {\n      if (result.statusCode === 409) {\n        return { error: 'Action already processed', status: 'accepted' }\n      }\n      if (result.statusCode === 403) {\n        return {\n          error: 'Insufficient permissions',\n          requiredFeature: action.requiredFeature ?? 'unknown',\n        }\n      }\n      return { error: 'Execution failed', detail: result.error ?? 'Unknown error' }\n    }\n\n    try {\n      const { resolveCache, invalidateCountsCache } = await import('./lib/cache')\n      const cache = resolveCache(ctx.container)\n      if (cache && scope.tenantId) {\n        await runWithCacheTenant(scope.tenantId, () => invalidateCountsCache(cache, scope.tenantId))\n      }\n    } catch { /* cache invalidation is non-critical */ }\n\n    return {\n      ok: true,\n      createdEntityId: result.createdEntityId ?? null,\n      createdEntityType: result.createdEntityType ?? null,\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_categorize_email \u2014 Standalone LLM-based text categorization\n// =============================================================================\n\nconst categorizeEmailSchema = z.object({\n  category: inboxProposalCategoryEnum,\n  confidence: z.number(),\n  reasoning: z.string(),\n})\n\nconst categorizeEmailTool = {\n  name: 'inbox_ops_categorize_email',\n  description: `Categorize email or text content using AI. Classifies text into one of: rfq, order, order_update, complaint, shipping_update, inquiry, payment, other.\n\nReturns: { category, confidence (0-1), reasoning }\nInput text is limited to 10,000 characters for cost control.`,\n  inputSchema: z.object({\n    text: z\n      .string()\n      .min(1)\n      .max(10000)\n      .describe('Email or text content to categorize (max 10K chars)'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { text: string }, ctx: ToolContext) => {\n    requireTenantContext(ctx)\n\n    const { model } = await resolveConfiguredStructuredModel({ moduleId: 'inbox_ops' })\n\n    const { generateObject } = await import('ai')\n\n    const result = await withTimeout(\n      generateObject({\n        model,\n        schema: categorizeEmailSchema,\n        system: `You are an email classification agent. Classify the given text into exactly one category:\n- rfq: Request for quotation or pricing inquiry\n- order: New purchase order or order placement\n- order_update: Change or update to an existing order\n- complaint: Customer complaint, dispute, or dissatisfaction\n- shipping_update: Shipment status, tracking, or delivery information\n- inquiry: General question or information request\n- payment: Payment-related (invoice, receipt, payment terms)\n- other: Does not fit any category above\n\nReturn a JSON object with:\n- category: one of the categories above\n- confidence: a number between 0 and 1 indicating how confident you are\n- reasoning: a brief explanation (1-2 sentences) of why this category was chosen`,\n        prompt: input.text,\n        temperature: 0,\n      }),\n      15000,\n      'Email categorization timed out after 15s',\n    )\n\n    return {\n      category: result.object.category,\n      confidence: Math.round(result.object.confidence * 100) / 100,\n      reasoning: result.object.reasoning,\n    }\n  },\n}\n\n// =============================================================================\n// Export\n// =============================================================================\n\n/**\n * All AI tools exported by the inbox_ops module.\n * Discovered by ai-assistant module's generator.\n */\nexport const aiTools: AiToolDefinition[] = [\n  listProposalsTool,\n  getProposalTool,\n  acceptActionTool,\n  categorizeEmailTool,\n]\n\nexport default aiTools\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,0BAA0B;AACnC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,kBAAkB;AAC3B,SAAS,eAAe,qBAAqB,wBAAwB;AACrE,SAAS,iCAAiC;AAC1C,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC,mBAAmB;AAC9D,SAAS,+BAA+B;AAuBxC,SAAS,qBAAqB,KAAgE;AAC5F,MAAI,CAAC,IAAI,YAAY,CAAC,IAAI,gBAAgB;AACxC,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,SAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AACtE;AAEA,SAAS,2BAA2B,WAAqC;AACvE,QAAM,WAAoC,CAAC;AAC3C,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,eAAS,GAAG,IAAI,UAAU,QAAQ,GAAG;AAAA,IACvC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAMA,MAAM,oBAAoB;AAAA,EACxB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA,EAGb,aAAa,EAAE,OAAO;AAAA,IACpB,QAAQ,EACL,KAAK,CAAC,WAAW,WAAW,YAAY,UAAU,CAAC,EACnD,SAAS,EACT,SAAS,2BAA2B;AAAA,IACvC,UAAU,0BACP,SAAS,EACT,SAAS,0BAA0B;AAAA,IACtC,OAAO,EACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,EAAE,EACN,SAAS,EACT,QAAQ,EAAE,EACV,SAAS,qDAAqD;AAAA,IACjE,UAAU,EACP,OAAO,EACP,SAAS,EACT,SAAS,2DAA2D;AAAA,IACvE,QAAQ,EACL,OAAO,EACP,SAAS,EACT,SAAS,4DAA4D;AAAA,EAC1E,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAAmG,QAAqB;AACtI,UAAM,QAAQ,qBAAqB,GAAG;AACtC,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,QAAiC;AAAA,MACrC,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAEA,QAAI,MAAM,QAAQ;AAChB,YAAM,SAAS,MAAM;AAAA,IACvB;AACA,QAAI,MAAM,UAAU;AAClB,YAAM,WAAW,MAAM;AAAA,IACzB;AACA,QAAI,MAAM,YAAY,MAAM,QAAQ;AAClC,YAAM,YAAqC,CAAC;AAC5C,UAAI,MAAM,UAAU;AAClB,kBAAU,OAAO,IAAI,KAAK,MAAM,QAAQ;AAAA,MAC1C;AACA,UAAI,MAAM,QAAQ;AAChB,kBAAU,OAAO,IAAI,KAAK,MAAM,MAAM;AAAA,MACxC;AACA,YAAM,YAAY;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,GAAG,OAAO,MAAM,MAAM;AAAA,MACrD;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7C,UAAM,iBAAiB,oBAAI,IAAoB;AAE/C,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,UACE,YAAY,EAAE,KAAK,YAAY;AAAA,UAC/B,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,iBAAW,UAAU,SAAS;AAC5B,uBAAe,IAAI,OAAO,aAAa,eAAe,IAAI,OAAO,UAAU,KAAK,KAAK,CAAC;AAAA,MACxF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,GAAG,MAAM,eAAe,KAAK;AAEjD,WAAO;AAAA,MACL;AAAA,MACA,WAAW,UAAU,IAAI,CAAC,OAAO;AAAA,QAC/B,IAAI,EAAE;AAAA,QACN,SAAS,EAAE;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE,YAAY;AAAA,QACxB,YAAY,OAAO,EAAE,UAAU;AAAA,QAC/B,aAAa,eAAe,IAAI,EAAE,EAAE,KAAK;AAAA,QACzC,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC,EAAE;AAAA,IACJ;AAAA,EACF;AACF;AAMA,MAAM,kBAAkB;AAAA,EACtB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA,EAGb,aAAa,EAAE,OAAO;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,sCAAsC;AAAA,EAC/E,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAA+B,QAAqB;AAClE,UAAM,QAAQ,qBAAqB,GAAG;AACtC,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,OAAO,qBAAqB;AAAA,IACvC;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,YAAY,SAAS;AAAA,QACrB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,QACE,YAAY,SAAS;AAAA,QACrB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU;AAAA,QACR,IAAI,SAAS;AAAA,QACb,SAAS,SAAS;AAAA,QAClB,QAAQ,SAAS;AAAA,QACjB,UAAU,SAAS,YAAY;AAAA,QAC/B,YAAY,OAAO,SAAS,UAAU;AAAA,QACtC,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,UAC3B,IAAI,EAAE;AAAA,UACN,YAAY,EAAE;AAAA,UACd,aAAa,EAAE;AAAA,UACf,QAAQ,EAAE;AAAA,UACV,YAAY,OAAO,EAAE,UAAU;AAAA,UAC/B,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,WAAW,EAAE;AAAA,UACb,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,mBAAmB,EAAE,qBAAqB;AAAA,QAC5C,EAAE;AAAA,QACF,eAAe,cAAc,IAAI,CAAC,OAAO;AAAA,UACvC,IAAI,EAAE;AAAA,UACN,MAAM,EAAE;AAAA,UACR,UAAU,EAAE;AAAA,UACZ,aAAa,EAAE;AAAA,UACf,eAAe,EAAE,iBAAiB;AAAA,UAClC,YAAY,EAAE,cAAc;AAAA,UAC5B,UAAU,EAAE;AAAA,QACd,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAMA,MAAM,mBAAmB;AAAA,EACvB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIb,aAAa,EAAE,OAAO;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0BAA0B;AAAA,IACjE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,kCAAkC;AAAA,EACzE,CAAC;AAAA,EACD,kBAAkB,CAAC,4BAA4B;AAAA;AAAA;AAAA;AAAA,EAI/C,YAAY;AAAA,EACZ,SAAS,OAAO,OAAiD,QAAqB;AACpF,UAAM,QAAQ,qBAAqB,GAAG;AACtC,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,OAAO,mBAAmB;AAAA,IACrC;AAGA,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,EAAE,OAAO,4BAA4B,QAAQ,OAAO,OAAO;AAAA,IACpE;AAGA,QAAI,OAAO,iBAAiB;AAC1B,YAAM,iBACJ,IAAI,gBAAgB,WAAW,IAAI,cAAc,OAAO,eAAe;AACzE,UAAI,CAAC,gBAAgB;AACnB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,iBAAiB,OAAO;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,2BAA2B,IAAI,SAAS;AACzD,UAAM,WAAW,wBAAwB,IAAI,SAAS;AAEtD,UAAM,SAAS,MAAM,cAAc,QAAQ;AAAA,MACzC;AAAA,MACA,QAAQ,IAAI;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB;AAAA,MACA,WAAW,IAAI;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,UAAI,OAAO,eAAe,KAAK;AAC7B,eAAO,EAAE,OAAO,4BAA4B,QAAQ,WAAW;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,KAAK;AAC7B,eAAO;AAAA,UACL,OAAO;AAAA,UACP,iBAAiB,OAAO,mBAAmB;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,OAAO,oBAAoB,QAAQ,OAAO,SAAS,gBAAgB;AAAA,IAC9E;AAEA,QAAI;AACF,YAAM,EAAE,cAAc,sBAAsB,IAAI,MAAM,OAAO,aAAa;AAC1E,YAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAI,SAAS,MAAM,UAAU;AAC3B,cAAM,mBAAmB,MAAM,UAAU,MAAM,sBAAsB,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC7F;AAAA,IACF,QAAQ;AAAA,IAA2C;AAEnD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,mBAAmB,OAAO,qBAAqB;AAAA,IACjD;AAAA,EACF;AACF;AAMA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU;AAAA,EACV,YAAY,EAAE,OAAO;AAAA,EACrB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,sBAAsB;AAAA,EAC1B,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIb,aAAa,EAAE,OAAO;AAAA,IACpB,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAK,EACT,SAAS,qDAAqD;AAAA,EACnE,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAAyB,QAAqB;AAC5D,yBAAqB,GAAG;AAExB,UAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,EAAE,UAAU,YAAY,CAAC;AAElF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,IAAI;AAE5C,UAAM,SAAS,MAAM;AAAA,MACnB,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAcR,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AAAA,MACD;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,KAAK,MAAM,OAAO,OAAO,aAAa,GAAG,IAAI;AAAA,MACzD,WAAW,OAAO,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;AAUO,MAAM,UAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAO,mBAAQ;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AwilixContainer } from 'awilix'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { InboxProposal, InboxProposalAction, InboxDiscrepancy } from './data/entities'\nimport { inboxProposalCategoryEnum } from './data/validators'\nimport { executeAction } from './lib/executionEngine'\nimport { resolveConfiguredStructuredModel, withTimeout } from './lib/llmProvider'\nimport { resolveOptionalEventBus } from './lib/eventBus'\n\ntype ToolContext = {\n  tenantId: string | null\n  organizationId: string | null\n  userId: string | null\n  container: AwilixContainer\n  userFeatures: string[]\n  isSuperAdmin: boolean\n}\n\ninterface AiToolDefinition {\n  name: string\n  description: string\n  inputSchema: z.ZodType\n  requiredFeatures?: string[]\n  handler: (input: never, ctx: ToolContext) => Promise<unknown>\n}\n\n// =============================================================================\n// Helpers\n// =============================================================================\n\nfunction requireTenantContext(ctx: ToolContext): { tenantId: string; organizationId: string } {\n  if (!ctx.tenantId || !ctx.organizationId) {\n    throw new Error('Tenant context is required')\n  }\n  return { tenantId: ctx.tenantId, organizationId: ctx.organizationId }\n}\n\nfunction resolveCrossModuleEntities(container: ToolContext['container']) {\n  const entities: Record<string, unknown> = {}\n  const keys = [\n    'CustomerEntity',\n    'SalesOrder',\n    'SalesShipment',\n    'SalesChannel',\n    'Dictionary',\n    'DictionaryEntry',\n  ]\n  for (const key of keys) {\n    try {\n      entities[key] = container.resolve(key)\n    } catch {\n      /* module not available */\n    }\n  }\n  return entities\n}\n\n// =============================================================================\n// inbox_ops_list_proposals \u2014 Query proposals by status, category, date range\n// =============================================================================\n\nconst listProposalsTool = {\n  name: 'inbox_ops_list_proposals',\n  description: `List inbox proposals with optional filters by status, category, and date range.\n\nReturns: total count and an array of proposals with id, summary, status, category, confidence, actionCount, and createdAt.`,\n  inputSchema: z.object({\n    status: z\n      .enum(['pending', 'partial', 'accepted', 'rejected'])\n      .optional()\n      .describe('Filter by proposal status'),\n    category: inboxProposalCategoryEnum\n      .optional()\n      .describe('Filter by email category'),\n    limit: z\n      .number()\n      .int()\n      .min(1)\n      .max(50)\n      .optional()\n      .default(10)\n      .describe('Maximum number of proposals to return (default: 10)'),\n    dateFrom: z\n      .string()\n      .optional()\n      .describe('Filter proposals created on or after this date (ISO 8601)'),\n    dateTo: z\n      .string()\n      .optional()\n      .describe('Filter proposals created on or before this date (ISO 8601)'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { status?: string; category?: string; limit?: number; dateFrom?: string; dateTo?: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const where: Record<string, unknown> = {\n      organizationId: scope.organizationId,\n      tenantId: scope.tenantId,\n      isActive: true,\n      deletedAt: null,\n    }\n\n    if (input.status) {\n      where.status = input.status\n    }\n    if (input.category) {\n      where.category = input.category\n    }\n    if (input.dateFrom || input.dateTo) {\n      const createdAt: Record<string, unknown> = {}\n      if (input.dateFrom) {\n        createdAt.$gte = new Date(input.dateFrom)\n      }\n      if (input.dateTo) {\n        createdAt.$lte = new Date(input.dateTo)\n      }\n      where.createdAt = createdAt\n    }\n\n    const proposals = await findWithDecryption(\n      em,\n      InboxProposal,\n      where,\n      { orderBy: { createdAt: 'DESC' }, limit: input.limit },\n      scope,\n    )\n\n    // Count actions per proposal in a single query\n    const proposalIds = proposals.map((p) => p.id)\n    const actionCountMap = new Map<string, number>()\n\n    if (proposalIds.length > 0) {\n      const actions = await findWithDecryption(\n        em,\n        InboxProposalAction,\n        {\n          proposalId: { $in: proposalIds },\n          deletedAt: null,\n        },\n        undefined,\n        scope,\n      )\n      for (const action of actions) {\n        actionCountMap.set(action.proposalId, (actionCountMap.get(action.proposalId) ?? 0) + 1)\n      }\n    }\n\n    // Get total count for the filter\n    const total = await em.count(InboxProposal, where)\n\n    return {\n      total,\n      proposals: proposals.map((p) => ({\n        id: p.id,\n        summary: p.summary,\n        status: p.status,\n        category: p.category ?? null,\n        confidence: Number(p.confidence),\n        actionCount: actionCountMap.get(p.id) ?? 0,\n        createdAt: p.createdAt.toISOString(),\n      })),\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_get_proposal \u2014 Fetch proposal detail with actions and discrepancies\n// =============================================================================\n\nconst getProposalTool = {\n  name: 'inbox_ops_get_proposal',\n  description: `Get full details of an inbox proposal including its actions and discrepancies.\n\nReturns: proposal with id, summary, status, category, confidence, actions array, and discrepancies array.`,\n  inputSchema: z.object({\n    proposalId: z.string().uuid().describe('The UUID of the proposal to retrieve'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { proposalId: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const proposal = await findOneWithDecryption(\n      em,\n      InboxProposal,\n      {\n        id: input.proposalId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        isActive: true,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!proposal) {\n      return { error: 'Proposal not found' }\n    }\n\n    const actions = await findWithDecryption(\n      em,\n      InboxProposalAction,\n      {\n        proposalId: proposal.id,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      { orderBy: { sortOrder: 'ASC' } },\n      scope,\n    )\n\n    const discrepancies = await findWithDecryption(\n      em,\n      InboxDiscrepancy,\n      {\n        proposalId: proposal.id,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n      },\n      undefined,\n      scope,\n    )\n\n    return {\n      proposal: {\n        id: proposal.id,\n        summary: proposal.summary,\n        status: proposal.status,\n        category: proposal.category ?? null,\n        confidence: Number(proposal.confidence),\n        actions: actions.map((a) => ({\n          id: a.id,\n          actionType: a.actionType,\n          description: a.description,\n          status: a.status,\n          confidence: Number(a.confidence),\n          requiredFeature: a.requiredFeature ?? null,\n          sortOrder: a.sortOrder,\n          createdEntityId: a.createdEntityId ?? null,\n          createdEntityType: a.createdEntityType ?? null,\n        })),\n        discrepancies: discrepancies.map((d) => ({\n          id: d.id,\n          type: d.type,\n          severity: d.severity,\n          description: d.description,\n          expectedValue: d.expectedValue ?? null,\n          foundValue: d.foundValue ?? null,\n          resolved: d.resolved,\n        })),\n      },\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_accept_action \u2014 Accept and execute a specific action\n// =============================================================================\n\nconst acceptActionTool = {\n  name: 'inbox_ops_accept_action',\n  description: `Accept and execute a specific action from an inbox proposal. Creates the entity in the target module (e.g., order, contact).\n\nReturns on success: { ok: true, createdEntityId, createdEntityType }\nReturns on error: error message with appropriate detail.`,\n  inputSchema: z.object({\n    proposalId: z.string().uuid().describe('The UUID of the proposal'),\n    actionId: z.string().uuid().describe('The UUID of the action to accept'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.manage'],\n  // Accepting an inbox action creates downstream entities (orders, contacts,\n  // etc.) in target modules \u2014 must surface as a write so any agent that\n  // whitelists it routes through the approval card.\n  isMutation: true,\n  handler: async (input: { proposalId: string; actionId: string }, ctx: ToolContext) => {\n    const scope = requireTenantContext(ctx)\n    if (!ctx.userId) {\n      throw new Error('User context is required')\n    }\n\n    const em = ctx.container.resolve<EntityManager>('em').fork()\n\n    const action = await findOneWithDecryption(\n      em,\n      InboxProposalAction,\n      {\n        id: input.actionId,\n        proposalId: input.proposalId,\n        organizationId: scope.organizationId,\n        tenantId: scope.tenantId,\n        deletedAt: null,\n      },\n      undefined,\n      scope,\n    )\n\n    if (!action) {\n      return { error: 'Action not found' }\n    }\n\n    // Check if action was already processed\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return { error: 'Action already processed', status: action.status }\n    }\n\n    // Check target module permission\n    if (action.requiredFeature) {\n      const featureGranted = authorizeFeatures([action.requiredFeature], {\n        grantedFeatures: ctx.userFeatures,\n        unrestricted: ctx.isSuperAdmin,\n      })\n      if (!featureGranted) {\n        return {\n          error: 'Insufficient permissions',\n          requiredFeature: action.requiredFeature,\n        }\n      }\n    }\n\n    const entities = resolveCrossModuleEntities(ctx.container)\n    const eventBus = resolveOptionalEventBus(ctx.container)\n\n    const result = await executeAction(action, {\n      em,\n      userId: ctx.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      eventBus,\n      container: ctx.container,\n      entities: entities as unknown as import('./lib/executionEngine').CrossModuleEntities,\n    })\n\n    if (!result.success) {\n      if (result.statusCode === 409) {\n        return { error: 'Action already processed', status: 'accepted' }\n      }\n      if (result.statusCode === 403) {\n        return {\n          error: 'Insufficient permissions',\n          requiredFeature: action.requiredFeature ?? 'unknown',\n        }\n      }\n      return { error: 'Execution failed', detail: result.error ?? 'Unknown error' }\n    }\n\n    try {\n      const { resolveCache, invalidateCountsCache } = await import('./lib/cache')\n      const cache = resolveCache(ctx.container)\n      if (cache && scope.tenantId) {\n        await runWithCacheTenant(scope.tenantId, () => invalidateCountsCache(cache, scope.tenantId))\n      }\n    } catch { /* cache invalidation is non-critical */ }\n\n    return {\n      ok: true,\n      createdEntityId: result.createdEntityId ?? null,\n      createdEntityType: result.createdEntityType ?? null,\n    }\n  },\n}\n\n// =============================================================================\n// inbox_ops_categorize_email \u2014 Standalone LLM-based text categorization\n// =============================================================================\n\nconst categorizeEmailSchema = z.object({\n  category: inboxProposalCategoryEnum,\n  confidence: z.number(),\n  reasoning: z.string(),\n})\n\nconst categorizeEmailTool = {\n  name: 'inbox_ops_categorize_email',\n  description: `Categorize email or text content using AI. Classifies text into one of: rfq, order, order_update, complaint, shipping_update, inquiry, payment, other.\n\nReturns: { category, confidence (0-1), reasoning }\nInput text is limited to 10,000 characters for cost control.`,\n  inputSchema: z.object({\n    text: z\n      .string()\n      .min(1)\n      .max(10000)\n      .describe('Email or text content to categorize (max 10K chars)'),\n  }),\n  requiredFeatures: ['inbox_ops.proposals.view'],\n  handler: async (input: { text: string }, ctx: ToolContext) => {\n    requireTenantContext(ctx)\n\n    const { model } = await resolveConfiguredStructuredModel({ moduleId: 'inbox_ops' })\n\n    const { generateObject } = await import('ai')\n\n    const result = await withTimeout(\n      generateObject({\n        model,\n        schema: categorizeEmailSchema,\n        system: `You are an email classification agent. Classify the given text into exactly one category:\n- rfq: Request for quotation or pricing inquiry\n- order: New purchase order or order placement\n- order_update: Change or update to an existing order\n- complaint: Customer complaint, dispute, or dissatisfaction\n- shipping_update: Shipment status, tracking, or delivery information\n- inquiry: General question or information request\n- payment: Payment-related (invoice, receipt, payment terms)\n- other: Does not fit any category above\n\nReturn a JSON object with:\n- category: one of the categories above\n- confidence: a number between 0 and 1 indicating how confident you are\n- reasoning: a brief explanation (1-2 sentences) of why this category was chosen`,\n        prompt: input.text,\n        temperature: 0,\n      }),\n      15000,\n      'Email categorization timed out after 15s',\n    )\n\n    return {\n      category: result.object.category,\n      confidence: Math.round(result.object.confidence * 100) / 100,\n      reasoning: result.object.reasoning,\n    }\n  },\n}\n\n// =============================================================================\n// Export\n// =============================================================================\n\n/**\n * All AI tools exported by the inbox_ops module.\n * Discovered by ai-assistant module's generator.\n */\nexport const aiTools: AiToolDefinition[] = [\n  listProposalsTool,\n  getProposalTool,\n  acceptActionTool,\n  categorizeEmailTool,\n]\n\nexport default aiTools\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,0BAA0B;AACnC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,yBAAyB;AAClC,SAAS,eAAe,qBAAqB,wBAAwB;AACrE,SAAS,iCAAiC;AAC1C,SAAS,qBAAqB;AAC9B,SAAS,kCAAkC,mBAAmB;AAC9D,SAAS,+BAA+B;AAuBxC,SAAS,qBAAqB,KAAgE;AAC5F,MAAI,CAAC,IAAI,YAAY,CAAC,IAAI,gBAAgB;AACxC,UAAM,IAAI,MAAM,4BAA4B;AAAA,EAC9C;AACA,SAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AACtE;AAEA,SAAS,2BAA2B,WAAqC;AACvE,QAAM,WAAoC,CAAC;AAC3C,QAAM,OAAO;AAAA,IACX;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,eAAS,GAAG,IAAI,UAAU,QAAQ,GAAG;AAAA,IACvC,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAMA,MAAM,oBAAoB;AAAA,EACxB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA,EAGb,aAAa,EAAE,OAAO;AAAA,IACpB,QAAQ,EACL,KAAK,CAAC,WAAW,WAAW,YAAY,UAAU,CAAC,EACnD,SAAS,EACT,SAAS,2BAA2B;AAAA,IACvC,UAAU,0BACP,SAAS,EACT,SAAS,0BAA0B;AAAA,IACtC,OAAO,EACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,EAAE,EACN,SAAS,EACT,QAAQ,EAAE,EACV,SAAS,qDAAqD;AAAA,IACjE,UAAU,EACP,OAAO,EACP,SAAS,EACT,SAAS,2DAA2D;AAAA,IACvE,QAAQ,EACL,OAAO,EACP,SAAS,EACT,SAAS,4DAA4D;AAAA,EAC1E,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAAmG,QAAqB;AACtI,UAAM,QAAQ,qBAAqB,GAAG;AACtC,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,QAAiC;AAAA,MACrC,gBAAgB,MAAM;AAAA,MACtB,UAAU,MAAM;AAAA,MAChB,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAEA,QAAI,MAAM,QAAQ;AAChB,YAAM,SAAS,MAAM;AAAA,IACvB;AACA,QAAI,MAAM,UAAU;AAClB,YAAM,WAAW,MAAM;AAAA,IACzB;AACA,QAAI,MAAM,YAAY,MAAM,QAAQ;AAClC,YAAM,YAAqC,CAAC;AAC5C,UAAI,MAAM,UAAU;AAClB,kBAAU,OAAO,IAAI,KAAK,MAAM,QAAQ;AAAA,MAC1C;AACA,UAAI,MAAM,QAAQ;AAChB,kBAAU,OAAO,IAAI,KAAK,MAAM,MAAM;AAAA,MACxC;AACA,YAAM,YAAY;AAAA,IACpB;AAEA,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,GAAG,OAAO,MAAM,MAAM;AAAA,MACrD;AAAA,IACF;AAGA,UAAM,cAAc,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7C,UAAM,iBAAiB,oBAAI,IAAoB;AAE/C,QAAI,YAAY,SAAS,GAAG;AAC1B,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,UACE,YAAY,EAAE,KAAK,YAAY;AAAA,UAC/B,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,iBAAW,UAAU,SAAS;AAC5B,uBAAe,IAAI,OAAO,aAAa,eAAe,IAAI,OAAO,UAAU,KAAK,KAAK,CAAC;AAAA,MACxF;AAAA,IACF;AAGA,UAAM,QAAQ,MAAM,GAAG,MAAM,eAAe,KAAK;AAEjD,WAAO;AAAA,MACL;AAAA,MACA,WAAW,UAAU,IAAI,CAAC,OAAO;AAAA,QAC/B,IAAI,EAAE;AAAA,QACN,SAAS,EAAE;AAAA,QACX,QAAQ,EAAE;AAAA,QACV,UAAU,EAAE,YAAY;AAAA,QACxB,YAAY,OAAO,EAAE,UAAU;AAAA,QAC/B,aAAa,eAAe,IAAI,EAAE,EAAE,KAAK;AAAA,QACzC,WAAW,EAAE,UAAU,YAAY;AAAA,MACrC,EAAE;AAAA,IACJ;AAAA,EACF;AACF;AAMA,MAAM,kBAAkB;AAAA,EACtB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA,EAGb,aAAa,EAAE,OAAO;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,sCAAsC;AAAA,EAC/E,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAA+B,QAAqB;AAClE,UAAM,QAAQ,qBAAqB,GAAG;AACtC,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,UAAU;AACb,aAAO,EAAE,OAAO,qBAAqB;AAAA,IACvC;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,YAAY,SAAS;AAAA,QACrB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC;AAAA,IACF;AAEA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,QACE,YAAY,SAAS;AAAA,QACrB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU;AAAA,QACR,IAAI,SAAS;AAAA,QACb,SAAS,SAAS;AAAA,QAClB,QAAQ,SAAS;AAAA,QACjB,UAAU,SAAS,YAAY;AAAA,QAC/B,YAAY,OAAO,SAAS,UAAU;AAAA,QACtC,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,UAC3B,IAAI,EAAE;AAAA,UACN,YAAY,EAAE;AAAA,UACd,aAAa,EAAE;AAAA,UACf,QAAQ,EAAE;AAAA,UACV,YAAY,OAAO,EAAE,UAAU;AAAA,UAC/B,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,WAAW,EAAE;AAAA,UACb,iBAAiB,EAAE,mBAAmB;AAAA,UACtC,mBAAmB,EAAE,qBAAqB;AAAA,QAC5C,EAAE;AAAA,QACF,eAAe,cAAc,IAAI,CAAC,OAAO;AAAA,UACvC,IAAI,EAAE;AAAA,UACN,MAAM,EAAE;AAAA,UACR,UAAU,EAAE;AAAA,UACZ,aAAa,EAAE;AAAA,UACf,eAAe,EAAE,iBAAiB;AAAA,UAClC,YAAY,EAAE,cAAc;AAAA,UAC5B,UAAU,EAAE;AAAA,QACd,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AACF;AAMA,MAAM,mBAAmB;AAAA,EACvB,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIb,aAAa,EAAE,OAAO;AAAA,IACpB,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,0BAA0B;AAAA,IACjE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,kCAAkC;AAAA,EACzE,CAAC;AAAA,EACD,kBAAkB,CAAC,4BAA4B;AAAA;AAAA;AAAA;AAAA,EAI/C,YAAY;AAAA,EACZ,SAAS,OAAO,OAAiD,QAAqB;AACpF,UAAM,QAAQ,qBAAqB,GAAG;AACtC,QAAI,CAAC,IAAI,QAAQ;AACf,YAAM,IAAI,MAAM,0BAA0B;AAAA,IAC5C;AAEA,UAAM,KAAK,IAAI,UAAU,QAAuB,IAAI,EAAE,KAAK;AAE3D,UAAM,SAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,YAAY,MAAM;AAAA,QAClB,gBAAgB,MAAM;AAAA,QACtB,UAAU,MAAM;AAAA,QAChB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ;AACX,aAAO,EAAE,OAAO,mBAAmB;AAAA,IACrC;AAGA,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,EAAE,OAAO,4BAA4B,QAAQ,OAAO,OAAO;AAAA,IACpE;AAGA,QAAI,OAAO,iBAAiB;AAC1B,YAAM,iBAAiB,kBAAkB,CAAC,OAAO,eAAe,GAAG;AAAA,QACjE,iBAAiB,IAAI;AAAA,QACrB,cAAc,IAAI;AAAA,MACpB,CAAC;AACD,UAAI,CAAC,gBAAgB;AACnB,eAAO;AAAA,UACL,OAAO;AAAA,UACP,iBAAiB,OAAO;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,WAAW,2BAA2B,IAAI,SAAS;AACzD,UAAM,WAAW,wBAAwB,IAAI,SAAS;AAEtD,UAAM,SAAS,MAAM,cAAc,QAAQ;AAAA,MACzC;AAAA,MACA,QAAQ,IAAI;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB;AAAA,MACA,WAAW,IAAI;AAAA,MACf;AAAA,IACF,CAAC;AAED,QAAI,CAAC,OAAO,SAAS;AACnB,UAAI,OAAO,eAAe,KAAK;AAC7B,eAAO,EAAE,OAAO,4BAA4B,QAAQ,WAAW;AAAA,MACjE;AACA,UAAI,OAAO,eAAe,KAAK;AAC7B,eAAO;AAAA,UACL,OAAO;AAAA,UACP,iBAAiB,OAAO,mBAAmB;AAAA,QAC7C;AAAA,MACF;AACA,aAAO,EAAE,OAAO,oBAAoB,QAAQ,OAAO,SAAS,gBAAgB;AAAA,IAC9E;AAEA,QAAI;AACF,YAAM,EAAE,cAAc,sBAAsB,IAAI,MAAM,OAAO,aAAa;AAC1E,YAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAI,SAAS,MAAM,UAAU;AAC3B,cAAM,mBAAmB,MAAM,UAAU,MAAM,sBAAsB,OAAO,MAAM,QAAQ,CAAC;AAAA,MAC7F;AAAA,IACF,QAAQ;AAAA,IAA2C;AAEnD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,iBAAiB,OAAO,mBAAmB;AAAA,MAC3C,mBAAmB,OAAO,qBAAqB;AAAA,IACjD;AAAA,EACF;AACF;AAMA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,UAAU;AAAA,EACV,YAAY,EAAE,OAAO;AAAA,EACrB,WAAW,EAAE,OAAO;AACtB,CAAC;AAED,MAAM,sBAAsB;AAAA,EAC1B,MAAM;AAAA,EACN,aAAa;AAAA;AAAA;AAAA;AAAA,EAIb,aAAa,EAAE,OAAO;AAAA,IACpB,MAAM,EACH,OAAO,EACP,IAAI,CAAC,EACL,IAAI,GAAK,EACT,SAAS,qDAAqD;AAAA,EACnE,CAAC;AAAA,EACD,kBAAkB,CAAC,0BAA0B;AAAA,EAC7C,SAAS,OAAO,OAAyB,QAAqB;AAC5D,yBAAqB,GAAG;AAExB,UAAM,EAAE,MAAM,IAAI,MAAM,iCAAiC,EAAE,UAAU,YAAY,CAAC;AAElF,UAAM,EAAE,eAAe,IAAI,MAAM,OAAO,IAAI;AAE5C,UAAM,SAAS,MAAM;AAAA,MACnB,eAAe;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAcR,QAAQ,MAAM;AAAA,QACd,aAAa;AAAA,MACf,CAAC;AAAA,MACD;AAAA,MACA;AAAA,IACF;AAEA,WAAO;AAAA,MACL,UAAU,OAAO,OAAO;AAAA,MACxB,YAAY,KAAK,MAAM,OAAO,OAAO,aAAa,GAAG,IAAI;AAAA,MACzD,WAAW,OAAO,OAAO;AAAA,IAC3B;AAAA,EACF;AACF;AAUO,MAAM,UAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAO,mBAAQ;",
   "names": []
 }

package/dist/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.js

@@ -1,5 +1,7 @@
 import { NextResponse } from "next/server";
 import { runWithCacheTenant } from "@open-mercato/cache";
+import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard
@@ -32,6 +34,17 @@ async function PATCH(req) {
     if (action.status !== "pending" && action.status !== "failed") {
       return NextResponse.json({ error: "Action already processed" }, { status: 409 });
     }
+    try {
+      await enforceCommandOptimisticLockWithGuards(ctx.container, {
+        resourceKind: "inbox_ops.action",
+        resourceId: action.id,
+        current: action.updatedAt ?? null,
+        request: req
+      });
+    } catch (err) {
+      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+      throw err;
+    }
     const mergedPayload = { ...action.payload, ...parsed.data.payload };
     const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload);
     if (!payloadValidation.success) {
@@ -93,7 +106,7 @@ const openApi = {
       responses: [
         { status: 200, description: "Action updated" },
         { status: 404, description: "Action not found" },
-        { status: 409, description: "Action already processed" }
+        { status: 409, description: "Action already processed or stale (optimistic-lock conflict)" }
       ]
     }
   }

package/dist/modules/inbox_ops/api/proposals/[id]/actions/[actionId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/inbox_ops/api/proposals/%5Bid%5D/actions/%5BactionId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { actionEditSchema, validateActionPayloadForType } from '../../../../../data/validators'\nimport { emitInboxOpsEvent } from '../../../../../events'\nimport { resolveCache, invalidateCountsCache } from '../../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveActionAndProposal,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../../routeHelpers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('inbox_ops').child({ component: 'action-edit' })\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const body = await req.json()\n    const parsed = actionEditSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n    const resolved = await resolveActionAndProposal(new URL(req.url), ctx)\n    if (isErrorResponse(resolved)) return resolved\n\n    const { action } = resolved\n\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return NextResponse.json({ error: 'Action already processed' }, { status: 409 })\n    }\n\n    const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }\n    const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)\n    if (!payloadValidation.success) {\n      return NextResponse.json({ error: payloadValidation.error }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: ctx.userId,\n      resourceKind: 'inbox_ops:inbox_proposal_action',\n      resourceId: action.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    action.payload = mergedPayload\n    await ctx.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: ctx.userId,\n        resourceKind: 'inbox_ops:inbox_proposal_action',\n        resourceId: action.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    try {\n      await emitInboxOpsEvent('inbox_ops.action.edited', {\n        actionId: action.id,\n        proposalId: action.proposalId,\n        actionType: action.actionType,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n    } catch (eventError) {\n      logger.error('Failed to emit event', { err: eventError })\n    }\n\n    return NextResponse.json({ ok: true, action })\n  } catch (err) {\n    return handleRouteError(err, 'edit action')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Edit action',\n  methods: {\n    PATCH: {\n      summary: 'Edit action payload before accepting',\n      responses: [\n        { status: 200, description: 'Action updated' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already processed' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,oCAAoC;AAC/D,SAAS,yBAAyB;AAClC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAEpE,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC9E;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtG;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,yBAAyB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AACrE,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,EAAE,OAAO,IAAI;AAEnB,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,SAAoC,GAAG,OAAO,KAAK,QAAQ;AAC7F,UAAM,oBAAoB,6BAA6B,OAAO,YAAY,aAAa;AACvF,QAAI,CAAC,kBAAkB,SAAS;AAC9B,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,WAAO,UAAU;AACjB,UAAM,IAAI,GAAG,MAAM;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,QAAI;AACF,YAAM,kBAAkB,2BAA2B;AAAA,QACjD,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,aAAO,MAAM,wBAAwB,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1D;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,aAAa;AAAA,EAC5C;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { actionEditSchema, validateActionPayloadForType } from '../../../../../data/validators'\nimport { emitInboxOpsEvent } from '../../../../../events'\nimport { resolveCache, invalidateCountsCache } from '../../../../../lib/cache'\nimport {\n  resolveRequestContext,\n  resolveActionAndProposal,\n  handleRouteError,\n  isErrorResponse,\n} from '../../../../routeHelpers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('inbox_ops').child({ component: 'action-edit' })\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },\n}\n\nexport async function PATCH(req: Request) {\n  try {\n    const body = await req.json()\n    const parsed = actionEditSchema.safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json({ error: 'Invalid payload', details: parsed.error.issues }, { status: 400 })\n    }\n\n    const ctx = await resolveRequestContext(req)\n    const resolved = await resolveActionAndProposal(new URL(req.url), ctx)\n    if (isErrorResponse(resolved)) return resolved\n\n    const { action } = resolved\n\n    if (action.status !== 'pending' && action.status !== 'failed') {\n      return NextResponse.json({ error: 'Action already processed' }, { status: 409 })\n    }\n\n    // Optimistic lock: refuse a stale overwrite when two tabs edit the same action\n    // payload. Strictly additive \u2014 a no-op without the expected-version header.\n    try {\n      await enforceCommandOptimisticLockWithGuards(ctx.container, {\n        resourceKind: 'inbox_ops.action',\n        resourceId: action.id,\n        current: action.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n\n    const mergedPayload = { ...action.payload as Record<string, unknown>, ...parsed.data.payload }\n    const payloadValidation = validateActionPayloadForType(action.actionType, mergedPayload)\n    if (!payloadValidation.success) {\n      return NextResponse.json({ error: payloadValidation.error }, { status: 400 })\n    }\n\n    const guardResult = await validateCrudMutationGuard(ctx.container, {\n      tenantId: ctx.tenantId,\n      organizationId: ctx.organizationId,\n      userId: ctx.userId,\n      resourceKind: 'inbox_ops:inbox_proposal_action',\n      resourceId: action.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: parsed.data,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    action.payload = mergedPayload\n    await ctx.em.flush()\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(ctx.container, {\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n        userId: ctx.userId,\n        resourceKind: 'inbox_ops:inbox_proposal_action',\n        resourceId: action.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    const cache = resolveCache(ctx.container)\n    await runWithCacheTenant(ctx.tenantId, () => invalidateCountsCache(cache, ctx.tenantId))\n\n    try {\n      await emitInboxOpsEvent('inbox_ops.action.edited', {\n        actionId: action.id,\n        proposalId: action.proposalId,\n        actionType: action.actionType,\n        tenantId: ctx.tenantId,\n        organizationId: ctx.organizationId,\n      })\n    } catch (eventError) {\n      logger.error('Failed to emit event', { err: eventError })\n    }\n\n    return NextResponse.json({ ok: true, action })\n  } catch (err) {\n    return handleRouteError(err, 'edit action')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Edit action',\n  methods: {\n    PATCH: {\n      summary: 'Edit action payload before accepting',\n      responses: [\n        { status: 200, description: 'Action updated' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already processed or stale (optimistic-lock conflict)' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAE7B,SAAS,0BAA0B;AACnC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB,oCAAoC;AAC/D,SAAS,yBAAyB;AAClC,SAAS,cAAc,6BAA6B;AACpD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AAEpE,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC9E;AAEA,eAAsB,MAAM,KAAc;AACxC,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,SAAS,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtG;AAEA,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAC3C,UAAM,WAAW,MAAM,yBAAyB,IAAI,IAAI,IAAI,GAAG,GAAG,GAAG;AACrE,QAAI,gBAAgB,QAAQ,EAAG,QAAO;AAEtC,UAAM,EAAE,OAAO,IAAI;AAEnB,QAAI,OAAO,WAAW,aAAa,OAAO,WAAW,UAAU;AAC7D,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AAIA,QAAI;AACF,YAAM,uCAAuC,IAAI,WAAW;AAAA,QAC1D,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,SAAS,OAAO,aAAa;AAAA,QAC7B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAEA,UAAM,gBAAgB,EAAE,GAAG,OAAO,SAAoC,GAAG,OAAO,KAAK,QAAQ;AAC7F,UAAM,oBAAoB,6BAA6B,OAAO,YAAY,aAAa;AACvF,QAAI,CAAC,kBAAkB,SAAS;AAC9B,aAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,MAAM,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9E;AAEA,UAAM,cAAc,MAAM,0BAA0B,IAAI,WAAW;AAAA,MACjE,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,QAAQ,IAAI;AAAA,MACZ,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,OAAO;AAAA,IAC1B,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,WAAO,UAAU;AACjB,UAAM,IAAI,GAAG,MAAM;AAEnB,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,IAAI,WAAW;AAAA,QACpD,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,QACpB,QAAQ,IAAI;AAAA,QACZ,cAAc;AAAA,QACd,YAAY,OAAO;AAAA,QACnB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,aAAa,IAAI,SAAS;AACxC,UAAM,mBAAmB,IAAI,UAAU,MAAM,sBAAsB,OAAO,IAAI,QAAQ,CAAC;AAEvF,QAAI;AACF,YAAM,kBAAkB,2BAA2B;AAAA,QACjD,UAAU,OAAO;AAAA,QACjB,YAAY,OAAO;AAAA,QACnB,YAAY,OAAO;AAAA,QACnB,UAAU,IAAI;AAAA,QACd,gBAAgB,IAAI;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,aAAO,MAAM,wBAAwB,EAAE,KAAK,WAAW,CAAC;AAAA,IAC1D;AAEA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,WAAO,iBAAiB,KAAK,aAAa;AAAA,EAC5C;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,+DAA+D;AAAA,MAC7F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/proposals/route.js

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { ZodError } from "zod";
 import { findAndCountWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { findEntityIdsBySearchTokens } from "@open-mercato/shared/lib/search/tokenLookup";
+import { E } from "../../../../generated/entities.ids.generated.js";
 import { InboxProposal, InboxEmail, InboxProposalAction, InboxDiscrepancy } from "../../data/entities.js";
 import { proposalListQuerySchema } from "../../data/validators.js";
 import { resolveRequestContext, UnauthorizedError } from "../routeHelpers.js";
@@ -39,7 +41,20 @@ async function GET(req) {
       }
     }
     if (query.search) {
-      where.summary = { $ilike: `%${escapeLikePattern(query.search)}%` };
+      const searchOr = [
+        { summary: { $ilike: `%${escapeLikePattern(query.search)}%` } }
+      ];
+      const tokenMatch = await findEntityIdsBySearchTokens({
+        db: ctx.em.getKysely(),
+        entityType: E.inbox_ops.inbox_proposal,
+        query: query.search,
+        fields: ["summary"],
+        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId }
+      });
+      if (tokenMatch.matched && tokenMatch.ids.length) {
+        searchOr.push({ id: { $in: tokenMatch.ids } });
+      }
+      where.$or = searchOr;
     }
     const offset = (query.page - 1) * query.pageSize;
     const [items, total] = await findAndCountWithDecryption(

package/dist/modules/inbox_ops/api/proposals/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/inbox_ops/api/proposals/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { ZodError } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { InboxProposal, InboxEmail, InboxProposalAction, InboxDiscrepancy, type InboxProposalCategory } from '../../data/entities'\nimport { proposalListQuerySchema } from '../../data/validators'\nimport { resolveRequestContext, UnauthorizedError } from '../routeHelpers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('inbox_ops').child({ component: 'proposals' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.view'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = proposalListQuerySchema.parse({\n      status: url.searchParams.get('status') || undefined,\n      category: url.searchParams.get('category') || undefined,\n      search: url.searchParams.get('search') || undefined,\n      page: url.searchParams.get('page') || undefined,\n      pageSize: url.searchParams.get('pageSize') || undefined,\n    })\n\n    const ctx = await resolveRequestContext(req)\n\n    const where: FilterQuery<InboxProposal> = {\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      deletedAt: null,\n      isActive: true,\n    }\n\n    if (query.status) {\n      where.status = query.status\n    }\n    if (query.category) {\n      const categories = query.category.split(',').map((c) => c.trim()).filter(Boolean) as InboxProposalCategory[]\n      if (categories.length === 1) {\n        where.category = categories[0]\n      } else if (categories.length > 1) {\n        where.category = { $in: categories }\n      }\n    }\n    if (query.search) {\n      where.summary = { $ilike: `%${escapeLikePattern(query.search)}%` }\n    }\n\n    const offset = (query.page - 1) * query.pageSize\n\n    const [items, total] = await findAndCountWithDecryption(\n      ctx.em,\n      InboxProposal,\n      where,\n      {\n        limit: query.pageSize,\n        offset,\n        orderBy: { createdAt: 'DESC' },\n      },\n      ctx.scope,\n    )\n\n    // Enrich proposals with email, action, and discrepancy data\n    const proposalIds = items.map((p) => p.id)\n    const emailIds = [...new Set(items.map((p) => p.inboxEmailId).filter(Boolean))]\n\n    const [emails, allActions, allDiscrepancies] = await Promise.all([\n      emailIds.length > 0\n        ? findWithDecryption(ctx.em, InboxEmail, { id: { $in: emailIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId }, {}, ctx.scope)\n        : Promise.resolve([] as InboxEmail[]),\n      proposalIds.length > 0\n        ? findWithDecryption(ctx.em, InboxProposalAction, { proposalId: { $in: proposalIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }, {}, ctx.scope)\n        : Promise.resolve([] as InboxProposalAction[]),\n      proposalIds.length > 0\n        ? findWithDecryption(ctx.em, InboxDiscrepancy, { proposalId: { $in: proposalIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId, resolved: false }, {}, ctx.scope)\n        : Promise.resolve([] as InboxDiscrepancy[]),\n    ])\n\n    const emailMap = new Map(emails.map((e) => [e.id, e]))\n\n    const enrichedItems = items.map((proposal) => {\n      const email = emailMap.get(proposal.inboxEmailId)\n      const proposalActions = allActions.filter((a) => a.proposalId === proposal.id)\n      const proposalDiscrepancies = allDiscrepancies.filter((d) => d.proposalId === proposal.id)\n\n      return {\n        ...proposal,\n        actionCount: proposalActions.length,\n        pendingActionCount: proposalActions.filter((a) => a.status === 'pending').length,\n        discrepancyCount: proposalDiscrepancies.length,\n        emailSubject: email?.subject || null,\n        emailFrom: email?.forwardedByName || email?.forwardedByAddress || null,\n        receivedAt: email?.receivedAt || proposal.createdAt,\n      }\n    })\n\n    return NextResponse.json({\n      items: enrichedItems,\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: Math.ceil(total / query.pageSize),\n    })\n  } catch (err) {\n    if (err instanceof ZodError) {\n      return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n    }\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    logger.error('Failed to list proposals', { err })\n    return NextResponse.json({ error: 'Failed to list proposals' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Proposals',\n  methods: {\n    GET: {\n      summary: 'List proposals',\n      description: 'List inbox proposals with optional status filter and pagination',\n      responses: [\n        { status: 200, description: 'Paginated list of proposals' },\n        { status: 401, description: 'Unauthorized' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB;AAGzB,SAAS,4BAA4B,0BAA0B;AAC/D,SAAS,yBAAyB;AAClC,SAAS,eAAe,YAAY,qBAAqB,wBAAoD;AAC7G,SAAS,+BAA+B;AACxC,SAAS,uBAAuB,yBAAyB;AACzD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAElE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,wBAAwB,MAAM;AAAA,MAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,QAAoC;AAAA,MACxC,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAEA,QAAI,MAAM,QAAQ;AAChB,YAAM,SAAS,MAAM;AAAA,IACvB;AACA,QAAI,MAAM,UAAU;AAClB,YAAM,aAAa,MAAM,SAAS,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChF,UAAI,WAAW,WAAW,GAAG;AAC3B,cAAM,WAAW,WAAW,CAAC;AAAA,MAC/B,WAAW,WAAW,SAAS,GAAG;AAChC,cAAM,WAAW,EAAE,KAAK,WAAW;AAAA,MACrC;AAAA,IACF;AACA,QAAI,MAAM,QAAQ;AAChB,YAAM,UAAU,EAAE,QAAQ,IAAI,kBAAkB,MAAM,MAAM,CAAC,IAAI;AAAA,IACnE;AAEA,UAAM,UAAU,MAAM,OAAO,KAAK,MAAM;AAExC,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,MAC3B,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,MACA,IAAI;AAAA,IACN;AAGA,UAAM,cAAc,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AACzC,UAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAE9E,UAAM,CAAC,QAAQ,YAAY,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/D,SAAS,SAAS,IACd,mBAAmB,IAAI,IAAI,YAAY,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS,GAAG,CAAC,GAAG,IAAI,KAAK,IAC3I,QAAQ,QAAQ,CAAC,CAAiB;AAAA,MACtC,YAAY,SAAS,IACjB,mBAAmB,IAAI,IAAI,qBAAqB,EAAE,YAAY,EAAE,KAAK,YAAY,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,UAAU,WAAW,KAAK,GAAG,CAAC,GAAG,IAAI,KAAK,IAChL,QAAQ,QAAQ,CAAC,CAA0B;AAAA,MAC/C,YAAY,SAAS,IACjB,mBAAmB,IAAI,IAAI,kBAAkB,EAAE,YAAY,EAAE,KAAK,YAAY,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,UAAU,UAAU,MAAM,GAAG,CAAC,GAAG,IAAI,KAAK,IAC7K,QAAQ,QAAQ,CAAC,CAAuB;AAAA,IAC9C,CAAC;AAED,UAAM,WAAW,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAErD,UAAM,gBAAgB,MAAM,IAAI,CAAC,aAAa;AAC5C,YAAM,QAAQ,SAAS,IAAI,SAAS,YAAY;AAChD,YAAM,kBAAkB,WAAW,OAAO,CAAC,MAAM,EAAE,eAAe,SAAS,EAAE;AAC7E,YAAM,wBAAwB,iBAAiB,OAAO,CAAC,MAAM,EAAE,eAAe,SAAS,EAAE;AAEzF,aAAO;AAAA,QACL,GAAG;AAAA,QACH,aAAa,gBAAgB;AAAA,QAC7B,oBAAoB,gBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAAA,QAC1E,kBAAkB,sBAAsB;AAAA,QACxC,cAAc,OAAO,WAAW;AAAA,QAChC,WAAW,OAAO,mBAAmB,OAAO,sBAAsB;AAAA,QAClE,YAAY,OAAO,cAAc,SAAS;AAAA,MAC5C;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,IAC9C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AACA,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { ZodError } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { FilterQuery } from '@mikro-orm/postgresql'\nimport { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { findEntityIdsBySearchTokens, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'\nimport { E } from '#generated/entities.ids.generated'\nimport { InboxProposal, InboxEmail, InboxProposalAction, InboxDiscrepancy, type InboxProposalCategory } from '../../data/entities'\nimport { proposalListQuerySchema } from '../../data/validators'\nimport { resolveRequestContext, UnauthorizedError } from '../routeHelpers'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('inbox_ops').child({ component: 'proposals' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.view'] },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = proposalListQuerySchema.parse({\n      status: url.searchParams.get('status') || undefined,\n      category: url.searchParams.get('category') || undefined,\n      search: url.searchParams.get('search') || undefined,\n      page: url.searchParams.get('page') || undefined,\n      pageSize: url.searchParams.get('pageSize') || undefined,\n    })\n\n    const ctx = await resolveRequestContext(req)\n\n    const where: FilterQuery<InboxProposal> = {\n      organizationId: ctx.organizationId,\n      tenantId: ctx.tenantId,\n      deletedAt: null,\n      isActive: true,\n    }\n\n    if (query.status) {\n      where.status = query.status\n    }\n    if (query.category) {\n      const categories = query.category.split(',').map((c) => c.trim()).filter(Boolean) as InboxProposalCategory[]\n      if (categories.length === 1) {\n        where.category = categories[0]\n      } else if (categories.length > 1) {\n        where.category = { $in: categories }\n      }\n    }\n    if (query.search) {\n      // `summary` is covered by the inbox_ops encryption map, so an ILIKE alone\n      // compares the pattern against ciphertext and matches nothing once\n      // encryption is on. Union it with the token index, which stores hashes of\n      // the plaintext. Issue #2990.\n      const searchOr: FilterQuery<InboxProposal>[] = [\n        { summary: { $ilike: `%${escapeLikePattern(query.search)}%` } },\n      ]\n      const tokenMatch = await findEntityIdsBySearchTokens({\n        db: ctx.em.getKysely<SearchTokenDatabase>(),\n        entityType: E.inbox_ops.inbox_proposal,\n        query: query.search,\n        fields: ['summary'],\n        scope: { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n      })\n      if (tokenMatch.matched && tokenMatch.ids.length) {\n        searchOr.push({ id: { $in: tokenMatch.ids } })\n      }\n      where.$or = searchOr\n    }\n\n    const offset = (query.page - 1) * query.pageSize\n\n    const [items, total] = await findAndCountWithDecryption(\n      ctx.em,\n      InboxProposal,\n      where,\n      {\n        limit: query.pageSize,\n        offset,\n        orderBy: { createdAt: 'DESC' },\n      },\n      ctx.scope,\n    )\n\n    // Enrich proposals with email, action, and discrepancy data\n    const proposalIds = items.map((p) => p.id)\n    const emailIds = [...new Set(items.map((p) => p.inboxEmailId).filter(Boolean))]\n\n    const [emails, allActions, allDiscrepancies] = await Promise.all([\n      emailIds.length > 0\n        ? findWithDecryption(ctx.em, InboxEmail, { id: { $in: emailIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId }, {}, ctx.scope)\n        : Promise.resolve([] as InboxEmail[]),\n      proposalIds.length > 0\n        ? findWithDecryption(ctx.em, InboxProposalAction, { proposalId: { $in: proposalIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId, deletedAt: null }, {}, ctx.scope)\n        : Promise.resolve([] as InboxProposalAction[]),\n      proposalIds.length > 0\n        ? findWithDecryption(ctx.em, InboxDiscrepancy, { proposalId: { $in: proposalIds }, organizationId: ctx.organizationId, tenantId: ctx.tenantId, resolved: false }, {}, ctx.scope)\n        : Promise.resolve([] as InboxDiscrepancy[]),\n    ])\n\n    const emailMap = new Map(emails.map((e) => [e.id, e]))\n\n    const enrichedItems = items.map((proposal) => {\n      const email = emailMap.get(proposal.inboxEmailId)\n      const proposalActions = allActions.filter((a) => a.proposalId === proposal.id)\n      const proposalDiscrepancies = allDiscrepancies.filter((d) => d.proposalId === proposal.id)\n\n      return {\n        ...proposal,\n        actionCount: proposalActions.length,\n        pendingActionCount: proposalActions.filter((a) => a.status === 'pending').length,\n        discrepancyCount: proposalDiscrepancies.length,\n        emailSubject: email?.subject || null,\n        emailFrom: email?.forwardedByName || email?.forwardedByAddress || null,\n        receivedAt: email?.receivedAt || proposal.createdAt,\n      }\n    })\n\n    return NextResponse.json({\n      items: enrichedItems,\n      total,\n      page: query.page,\n      pageSize: query.pageSize,\n      totalPages: Math.ceil(total / query.pageSize),\n    })\n  } catch (err) {\n    if (err instanceof ZodError) {\n      return NextResponse.json({ error: 'Invalid query parameters' }, { status: 400 })\n    }\n    if (err instanceof UnauthorizedError) {\n      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n    }\n    logger.error('Failed to list proposals', { err })\n    return NextResponse.json({ error: 'Failed to list proposals' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Proposals',\n  methods: {\n    GET: {\n      summary: 'List proposals',\n      description: 'List inbox proposals with optional status filter and pagination',\n      responses: [\n        { status: 200, description: 'Paginated list of proposals' },\n        { status: 401, description: 'Unauthorized' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB;AAGzB,SAAS,4BAA4B,0BAA0B;AAC/D,SAAS,yBAAyB;AAClC,SAAS,mCAA6D;AACtE,SAAS,SAAS;AAClB,SAAS,eAAe,YAAY,qBAAqB,wBAAoD;AAC7G,SAAS,+BAA+B;AACxC,SAAS,uBAAuB,yBAAyB;AACzD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAElE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,0BAA0B,EAAE;AAC1E;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,wBAAwB,MAAM;AAAA,MAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,MAAM,MAAM,sBAAsB,GAAG;AAE3C,UAAM,QAAoC;AAAA,MACxC,gBAAgB,IAAI;AAAA,MACpB,UAAU,IAAI;AAAA,MACd,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAEA,QAAI,MAAM,QAAQ;AAChB,YAAM,SAAS,MAAM;AAAA,IACvB;AACA,QAAI,MAAM,UAAU;AAClB,YAAM,aAAa,MAAM,SAAS,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChF,UAAI,WAAW,WAAW,GAAG;AAC3B,cAAM,WAAW,WAAW,CAAC;AAAA,MAC/B,WAAW,WAAW,SAAS,GAAG;AAChC,cAAM,WAAW,EAAE,KAAK,WAAW;AAAA,MACrC;AAAA,IACF;AACA,QAAI,MAAM,QAAQ;AAKhB,YAAM,WAAyC;AAAA,QAC7C,EAAE,SAAS,EAAE,QAAQ,IAAI,kBAAkB,MAAM,MAAM,CAAC,IAAI,EAAE;AAAA,MAChE;AACA,YAAM,aAAa,MAAM,4BAA4B;AAAA,QACnD,IAAI,IAAI,GAAG,UAA+B;AAAA,QAC1C,YAAY,EAAE,UAAU;AAAA,QACxB,OAAO,MAAM;AAAA,QACb,QAAQ,CAAC,SAAS;AAAA,QAClB,OAAO,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,MACtE,CAAC;AACD,UAAI,WAAW,WAAW,WAAW,IAAI,QAAQ;AAC/C,iBAAS,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,IAAI,EAAE,CAAC;AAAA,MAC/C;AACA,YAAM,MAAM;AAAA,IACd;AAEA,UAAM,UAAU,MAAM,OAAO,KAAK,MAAM;AAExC,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,MAC3B,IAAI;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,OAAO,MAAM;AAAA,QACb;AAAA,QACA,SAAS,EAAE,WAAW,OAAO;AAAA,MAC/B;AAAA,MACA,IAAI;AAAA,IACN;AAGA,UAAM,cAAc,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE;AACzC,UAAM,WAAW,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,OAAO,OAAO,CAAC,CAAC;AAE9E,UAAM,CAAC,QAAQ,YAAY,gBAAgB,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/D,SAAS,SAAS,IACd,mBAAmB,IAAI,IAAI,YAAY,EAAE,IAAI,EAAE,KAAK,SAAS,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,SAAS,GAAG,CAAC,GAAG,IAAI,KAAK,IAC3I,QAAQ,QAAQ,CAAC,CAAiB;AAAA,MACtC,YAAY,SAAS,IACjB,mBAAmB,IAAI,IAAI,qBAAqB,EAAE,YAAY,EAAE,KAAK,YAAY,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,UAAU,WAAW,KAAK,GAAG,CAAC,GAAG,IAAI,KAAK,IAChL,QAAQ,QAAQ,CAAC,CAA0B;AAAA,MAC/C,YAAY,SAAS,IACjB,mBAAmB,IAAI,IAAI,kBAAkB,EAAE,YAAY,EAAE,KAAK,YAAY,GAAG,gBAAgB,IAAI,gBAAgB,UAAU,IAAI,UAAU,UAAU,MAAM,GAAG,CAAC,GAAG,IAAI,KAAK,IAC7K,QAAQ,QAAQ,CAAC,CAAuB;AAAA,IAC9C,CAAC;AAED,UAAM,WAAW,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AAErD,UAAM,gBAAgB,MAAM,IAAI,CAAC,aAAa;AAC5C,YAAM,QAAQ,SAAS,IAAI,SAAS,YAAY;AAChD,YAAM,kBAAkB,WAAW,OAAO,CAAC,MAAM,EAAE,eAAe,SAAS,EAAE;AAC7E,YAAM,wBAAwB,iBAAiB,OAAO,CAAC,MAAM,EAAE,eAAe,SAAS,EAAE;AAEzF,aAAO;AAAA,QACL,GAAG;AAAA,QACH,aAAa,gBAAgB;AAAA,QAC7B,oBAAoB,gBAAgB,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAAA,QAC1E,kBAAkB,sBAAsB;AAAA,QACxC,cAAc,OAAO,WAAW;AAAA,QAChC,WAAW,OAAO,mBAAmB,OAAO,sBAAsB;AAAA,QAClE,YAAY,OAAO,cAAc,SAAS;AAAA,MAC5C;AAAA,IACF,CAAC;AAED,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO;AAAA,MACP;AAAA,MACA,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,IAC9C,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,UAAU;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjF;AACA,QAAI,eAAe,mBAAmB;AACpC,aAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrE;AACA,WAAO,MAAM,4BAA4B,EAAE,IAAI,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/inbox_ops/api/webhook/inbound.js

@@ -10,11 +10,19 @@ import { parseInboundEmail } from "../../lib/emailParser.js";
 import { checkRateLimit } from "../../lib/rateLimiter.js";
 import { emitInboxOpsEvent } from "../../events.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import {
+  readBoundedRequestBody,
+  resolveWebhookBodyLimitBytes,
+  WebhookBodyTooLargeError
+} from "@open-mercato/shared/lib/webhooks";
 const logger = createLogger("inbox_ops").child({ component: "webhook" });
 const metadata = {
   POST: { requireAuth: false }
 };
-const MAX_PAYLOAD_SIZE = 2 * 1024 * 1024;
+const MAX_PAYLOAD_SIZE = resolveWebhookBodyLimitBytes(
+  process.env.INBOX_OPS_WEBHOOK_MAX_BODY_BYTES ?? process.env.OM_WEBHOOK_MAX_BODY_BYTES,
+  2 * 1024 * 1024
+);
 const REPLAY_WINDOW_MS = 5 * 60 * 1e3;
 function isTimestampFresh(timestamp) {
   if (!timestamp) return false;
@@ -140,19 +148,15 @@ async function POST(req) {
     logger.error("Neither INBOX_OPS_WEBHOOK_SECRET nor RESEND_WEBHOOK_SIGNING_SECRET is configured");
     return NextResponse.json({ error: "Service unavailable" }, { status: 503 });
   }
-  const contentLength = parseInt(req.headers.get("content-length") || "0", 10);
-  if (contentLength > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: "Payload too large" }, { status: 413 });
-  }
   let rawBody;
   try {
-    rawBody = await req.text();
-  } catch {
+    rawBody = await readBoundedRequestBody(req, { maxBytes: MAX_PAYLOAD_SIZE });
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) {
+      return NextResponse.json({ error: "Payload too large" }, { status: 413 });
+    }
     return NextResponse.json({ error: "Bad request" }, { status: 400 });
   }
-  if (rawBody.length > MAX_PAYLOAD_SIZE) {
-    return NextResponse.json({ error: "Payload too large" }, { status: 413 });
-  }
   const verified = await verifyAndParse(req, rawBody);
   if (!verified.ok) {
     return verified.response;

package/dist/modules/inbox_ops/api/webhook/inbound.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/inbox_ops/api/webhook/inbound.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createHmac, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport { Webhook } from 'svix'\nimport { Resend } from 'resend'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { InboxSettings, InboxEmail } from '../../data/entities'\nimport { parseInboundEmail } from '../../lib/emailParser'\nimport { checkRateLimit } from '../../lib/rateLimiter'\nimport { emitInboxOpsEvent } from '../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('inbox_ops').child({ component: 'webhook' })\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst MAX_PAYLOAD_SIZE = 2 * 1024 * 1024 // 2MB\nconst REPLAY_WINDOW_MS = 5 * 60 * 1000 // 5 minutes\n\nfunction isTimestampFresh(timestamp: string): boolean {\n  if (!timestamp) return false\n  const timestampMs = parseInt(timestamp, 10) * 1000\n  if (isNaN(timestampMs)) return false\n  return Math.abs(Date.now() - timestampMs) <= REPLAY_WINDOW_MS\n}\n\nfunction verifyHmacSignature(\n  payload: string,\n  signature: string,\n  timestamp: string,\n  secret: string,\n): boolean {\n  if (!signature || !timestamp || !secret) return false\n\n  if (!isTimestampFresh(timestamp)) return false\n\n  const expected = createHmac('sha256', secret)\n    .update(`${timestamp}.${payload}`)\n    .digest('hex')\n  const received = signature.startsWith('sha256=')\n    ? signature.slice('sha256='.length)\n    : signature\n\n  try {\n    if (received.length !== expected.length) return false\n    return timingSafeEqual(\n      Buffer.from(received, 'hex'),\n      Buffer.from(expected, 'hex'),\n    )\n  } catch {\n    return false\n  }\n}\n\n// True when the signature verifies against ANY of the candidate secrets. Used\n// to bind the inbound signature to the resolved tenant: once the target inbox\n// declares its own per-tenant secret, the global INBOX_OPS_WEBHOOK_SECRET is no\n// longer accepted for that inbox, so a holder of the global key alone cannot\n// forge mail into a tenant that opted into a dedicated secret.\nfunction verifyHmacAgainstAny(\n  payload: string,\n  signature: string,\n  timestamp: string,\n  secrets: string[],\n): boolean {\n  for (const secret of secrets) {\n    if (secret && verifyHmacSignature(payload, signature, timestamp, secret)) return true\n  }\n  return false\n}\n\n// Stable, non-reversible identifier for the pre-DB global rate-limit bucket.\n// Keying on the configured signing secret (rather than the attacker-set `to` or\n// the per-request signature) means the bucket is request-invariant for a given\n// secret, so rotating recipients or mutating the body cannot dilute the limit.\nfunction secretFingerprint(secret: string): string {\n  return createHmac('sha256', 'inbox_ops:rate_limit:salt').update(secret).digest('hex').slice(0, 32)\n}\n\nfunction verifySvixSignature(\n  rawBody: string,\n  headers: Record<string, string>,\n  secret: string,\n): boolean {\n  try {\n    const wh = new Webhook(secret)\n    wh.verify(rawBody, {\n      'svix-id': headers['svix-id'],\n      'svix-timestamp': headers['svix-timestamp'],\n      'svix-signature': headers['svix-signature'],\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\nasync function fetchResendEmail(emailId: string): Promise<{\n  from?: string\n  to?: string[]\n  subject?: string\n  text?: string\n  html?: string\n  messageId?: string\n  replyTo?: string\n  inReplyTo?: string\n  references?: string[]\n}> {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is required to fetch Resend inbound emails')\n\n  const resend = new Resend(apiKey)\n  const { data, error } = await resend.emails.receiving.get(emailId)\n  if (error || !data) {\n    throw new Error(`Failed to fetch Resend email ${emailId}: ${error?.message || 'unknown error'}`)\n  }\n\n  return {\n    from: data.from,\n    to: data.to,\n    subject: data.subject,\n    text: data.text ?? undefined,\n    html: data.html ?? undefined,\n    messageId: data.message_id,\n    replyTo: data.reply_to?.[0] ?? undefined,\n    inReplyTo: data.headers?.['in-reply-to'] ?? undefined,\n    references: data.headers?.['references']?.split(/\\s+/).filter(Boolean),\n  }\n}\n\ntype VerifiedPayload =\n  | { kind: 'custom'; payload: Record<string, unknown>; signature: string; timestamp: string }\n  | { kind: 'resend'; emailFields: Awaited<ReturnType<typeof fetchResendEmail>>; to: string[] }\n\nasync function verifyAndParse(req: Request, rawBody: string): Promise<\n  | { ok: true; data: VerifiedPayload }\n  | { ok: false; response: NextResponse }\n> {\n  const customSig = req.headers.get('x-webhook-signature')\n  const svixId = req.headers.get('svix-id')\n\n  if (customSig) {\n    const webhookSecret = process.env.INBOX_OPS_WEBHOOK_SECRET\n    if (!webhookSecret) {\n      logger.error('INBOX_OPS_WEBHOOK_SECRET not configured')\n      return { ok: false, response: NextResponse.json({ error: 'Service unavailable' }, { status: 503 }) }\n    }\n    const timestamp = req.headers.get('x-webhook-timestamp') || ''\n    // Cheap, secret-independent gate first: reject replayed/stale requests\n    // before parsing. The HMAC itself is verified later, against the secret\n    // bound to the resolved inbox (see the POST handler), so a holder of the\n    // global secret cannot inject into a tenant that owns its own secret.\n    if (!isTimestampFresh(timestamp)) {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid signature' }, { status: 400 }) }\n    }\n    let payload: Record<string, unknown>\n    try {\n      payload = JSON.parse(rawBody)\n    } catch {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n    }\n    return { ok: true, data: { kind: 'custom', payload, signature: customSig, timestamp } }\n  }\n\n  if (svixId) {\n    const signingSecret = process.env.RESEND_WEBHOOK_SIGNING_SECRET\n    if (!signingSecret) {\n      logger.error('RESEND_WEBHOOK_SIGNING_SECRET not configured')\n      return { ok: false, response: NextResponse.json({ error: 'Service unavailable' }, { status: 503 }) }\n    }\n    const headers: Record<string, string> = {\n      'svix-id': svixId,\n      'svix-timestamp': req.headers.get('svix-timestamp') || '',\n      'svix-signature': req.headers.get('svix-signature') || '',\n    }\n    if (!verifySvixSignature(rawBody, headers, signingSecret)) {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid signature' }, { status: 400 }) }\n    }\n    let envelope: { type?: string; data?: { email_id?: string; from?: string; to?: string[] } }\n    try {\n      envelope = JSON.parse(rawBody)\n    } catch {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n    }\n    if (envelope.type !== 'email.received') {\n      return { ok: false, response: NextResponse.json({ ok: true }) }\n    }\n    const emailId = envelope.data?.email_id\n    if (!emailId) {\n      return { ok: false, response: NextResponse.json({ error: 'Missing email_id in Resend payload' }, { status: 400 }) }\n    }\n    const emailFields = await fetchResendEmail(emailId)\n    const to = emailFields.to || envelope.data?.to || []\n    return { ok: true, data: { kind: 'resend', emailFields, to } }\n  }\n\n  return { ok: false, response: NextResponse.json({ error: 'Missing signature headers' }, { status: 400 }) }\n}\n\nexport async function POST(req: Request) {\n  const hasCustomSecret = Boolean(process.env.INBOX_OPS_WEBHOOK_SECRET)\n  const hasResendSecret = Boolean(process.env.RESEND_WEBHOOK_SIGNING_SECRET)\n  if (!hasCustomSecret && !hasResendSecret) {\n    logger.error('Neither INBOX_OPS_WEBHOOK_SECRET nor RESEND_WEBHOOK_SIGNING_SECRET is configured')\n    return NextResponse.json({ error: 'Service unavailable' }, { status: 503 })\n  }\n\n  const contentLength = parseInt(req.headers.get('content-length') || '0', 10)\n  if (contentLength > MAX_PAYLOAD_SIZE) {\n    return NextResponse.json({ error: 'Payload too large' }, { status: 413 })\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'Bad request' }, { status: 400 })\n  }\n\n  if (rawBody.length > MAX_PAYLOAD_SIZE) {\n    return NextResponse.json({ error: 'Payload too large' }, { status: 413 })\n  }\n\n  const verified = await verifyAndParse(req, rawBody)\n  if (!verified.ok) {\n    return verified.response\n  }\n\n  let toAddress: string | null\n  let emailInput: Parameters<typeof parseInboundEmail>[0]\n\n  if (verified.data.kind === 'custom') {\n    const payload = verified.data.payload\n    toAddress = extractToAddress(payload)\n    emailInput = {\n      from: payload.from as string | undefined,\n      to: payload.to as string | string[] | undefined,\n      subject: payload.subject as string | undefined,\n      text: payload.text as string | undefined,\n      html: payload.html as string | undefined,\n      messageId: payload.messageId as string | undefined,\n      replyTo: payload.replyTo as string | undefined,\n      inReplyTo: payload.inReplyTo as string | undefined,\n      references: payload.references as string | string[] | undefined,\n    }\n  } else {\n    const { emailFields, to } = verified.data\n    toAddress = to.length > 0 ? to[0].toLowerCase() : null\n    emailInput = {\n      from: emailFields.from,\n      to: emailFields.to,\n      subject: emailFields.subject,\n      text: emailFields.text,\n      html: emailFields.html,\n      messageId: emailFields.messageId,\n      replyTo: emailFields.replyTo,\n      inReplyTo: emailFields.inReplyTo,\n      references: emailFields.references,\n    }\n  }\n\n  if (!toAddress) {\n    return NextResponse.json({ error: 'Missing recipient address' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n\n  let cache: CacheStrategy | null = null\n  try {\n    cache = container.resolve('cache') as CacheStrategy\n  } catch {\n    // Cache not available \u2014 the limiter now fails closed with a process-local\n    // bucket instead of waving the request through.\n  }\n\n  // Pre-DB global bucket keyed on the configured signing secret (custom) or the\n  // static Resend path, NOT on the attacker-controllable `to` and NOT on the\n  // per-request signature (which mutates with timestamp/body, so it would mint a\n  // fresh bucket every request and never throttle). The per-tenant secret lives\n  // behind the encrypted-column lookup, so the only secret available here without\n  // a DB hit is the global one \u2014 keying on it caps total inbound volume for the\n  // custom path and runs BEFORE the lookup so a flood cannot amplify DB work.\n  const globalBucketKey = verified.data.kind === 'custom'\n    ? `webhook:secret:${secretFingerprint(process.env.INBOX_OPS_WEBHOOK_SECRET || '')}`\n    : 'webhook:resend'\n  const globalRateCheck = await checkRateLimit(cache, globalBucketKey)\n  if (!globalRateCheck.allowed) {\n    return rateLimitedResponse(globalRateCheck.retryAfterSeconds)\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // No explicit scope: decryptEntitiesWithFallbackScope reads tenant/org off the\n  // resolved row, which is exactly what binds webhook_secret to its own tenant.\n  const settings = await findOneWithDecryption(\n    em,\n    InboxSettings,\n    {\n      inboxAddress: toAddress.toLowerCase(),\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n\n  // Final HMAC verification for the custom provider path: bind the signature to\n  // the resolved tenant. When the inbox declares its own secret, ONLY that\n  // secret is accepted; otherwise the global secret is accepted (back-compat).\n  // For an unknown `to` we still require the global secret so the endpoint never\n  // behaves as an unauthenticated probe oracle.\n  if (verified.data.kind === 'custom') {\n    const globalSecret = process.env.INBOX_OPS_WEBHOOK_SECRET || ''\n    const inboxSecret = settings?.webhookSecret || ''\n    const acceptableSecrets = inboxSecret ? [inboxSecret] : [globalSecret]\n    const signatureValid = verifyHmacAgainstAny(\n      rawBody,\n      verified.data.signature,\n      verified.data.timestamp,\n      acceptableSecrets,\n    )\n    if (!signatureValid) {\n      return NextResponse.json({ error: 'Invalid signature' }, { status: 400 })\n    }\n  }\n\n  if (!settings) {\n    return NextResponse.json({ ok: true })\n  }\n\n  // Per-tenant bucket keyed on the RESOLVED tenant (not the raw `to`), so it\n  // cannot be diluted by alias addresses that map to the same inbox.\n  const tenantRateCheck = await checkRateLimit(\n    cache,\n    `webhook:tenant:${settings.tenantId}`,\n    settings.tenantId,\n  )\n  if (!tenantRateCheck.allowed) {\n    return rateLimitedResponse(tenantRateCheck.retryAfterSeconds)\n  }\n\n  const parsed = parseInboundEmail(emailInput)\n\n  const isDuplicate = await checkDuplicate(em, settings, parsed.messageId, parsed.contentHash)\n  if (isDuplicate) {\n    try {\n      await emitInboxOpsEvent('inbox_ops.email.deduplicated', {\n        tenantId: settings.tenantId,\n        organizationId: settings.organizationId,\n        toAddress,\n      })\n    } catch (eventError) {\n      logger.error('Failed to emit deduplicated event', { err: eventError })\n    }\n    return NextResponse.json({ ok: true })\n  }\n\n  const maxTextSize = parseInt(process.env.INBOX_OPS_MAX_TEXT_SIZE || '204800', 10)\n  const cleanedText = parsed.cleanedText.slice(0, maxTextSize)\n\n  const email = em.create(InboxEmail, {\n    messageId: parsed.messageId,\n    contentHash: parsed.contentHash,\n    forwardedByAddress: parsed.from.email,\n    forwardedByName: parsed.from.name || null,\n    toAddress,\n    subject: parsed.subject,\n    replyTo: parsed.replyTo,\n    inReplyTo: parsed.inReplyTo,\n    emailReferences: parsed.references,\n    rawText: parsed.rawText,\n    rawHtml: parsed.rawHtml,\n    cleanedText,\n    threadMessages: parsed.threadMessages,\n    detectedLanguage: parsed.detectedLanguage,\n    receivedAt: new Date(),\n    status: 'received' as const,\n    isActive: true,\n    organizationId: settings.organizationId,\n    tenantId: settings.tenantId,\n  })\n\n  em.persist(email)\n  await em.flush()\n\n  try {\n    await emitInboxOpsEvent('inbox_ops.email.received', {\n      emailId: email.id,\n      tenantId: settings.tenantId,\n      organizationId: settings.organizationId,\n      forwardedByAddress: parsed.from.email,\n      subject: parsed.subject,\n    })\n  } catch (eventError) {\n    logger.error('Failed to emit email.received event', { err: eventError })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nfunction rateLimitedResponse(retryAfterSeconds?: number): NextResponse {\n  return NextResponse.json(\n    { error: 'Rate limit exceeded' },\n    {\n      status: 429,\n      headers: retryAfterSeconds ? { 'Retry-After': String(retryAfterSeconds) } : undefined,\n    },\n  )\n}\n\nfunction extractToAddress(payload: Record<string, unknown>): string | null {\n  const to = payload.to\n  if (typeof to === 'string') {\n    const match = to.match(/<([^>]+)>/)\n    return match ? match[1].toLowerCase() : to.trim().toLowerCase()\n  }\n  if (Array.isArray(to) && to.length > 0) {\n    const first = to[0]\n    if (typeof first === 'string') {\n      const match = first.match(/<([^>]+)>/)\n      return match ? match[1].toLowerCase() : first.trim().toLowerCase()\n    }\n  }\n  return null\n}\n\nasync function checkDuplicate(\n  em: EntityManager,\n  settings: InboxSettings,\n  messageId: string | null | undefined,\n  contentHash: string | null | undefined,\n): Promise<boolean> {\n  const encScope = {\n    tenantId: settings.tenantId,\n    organizationId: settings.organizationId,\n  }\n  const whereBase = {\n    organizationId: settings.organizationId,\n    tenantId: settings.tenantId,\n    deletedAt: null,\n  }\n\n  if (messageId) {\n    const byMessageId = await findOneWithDecryption(em, InboxEmail, { ...whereBase, messageId }, undefined, encScope)\n    if (byMessageId) return true\n  }\n\n  if (contentHash) {\n    const byHash = await findOneWithDecryption(em, InboxEmail, { ...whereBase, contentHash }, undefined, encScope)\n    if (byHash) return true\n  }\n\n  return false\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Inbound email webhook',\n  methods: {\n    POST: {\n      summary: 'Receive forwarded email from provider webhook',\n      description: 'Public endpoint \u2014 validated by provider HMAC signature or Resend/Svix signature. Rate limited per tenant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: z.object({\n          from: z.string().optional(),\n          to: z.union([z.string(), z.array(z.string())]).optional(),\n          subject: z.string().optional(),\n          text: z.string().optional(),\n          html: z.string().optional(),\n          messageId: z.string().optional(),\n          replyTo: z.string().optional(),\n          inReplyTo: z.string().optional(),\n          references: z.union([z.string(), z.array(z.string())]).optional(),\n        }),\n      },\n      responses: [\n        { status: 200, description: 'Email received and queued for processing' },\n        { status: 400, description: 'Invalid payload or signature' },\n        { status: 413, description: 'Payload too large' },\n        { status: 429, description: 'Rate limit exceeded' },\n        { status: 503, description: 'Webhook secret not configured' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,uBAAuB;AAC5C,SAAS,SAAS;AAClB,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,8BAA8B;AAIvC,SAAS,6BAA6B;AACtC,SAAS,eAAe,kBAAkB;AAC1C,SAAS,yBAAyB;AAClC,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,mBAAmB,IAAI,OAAO;AACpC,MAAM,mBAAmB,IAAI,KAAK;AAElC,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,cAAc,SAAS,WAAW,EAAE,IAAI;AAC9C,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,WAAW,KAAK;AAC/C;AAEA,SAAS,oBACP,SACA,WACA,WACA,QACS;AACT,MAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAQ,QAAO;AAEhD,MAAI,CAAC,iBAAiB,SAAS,EAAG,QAAO;AAEzC,QAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,EAChC,OAAO,KAAK;AACf,QAAM,WAAW,UAAU,WAAW,SAAS,IAC3C,UAAU,MAAM,UAAU,MAAM,IAChC;AAEJ,MAAI;AACF,QAAI,SAAS,WAAW,SAAS,OAAQ,QAAO;AAChD,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,qBACP,SACA,WACA,WACA,SACS;AACT,aAAW,UAAU,SAAS;AAC5B,QAAI,UAAU,oBAAoB,SAAS,WAAW,WAAW,MAAM,EAAG,QAAO;AAAA,EACnF;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,QAAwB;AACjD,SAAO,WAAW,UAAU,2BAA2B,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACnG;AAEA,SAAS,oBACP,SACA,SACA,QACS;AACT,MAAI;AACF,UAAM,KAAK,IAAI,QAAQ,MAAM;AAC7B,OAAG,OAAO,SAAS;AAAA,MACjB,WAAW,QAAQ,SAAS;AAAA,MAC5B,kBAAkB,QAAQ,gBAAgB;AAAA,MAC1C,kBAAkB,QAAQ,gBAAgB;AAAA,IAC5C,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,SAU7B;AACD,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2DAA2D;AAExF,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,OAAO,UAAU,IAAI,OAAO;AACjE,MAAI,SAAS,CAAC,MAAM;AAClB,UAAM,IAAI,MAAM,gCAAgC,OAAO,KAAK,OAAO,WAAW,eAAe,EAAE;AAAA,EACjG;AAEA,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,IAAI,KAAK;AAAA,IACT,SAAS,KAAK;AAAA,IACd,MAAM,KAAK,QAAQ;AAAA,IACnB,MAAM,KAAK,QAAQ;AAAA,IACnB,WAAW,KAAK;AAAA,IAChB,SAAS,KAAK,WAAW,CAAC,KAAK;AAAA,IAC/B,WAAW,KAAK,UAAU,aAAa,KAAK;AAAA,IAC5C,YAAY,KAAK,UAAU,YAAY,GAAG,MAAM,KAAK,EAAE,OAAO,OAAO;AAAA,EACvE;AACF;AAMA,eAAe,eAAe,KAAc,SAG1C;AACA,QAAM,YAAY,IAAI,QAAQ,IAAI,qBAAqB;AACvD,QAAM,SAAS,IAAI,QAAQ,IAAI,SAAS;AAExC,MAAI,WAAW;AACb,UAAM,gBAAgB,QAAQ,IAAI;AAClC,QAAI,CAAC,eAAe;AAClB,aAAO,MAAM,yCAAyC;AACtD,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACrG;AACA,UAAM,YAAY,IAAI,QAAQ,IAAI,qBAAqB,KAAK;AAK5D,QAAI,CAAC,iBAAiB,SAAS,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACnG;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO;AAAA,IAC9B,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,MAAM,UAAU,SAAS,WAAW,WAAW,UAAU,EAAE;AAAA,EACxF;AAEA,MAAI,QAAQ;AACV,UAAM,gBAAgB,QAAQ,IAAI;AAClC,QAAI,CAAC,eAAe;AAClB,aAAO,MAAM,8CAA8C;AAC3D,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACrG;AACA,UAAM,UAAkC;AAAA,MACtC,WAAW;AAAA,MACX,kBAAkB,IAAI,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MACvD,kBAAkB,IAAI,QAAQ,IAAI,gBAAgB,KAAK;AAAA,IACzD;AACA,QAAI,CAAC,oBAAoB,SAAS,SAAS,aAAa,GAAG;AACzD,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACnG;AACA,QAAI;AACJ,QAAI;AACF,iBAAW,KAAK,MAAM,OAAO;AAAA,IAC/B,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IAC9F;AACA,QAAI,SAAS,SAAS,kBAAkB;AACtC,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE;AAAA,IAChE;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACpH;AACA,UAAM,cAAc,MAAM,iBAAiB,OAAO;AAClD,UAAM,KAAK,YAAY,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,MAAM,UAAU,aAAa,GAAG,EAAE;AAAA,EAC/D;AAEA,SAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAC3G;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,wBAAwB;AACpE,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,6BAA6B;AACzE,MAAI,CAAC,mBAAmB,CAAC,iBAAiB;AACxC,WAAO,MAAM,kFAAkF;AAC/F,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,QAAM,gBAAgB,SAAS,IAAI,QAAQ,IAAI,gBAAgB,KAAK,KAAK,EAAE;AAC3E,MAAI,gBAAgB,kBAAkB;AACpC,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AAEA,MAAI,QAAQ,SAAS,kBAAkB;AACrC,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,WAAW,MAAM,eAAe,KAAK,OAAO;AAClD,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI;AACJ,MAAI;AAEJ,MAAI,SAAS,KAAK,SAAS,UAAU;AACnC,UAAM,UAAU,SAAS,KAAK;AAC9B,gBAAY,iBAAiB,OAAO;AACpC,iBAAa;AAAA,MACX,MAAM,QAAQ;AAAA,MACd,IAAI,QAAQ;AAAA,MACZ,SAAS,QAAQ;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ;AAAA,MACjB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,IACtB;AAAA,EACF,OAAO;AACL,UAAM,EAAE,aAAa,GAAG,IAAI,SAAS;AACrC,gBAAY,GAAG,SAAS,IAAI,GAAG,CAAC,EAAE,YAAY,IAAI;AAClD,iBAAa;AAAA,MACX,MAAM,YAAY;AAAA,MAClB,IAAI,YAAY;AAAA,MAChB,SAAS,YAAY;AAAA,MACrB,MAAM,YAAY;AAAA,MAClB,MAAM,YAAY;AAAA,MAClB,WAAW,YAAY;AAAA,MACvB,SAAS,YAAY;AAAA,MACrB,WAAW,YAAY;AAAA,MACvB,YAAY,YAAY;AAAA,IAC1B;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAE/C,MAAI,QAA8B;AAClC,MAAI;AACF,YAAQ,UAAU,QAAQ,OAAO;AAAA,EACnC,QAAQ;AAAA,EAGR;AASA,QAAM,kBAAkB,SAAS,KAAK,SAAS,WAC3C,kBAAkB,kBAAkB,QAAQ,IAAI,4BAA4B,EAAE,CAAC,KAC/E;AACJ,QAAM,kBAAkB,MAAM,eAAe,OAAO,eAAe;AACnE,MAAI,CAAC,gBAAgB,SAAS;AAC5B,WAAO,oBAAoB,gBAAgB,iBAAiB;AAAA,EAC9D;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAI3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,cAAc,UAAU,YAAY;AAAA,MACpC,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AAOA,MAAI,SAAS,KAAK,SAAS,UAAU;AACnC,UAAM,eAAe,QAAQ,IAAI,4BAA4B;AAC7D,UAAM,cAAc,UAAU,iBAAiB;AAC/C,UAAM,oBAAoB,cAAc,CAAC,WAAW,IAAI,CAAC,YAAY;AACrE,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA,SAAS,KAAK;AAAA,MACd,SAAS,KAAK;AAAA,MACd;AAAA,IACF;AACA,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAIA,QAAM,kBAAkB,MAAM;AAAA,IAC5B;AAAA,IACA,kBAAkB,SAAS,QAAQ;AAAA,IACnC,SAAS;AAAA,EACX;AACA,MAAI,CAAC,gBAAgB,SAAS;AAC5B,WAAO,oBAAoB,gBAAgB,iBAAiB;AAAA,EAC9D;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAE3C,QAAM,cAAc,MAAM,eAAe,IAAI,UAAU,OAAO,WAAW,OAAO,WAAW;AAC3F,MAAI,aAAa;AACf,QAAI;AACF,YAAM,kBAAkB,gCAAgC;AAAA,QACtD,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB;AAAA,MACF,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,aAAO,MAAM,qCAAqC,EAAE,KAAK,WAAW,CAAC;AAAA,IACvE;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,cAAc,SAAS,QAAQ,IAAI,2BAA2B,UAAU,EAAE;AAChF,QAAM,cAAc,OAAO,YAAY,MAAM,GAAG,WAAW;AAE3D,QAAM,QAAQ,GAAG,OAAO,YAAY;AAAA,IAClC,WAAW,OAAO;AAAA,IAClB,aAAa,OAAO;AAAA,IACpB,oBAAoB,OAAO,KAAK;AAAA,IAChC,iBAAiB,OAAO,KAAK,QAAQ;AAAA,IACrC;AAAA,IACA,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,iBAAiB,OAAO;AAAA,IACxB,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,kBAAkB,OAAO;AAAA,IACzB,YAAY,oBAAI,KAAK;AAAA,IACrB,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,gBAAgB,SAAS;AAAA,IACzB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,KAAG,QAAQ,KAAK;AAChB,QAAM,GAAG,MAAM;AAEf,MAAI;AACF,UAAM,kBAAkB,4BAA4B;AAAA,MAClD,SAAS,MAAM;AAAA,MACf,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,oBAAoB,OAAO,KAAK;AAAA,MAChC,SAAS,OAAO;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,YAAY;AACnB,WAAO,MAAM,uCAAuC,EAAE,KAAK,WAAW,CAAC;AAAA,EACzE;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,SAAS,oBAAoB,mBAA0C;AACrE,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,sBAAsB;AAAA,IAC/B;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,oBAAoB,EAAE,eAAe,OAAO,iBAAiB,EAAE,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,KAAK,QAAQ;AACnB,MAAI,OAAO,OAAO,UAAU;AAC1B,UAAM,QAAQ,GAAG,MAAM,WAAW;AAClC,WAAO,QAAQ,MAAM,CAAC,EAAE,YAAY,IAAI,GAAG,KAAK,EAAE,YAAY;AAAA,EAChE;AACA,MAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,GAAG;AACtC,UAAM,QAAQ,GAAG,CAAC;AAClB,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,QAAQ,MAAM,MAAM,WAAW;AACrC,aAAO,QAAQ,MAAM,CAAC,EAAE,YAAY,IAAI,MAAM,KAAK,EAAE,YAAY;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eACb,IACA,UACA,WACA,aACkB;AAClB,QAAM,WAAW;AAAA,IACf,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,EAC3B;AACA,QAAM,YAAY;AAAA,IAChB,gBAAgB,SAAS;AAAA,IACzB,UAAU,SAAS;AAAA,IACnB,WAAW;AAAA,EACb;AAEA,MAAI,WAAW;AACb,UAAM,cAAc,MAAM,sBAAsB,IAAI,YAAY,EAAE,GAAG,WAAW,UAAU,GAAG,QAAW,QAAQ;AAChH,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,MAAI,aAAa;AACf,UAAM,SAAS,MAAM,sBAAsB,IAAI,YAAY,EAAE,GAAG,WAAW,YAAY,GAAG,QAAW,QAAQ;AAC7G,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,EAAE,OAAO;AAAA,UACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,UACxD,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,UAC7B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,UAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,UAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,UAC/B,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,+BAA+B;AAAA,QAC3D,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,QAClD,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createHmac, timingSafeEqual } from 'node:crypto'\nimport { z } from 'zod'\nimport { Webhook } from 'svix'\nimport { Resend } from 'resend'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { InboxSettings, InboxEmail } from '../../data/entities'\nimport { parseInboundEmail } from '../../lib/emailParser'\nimport { checkRateLimit } from '../../lib/rateLimiter'\nimport { emitInboxOpsEvent } from '../../events'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport {\n  readBoundedRequestBody,\n  resolveWebhookBodyLimitBytes,\n  WebhookBodyTooLargeError,\n} from '@open-mercato/shared/lib/webhooks'\n\nconst logger = createLogger('inbox_ops').child({ component: 'webhook' })\n\nexport const metadata = {\n  POST: { requireAuth: false },\n}\n\nconst MAX_PAYLOAD_SIZE = resolveWebhookBodyLimitBytes(\n  process.env.INBOX_OPS_WEBHOOK_MAX_BODY_BYTES ?? process.env.OM_WEBHOOK_MAX_BODY_BYTES,\n  2 * 1024 * 1024,\n)\nconst REPLAY_WINDOW_MS = 5 * 60 * 1000 // 5 minutes\n\nfunction isTimestampFresh(timestamp: string): boolean {\n  if (!timestamp) return false\n  const timestampMs = parseInt(timestamp, 10) * 1000\n  if (isNaN(timestampMs)) return false\n  return Math.abs(Date.now() - timestampMs) <= REPLAY_WINDOW_MS\n}\n\nfunction verifyHmacSignature(\n  payload: string,\n  signature: string,\n  timestamp: string,\n  secret: string,\n): boolean {\n  if (!signature || !timestamp || !secret) return false\n\n  if (!isTimestampFresh(timestamp)) return false\n\n  const expected = createHmac('sha256', secret)\n    .update(`${timestamp}.${payload}`)\n    .digest('hex')\n  const received = signature.startsWith('sha256=')\n    ? signature.slice('sha256='.length)\n    : signature\n\n  try {\n    if (received.length !== expected.length) return false\n    return timingSafeEqual(\n      Buffer.from(received, 'hex'),\n      Buffer.from(expected, 'hex'),\n    )\n  } catch {\n    return false\n  }\n}\n\n// True when the signature verifies against ANY of the candidate secrets. Used\n// to bind the inbound signature to the resolved tenant: once the target inbox\n// declares its own per-tenant secret, the global INBOX_OPS_WEBHOOK_SECRET is no\n// longer accepted for that inbox, so a holder of the global key alone cannot\n// forge mail into a tenant that opted into a dedicated secret.\nfunction verifyHmacAgainstAny(\n  payload: string,\n  signature: string,\n  timestamp: string,\n  secrets: string[],\n): boolean {\n  for (const secret of secrets) {\n    if (secret && verifyHmacSignature(payload, signature, timestamp, secret)) return true\n  }\n  return false\n}\n\n// Stable, non-reversible identifier for the pre-DB global rate-limit bucket.\n// Keying on the configured signing secret (rather than the attacker-set `to` or\n// the per-request signature) means the bucket is request-invariant for a given\n// secret, so rotating recipients or mutating the body cannot dilute the limit.\nfunction secretFingerprint(secret: string): string {\n  return createHmac('sha256', 'inbox_ops:rate_limit:salt').update(secret).digest('hex').slice(0, 32)\n}\n\nfunction verifySvixSignature(\n  rawBody: string,\n  headers: Record<string, string>,\n  secret: string,\n): boolean {\n  try {\n    const wh = new Webhook(secret)\n    wh.verify(rawBody, {\n      'svix-id': headers['svix-id'],\n      'svix-timestamp': headers['svix-timestamp'],\n      'svix-signature': headers['svix-signature'],\n    })\n    return true\n  } catch {\n    return false\n  }\n}\n\nasync function fetchResendEmail(emailId: string): Promise<{\n  from?: string\n  to?: string[]\n  subject?: string\n  text?: string\n  html?: string\n  messageId?: string\n  replyTo?: string\n  inReplyTo?: string\n  references?: string[]\n}> {\n  const apiKey = process.env.RESEND_API_KEY\n  if (!apiKey) throw new Error('RESEND_API_KEY is required to fetch Resend inbound emails')\n\n  const resend = new Resend(apiKey)\n  const { data, error } = await resend.emails.receiving.get(emailId)\n  if (error || !data) {\n    throw new Error(`Failed to fetch Resend email ${emailId}: ${error?.message || 'unknown error'}`)\n  }\n\n  return {\n    from: data.from,\n    to: data.to,\n    subject: data.subject,\n    text: data.text ?? undefined,\n    html: data.html ?? undefined,\n    messageId: data.message_id,\n    replyTo: data.reply_to?.[0] ?? undefined,\n    inReplyTo: data.headers?.['in-reply-to'] ?? undefined,\n    references: data.headers?.['references']?.split(/\\s+/).filter(Boolean),\n  }\n}\n\ntype VerifiedPayload =\n  | { kind: 'custom'; payload: Record<string, unknown>; signature: string; timestamp: string }\n  | { kind: 'resend'; emailFields: Awaited<ReturnType<typeof fetchResendEmail>>; to: string[] }\n\nasync function verifyAndParse(req: Request, rawBody: string): Promise<\n  | { ok: true; data: VerifiedPayload }\n  | { ok: false; response: NextResponse }\n> {\n  const customSig = req.headers.get('x-webhook-signature')\n  const svixId = req.headers.get('svix-id')\n\n  if (customSig) {\n    const webhookSecret = process.env.INBOX_OPS_WEBHOOK_SECRET\n    if (!webhookSecret) {\n      logger.error('INBOX_OPS_WEBHOOK_SECRET not configured')\n      return { ok: false, response: NextResponse.json({ error: 'Service unavailable' }, { status: 503 }) }\n    }\n    const timestamp = req.headers.get('x-webhook-timestamp') || ''\n    // Cheap, secret-independent gate first: reject replayed/stale requests\n    // before parsing. The HMAC itself is verified later, against the secret\n    // bound to the resolved inbox (see the POST handler), so a holder of the\n    // global secret cannot inject into a tenant that owns its own secret.\n    if (!isTimestampFresh(timestamp)) {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid signature' }, { status: 400 }) }\n    }\n    let payload: Record<string, unknown>\n    try {\n      payload = JSON.parse(rawBody)\n    } catch {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n    }\n    return { ok: true, data: { kind: 'custom', payload, signature: customSig, timestamp } }\n  }\n\n  if (svixId) {\n    const signingSecret = process.env.RESEND_WEBHOOK_SIGNING_SECRET\n    if (!signingSecret) {\n      logger.error('RESEND_WEBHOOK_SIGNING_SECRET not configured')\n      return { ok: false, response: NextResponse.json({ error: 'Service unavailable' }, { status: 503 }) }\n    }\n    const headers: Record<string, string> = {\n      'svix-id': svixId,\n      'svix-timestamp': req.headers.get('svix-timestamp') || '',\n      'svix-signature': req.headers.get('svix-signature') || '',\n    }\n    if (!verifySvixSignature(rawBody, headers, signingSecret)) {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid signature' }, { status: 400 }) }\n    }\n    let envelope: { type?: string; data?: { email_id?: string; from?: string; to?: string[] } }\n    try {\n      envelope = JSON.parse(rawBody)\n    } catch {\n      return { ok: false, response: NextResponse.json({ error: 'Invalid JSON' }, { status: 400 }) }\n    }\n    if (envelope.type !== 'email.received') {\n      return { ok: false, response: NextResponse.json({ ok: true }) }\n    }\n    const emailId = envelope.data?.email_id\n    if (!emailId) {\n      return { ok: false, response: NextResponse.json({ error: 'Missing email_id in Resend payload' }, { status: 400 }) }\n    }\n    const emailFields = await fetchResendEmail(emailId)\n    const to = emailFields.to || envelope.data?.to || []\n    return { ok: true, data: { kind: 'resend', emailFields, to } }\n  }\n\n  return { ok: false, response: NextResponse.json({ error: 'Missing signature headers' }, { status: 400 }) }\n}\n\nexport async function POST(req: Request) {\n  const hasCustomSecret = Boolean(process.env.INBOX_OPS_WEBHOOK_SECRET)\n  const hasResendSecret = Boolean(process.env.RESEND_WEBHOOK_SIGNING_SECRET)\n  if (!hasCustomSecret && !hasResendSecret) {\n    logger.error('Neither INBOX_OPS_WEBHOOK_SECRET nor RESEND_WEBHOOK_SIGNING_SECRET is configured')\n    return NextResponse.json({ error: 'Service unavailable' }, { status: 503 })\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await readBoundedRequestBody(req, { maxBytes: MAX_PAYLOAD_SIZE })\n  } catch (error) {\n    if (error instanceof WebhookBodyTooLargeError) {\n      return NextResponse.json({ error: 'Payload too large' }, { status: 413 })\n    }\n    return NextResponse.json({ error: 'Bad request' }, { status: 400 })\n  }\n\n  const verified = await verifyAndParse(req, rawBody)\n  if (!verified.ok) {\n    return verified.response\n  }\n\n  let toAddress: string | null\n  let emailInput: Parameters<typeof parseInboundEmail>[0]\n\n  if (verified.data.kind === 'custom') {\n    const payload = verified.data.payload\n    toAddress = extractToAddress(payload)\n    emailInput = {\n      from: payload.from as string | undefined,\n      to: payload.to as string | string[] | undefined,\n      subject: payload.subject as string | undefined,\n      text: payload.text as string | undefined,\n      html: payload.html as string | undefined,\n      messageId: payload.messageId as string | undefined,\n      replyTo: payload.replyTo as string | undefined,\n      inReplyTo: payload.inReplyTo as string | undefined,\n      references: payload.references as string | string[] | undefined,\n    }\n  } else {\n    const { emailFields, to } = verified.data\n    toAddress = to.length > 0 ? to[0].toLowerCase() : null\n    emailInput = {\n      from: emailFields.from,\n      to: emailFields.to,\n      subject: emailFields.subject,\n      text: emailFields.text,\n      html: emailFields.html,\n      messageId: emailFields.messageId,\n      replyTo: emailFields.replyTo,\n      inReplyTo: emailFields.inReplyTo,\n      references: emailFields.references,\n    }\n  }\n\n  if (!toAddress) {\n    return NextResponse.json({ error: 'Missing recipient address' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n\n  let cache: CacheStrategy | null = null\n  try {\n    cache = container.resolve('cache') as CacheStrategy\n  } catch {\n    // Cache not available \u2014 the limiter now fails closed with a process-local\n    // bucket instead of waving the request through.\n  }\n\n  // Pre-DB global bucket keyed on the configured signing secret (custom) or the\n  // static Resend path, NOT on the attacker-controllable `to` and NOT on the\n  // per-request signature (which mutates with timestamp/body, so it would mint a\n  // fresh bucket every request and never throttle). The per-tenant secret lives\n  // behind the encrypted-column lookup, so the only secret available here without\n  // a DB hit is the global one \u2014 keying on it caps total inbound volume for the\n  // custom path and runs BEFORE the lookup so a flood cannot amplify DB work.\n  const globalBucketKey = verified.data.kind === 'custom'\n    ? `webhook:secret:${secretFingerprint(process.env.INBOX_OPS_WEBHOOK_SECRET || '')}`\n    : 'webhook:resend'\n  const globalRateCheck = await checkRateLimit(cache, globalBucketKey)\n  if (!globalRateCheck.allowed) {\n    return rateLimitedResponse(globalRateCheck.retryAfterSeconds)\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // No explicit scope: decryptEntitiesWithFallbackScope reads tenant/org off the\n  // resolved row, which is exactly what binds webhook_secret to its own tenant.\n  const settings = await findOneWithDecryption(\n    em,\n    InboxSettings,\n    {\n      inboxAddress: toAddress.toLowerCase(),\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n\n  // Final HMAC verification for the custom provider path: bind the signature to\n  // the resolved tenant. When the inbox declares its own secret, ONLY that\n  // secret is accepted; otherwise the global secret is accepted (back-compat).\n  // For an unknown `to` we still require the global secret so the endpoint never\n  // behaves as an unauthenticated probe oracle.\n  if (verified.data.kind === 'custom') {\n    const globalSecret = process.env.INBOX_OPS_WEBHOOK_SECRET || ''\n    const inboxSecret = settings?.webhookSecret || ''\n    const acceptableSecrets = inboxSecret ? [inboxSecret] : [globalSecret]\n    const signatureValid = verifyHmacAgainstAny(\n      rawBody,\n      verified.data.signature,\n      verified.data.timestamp,\n      acceptableSecrets,\n    )\n    if (!signatureValid) {\n      return NextResponse.json({ error: 'Invalid signature' }, { status: 400 })\n    }\n  }\n\n  if (!settings) {\n    return NextResponse.json({ ok: true })\n  }\n\n  // Per-tenant bucket keyed on the RESOLVED tenant (not the raw `to`), so it\n  // cannot be diluted by alias addresses that map to the same inbox.\n  const tenantRateCheck = await checkRateLimit(\n    cache,\n    `webhook:tenant:${settings.tenantId}`,\n    settings.tenantId,\n  )\n  if (!tenantRateCheck.allowed) {\n    return rateLimitedResponse(tenantRateCheck.retryAfterSeconds)\n  }\n\n  const parsed = parseInboundEmail(emailInput)\n\n  const isDuplicate = await checkDuplicate(em, settings, parsed.messageId, parsed.contentHash)\n  if (isDuplicate) {\n    try {\n      await emitInboxOpsEvent('inbox_ops.email.deduplicated', {\n        tenantId: settings.tenantId,\n        organizationId: settings.organizationId,\n        toAddress,\n      })\n    } catch (eventError) {\n      logger.error('Failed to emit deduplicated event', { err: eventError })\n    }\n    return NextResponse.json({ ok: true })\n  }\n\n  const maxTextSize = parseInt(process.env.INBOX_OPS_MAX_TEXT_SIZE || '204800', 10)\n  const cleanedText = parsed.cleanedText.slice(0, maxTextSize)\n\n  const email = em.create(InboxEmail, {\n    messageId: parsed.messageId,\n    contentHash: parsed.contentHash,\n    forwardedByAddress: parsed.from.email,\n    forwardedByName: parsed.from.name || null,\n    toAddress,\n    subject: parsed.subject,\n    replyTo: parsed.replyTo,\n    inReplyTo: parsed.inReplyTo,\n    emailReferences: parsed.references,\n    rawText: parsed.rawText,\n    rawHtml: parsed.rawHtml,\n    cleanedText,\n    threadMessages: parsed.threadMessages,\n    detectedLanguage: parsed.detectedLanguage,\n    receivedAt: new Date(),\n    status: 'received' as const,\n    isActive: true,\n    organizationId: settings.organizationId,\n    tenantId: settings.tenantId,\n  })\n\n  em.persist(email)\n  await em.flush()\n\n  try {\n    await emitInboxOpsEvent('inbox_ops.email.received', {\n      emailId: email.id,\n      tenantId: settings.tenantId,\n      organizationId: settings.organizationId,\n      forwardedByAddress: parsed.from.email,\n      subject: parsed.subject,\n    })\n  } catch (eventError) {\n    logger.error('Failed to emit email.received event', { err: eventError })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nfunction rateLimitedResponse(retryAfterSeconds?: number): NextResponse {\n  return NextResponse.json(\n    { error: 'Rate limit exceeded' },\n    {\n      status: 429,\n      headers: retryAfterSeconds ? { 'Retry-After': String(retryAfterSeconds) } : undefined,\n    },\n  )\n}\n\nfunction extractToAddress(payload: Record<string, unknown>): string | null {\n  const to = payload.to\n  if (typeof to === 'string') {\n    const match = to.match(/<([^>]+)>/)\n    return match ? match[1].toLowerCase() : to.trim().toLowerCase()\n  }\n  if (Array.isArray(to) && to.length > 0) {\n    const first = to[0]\n    if (typeof first === 'string') {\n      const match = first.match(/<([^>]+)>/)\n      return match ? match[1].toLowerCase() : first.trim().toLowerCase()\n    }\n  }\n  return null\n}\n\nasync function checkDuplicate(\n  em: EntityManager,\n  settings: InboxSettings,\n  messageId: string | null | undefined,\n  contentHash: string | null | undefined,\n): Promise<boolean> {\n  const encScope = {\n    tenantId: settings.tenantId,\n    organizationId: settings.organizationId,\n  }\n  const whereBase = {\n    organizationId: settings.organizationId,\n    tenantId: settings.tenantId,\n    deletedAt: null,\n  }\n\n  if (messageId) {\n    const byMessageId = await findOneWithDecryption(em, InboxEmail, { ...whereBase, messageId }, undefined, encScope)\n    if (byMessageId) return true\n  }\n\n  if (contentHash) {\n    const byHash = await findOneWithDecryption(em, InboxEmail, { ...whereBase, contentHash }, undefined, encScope)\n    if (byHash) return true\n  }\n\n  return false\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'InboxOps',\n  summary: 'Inbound email webhook',\n  methods: {\n    POST: {\n      summary: 'Receive forwarded email from provider webhook',\n      description: 'Public endpoint \u2014 validated by provider HMAC signature or Resend/Svix signature. Rate limited per tenant.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: z.object({\n          from: z.string().optional(),\n          to: z.union([z.string(), z.array(z.string())]).optional(),\n          subject: z.string().optional(),\n          text: z.string().optional(),\n          html: z.string().optional(),\n          messageId: z.string().optional(),\n          replyTo: z.string().optional(),\n          inReplyTo: z.string().optional(),\n          references: z.union([z.string(), z.array(z.string())]).optional(),\n        }),\n      },\n      responses: [\n        { status: 200, description: 'Email received and queued for processing' },\n        { status: 400, description: 'Invalid payload or signature' },\n        { status: 413, description: 'Payload too large' },\n        { status: 429, description: 'Rate limit exceeded' },\n        { status: 503, description: 'Webhook secret not configured' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,YAAY,uBAAuB;AAC5C,SAAS,SAAS;AAClB,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,8BAA8B;AAIvC,SAAS,6BAA6B;AACtC,SAAS,eAAe,kBAAkB;AAC1C,SAAS,yBAAyB;AAClC,SAAS,sBAAsB;AAC/B,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAEhE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,mBAAmB;AAAA,EACvB,QAAQ,IAAI,oCAAoC,QAAQ,IAAI;AAAA,EAC5D,IAAI,OAAO;AACb;AACA,MAAM,mBAAmB,IAAI,KAAK;AAElC,SAAS,iBAAiB,WAA4B;AACpD,MAAI,CAAC,UAAW,QAAO;AACvB,QAAM,cAAc,SAAS,WAAW,EAAE,IAAI;AAC9C,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,SAAO,KAAK,IAAI,KAAK,IAAI,IAAI,WAAW,KAAK;AAC/C;AAEA,SAAS,oBACP,SACA,WACA,WACA,QACS;AACT,MAAI,CAAC,aAAa,CAAC,aAAa,CAAC,OAAQ,QAAO;AAEhD,MAAI,CAAC,iBAAiB,SAAS,EAAG,QAAO;AAEzC,QAAM,WAAW,WAAW,UAAU,MAAM,EACzC,OAAO,GAAG,SAAS,IAAI,OAAO,EAAE,EAChC,OAAO,KAAK;AACf,QAAM,WAAW,UAAU,WAAW,SAAS,IAC3C,UAAU,MAAM,UAAU,MAAM,IAChC;AAEJ,MAAI;AACF,QAAI,SAAS,WAAW,SAAS,OAAQ,QAAO;AAChD,WAAO;AAAA,MACL,OAAO,KAAK,UAAU,KAAK;AAAA,MAC3B,OAAO,KAAK,UAAU,KAAK;AAAA,IAC7B;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAOA,SAAS,qBACP,SACA,WACA,WACA,SACS;AACT,aAAW,UAAU,SAAS;AAC5B,QAAI,UAAU,oBAAoB,SAAS,WAAW,WAAW,MAAM,EAAG,QAAO;AAAA,EACnF;AACA,SAAO;AACT;AAMA,SAAS,kBAAkB,QAAwB;AACjD,SAAO,WAAW,UAAU,2BAA2B,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACnG;AAEA,SAAS,oBACP,SACA,SACA,QACS;AACT,MAAI;AACF,UAAM,KAAK,IAAI,QAAQ,MAAM;AAC7B,OAAG,OAAO,SAAS;AAAA,MACjB,WAAW,QAAQ,SAAS;AAAA,MAC5B,kBAAkB,QAAQ,gBAAgB;AAAA,MAC1C,kBAAkB,QAAQ,gBAAgB;AAAA,IAC5C,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,iBAAiB,SAU7B;AACD,QAAM,SAAS,QAAQ,IAAI;AAC3B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,2DAA2D;AAExF,QAAM,SAAS,IAAI,OAAO,MAAM;AAChC,QAAM,EAAE,MAAM,MAAM,IAAI,MAAM,OAAO,OAAO,UAAU,IAAI,OAAO;AACjE,MAAI,SAAS,CAAC,MAAM;AAClB,UAAM,IAAI,MAAM,gCAAgC,OAAO,KAAK,OAAO,WAAW,eAAe,EAAE;AAAA,EACjG;AAEA,SAAO;AAAA,IACL,MAAM,KAAK;AAAA,IACX,IAAI,KAAK;AAAA,IACT,SAAS,KAAK;AAAA,IACd,MAAM,KAAK,QAAQ;AAAA,IACnB,MAAM,KAAK,QAAQ;AAAA,IACnB,WAAW,KAAK;AAAA,IAChB,SAAS,KAAK,WAAW,CAAC,KAAK;AAAA,IAC/B,WAAW,KAAK,UAAU,aAAa,KAAK;AAAA,IAC5C,YAAY,KAAK,UAAU,YAAY,GAAG,MAAM,KAAK,EAAE,OAAO,OAAO;AAAA,EACvE;AACF;AAMA,eAAe,eAAe,KAAc,SAG1C;AACA,QAAM,YAAY,IAAI,QAAQ,IAAI,qBAAqB;AACvD,QAAM,SAAS,IAAI,QAAQ,IAAI,SAAS;AAExC,MAAI,WAAW;AACb,UAAM,gBAAgB,QAAQ,IAAI;AAClC,QAAI,CAAC,eAAe;AAClB,aAAO,MAAM,yCAAyC;AACtD,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACrG;AACA,UAAM,YAAY,IAAI,QAAQ,IAAI,qBAAqB,KAAK;AAK5D,QAAI,CAAC,iBAAiB,SAAS,GAAG;AAChC,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACnG;AACA,QAAI;AACJ,QAAI;AACF,gBAAU,KAAK,MAAM,OAAO;AAAA,IAC9B,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IAC9F;AACA,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,MAAM,UAAU,SAAS,WAAW,WAAW,UAAU,EAAE;AAAA,EACxF;AAEA,MAAI,QAAQ;AACV,UAAM,gBAAgB,QAAQ,IAAI;AAClC,QAAI,CAAC,eAAe;AAClB,aAAO,MAAM,8CAA8C;AAC3D,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACrG;AACA,UAAM,UAAkC;AAAA,MACtC,WAAW;AAAA,MACX,kBAAkB,IAAI,QAAQ,IAAI,gBAAgB,KAAK;AAAA,MACvD,kBAAkB,IAAI,QAAQ,IAAI,gBAAgB,KAAK;AAAA,IACzD;AACA,QAAI,CAAC,oBAAoB,SAAS,SAAS,aAAa,GAAG;AACzD,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACnG;AACA,QAAI;AACJ,QAAI;AACF,iBAAW,KAAK,MAAM,OAAO;AAAA,IAC/B,QAAQ;AACN,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IAC9F;AACA,QAAI,SAAS,SAAS,kBAAkB;AACtC,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,EAAE;AAAA,IAChE;AACA,UAAM,UAAU,SAAS,MAAM;AAC/B,QAAI,CAAC,SAAS;AACZ,aAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,IACpH;AACA,UAAM,cAAc,MAAM,iBAAiB,OAAO;AAClD,UAAM,KAAK,YAAY,MAAM,SAAS,MAAM,MAAM,CAAC;AACnD,WAAO,EAAE,IAAI,MAAM,MAAM,EAAE,MAAM,UAAU,aAAa,GAAG,EAAE;AAAA,EAC/D;AAEA,SAAO,EAAE,IAAI,OAAO,UAAU,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAC3G;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,wBAAwB;AACpE,QAAM,kBAAkB,QAAQ,QAAQ,IAAI,6BAA6B;AACzE,MAAI,CAAC,mBAAmB,CAAC,iBAAiB;AACxC,WAAO,MAAM,kFAAkF;AAC/F,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,uBAAuB,KAAK,EAAE,UAAU,iBAAiB,CAAC;AAAA,EAC5E,SAAS,OAAO;AACd,QAAI,iBAAiB,0BAA0B;AAC7C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AAEA,QAAM,WAAW,MAAM,eAAe,KAAK,OAAO;AAClD,MAAI,CAAC,SAAS,IAAI;AAChB,WAAO,SAAS;AAAA,EAClB;AAEA,MAAI;AACJ,MAAI;AAEJ,MAAI,SAAS,KAAK,SAAS,UAAU;AACnC,UAAM,UAAU,SAAS,KAAK;AAC9B,gBAAY,iBAAiB,OAAO;AACpC,iBAAa;AAAA,MACX,MAAM,QAAQ;AAAA,MACd,IAAI,QAAQ;AAAA,MACZ,SAAS,QAAQ;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ;AAAA,MACnB,SAAS,QAAQ;AAAA,MACjB,WAAW,QAAQ;AAAA,MACnB,YAAY,QAAQ;AAAA,IACtB;AAAA,EACF,OAAO;AACL,UAAM,EAAE,aAAa,GAAG,IAAI,SAAS;AACrC,gBAAY,GAAG,SAAS,IAAI,GAAG,CAAC,EAAE,YAAY,IAAI;AAClD,iBAAa;AAAA,MACX,MAAM,YAAY;AAAA,MAClB,IAAI,YAAY;AAAA,MAChB,SAAS,YAAY;AAAA,MACrB,MAAM,YAAY;AAAA,MAClB,MAAM,YAAY;AAAA,MAClB,WAAW,YAAY;AAAA,MACvB,SAAS,YAAY;AAAA,MACrB,WAAW,YAAY;AAAA,MACvB,YAAY,YAAY;AAAA,IAC1B;AAAA,EACF;AAEA,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAE/C,MAAI,QAA8B;AAClC,MAAI;AACF,YAAQ,UAAU,QAAQ,OAAO;AAAA,EACnC,QAAQ;AAAA,EAGR;AASA,QAAM,kBAAkB,SAAS,KAAK,SAAS,WAC3C,kBAAkB,kBAAkB,QAAQ,IAAI,4BAA4B,EAAE,CAAC,KAC/E;AACJ,QAAM,kBAAkB,MAAM,eAAe,OAAO,eAAe;AACnE,MAAI,CAAC,gBAAgB,SAAS;AAC5B,WAAO,oBAAoB,gBAAgB,iBAAiB;AAAA,EAC9D;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAI3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,cAAc,UAAU,YAAY;AAAA,MACpC,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AAOA,MAAI,SAAS,KAAK,SAAS,UAAU;AACnC,UAAM,eAAe,QAAQ,IAAI,4BAA4B;AAC7D,UAAM,cAAc,UAAU,iBAAiB;AAC/C,UAAM,oBAAoB,cAAc,CAAC,WAAW,IAAI,CAAC,YAAY;AACrE,UAAM,iBAAiB;AAAA,MACrB;AAAA,MACA,SAAS,KAAK;AAAA,MACd,SAAS,KAAK;AAAA,MACd;AAAA,IACF;AACA,QAAI,CAAC,gBAAgB;AACnB,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAIA,QAAM,kBAAkB,MAAM;AAAA,IAC5B;AAAA,IACA,kBAAkB,SAAS,QAAQ;AAAA,IACnC,SAAS;AAAA,EACX;AACA,MAAI,CAAC,gBAAgB,SAAS;AAC5B,WAAO,oBAAoB,gBAAgB,iBAAiB;AAAA,EAC9D;AAEA,QAAM,SAAS,kBAAkB,UAAU;AAE3C,QAAM,cAAc,MAAM,eAAe,IAAI,UAAU,OAAO,WAAW,OAAO,WAAW;AAC3F,MAAI,aAAa;AACf,QAAI;AACF,YAAM,kBAAkB,gCAAgC;AAAA,QACtD,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB;AAAA,MACF,CAAC;AAAA,IACH,SAAS,YAAY;AACnB,aAAO,MAAM,qCAAqC,EAAE,KAAK,WAAW,CAAC;AAAA,IACvE;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,cAAc,SAAS,QAAQ,IAAI,2BAA2B,UAAU,EAAE;AAChF,QAAM,cAAc,OAAO,YAAY,MAAM,GAAG,WAAW;AAE3D,QAAM,QAAQ,GAAG,OAAO,YAAY;AAAA,IAClC,WAAW,OAAO;AAAA,IAClB,aAAa,OAAO;AAAA,IACpB,oBAAoB,OAAO,KAAK;AAAA,IAChC,iBAAiB,OAAO,KAAK,QAAQ;AAAA,IACrC;AAAA,IACA,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB,WAAW,OAAO;AAAA,IAClB,iBAAiB,OAAO;AAAA,IACxB,SAAS,OAAO;AAAA,IAChB,SAAS,OAAO;AAAA,IAChB;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,kBAAkB,OAAO;AAAA,IACzB,YAAY,oBAAI,KAAK;AAAA,IACrB,QAAQ;AAAA,IACR,UAAU;AAAA,IACV,gBAAgB,SAAS;AAAA,IACzB,UAAU,SAAS;AAAA,EACrB,CAAC;AAED,KAAG,QAAQ,KAAK;AAChB,QAAM,GAAG,MAAM;AAEf,MAAI;AACF,UAAM,kBAAkB,4BAA4B;AAAA,MAClD,SAAS,MAAM;AAAA,MACf,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,oBAAoB,OAAO,KAAK;AAAA,MAChC,SAAS,OAAO;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,YAAY;AACnB,WAAO,MAAM,uCAAuC,EAAE,KAAK,WAAW,CAAC;AAAA,EACzE;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,SAAS,oBAAoB,mBAA0C;AACrE,SAAO,aAAa;AAAA,IAClB,EAAE,OAAO,sBAAsB;AAAA,IAC/B;AAAA,MACE,QAAQ;AAAA,MACR,SAAS,oBAAoB,EAAE,eAAe,OAAO,iBAAiB,EAAE,IAAI;AAAA,IAC9E;AAAA,EACF;AACF;AAEA,SAAS,iBAAiB,SAAiD;AACzE,QAAM,KAAK,QAAQ;AACnB,MAAI,OAAO,OAAO,UAAU;AAC1B,UAAM,QAAQ,GAAG,MAAM,WAAW;AAClC,WAAO,QAAQ,MAAM,CAAC,EAAE,YAAY,IAAI,GAAG,KAAK,EAAE,YAAY;AAAA,EAChE;AACA,MAAI,MAAM,QAAQ,EAAE,KAAK,GAAG,SAAS,GAAG;AACtC,UAAM,QAAQ,GAAG,CAAC;AAClB,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,QAAQ,MAAM,MAAM,WAAW;AACrC,aAAO,QAAQ,MAAM,CAAC,EAAE,YAAY,IAAI,MAAM,KAAK,EAAE,YAAY;AAAA,IACnE;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,eACb,IACA,UACA,WACA,aACkB;AAClB,QAAM,WAAW;AAAA,IACf,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,EAC3B;AACA,QAAM,YAAY;AAAA,IAChB,gBAAgB,SAAS;AAAA,IACzB,UAAU,SAAS;AAAA,IACnB,WAAW;AAAA,EACb;AAEA,MAAI,WAAW;AACb,UAAM,cAAc,MAAM,sBAAsB,IAAI,YAAY,EAAE,GAAG,WAAW,UAAU,GAAG,QAAW,QAAQ;AAChH,QAAI,YAAa,QAAO;AAAA,EAC1B;AAEA,MAAI,aAAa;AACf,UAAM,SAAS,MAAM,sBAAsB,IAAI,YAAY,EAAE,GAAG,WAAW,YAAY,GAAG,QAAW,QAAQ;AAC7G,QAAI,OAAQ,QAAO;AAAA,EACrB;AAEA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ,EAAE,OAAO;AAAA,UACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,IAAI,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,UACxD,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,UAC7B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,UAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,UAC/B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,UAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,UAC/B,YAAY,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,+BAA+B;AAAA,QAC3D,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,QAClD,EAAE,QAAQ,KAAK,aAAa,gCAAgC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }