@open-mercato/core 0.7.1-develop.7130.1.fef2396fd8 → 0.7.1-develop.7135.1.19bf969756

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4374 entry points
+[build:core] found 4375 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/helpers/integration/communicationChannelsFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/communicationChannelsFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n/**\n * Communication-channels integration fixtures.\n *\n * These drive the TEST-ONLY seed endpoint `POST /api/communication_channels/test-seed`,\n * which is gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` (inert/404 in production). Use\n * {@link isChannelSeedingAvailable} to skip tests when the gate is off rather than\n * failing them.\n */\n\nexport type SeedAddressField =\n  | string\n  | { address: string; name?: string }\n  | Array<string | { address: string; name?: string }>;\n\nconst TEST_SEED_PATH = '/api/communication_channels/test-seed';\n\n/**\n * Probe whether the env-gated test-seed endpoint is enabled in the target app.\n * Returns false when the route answers 404 (flag off) so callers can `test.skip`.\n * The caller's token must hold `communication_channels.connect_user_channel`.\n */\nexport async function isChannelSeedingAvailable(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  // A malformed body returns 422 when the gate is ON and 404 when it is OFF.\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: '__probe__' },\n  });\n  return response.status() !== 404;\n}\n\n/**\n * Seed a connected, network-free `__test_seed__` channel owned by the caller.\n * Returns the new channel id. Tear down with {@link deleteChannelIfExists}.\n */\nexport async function seedConnectedChannel(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    displayName?: string;\n    externalIdentifier?: string;\n    /**\n     * `chat` connects the non-email stub instead: a channel whose senders carry\n     * an opaque handle and no address, and whose `externalIdentifier` is NULL \u2014\n     * the shape a real Discord/Slack channel has. Use it for anything asserting\n     * the hub's sender-identity contract (#4975); the default `email` flavor\n     * cannot prove it, because it can only ever supply email-shaped data.\n     */\n    providerFlavor?: 'email' | 'chat';\n  } = {},\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'connect-channel', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (connect-channel) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{ channelId?: string }>(response);\n  return expectId(body?.channelId, 'connect-channel response should include channelId');\n}\n\n/**\n * Seed an inbound `MessageChannelLink` for `channelId` and emit\n * `communication_channels.message.received` through the real event bus. The\n * persistent customers link-channel-message-received subscriber is enqueued to\n * the `events` queue \u2014 drain it with `drainIntegrationQueue('events')`.\n *\n * Returns the created link + message ids (the message id is the platform\n * `messages.message` id, usable as `messageThreadId` to thread a follow-up).\n *\n * Pass `createThreadMapping: true` to also seed a `ChannelThreadMapping` for the\n * thread \u2014 required before exercising the reaction (`/messages/[id]/reactions`)\n * and thread-assign (`/threads/[id]/assign`) routes, which resolve the owning\n * channel through that mapping.\n */\nexport async function seedInboundMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    from?: SeedAddressField;\n    to?: SeedAddressField;\n    cc?: SeedAddressField;\n    subject?: string;\n    bodyText?: string;\n    messageId?: string;\n    inReplyTo?: string;\n    references?: string[];\n    messageThreadId?: string;\n    providerKey?: string;\n    createThreadMapping?: boolean;\n  },\n): Promise<{ channelLinkId: string; messageId: string; conversationId: string }> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'emit-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (emit-inbound) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    channelLinkId?: string;\n    messageId?: string;\n    conversationId?: string;\n  }>(response);\n  return {\n    channelLinkId: expectId(body?.channelLinkId, 'emit-inbound response should include channelLinkId'),\n    messageId: expectId(body?.messageId, 'emit-inbound response should include messageId'),\n    conversationId: expectId(\n      body?.conversationId,\n      'emit-inbound response should include conversationId',\n    ),\n  };\n}\n\n/**\n * Best-effort delete of a seeded channel via the owner-scoped DELETE route.\n * Safe to call with a null id in `finally`.\n */\n/**\n * Ingest an inbound chat message through the REAL `ingest_inbound_message`\n * command: the stub adapter normalizes the frame and the hub composes the\n * platform message via `messages.messages.compose`.\n *\n * Unlike {@link seedInboundMessage}, nothing here is short-circuited \u2014 no row is\n * inserted behind the compose path \u2014 so a hub contract the provider cannot\n * satisfy fails the test instead of hiding behind seeded data. That bypass is\n * exactly why CI was green while every real inbound Discord message was rejected\n * (#4975).\n *\n * The sender is identified only by `senderIdentifier` (a Discord snowflake, a\n * Slack member id, \u2026). There is deliberately no way to pass an address.\n */\nexport async function ingestInboundChatMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    senderIdentifier: string;\n    senderDisplayName?: string;\n    body?: string;\n    externalMessageId: string;\n    externalConversationId: string;\n  },\n): Promise<{\n  status: string;\n  messageId: string | null;\n  conversationId: string | null;\n  channelLinkId: string | null;\n  channelType: string | null;\n}> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'ingest-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (ingest-inbound) should return 201 \u2014 ' +\n      'a non-201 here means the hub rejected a sender with no email address',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    status?: string;\n    messageId?: string | null;\n    conversationId?: string | null;\n    channelLinkId?: string | null;\n    channelType?: string | null;\n  }>(response);\n  return {\n    status: body?.status ?? 'unknown',\n    messageId: body?.messageId ?? null,\n    conversationId: body?.conversationId ?? null,\n    channelLinkId: body?.channelLinkId ?? null,\n    channelType: body?.channelType ?? null,\n  };\n}\n\nexport async function deleteChannelIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  channelId: string | null,\n): Promise<void> {\n  if (!token || !channelId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,\n    { token },\n  ).catch(() => undefined);\n}\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAgBvC,MAAM,iBAAiB;AAOvB,eAAsB,0BACpB,SACA,OACkB;AAElB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO,SAAS,OAAO,MAAM;AAC/B;AAMA,eAAsB,qBACpB,SACA,OACA,QAWI,CAAC,GACY;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EAC9C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,mDAAmD;AACtF;AAgBA,eAAsB,mBACpB,SACA,OACA,OAc+E;AAC/E,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,gBAAgB,GAAG,MAAM;AAAA,EAC3C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAIhB,QAAQ;AACX,SAAO;AAAA,IACL,eAAe,SAAS,MAAM,eAAe,oDAAoD;AAAA,IACjG,WAAW,SAAS,MAAM,WAAW,gDAAgD;AAAA,IACrF,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAoBA,eAAsB,yBACpB,SACA,OACA,OAcC;AACD,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,kBAAkB,GAAG,MAAM;AAAA,EAC7C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EAEF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAMhB,QAAQ;AACX,SAAO;AAAA,IACL,QAAQ,MAAM,UAAU;AAAA,IACxB,WAAW,MAAM,aAAa;AAAA,IAC9B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,eAAe,MAAM,iBAAiB;AAAA,IACtC,aAAa,MAAM,eAAe;AAAA,EACpC;AACF;AAEA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,UAAW;AAC1B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wCAAwC,mBAAmB,SAAS,CAAC;AAAA,IACrE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { expectId, readJsonSafe } from './generalFixtures';\n\n/**\n * Communication-channels integration fixtures.\n *\n * These drive the TEST-ONLY seed endpoint `POST /api/communication_channels/test-seed`,\n * which is gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` (inert/404 in production). Use\n * {@link isChannelSeedingAvailable} to skip tests when the gate is off rather than\n * failing them.\n */\n\nexport type SeedAddressField =\n  | string\n  | { address: string; name?: string }\n  | Array<string | { address: string; name?: string }>;\n\nconst TEST_SEED_PATH = '/api/communication_channels/test-seed';\n\n/**\n * Probe whether the env-gated test-seed endpoint is enabled in the target app.\n * Returns false when the route answers 404 (flag off) so callers can `test.skip`.\n * The caller's token must hold `communication_channels.connect_user_channel`.\n */\nexport async function isChannelSeedingAvailable(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  // A malformed body returns 422 when the gate is ON and 404 when it is OFF.\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: '__probe__' },\n  });\n  return response.status() !== 404;\n}\n\n/**\n * Seed a connected, network-free `__test_seed__` channel owned by the caller.\n * Returns the new channel id. Tear down with {@link deleteChannelIfExists}.\n */\nexport async function seedConnectedChannel(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    displayName?: string;\n    externalIdentifier?: string;\n    /**\n     * `chat` connects the non-email stub instead: a channel whose senders carry\n     * an opaque handle and no address, and whose `externalIdentifier` is NULL \u2014\n     * the shape a real Discord/Slack channel has. Use it for anything asserting\n     * the hub's sender-identity contract (#4975); the default `email` flavor\n     * cannot prove it, because it can only ever supply email-shaped data.\n     */\n    providerFlavor?: 'email' | 'chat';\n    /**\n     * Relabel the connected stub channel's `provider_key`. Provider packages own\n     * routes that filter on their own key, and a real channel for those providers\n     * cannot be connected in CI (the Discord adapter validates its bot token\n     * against the live API), so without this a provider-scoped listing can only\n     * be asserted against an empty result \u2014 the assertion that stayed green\n     * through #5602.\n     *\n     * The row is relabelled, nothing is registered: do not drive an outbound send\n     * through a relabelled channel, because delivery would resolve the real\n     * provider's adapter.\n     */\n    labelAsProviderKey?: string;\n  } = {},\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'connect-channel', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (connect-channel) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{ channelId?: string }>(response);\n  return expectId(body?.channelId, 'connect-channel response should include channelId');\n}\n\n/**\n * Seed an inbound `MessageChannelLink` for `channelId` and emit\n * `communication_channels.message.received` through the real event bus. The\n * persistent customers link-channel-message-received subscriber is enqueued to\n * the `events` queue \u2014 drain it with `drainIntegrationQueue('events')`.\n *\n * Returns the created link + message ids (the message id is the platform\n * `messages.message` id, usable as `messageThreadId` to thread a follow-up).\n *\n * Pass `createThreadMapping: true` to also seed a `ChannelThreadMapping` for the\n * thread \u2014 required before exercising the reaction (`/messages/[id]/reactions`)\n * and thread-assign (`/threads/[id]/assign`) routes, which resolve the owning\n * channel through that mapping.\n */\nexport async function seedInboundMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    from?: SeedAddressField;\n    to?: SeedAddressField;\n    cc?: SeedAddressField;\n    subject?: string;\n    bodyText?: string;\n    messageId?: string;\n    inReplyTo?: string;\n    references?: string[];\n    messageThreadId?: string;\n    providerKey?: string;\n    createThreadMapping?: boolean;\n  },\n): Promise<{ channelLinkId: string; messageId: string; conversationId: string }> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'emit-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (emit-inbound) should return 201',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    channelLinkId?: string;\n    messageId?: string;\n    conversationId?: string;\n  }>(response);\n  return {\n    channelLinkId: expectId(body?.channelLinkId, 'emit-inbound response should include channelLinkId'),\n    messageId: expectId(body?.messageId, 'emit-inbound response should include messageId'),\n    conversationId: expectId(\n      body?.conversationId,\n      'emit-inbound response should include conversationId',\n    ),\n  };\n}\n\n/**\n * Best-effort delete of a seeded channel via the owner-scoped DELETE route.\n * Safe to call with a null id in `finally`.\n */\n/**\n * Ingest an inbound chat message through the REAL `ingest_inbound_message`\n * command: the stub adapter normalizes the frame and the hub composes the\n * platform message via `messages.messages.compose`.\n *\n * Unlike {@link seedInboundMessage}, nothing here is short-circuited \u2014 no row is\n * inserted behind the compose path \u2014 so a hub contract the provider cannot\n * satisfy fails the test instead of hiding behind seeded data. That bypass is\n * exactly why CI was green while every real inbound Discord message was rejected\n * (#4975).\n *\n * The sender is identified only by `senderIdentifier` (a Discord snowflake, a\n * Slack member id, \u2026). There is deliberately no way to pass an address.\n */\nexport async function ingestInboundChatMessage(\n  request: APIRequestContext,\n  token: string,\n  input: {\n    channelId: string;\n    senderIdentifier: string;\n    senderDisplayName?: string;\n    body?: string;\n    externalMessageId: string;\n    externalConversationId: string;\n  },\n): Promise<{\n  status: string;\n  messageId: string | null;\n  conversationId: string | null;\n  channelLinkId: string | null;\n  channelType: string | null;\n}> {\n  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {\n    token,\n    data: { action: 'ingest-inbound', ...input },\n  });\n  expect(\n    response.status(),\n    'POST /api/communication_channels/test-seed (ingest-inbound) should return 201 \u2014 ' +\n      'a non-201 here means the hub rejected a sender with no email address',\n  ).toBe(201);\n  const body = await readJsonSafe<{\n    status?: string;\n    messageId?: string | null;\n    conversationId?: string | null;\n    channelLinkId?: string | null;\n    channelType?: string | null;\n  }>(response);\n  return {\n    status: body?.status ?? 'unknown',\n    messageId: body?.messageId ?? null,\n    conversationId: body?.conversationId ?? null,\n    channelLinkId: body?.channelLinkId ?? null,\n    channelType: body?.channelType ?? null,\n  };\n}\n\nexport async function deleteChannelIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  channelId: string | null,\n): Promise<void> {\n  if (!token || !channelId) return;\n  await apiRequest(\n    request,\n    'DELETE',\n    `/api/communication_channels/channels/${encodeURIComponent(channelId)}`,\n    { token },\n  ).catch(() => undefined);\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAgBvC,MAAM,iBAAiB;AAOvB,eAAsB,0BACpB,SACA,OACkB;AAElB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,YAAY;AAAA,EAC9B,CAAC;AACD,SAAO,SAAS,OAAO,MAAM;AAC/B;AAMA,eAAsB,qBACpB,SACA,OACA,QAwBI,CAAC,GACY;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,mBAAmB,GAAG,MAAM;AAAA,EAC9C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAAqC,QAAQ;AAChE,SAAO,SAAS,MAAM,WAAW,mDAAmD;AACtF;AAgBA,eAAsB,mBACpB,SACA,OACA,OAc+E;AAC/E,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,gBAAgB,GAAG,MAAM;AAAA,EAC3C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EACF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAIhB,QAAQ;AACX,SAAO;AAAA,IACL,eAAe,SAAS,MAAM,eAAe,oDAAoD;AAAA,IACjG,WAAW,SAAS,MAAM,WAAW,gDAAgD;AAAA,IACrF,gBAAgB;AAAA,MACd,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF;AACF;AAoBA,eAAsB,yBACpB,SACA,OACA,OAcC;AACD,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,gBAAgB;AAAA,IACjE;AAAA,IACA,MAAM,EAAE,QAAQ,kBAAkB,GAAG,MAAM;AAAA,EAC7C,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB;AAAA,EAEF,EAAE,KAAK,GAAG;AACV,QAAM,OAAO,MAAM,aAMhB,QAAQ;AACX,SAAO;AAAA,IACL,QAAQ,MAAM,UAAU;AAAA,IACxB,WAAW,MAAM,aAAa;AAAA,IAC9B,gBAAgB,MAAM,kBAAkB;AAAA,IACxC,eAAe,MAAM,iBAAiB;AAAA,IACtC,aAAa,MAAM,eAAe;AAAA,EACpC;AACF;AAEA,eAAsB,sBACpB,SACA,OACA,WACe;AACf,MAAI,CAAC,SAAS,CAAC,UAAW;AAC1B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,wCAAwC,mBAAmB,SAAS,CAAC;AAAA,IACrE,EAAE,MAAM;AAAA,EACV,EAAE,MAAM,MAAM,MAAS;AACzB;",
   "names": []
 }

package/dist/modules/audit_logs/api/audit-logs/actions/redo/route.js

@@ -6,6 +6,7 @@ import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { serializeOperationMetadata } from "@open-mercato/shared/lib/commands/operationMetadata";
 import { z } from "zod";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 const logger = createLogger("audit_logs").child({ component: "redo" });
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["audit_logs.redo_self"] }
@@ -121,6 +122,10 @@ async function POST(req) {
       logger.warn("Redo rejected", { err });
       return NextResponse.json(err.body, { status: err.status });
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
     logger.error("Redo failed", { err });
     return NextResponse.json({ error: "Redo failed" }, { status: 400 });
   }

package/dist/modules/audit_logs/api/audit-logs/actions/redo/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/audit_logs/api/audit-logs/actions/redo/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { AwilixContainer } from 'awilix'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('audit_logs').child({ component: 'redo' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.redo_self'] },\n}\n\ntype RedoRequestBody = {\n  logId?: string\n}\n\nconst redoRequestSchema = z.object({\n  logId: z.string().min(1).describe('Identifier of the previously undone action log'),\n})\n\nconst redoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().nullable().describe('Identifier of the new redo log entry, if available'),\n  undoToken: z.string().nullable().describe('New undo token associated with the redone action'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as RedoRequestBody | null\n  const logId = typeof body?.logId === 'string' ? body.logId.trim() : ''\n  if (!logId) return NextResponse.json({ error: 'Invalid log id' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canRedoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.redo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const scopedOrgId = canRedoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  const log = await logs.findById(logId)\n\n  if (!log || log.executionState !== 'undone') {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.actorUserId && log.actorUserId !== auth.sub && !canRedoTenant) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Fail closed on tenant scope: `audit_logs.redo_tenant` only widens scope WITHIN a\n  // tenant, never across tenants, so a tenant-scoped target always requires a caller\n  // bound to that same tenant. A caller whose tenantId is null (tenant-less global\n  // account or unscoped API key) must never redo a tenant-scoped row. Mirrors the\n  // hardened undo route (issue #2685, ported in #2931).\n  if (log.tenantId && log.tenantId !== (auth.tenantId ?? null)) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Tenant-level redoers may redo across organizations within the tenant, so an\n  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.\n  // Every other caller must resolve to the target's own organization \u2014 a null caller\n  // org must not bypass an org-scoped target (issue #2685, ported in #2931).\n  const orgScopeMismatch = canRedoTenant\n    ? Boolean(log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId)\n    : Boolean(log.organizationId && log.organizationId !== scopedOrgId)\n  if (orgScopeMismatch) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canRedoTenant ? (log.actorUserId ?? auth.sub) : auth.sub\n  const latestUndoneOrganizationId = log.organizationId ?? null\n  const latestUndone = await logs.latestUndoneForActor(lookupActorId, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: latestUndoneOrganizationId,\n  })\n  if (!latestUndone || latestUndone.id !== log.id) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    const contextRecord = log.contextJson && typeof log.contextJson === 'object' ? (log.contextJson as Record<string, unknown>) : null\n    const cacheAliasesRaw = Array.isArray(contextRecord?.cacheAliases as unknown[])\n      ? (contextRecord!.cacheAliases as unknown[])\n      : []\n    const cacheAliases = cacheAliasesRaw\n      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)\n      .map((value) => value.trim())\n    const metadataContext: Record<string, unknown> = {\n      historyAction: 'redo',\n      sourceLogId: log.id,\n      sourceCommandId: log.commandId,\n    }\n    if (cacheAliases.length) metadataContext.cacheAliases = cacheAliases\n    const metadata: CommandLogMetadata = {\n      tenantId: log.tenantId,\n      organizationId: log.organizationId,\n      actorUserId: auth.sub,\n      actionLabel: log.actionLabel,\n      resourceKind: log.resourceKind,\n      resourceId: log.resourceId,\n      context: metadataContext,\n    }\n    const resolvedInput = resolveRedoInput(log.commandPayload, log)\n    if (!resolvedInput) {\n      return NextResponse.json({ error: 'Redo data unavailable for this action' }, { status: 400 })\n    }\n    const commandInput = resolvedInput\n    const { logEntry } = await commandBus.execute(log.commandId, {\n      input: commandInput,\n      ctx,\n      metadata,\n      redoLogEntry: log,\n    })\n    await logs.markRedone(log.id)\n    const actionLog = asActionLog(logEntry)\n    const response = NextResponse.json({\n      ok: true,\n      logId: actionLog?.id ?? null,\n      undoToken: actionLog?.undoToken ?? null,\n    })\n    if (actionLog?.undoToken && actionLog.id) {\n      const createdAt = actionLog.createdAt instanceof Date\n        ? actionLog.createdAt.toISOString()\n        : (typeof actionLog.createdAt === 'string' ? actionLog.createdAt : new Date().toISOString())\n      response.headers.set('x-om-operation', serializeOperationMetadata({\n        id: actionLog.id,\n        undoToken: actionLog.undoToken,\n        commandId: actionLog.commandId ?? log.commandId,\n        actionLabel: actionLog.actionLabel ?? log.actionLabel ?? null,\n        resourceKind: typeof actionLog.resourceKind === 'string' ? actionLog.resourceKind : log.resourceKind ?? null,\n        resourceId: typeof actionLog.resourceId === 'string' ? actionLog.resourceId : log.resourceId ?? null,\n        executedAt: createdAt,\n      }))\n    }\n    return response\n  } catch (err) {\n    // Same contract as undo: a domain refusal carries an already-localized body the\n    // operator can act on, so surface it instead of a generic message.\n    if (isCrudHttpError(err)) {\n      logger.warn('Redo rejected', { err })\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Redo failed', { err })\n    return NextResponse.json({ error: 'Redo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nfunction asActionLog(entry: unknown): ActionLog | null {\n  if (!entry || typeof entry !== 'object') return null\n  if (typeof (entry as { id?: unknown }).id !== 'string') return null\n  return entry as ActionLog\n}\n\nfunction resolveRedoInput(payload: unknown, log: ActionLog): unknown | null {\n  if (payload && typeof payload === 'object' && !Array.isArray(payload) && '__redoInput' in payload) {\n    const envelope = payload as { __redoInput?: unknown }\n    return envelope.__redoInput ?? {}\n  }\n  const updateFallback = deriveUpdateInput(log)\n  if (updateFallback) return updateFallback\n  return null\n}\n\nfunction deriveUpdateInput(log: ActionLog): Record<string, unknown> | null {\n  if (!log.commandId.endsWith('.update')) return null\n  if (!log.resourceId) return null\n  const changes = log.changesJson\n  if (!changes || typeof changes !== 'object' || Array.isArray(changes)) return { id: log.resourceId }\n  const payload: Record<string, unknown> = { id: log.resourceId }\n  for (const [key, value] of Object.entries(changes)) {\n    if (value && typeof value === 'object' && !Array.isArray(value) && 'to' in value) {\n      payload[key] = (value as Record<string, unknown>).to\n    } else {\n      payload[key] = value\n    }\n  }\n  return payload\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Redo a previously undone action',\n  description: 'Replays the command associated with a recently undone action, reapplying the change and issuing a fresh undo token.',\n  methods: {\n    POST: {\n      summary: 'Redo by action log id',\n      description:\n        'Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: redoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Redo executed successfully', schema: redoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Log not eligible for redo', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Redo blocked by scope checks', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAG/E,SAAS,uBAAuB;AAGhC,SAAS,kCAAkC;AAG3C,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE9D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,gDAAgD;AACpF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EAC1F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAC9F,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACpE,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,QAAM,MAAM,MAAM,KAAK,SAAS,KAAK;AAErC,MAAI,CAAC,OAAO,IAAI,mBAAmB,UAAU;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,eAAe,IAAI,gBAAgB,KAAK,OAAO,CAAC,eAAe;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAMA,MAAI,IAAI,YAAY,IAAI,cAAc,KAAK,YAAY,OAAO;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,QAAM,mBAAmB,gBACrB,QAAQ,IAAI,kBAAkB,eAAe,IAAI,mBAAmB,WAAW,IAC/E,QAAQ,IAAI,kBAAkB,IAAI,mBAAmB,WAAW;AACpE,MAAI,kBAAkB;AACpB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,gBAAgB,gBAAiB,IAAI,eAAe,KAAK,MAAO,KAAK;AAC3E,QAAM,6BAA6B,IAAI,kBAAkB;AACzD,QAAM,eAAe,MAAM,KAAK,qBAAqB,eAAe;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,gBAAgB,aAAa,OAAO,IAAI,IAAI;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,gBAAgB,IAAI,eAAe,OAAO,IAAI,gBAAgB,WAAY,IAAI,cAA0C;AAC9H,UAAM,kBAAkB,MAAM,QAAQ,eAAe,YAAyB,IACzE,cAAe,eAChB,CAAC;AACL,UAAM,eAAe,gBAClB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC9B,UAAM,kBAA2C;AAAA,MAC/C,eAAe;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,iBAAiB,IAAI;AAAA,IACvB;AACA,QAAI,aAAa,OAAQ,iBAAgB,eAAe;AACxD,UAAMA,YAA+B;AAAA,MACnC,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,aAAa,KAAK;AAAA,MAClB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AACA,UAAM,gBAAgB,iBAAiB,IAAI,gBAAgB,GAAG;AAC9D,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,UAAM,eAAe;AACrB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,IAAI,WAAW;AAAA,MAC3D,OAAO;AAAA,MACP;AAAA,MACA,UAAAA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,WAAW,IAAI,EAAE;AAC5B,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO,WAAW,MAAM;AAAA,MACxB,WAAW,WAAW,aAAa;AAAA,IACrC,CAAC;AACD,QAAI,WAAW,aAAa,UAAU,IAAI;AACxC,YAAM,YAAY,UAAU,qBAAqB,OAC7C,UAAU,UAAU,YAAY,IAC/B,OAAO,UAAU,cAAc,WAAW,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY;AAC5F,eAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,QAChE,IAAI,UAAU;AAAA,QACd,WAAW,UAAU;AAAA,QACrB,WAAW,UAAU,aAAa,IAAI;AAAA,QACtC,aAAa,UAAU,eAAe,IAAI,eAAe;AAAA,QACzD,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe,IAAI,gBAAgB;AAAA,QACxG,YAAY,OAAO,UAAU,eAAe,WAAW,UAAU,aAAa,IAAI,cAAc;AAAA,QAChG,YAAY;AAAA,MACd,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AAGZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,KAAK,iBAAiB,EAAE,IAAI,CAAC;AACpC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,eAAe,EAAE,IAAI,CAAC;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAkC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAQ,MAA2B,OAAO,SAAU,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkB,KAAgC;AAC1E,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,iBAAiB,SAAS;AACjG,UAAM,WAAW;AACjB,WAAO,SAAS,eAAe,CAAC;AAAA,EAClC;AACA,QAAM,iBAAiB,kBAAkB,GAAG;AAC5C,MAAI,eAAgB,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAgD;AACzE,MAAI,CAAC,IAAI,UAAU,SAAS,SAAS,EAAG,QAAO;AAC/C,MAAI,CAAC,IAAI,WAAY,QAAO;AAC5B,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO,EAAE,IAAI,IAAI,WAAW;AACnG,QAAM,UAAmC,EAAE,IAAI,IAAI,WAAW;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,QAAQ,OAAO;AAChF,cAAQ,GAAG,IAAK,MAAkC;AAAA,IACpD,OAAO;AACL,cAAQ,GAAG,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mBAAmB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { AwilixContainer } from 'awilix'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('audit_logs').child({ component: 'redo' })\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.redo_self'] },\n}\n\ntype RedoRequestBody = {\n  logId?: string\n}\n\nconst redoRequestSchema = z.object({\n  logId: z.string().min(1).describe('Identifier of the previously undone action log'),\n})\n\nconst redoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().nullable().describe('Identifier of the new redo log entry, if available'),\n  undoToken: z.string().nullable().describe('New undo token associated with the redone action'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as RedoRequestBody | null\n  const logId = typeof body?.logId === 'string' ? body.logId.trim() : ''\n  if (!logId) return NextResponse.json({ error: 'Invalid log id' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canRedoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.redo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const scopedOrgId = canRedoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  const log = await logs.findById(logId)\n\n  if (!log || log.executionState !== 'undone') {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.actorUserId && log.actorUserId !== auth.sub && !canRedoTenant) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Fail closed on tenant scope: `audit_logs.redo_tenant` only widens scope WITHIN a\n  // tenant, never across tenants, so a tenant-scoped target always requires a caller\n  // bound to that same tenant. A caller whose tenantId is null (tenant-less global\n  // account or unscoped API key) must never redo a tenant-scoped row. Mirrors the\n  // hardened undo route (issue #2685, ported in #2931).\n  if (log.tenantId && log.tenantId !== (auth.tenantId ?? null)) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Tenant-level redoers may redo across organizations within the tenant, so an\n  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.\n  // Every other caller must resolve to the target's own organization \u2014 a null caller\n  // org must not bypass an org-scoped target (issue #2685, ported in #2931).\n  const orgScopeMismatch = canRedoTenant\n    ? Boolean(log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId)\n    : Boolean(log.organizationId && log.organizationId !== scopedOrgId)\n  if (orgScopeMismatch) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canRedoTenant ? (log.actorUserId ?? auth.sub) : auth.sub\n  const latestUndoneOrganizationId = log.organizationId ?? null\n  const latestUndone = await logs.latestUndoneForActor(lookupActorId, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: latestUndoneOrganizationId,\n  })\n  if (!latestUndone || latestUndone.id !== log.id) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    const contextRecord = log.contextJson && typeof log.contextJson === 'object' ? (log.contextJson as Record<string, unknown>) : null\n    const cacheAliasesRaw = Array.isArray(contextRecord?.cacheAliases as unknown[])\n      ? (contextRecord!.cacheAliases as unknown[])\n      : []\n    const cacheAliases = cacheAliasesRaw\n      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)\n      .map((value) => value.trim())\n    const metadataContext: Record<string, unknown> = {\n      historyAction: 'redo',\n      sourceLogId: log.id,\n      sourceCommandId: log.commandId,\n    }\n    if (cacheAliases.length) metadataContext.cacheAliases = cacheAliases\n    const metadata: CommandLogMetadata = {\n      tenantId: log.tenantId,\n      organizationId: log.organizationId,\n      actorUserId: auth.sub,\n      actionLabel: log.actionLabel,\n      resourceKind: log.resourceKind,\n      resourceId: log.resourceId,\n      context: metadataContext,\n    }\n    const resolvedInput = resolveRedoInput(log.commandPayload, log)\n    if (!resolvedInput) {\n      return NextResponse.json({ error: 'Redo data unavailable for this action' }, { status: 400 })\n    }\n    const commandInput = resolvedInput\n    const { logEntry } = await commandBus.execute(log.commandId, {\n      input: commandInput,\n      ctx,\n      metadata,\n      redoLogEntry: log,\n    })\n    await logs.markRedone(log.id)\n    const actionLog = asActionLog(logEntry)\n    const response = NextResponse.json({\n      ok: true,\n      logId: actionLog?.id ?? null,\n      undoToken: actionLog?.undoToken ?? null,\n    })\n    if (actionLog?.undoToken && actionLog.id) {\n      const createdAt = actionLog.createdAt instanceof Date\n        ? actionLog.createdAt.toISOString()\n        : (typeof actionLog.createdAt === 'string' ? actionLog.createdAt : new Date().toISOString())\n      response.headers.set('x-om-operation', serializeOperationMetadata({\n        id: actionLog.id,\n        undoToken: actionLog.undoToken,\n        commandId: actionLog.commandId ?? log.commandId,\n        actionLabel: actionLog.actionLabel ?? log.actionLabel ?? null,\n        resourceKind: typeof actionLog.resourceKind === 'string' ? actionLog.resourceKind : log.resourceKind ?? null,\n        resourceId: typeof actionLog.resourceId === 'string' ? actionLog.resourceId : log.resourceId ?? null,\n        executedAt: createdAt,\n      }))\n    }\n    return response\n  } catch (err) {\n    // Same contract as undo: a domain refusal carries an already-localized body the\n    // operator can act on, so surface it instead of a generic message.\n    if (isCrudHttpError(err)) {\n      logger.warn('Redo rejected', { err })\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Redo failed', { err })\n    return NextResponse.json({ error: 'Redo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nfunction asActionLog(entry: unknown): ActionLog | null {\n  if (!entry || typeof entry !== 'object') return null\n  if (typeof (entry as { id?: unknown }).id !== 'string') return null\n  return entry as ActionLog\n}\n\nfunction resolveRedoInput(payload: unknown, log: ActionLog): unknown | null {\n  if (payload && typeof payload === 'object' && !Array.isArray(payload) && '__redoInput' in payload) {\n    const envelope = payload as { __redoInput?: unknown }\n    return envelope.__redoInput ?? {}\n  }\n  const updateFallback = deriveUpdateInput(log)\n  if (updateFallback) return updateFallback\n  return null\n}\n\nfunction deriveUpdateInput(log: ActionLog): Record<string, unknown> | null {\n  if (!log.commandId.endsWith('.update')) return null\n  if (!log.resourceId) return null\n  const changes = log.changesJson\n  if (!changes || typeof changes !== 'object' || Array.isArray(changes)) return { id: log.resourceId }\n  const payload: Record<string, unknown> = { id: log.resourceId }\n  for (const [key, value] of Object.entries(changes)) {\n    if (value && typeof value === 'object' && !Array.isArray(value) && 'to' in value) {\n      payload[key] = (value as Record<string, unknown>).to\n    } else {\n      payload[key] = value\n    }\n  }\n  return payload\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Redo a previously undone action',\n  description: 'Replays the command associated with a recently undone action, reapplying the change and issuing a fresh undo token.',\n  methods: {\n    POST: {\n      summary: 'Redo by action log id',\n      description:\n        'Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: redoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Redo executed successfully', schema: redoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Log not eligible for redo', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Redo blocked by scope checks', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAG/E,SAAS,uBAAuB;AAGhC,SAAS,kCAAkC;AAG3C,SAAS,SAAS;AAElB,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,YAAY,EAAE,MAAM,EAAE,WAAW,OAAO,CAAC;AAE9D,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,gDAAgD;AACpF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EAC1F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAC9F,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACpE,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,QAAM,MAAM,MAAM,KAAK,SAAS,KAAK;AAErC,MAAI,CAAC,OAAO,IAAI,mBAAmB,UAAU;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,eAAe,IAAI,gBAAgB,KAAK,OAAO,CAAC,eAAe;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAMA,MAAI,IAAI,YAAY,IAAI,cAAc,KAAK,YAAY,OAAO;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,QAAM,mBAAmB,gBACrB,QAAQ,IAAI,kBAAkB,eAAe,IAAI,mBAAmB,WAAW,IAC/E,QAAQ,IAAI,kBAAkB,IAAI,mBAAmB,WAAW;AACpE,MAAI,kBAAkB;AACpB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,gBAAgB,gBAAiB,IAAI,eAAe,KAAK,MAAO,KAAK;AAC3E,QAAM,6BAA6B,IAAI,kBAAkB;AACzD,QAAM,eAAe,MAAM,KAAK,qBAAqB,eAAe;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,gBAAgB,aAAa,OAAO,IAAI,IAAI;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,gBAAgB,IAAI,eAAe,OAAO,IAAI,gBAAgB,WAAY,IAAI,cAA0C;AAC9H,UAAM,kBAAkB,MAAM,QAAQ,eAAe,YAAyB,IACzE,cAAe,eAChB,CAAC;AACL,UAAM,eAAe,gBAClB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC9B,UAAM,kBAA2C;AAAA,MAC/C,eAAe;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,iBAAiB,IAAI;AAAA,IACvB;AACA,QAAI,aAAa,OAAQ,iBAAgB,eAAe;AACxD,UAAMA,YAA+B;AAAA,MACnC,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,aAAa,KAAK;AAAA,MAClB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AACA,UAAM,gBAAgB,iBAAiB,IAAI,gBAAgB,GAAG;AAC9D,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,UAAM,eAAe;AACrB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,IAAI,WAAW;AAAA,MAC3D,OAAO;AAAA,MACP;AAAA,MACA,UAAAA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,WAAW,IAAI,EAAE;AAC5B,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO,WAAW,MAAM;AAAA,MACxB,WAAW,WAAW,aAAa;AAAA,IACrC,CAAC;AACD,QAAI,WAAW,aAAa,UAAU,IAAI;AACxC,YAAM,YAAY,UAAU,qBAAqB,OAC7C,UAAU,UAAU,YAAY,IAC/B,OAAO,UAAU,cAAc,WAAW,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY;AAC5F,eAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,QAChE,IAAI,UAAU;AAAA,QACd,WAAW,UAAU;AAAA,QACrB,WAAW,UAAU,aAAa,IAAI;AAAA,QACtC,aAAa,UAAU,eAAe,IAAI,eAAe;AAAA,QACzD,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe,IAAI,gBAAgB;AAAA,QACxG,YAAY,OAAO,UAAU,eAAe,WAAW,UAAU,aAAa,IAAI,cAAc;AAAA,QAChG,YAAY;AAAA,MACd,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AAGZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,KAAK,iBAAiB,EAAE,IAAI,CAAC;AACpC,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,eAAe,EAAE,IAAI,CAAC;AACnC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAkC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAQ,MAA2B,OAAO,SAAU,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkB,KAAgC;AAC1E,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,iBAAiB,SAAS;AACjG,UAAM,WAAW;AACjB,WAAO,SAAS,eAAe,CAAC;AAAA,EAClC;AACA,QAAM,iBAAiB,kBAAkB,GAAG;AAC5C,MAAI,eAAgB,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAgD;AACzE,MAAI,CAAC,IAAI,UAAU,SAAS,SAAS,EAAG,QAAO;AAC/C,MAAI,CAAC,IAAI,WAAY,QAAO;AAC5B,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO,EAAE,IAAI,IAAI,WAAW;AACnG,QAAM,UAAmC,EAAE,IAAI,IAAI,WAAW;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,QAAQ,OAAO;AAChF,cAAQ,GAAG,IAAK,MAAkC;AAAA,IACpD,OAAO;AACL,cAAQ,GAAG,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mBAAmB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/auth/api/profile/route.js

@@ -9,6 +9,7 @@ import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { buildPasswordSchema } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 const logger = createLogger("auth").child({ component: "profile" });
 const profileResponseSchema = z.object({
   email: z.string().email(),
@@ -187,6 +188,10 @@ async function PUT(req) {
     if (isCrudHttpError(err)) {
       return NextResponse.json(err.body, { status: err.status });
     }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
     logger.error("Profile update failed", { err });
     return NextResponse.json({ error: translate("auth.profile.form.errors.save", "Failed to update profile.") }, { status: 400 });
   }

package/dist/modules/auth/api/profile/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/profile/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/communication_channels/api/post/test-seed/route.js

@@ -47,7 +47,23 @@ const connectChannelSchema = z.object({
    * address, so a test can exercise the hub's non-email identity contract
    * without inventing one (#4975).
    */
-  providerFlavor: z.enum(["email", "chat"]).optional()
+  providerFlavor: z.enum(["email", "chat"]).optional(),
+  /**
+   * TEST-ONLY: rewrite the connected stub channel's `provider_key` to this value.
+   *
+   * Routes that a provider package owns filter on their own `provider_key`, and
+   * a real channel for those providers cannot be connected in CI — the Discord
+   * adapter's `validateCredentials` performs a live API call against a bot token
+   * no test environment has. Without this, a provider-scoped listing has nothing
+   * to list and can only be asserted against an empty result, which is exactly
+   * the assertion that would have stayed green through #5602.
+   *
+   * It relabels a row; it registers nothing. The stub adapter is still the only
+   * adapter present, so the channel remains network-free — but no test should
+   * drive an outbound send through a relabelled channel, because delivery would
+   * then resolve the real provider's adapter.
+   */
+  labelAsProviderKey: z.string().min(1).max(64).regex(/^[a-z0-9_-]+$/).optional()
 });
 const ingestInboundSchema = z.object({
   action: z.literal("ingest-inbound"),
@@ -149,8 +165,30 @@ async function POST(req) {
         { status: 500 }
       );
     }
+    if (body.labelAsProviderKey && body.labelAsProviderKey !== input.providerKey) {
+      const seedEm = container.resolve("em").fork();
+      const connected = await findOneWithDecryption(
+        seedEm,
+        CommunicationChannel,
+        { id: result.channelId, tenantId },
+        void 0,
+        { tenantId, organizationId }
+      );
+      if (!connected) {
+        return NextResponse.json(
+          { error: "[internal] test-seed could not reload the channel it just connected" },
+          { status: 500 }
+        );
+      }
+      connected.providerKey = body.labelAsProviderKey;
+      await seedEm.flush();
+    }
     return NextResponse.json(
-      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },
+      {
+        channelId: result.channelId,
+        externalIdentifier: result.externalIdentifier,
+        providerKey: body.labelAsProviderKey ?? input.providerKey
+      },
       { status: 201 }
     );
   }

package/dist/modules/communication_channels/api/post/test-seed/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/communication_channels/api/post/test-seed/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../../../data/entities'\nimport { ChannelAccessDeniedError, assertCanManageChannel } from '../../../lib/access-control'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../commands/connect-credential-channel'\nimport { emitCommunicationChannelsEvent } from '../../../events'\nimport {\n  TEST_SEED_CHAT_PROVIDER_KEY,\n  TEST_SEED_PROVIDER_KEY,\n  ensureTestSeedAdapterRegistered,\n  isTestChannelSeedingEnabled,\n} from '../../../lib/test-seed'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n  type IngestInboundMessageResult,\n} from '../../../commands/ingest-inbound-message'\n\n/**\n * TEST-ONLY channel seeding endpoint.\n *\n * Gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` \u2014 when the flag is unset (the\n * production default) every request returns 404, so this route is invisible and\n * inert in production. See `lib/test-seed.ts` for the full rationale.\n *\n * Three actions, all scoped to the caller's tenant/org:\n *   - `connect-channel`: connect a network-free stub channel owned by the caller\n *     (delegates to the real connect-credential command so the channel persists\n *     credentials + lands in `status='connected'`). Enables the outbound\n *     compose \u2192 deliver \u2192 `.sent` chain to complete in CI. `providerFlavor: 'chat'`\n *     connects the non-email stub instead, for tests about sender identity.\n *   - `ingest-inbound`: run the REAL `ingest_inbound_message` command over an\n *     adapter-normalized chat frame, so the platform compose path \u2014 and every\n *     validation rule on it \u2014 actually executes. Use this for anything that\n *     claims inbound works.\n *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`\n *     row for threading) and emit `communication_channels.message.received` so the\n *     customers link-channel-message subscriber runs against real Postgres. Enables\n *     the inbound auto-link tests (TC-CRM-EMAIL-002..005). NOTE: this action\n *     deliberately bypasses `messages.messages.compose` \u2014 it can never prove that\n *     the hub accepts a message, only that downstream subscribers fire.\n */\ntype RbacServiceLike = {\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>\n}\n\nexport const metadata = {\n  path: '/communication_channels/test-seed',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\nconst addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() })\nconst addressFieldSchema = z.union([\n  z.string(),\n  addressObjectSchema,\n  z.array(z.union([z.string(), addressObjectSchema])),\n])\n\nconst connectChannelSchema = z.object({\n  action: z.literal('connect-channel'),\n  displayName: z.string().min(1).max(255).optional(),\n  externalIdentifier: z.string().min(1).max(255).optional(),\n  /**\n   * Which stub provider to connect. `email` (default) keeps the historical\n   * email-shaped channel; `chat` connects a channel whose senders have no\n   * address, so a test can exercise the hub's non-email identity contract\n   * without inventing one (#4975).\n   */\n  providerFlavor: z.enum(['email', 'chat']).optional(),\n})\n\n/**\n * Drive the REAL `ingest_inbound_message` command with a chat-shaped frame.\n *\n * `emit-inbound` below deliberately bypasses the platform compose path (it\n * inserts the `messages` row with raw SQL) because it only ever needed a\n * landing zone for the CRM-link subscribers. That bypass is why an inbound test\n * could pass while `composeMessageSchema` rejected every real message (#4975).\n * This action takes the opposite approach: it hands the frame to the adapter and\n * the ingest command and asserts nothing on the way, so whatever the hub's\n * contract really is, the test feels it.\n */\nconst ingestInboundSchema = z.object({\n  action: z.literal('ingest-inbound'),\n  channelId: z.string().uuid(),\n  /** Opaque sender handle \u2014 a Discord snowflake, a Slack member id, etc. */\n  senderIdentifier: z.string().min(1).max(255),\n  senderDisplayName: z.string().max(255).optional(),\n  body: z.string().max(50_000).optional(),\n  externalMessageId: z.string().min(1).max(255),\n  externalConversationId: z.string().min(1).max(255),\n})\n\nconst emitInboundSchema = z.object({\n  action: z.literal('emit-inbound'),\n  /** Channel that owns the inbound message; controls authorUserId + default visibility. */\n  channelId: z.string().uuid(),\n  /** Provider key persisted on the link (defaults to the stub provider). */\n  providerKey: z.string().min(1).max(64).optional(),\n  /** Normalized inbound addresses (stored under channelPayload). */\n  from: addressFieldSchema.optional(),\n  to: addressFieldSchema.optional(),\n  cc: addressFieldSchema.optional(),\n  subject: z.string().max(500).optional(),\n  bodyText: z.string().max(200_000).optional(),\n  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */\n  messageId: z.string().max(500).optional(),\n  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */\n  inReplyTo: z.string().max(500).optional(),\n  references: z.array(z.string().max(500)).max(50).optional(),\n  /**\n   * Open Mercato `messages.message` thread id this inbound message belongs to.\n   * When set, a `messages.message` row is created with this `threadId` so the\n   * hub-thread inheritance join can resolve a Person from a sibling message.\n   */\n  messageThreadId: z.string().uuid().optional(),\n  /**\n   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The\n   * reaction (`/messages/[id]/reactions`) and thread-assign\n   * (`/threads/[id]/assign`) routes resolve the owning channel through this\n   * mapping and return 409/404 without it. Opt-in so the existing CRM-link\n   * seeds (which don't need a mapping) keep their current mapping-free shape.\n   */\n  createThreadMapping: z.boolean().optional(),\n})\n\nconst bodySchema = z.discriminatedUnion('action', [\n  connectChannelSchema,\n  ingestInboundSchema,\n  emitInboundSchema,\n])\n\nexport async function POST(req: Request): Promise<Response> {\n  // Fail-closed: invisible in production. Mirrors an unknown route (404) rather\n  // than 403 so the surface leaks nothing when the flag is off.\n  if (!isTestChannelSeedingEnabled()) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  // Defensive: make sure the stub adapter is registered for this process even if\n  // a worker-only node skipped module di registration.\n  ensureTestSeedAdapterRegistered()\n\n  const tenantId = auth.tenantId as string\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const userId = auth.sub as string\n\n  if (body.action === 'connect-channel') {\n    const stamp = Date.now()\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const isChatFlavor = body.providerFlavor === 'chat'\n    // A chat channel is deliberately connected WITHOUT an email-ish credential\n    // key, so `connect-credential-channel` derives no `externalIdentifier` and\n    // the row is shaped exactly like a real Discord channel (identifier NULL \u2014\n    // the condition #4977 describes). Inventing one here would recreate the\n    // fixture dishonesty that hid #4975.\n    const credentials = isChatFlavor\n      ? { handle: body.externalIdentifier ?? `test-seed-chat-${stamp}` }\n      : {\n          username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n          fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n        }\n    const input: ConnectCredentialChannelInput = {\n      providerKey: isChatFlavor ? TEST_SEED_CHAT_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY,\n      displayName:\n        body.displayName ?? `Test Seed ${isChatFlavor ? 'Chat ' : ''}Channel ${stamp}`,\n      credentials,\n      userId,\n      scope: { tenantId, organizationId },\n    }\n    const { result } = await commandBus.execute<\n      ConnectCredentialChannelInput,\n      ConnectCredentialChannelResult\n    >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    if (result.status !== 'connected') {\n      return NextResponse.json(\n        { error: '[internal] test-seed connect failed', detail: result },\n        { status: 500 },\n      )\n    }\n    return NextResponse.json(\n      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },\n      { status: 201 },\n    )\n  }\n\n  // action === 'ingest-inbound' | 'emit-inbound' \u2014 both address an existing channel.\n  const em = (container.resolve('em') as EntityManager).fork()\n  // Only the `emit-inbound` branch stamps a caller-chosen provider key onto the\n  // rows it seeds; `ingest-inbound` takes the channel's own (see below).\n  const providerKey =\n    body.action === 'emit-inbound' ? body.providerKey ?? TEST_SEED_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY\n\n  // `channelId` is caller-supplied, so confirm it names a channel this tenant/org\n  // actually owns before seeding rows that reference it. Mirrors the ownership\n  // lookup every other per-channel route performs (see channels/[id]/test-send).\n  const ownedChannel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: body.channelId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId, organizationId },\n  )\n  if (!ownedChannel) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n\n  // Tenant/org scope alone does not authorize: `connect_user_channel` is granted\n  // broadly, so a same-tenant caller could otherwise seed against a colleague's\n  // personal mailbox. Enforce the module's owner-only contract \u2014 personal\n  // channels are owner-restricted, shared channels need `manage`.\n  let userFeatures: string[] = []\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const acl = await rbac.loadAcl(userId, { tenantId, organizationId })\n    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []\n  } catch {\n    userFeatures = []\n  }\n  try {\n    assertCanManageChannel(\n      { userId: ownedChannel.userId },\n      userId,\n      userFeatures,\n      'communication_channels.manage',\n    )\n  } catch (err) {\n    if (err instanceof ChannelAccessDeniedError) {\n      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n    }\n    const status = (err as { statusCode?: number }).statusCode ?? 403\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Access denied' },\n      { status },\n    )\n  }\n\n  if (body.action === 'ingest-inbound') {\n    // Everything below this point is the real path: the adapter normalizes the\n    // frame and `ingest_inbound_message` composes the platform message through\n    // `messages.messages.compose`. Nothing is short-circuited, so a hub contract\n    // the provider cannot satisfy surfaces here as a failure instead of hiding\n    // behind seeded rows (#4975).\n    // The channel's own provider key, never a hardcoded one: ingest does not\n    // check that `providerKey` matches the channel it names, so passing a\n    // different one would silently stamp the wrong provider onto the link.\n    const channelProviderKey = ownedChannel.providerKey\n    if (channelProviderKey !== TEST_SEED_CHAT_PROVIDER_KEY) {\n      return NextResponse.json(\n        {\n          error:\n            'ingest-inbound requires a channel connected with providerFlavor: \"chat\"; ' +\n            `channel ${body.channelId} is '${channelProviderKey}'`,\n        },\n        { status: 422 },\n      )\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const adapterRegistry = container.resolve('channelAdapterRegistry') as {\n      get: (key: string) => { normalizeInbound: (raw: unknown) => Promise<unknown> } | undefined\n    }\n    const adapter = adapterRegistry.get(channelProviderKey)\n    if (!adapter) {\n      return NextResponse.json(\n        { error: '[internal] test-seed chat adapter is not registered' },\n        { status: 500 },\n      )\n    }\n\n    const normalized = await adapter.normalizeInbound({\n      raw: {\n        externalMessageId: body.externalMessageId,\n        externalConversationId: body.externalConversationId,\n        senderIdentifier: body.senderIdentifier,\n        senderDisplayName: body.senderDisplayName,\n        body: body.body ?? '',\n      },\n      eventType: 'message',\n      metadata: {},\n    })\n\n    const ingestInput = {\n      channelId: body.channelId,\n      providerKey: channelProviderKey,\n      channelType: ownedChannel.channelType,\n      scope: { tenantId, organizationId },\n      message: normalized,\n    } as IngestInboundMessageInput\n\n    const { result } = await commandBus.execute<\n      IngestInboundMessageInput,\n      IngestInboundMessageResult\n    >(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n      input: ingestInput,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n\n    return NextResponse.json(\n      {\n        status: result.status,\n        messageId: result.messageId ?? null,\n        conversationId: result.externalConversationId ?? null,\n        channelLinkId: result.channelLinkId ?? null,\n        channelType: ownedChannel.channelType,\n      },\n      { status: 201 },\n    )\n  }\n\n  // A MessageChannelLink requires a non-null external_conversation_id (FK) and\n  // message_id. Create a synthetic conversation + (optionally threaded) message\n  // so the link is shaped like a real inbound row the subscriber can consume.\n  const conversation = em.create(ExternalConversation, {\n    channelId: body.channelId,\n    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,\n    subject: body.subject ?? null,\n    tenantId,\n    organizationId,\n    lastMessageAt: new Date(),\n  })\n  em.persist(conversation)\n  await em.flush()\n\n  // Insert the platform `messages.message` row via raw SQL rather than importing\n  // the messages module's entity class (cross-module ORM coupling rule). Only\n  // `thread_id` matters for the hub-thread inheritance join (TC-CRM-EMAIL-005);\n  // the rest satisfy NOT NULL constraints.\n  const messageRows = (await em.getConnection().execute(\n    `INSERT INTO messages\n       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,\n        is_draft, sent_at, visibility, source_entity_type, source_entity_id,\n        tenant_id, organization_id, created_at, updated_at)\n     VALUES\n       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',\n        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,\n        ?, ?, now(), now())\n     RETURNING id`,\n    [\n      `channel.${providerKey}`,\n      body.messageThreadId ?? null,\n      userId,\n      body.subject ?? '(no subject)',\n      body.bodyText ?? '',\n      body.channelId,\n      tenantId,\n      organizationId,\n    ],\n  )) as Array<{ id: string }>\n  const messageId = messageRows[0]?.id\n  if (!messageId) {\n    return NextResponse.json({ error: '[internal] failed to seed message row' }, { status: 500 })\n  }\n\n  const link = em.create(MessageChannelLink, {\n    messageId,\n    externalConversationId: conversation.id,\n    providerKey,\n    channelType: 'email',\n    direction: 'inbound',\n    deliveryStatus: 'delivered',\n    channelPayload: {\n      ...(body.from !== undefined ? { from: body.from } : {}),\n      ...(body.to !== undefined ? { to: body.to } : {}),\n      ...(body.cc !== undefined ? { cc: body.cc } : {}),\n      ...(body.subject !== undefined ? { subject: body.subject } : {}),\n      ...(body.bodyText !== undefined ? { text: body.bodyText } : {}),\n      ...(body.inReplyTo !== undefined ? { inReplyTo: body.inReplyTo } : {}),\n      ...(body.references !== undefined ? { references: body.references } : {}),\n    },\n    channelContentType: 'text/plain',\n    channelMetadata: {\n      ...(body.messageId !== undefined ? { messageId: body.messageId } : {}),\n    },\n    tenantId,\n    organizationId,\n  })\n  em.persist(link)\n  await em.flush()\n\n  // Optionally mirror `ingest-inbound-message`: a real inbound message always\n  // lands a ChannelThreadMapping that the reaction + thread-assign routes use to\n  // resolve the owning channel. Seeded inbound messages skip it by default; opt\n  // in for tests that exercise those routes. Keyed by `messageThreadId ?? messageId`\n  // to match how those commands resolve the mapping (`message.threadId ?? message.id`).\n  if (body.createThreadMapping) {\n    const mapping = em.create(ChannelThreadMapping, {\n      externalConversationId: conversation.id,\n      messageThreadId: body.messageThreadId ?? messageId,\n      channelId: body.channelId,\n      providerKey,\n      externalThreadRef: conversation.externalConversationId,\n      tenantId,\n      organizationId,\n    })\n    em.persist(mapping)\n    await em.flush()\n  }\n\n  // Emit the hub event through the real event bus so the persistent customers\n  // link-channel-message-received subscriber is enqueued to the `events` queue.\n  await emitCommunicationChannelsEvent(\n    'communication_channels.message.received',\n    {\n      channelLinkId: link.id,\n      channelId: body.channelId,\n      providerKey,\n      direction: 'inbound',\n      tenantId,\n      organizationId,\n    },\n    { persistent: true },\n  )\n\n  return NextResponse.json(\n    { channelLinkId: link.id, messageId, conversationId: conversation.id },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary:\n        'Test-only: seed a connected channel, ingest a real inbound message, or emit a seeded inbound link (env-gated)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel seeded / inbound message emitted' },\n        { status: 401, description: 'Unauthorized' },\n        {\n          status: 404,\n          description:\n            'Test channel seeding disabled (production default), or the requested channel does not belong to the caller',\n        },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Seed failed' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B,8BAA8B;AACjE;AAAA,EACE;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAiCA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzF,MAAM,qBAAqB,EAAE,MAAM;AAAA,EACjC,EAAE,OAAO;AAAA,EACT;AAAA,EACA,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD,gBAAgB,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AACrD,CAAC;AAaD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EACtC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC5C,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,QAAQ,EAAE,QAAQ,cAAc;AAAA;AAAA,EAEhC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,MAAM,mBAAmB,SAAS;AAAA,EAClC,IAAI,mBAAmB,SAAS;AAAA,EAChC,IAAI,mBAAmB,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,aAAa,EAAE,mBAAmB,UAAU;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,eAAsB,KAAK,KAAiC;AAG1D,MAAI,CAAC,4BAA4B,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAG/C,kCAAgC;AAEhC,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,SAAS,KAAK;AAEpB,MAAI,KAAK,WAAW,mBAAmB;AACrC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,eAAe,KAAK,mBAAmB;AAM7C,UAAM,cAAc,eAChB,EAAE,QAAQ,KAAK,sBAAsB,kBAAkB,KAAK,GAAG,IAC/D;AAAA,MACE,UAAU,KAAK,sBAAsB,aAAa,KAAK;AAAA,MACvD,aAAa,KAAK,sBAAsB,aAAa,KAAK;AAAA,IAC5D;AACJ,UAAM,QAAuC;AAAA,MAC3C,aAAa,eAAe,8BAA8B;AAAA,MAC1D,aACE,KAAK,eAAe,aAAa,eAAe,UAAU,EAAE,WAAW,KAAK;AAAA,MAC9E;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,uCAAuC,QAAQ,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,WAAW,OAAO,WAAW,oBAAoB,OAAO,mBAAmB;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG3D,QAAM,cACJ,KAAK,WAAW,iBAAiB,KAAK,eAAe,yBAAyB;AAKhF,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAMA,MAAI,eAAyB,CAAC;AAC9B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,EAAE,UAAU,eAAe,CAAC;AACnE,mBAAe,KAAK,eAAe,CAAC,GAAG,IAAI,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,EAC5F,QAAQ;AACN,mBAAe,CAAC;AAAA,EAClB;AACA,MAAI;AACF;AAAA,MACE,EAAE,QAAQ,aAAa,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM,SAAU,IAAgC,cAAc;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,gBAAgB;AAAA,MAC9D,EAAE,OAAO;AAAA,IACX;AAAA,EACF;AAEA,MAAI,KAAK,WAAW,kBAAkB;AASpC,UAAM,qBAAqB,aAAa;AACxC,QAAI,uBAAuB,6BAA6B;AACtD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OACE,oFACW,KAAK,SAAS,QAAQ,kBAAkB;AAAA,QACvD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,kBAAkB,UAAU,QAAQ,wBAAwB;AAGlE,UAAM,UAAU,gBAAgB,IAAI,kBAAkB;AACtD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,sDAAsD;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,QAAQ,iBAAiB;AAAA,MAChD,KAAK;AAAA,QACH,mBAAmB,KAAK;AAAA,QACxB,wBAAwB,KAAK;AAAA,QAC7B,kBAAkB,KAAK;AAAA,QACvB,mBAAmB,KAAK;AAAA,QACxB,MAAM,KAAK,QAAQ;AAAA,MACrB;AAAA,MACA,WAAW;AAAA,MACX,UAAU,CAAC;AAAA,IACb,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa;AAAA,MACb,aAAa,aAAa;AAAA,MAC1B,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,SAAS;AAAA,IACX;AAEA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,kDAAkD;AAAA,MAClD,OAAO;AAAA,MACP,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,QAAQ,OAAO;AAAA,QACf,WAAW,OAAO,aAAa;AAAA,QAC/B,gBAAgB,OAAO,0BAA0B;AAAA,QACjD,eAAe,OAAO,iBAAiB;AAAA,QACvC,aAAa,aAAa;AAAA,MAC5B;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,eAAe,GAAG,OAAO,sBAAsB;AAAA,IACnD,WAAW,KAAK;AAAA,IAChB,wBAAwB,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IAC5F,SAAS,KAAK,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA,eAAe,oBAAI,KAAK;AAAA,EAC1B,CAAC;AACD,KAAG,QAAQ,YAAY;AACvB,QAAM,GAAG,MAAM;AAMf,QAAM,cAAe,MAAM,GAAG,cAAc,EAAE;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA;AAAA,MACE,WAAW,WAAW;AAAA,MACtB,KAAK,mBAAmB;AAAA,MACxB;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,KAAK,YAAY;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,YAAY,CAAC,GAAG;AAClC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,OAAO,GAAG,OAAO,oBAAoB;AAAA,IACzC;AAAA,IACA,wBAAwB,aAAa;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,MACd,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,aAAa,SAAY,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzE;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAOf,MAAI,KAAK,qBAAqB;AAC5B,UAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,MAC9C,wBAAwB,aAAa;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,MACzC,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,mBAAmB,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,OAAO;AAClB,UAAM,GAAG,MAAM;AAAA,EACjB;AAIA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,aAAa;AAAA,IAClB,EAAE,eAAe,KAAK,IAAI,WAAW,gBAAgB,aAAa,GAAG;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SACE;AAAA,MACF,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,QACJ;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../../../data/entities'\nimport { ChannelAccessDeniedError, assertCanManageChannel } from '../../../lib/access-control'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../commands/connect-credential-channel'\nimport { emitCommunicationChannelsEvent } from '../../../events'\nimport {\n  TEST_SEED_CHAT_PROVIDER_KEY,\n  TEST_SEED_PROVIDER_KEY,\n  ensureTestSeedAdapterRegistered,\n  isTestChannelSeedingEnabled,\n} from '../../../lib/test-seed'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n  type IngestInboundMessageResult,\n} from '../../../commands/ingest-inbound-message'\n\n/**\n * TEST-ONLY channel seeding endpoint.\n *\n * Gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` \u2014 when the flag is unset (the\n * production default) every request returns 404, so this route is invisible and\n * inert in production. See `lib/test-seed.ts` for the full rationale.\n *\n * Three actions, all scoped to the caller's tenant/org:\n *   - `connect-channel`: connect a network-free stub channel owned by the caller\n *     (delegates to the real connect-credential command so the channel persists\n *     credentials + lands in `status='connected'`). Enables the outbound\n *     compose \u2192 deliver \u2192 `.sent` chain to complete in CI. `providerFlavor: 'chat'`\n *     connects the non-email stub instead, for tests about sender identity, and\n *     `labelAsProviderKey` relabels the connected row so a provider-scoped\n *     listing has something to list without a live credential probe.\n *   - `ingest-inbound`: run the REAL `ingest_inbound_message` command over an\n *     adapter-normalized chat frame, so the platform compose path \u2014 and every\n *     validation rule on it \u2014 actually executes. Use this for anything that\n *     claims inbound works.\n *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`\n *     row for threading) and emit `communication_channels.message.received` so the\n *     customers link-channel-message subscriber runs against real Postgres. Enables\n *     the inbound auto-link tests (TC-CRM-EMAIL-002..005). NOTE: this action\n *     deliberately bypasses `messages.messages.compose` \u2014 it can never prove that\n *     the hub accepts a message, only that downstream subscribers fire.\n */\ntype RbacServiceLike = {\n  loadAcl: (\n    userId: string,\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>\n}\n\nexport const metadata = {\n  path: '/communication_channels/test-seed',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\nconst addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() })\nconst addressFieldSchema = z.union([\n  z.string(),\n  addressObjectSchema,\n  z.array(z.union([z.string(), addressObjectSchema])),\n])\n\nconst connectChannelSchema = z.object({\n  action: z.literal('connect-channel'),\n  displayName: z.string().min(1).max(255).optional(),\n  externalIdentifier: z.string().min(1).max(255).optional(),\n  /**\n   * Which stub provider to connect. `email` (default) keeps the historical\n   * email-shaped channel; `chat` connects a channel whose senders have no\n   * address, so a test can exercise the hub's non-email identity contract\n   * without inventing one (#4975).\n   */\n  providerFlavor: z.enum(['email', 'chat']).optional(),\n  /**\n   * TEST-ONLY: rewrite the connected stub channel's `provider_key` to this value.\n   *\n   * Routes that a provider package owns filter on their own `provider_key`, and\n   * a real channel for those providers cannot be connected in CI \u2014 the Discord\n   * adapter's `validateCredentials` performs a live API call against a bot token\n   * no test environment has. Without this, a provider-scoped listing has nothing\n   * to list and can only be asserted against an empty result, which is exactly\n   * the assertion that would have stayed green through #5602.\n   *\n   * It relabels a row; it registers nothing. The stub adapter is still the only\n   * adapter present, so the channel remains network-free \u2014 but no test should\n   * drive an outbound send through a relabelled channel, because delivery would\n   * then resolve the real provider's adapter.\n   */\n  labelAsProviderKey: z\n    .string()\n    .min(1)\n    .max(64)\n    .regex(/^[a-z0-9_-]+$/)\n    .optional(),\n})\n\n/**\n * Drive the REAL `ingest_inbound_message` command with a chat-shaped frame.\n *\n * `emit-inbound` below deliberately bypasses the platform compose path (it\n * inserts the `messages` row with raw SQL) because it only ever needed a\n * landing zone for the CRM-link subscribers. That bypass is why an inbound test\n * could pass while `composeMessageSchema` rejected every real message (#4975).\n * This action takes the opposite approach: it hands the frame to the adapter and\n * the ingest command and asserts nothing on the way, so whatever the hub's\n * contract really is, the test feels it.\n */\nconst ingestInboundSchema = z.object({\n  action: z.literal('ingest-inbound'),\n  channelId: z.string().uuid(),\n  /** Opaque sender handle \u2014 a Discord snowflake, a Slack member id, etc. */\n  senderIdentifier: z.string().min(1).max(255),\n  senderDisplayName: z.string().max(255).optional(),\n  body: z.string().max(50_000).optional(),\n  externalMessageId: z.string().min(1).max(255),\n  externalConversationId: z.string().min(1).max(255),\n})\n\nconst emitInboundSchema = z.object({\n  action: z.literal('emit-inbound'),\n  /** Channel that owns the inbound message; controls authorUserId + default visibility. */\n  channelId: z.string().uuid(),\n  /** Provider key persisted on the link (defaults to the stub provider). */\n  providerKey: z.string().min(1).max(64).optional(),\n  /** Normalized inbound addresses (stored under channelPayload). */\n  from: addressFieldSchema.optional(),\n  to: addressFieldSchema.optional(),\n  cc: addressFieldSchema.optional(),\n  subject: z.string().max(500).optional(),\n  bodyText: z.string().max(200_000).optional(),\n  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */\n  messageId: z.string().max(500).optional(),\n  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */\n  inReplyTo: z.string().max(500).optional(),\n  references: z.array(z.string().max(500)).max(50).optional(),\n  /**\n   * Open Mercato `messages.message` thread id this inbound message belongs to.\n   * When set, a `messages.message` row is created with this `threadId` so the\n   * hub-thread inheritance join can resolve a Person from a sibling message.\n   */\n  messageThreadId: z.string().uuid().optional(),\n  /**\n   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The\n   * reaction (`/messages/[id]/reactions`) and thread-assign\n   * (`/threads/[id]/assign`) routes resolve the owning channel through this\n   * mapping and return 409/404 without it. Opt-in so the existing CRM-link\n   * seeds (which don't need a mapping) keep their current mapping-free shape.\n   */\n  createThreadMapping: z.boolean().optional(),\n})\n\nconst bodySchema = z.discriminatedUnion('action', [\n  connectChannelSchema,\n  ingestInboundSchema,\n  emitInboundSchema,\n])\n\nexport async function POST(req: Request): Promise<Response> {\n  // Fail-closed: invisible in production. Mirrors an unknown route (404) rather\n  // than 403 so the surface leaks nothing when the flag is off.\n  if (!isTestChannelSeedingEnabled()) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  // Defensive: make sure the stub adapter is registered for this process even if\n  // a worker-only node skipped module di registration.\n  ensureTestSeedAdapterRegistered()\n\n  const tenantId = auth.tenantId as string\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const userId = auth.sub as string\n\n  if (body.action === 'connect-channel') {\n    const stamp = Date.now()\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const isChatFlavor = body.providerFlavor === 'chat'\n    // A chat channel is deliberately connected WITHOUT an email-ish credential\n    // key, so `connect-credential-channel` derives no `externalIdentifier` and\n    // the row is shaped exactly like a real Discord channel (identifier NULL \u2014\n    // the condition #4977 describes). Inventing one here would recreate the\n    // fixture dishonesty that hid #4975.\n    const credentials = isChatFlavor\n      ? { handle: body.externalIdentifier ?? `test-seed-chat-${stamp}` }\n      : {\n          username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n          fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n        }\n    const input: ConnectCredentialChannelInput = {\n      providerKey: isChatFlavor ? TEST_SEED_CHAT_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY,\n      displayName:\n        body.displayName ?? `Test Seed ${isChatFlavor ? 'Chat ' : ''}Channel ${stamp}`,\n      credentials,\n      userId,\n      scope: { tenantId, organizationId },\n    }\n    const { result } = await commandBus.execute<\n      ConnectCredentialChannelInput,\n      ConnectCredentialChannelResult\n    >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    if (result.status !== 'connected') {\n      return NextResponse.json(\n        { error: '[internal] test-seed connect failed', detail: result },\n        { status: 500 },\n      )\n    }\n    if (body.labelAsProviderKey && body.labelAsProviderKey !== input.providerKey) {\n      const seedEm = (container.resolve('em') as EntityManager).fork()\n      const connected = await findOneWithDecryption(\n        seedEm,\n        CommunicationChannel,\n        { id: result.channelId, tenantId },\n        undefined,\n        { tenantId, organizationId },\n      )\n      if (!connected) {\n        return NextResponse.json(\n          { error: '[internal] test-seed could not reload the channel it just connected' },\n          { status: 500 },\n        )\n      }\n      connected.providerKey = body.labelAsProviderKey\n      await seedEm.flush()\n    }\n    return NextResponse.json(\n      {\n        channelId: result.channelId,\n        externalIdentifier: result.externalIdentifier,\n        providerKey: body.labelAsProviderKey ?? input.providerKey,\n      },\n      { status: 201 },\n    )\n  }\n\n  // action === 'ingest-inbound' | 'emit-inbound' \u2014 both address an existing channel.\n  const em = (container.resolve('em') as EntityManager).fork()\n  // Only the `emit-inbound` branch stamps a caller-chosen provider key onto the\n  // rows it seeds; `ingest-inbound` takes the channel's own (see below).\n  const providerKey =\n    body.action === 'emit-inbound' ? body.providerKey ?? TEST_SEED_PROVIDER_KEY : TEST_SEED_PROVIDER_KEY\n\n  // `channelId` is caller-supplied, so confirm it names a channel this tenant/org\n  // actually owns before seeding rows that reference it. Mirrors the ownership\n  // lookup every other per-channel route performs (see channels/[id]/test-send).\n  const ownedChannel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: body.channelId,\n      tenantId,\n      organizationId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId, organizationId },\n  )\n  if (!ownedChannel) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n\n  // Tenant/org scope alone does not authorize: `connect_user_channel` is granted\n  // broadly, so a same-tenant caller could otherwise seed against a colleague's\n  // personal mailbox. Enforce the module's owner-only contract \u2014 personal\n  // channels are owner-restricted, shared channels need `manage`.\n  let userFeatures: string[] = []\n  try {\n    const rbac = container.resolve('rbacService') as RbacServiceLike\n    const acl = await rbac.loadAcl(userId, { tenantId, organizationId })\n    userFeatures = acl?.isSuperAdmin ? ['*'] : Array.isArray(acl?.features) ? acl.features : []\n  } catch {\n    userFeatures = []\n  }\n  try {\n    assertCanManageChannel(\n      { userId: ownedChannel.userId },\n      userId,\n      userFeatures,\n      'communication_channels.manage',\n    )\n  } catch (err) {\n    if (err instanceof ChannelAccessDeniedError) {\n      return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n    }\n    const status = (err as { statusCode?: number }).statusCode ?? 403\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Access denied' },\n      { status },\n    )\n  }\n\n  if (body.action === 'ingest-inbound') {\n    // Everything below this point is the real path: the adapter normalizes the\n    // frame and `ingest_inbound_message` composes the platform message through\n    // `messages.messages.compose`. Nothing is short-circuited, so a hub contract\n    // the provider cannot satisfy surfaces here as a failure instead of hiding\n    // behind seeded rows (#4975).\n    // The channel's own provider key, never a hardcoded one: ingest does not\n    // check that `providerKey` matches the channel it names, so passing a\n    // different one would silently stamp the wrong provider onto the link.\n    const channelProviderKey = ownedChannel.providerKey\n    if (channelProviderKey !== TEST_SEED_CHAT_PROVIDER_KEY) {\n      return NextResponse.json(\n        {\n          error:\n            'ingest-inbound requires a channel connected with providerFlavor: \"chat\"; ' +\n            `channel ${body.channelId} is '${channelProviderKey}'`,\n        },\n        { status: 422 },\n      )\n    }\n\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const adapterRegistry = container.resolve('channelAdapterRegistry') as {\n      get: (key: string) => { normalizeInbound: (raw: unknown) => Promise<unknown> } | undefined\n    }\n    const adapter = adapterRegistry.get(channelProviderKey)\n    if (!adapter) {\n      return NextResponse.json(\n        { error: '[internal] test-seed chat adapter is not registered' },\n        { status: 500 },\n      )\n    }\n\n    const normalized = await adapter.normalizeInbound({\n      raw: {\n        externalMessageId: body.externalMessageId,\n        externalConversationId: body.externalConversationId,\n        senderIdentifier: body.senderIdentifier,\n        senderDisplayName: body.senderDisplayName,\n        body: body.body ?? '',\n      },\n      eventType: 'message',\n      metadata: {},\n    })\n\n    const ingestInput = {\n      channelId: body.channelId,\n      providerKey: channelProviderKey,\n      channelType: ownedChannel.channelType,\n      scope: { tenantId, organizationId },\n      message: normalized,\n    } as IngestInboundMessageInput\n\n    const { result } = await commandBus.execute<\n      IngestInboundMessageInput,\n      IngestInboundMessageResult\n    >(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n      input: ingestInput,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n\n    return NextResponse.json(\n      {\n        status: result.status,\n        messageId: result.messageId ?? null,\n        conversationId: result.externalConversationId ?? null,\n        channelLinkId: result.channelLinkId ?? null,\n        channelType: ownedChannel.channelType,\n      },\n      { status: 201 },\n    )\n  }\n\n  // A MessageChannelLink requires a non-null external_conversation_id (FK) and\n  // message_id. Create a synthetic conversation + (optionally threaded) message\n  // so the link is shaped like a real inbound row the subscriber can consume.\n  const conversation = em.create(ExternalConversation, {\n    channelId: body.channelId,\n    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,\n    subject: body.subject ?? null,\n    tenantId,\n    organizationId,\n    lastMessageAt: new Date(),\n  })\n  em.persist(conversation)\n  await em.flush()\n\n  // Insert the platform `messages.message` row via raw SQL rather than importing\n  // the messages module's entity class (cross-module ORM coupling rule). Only\n  // `thread_id` matters for the hub-thread inheritance join (TC-CRM-EMAIL-005);\n  // the rest satisfy NOT NULL constraints.\n  const messageRows = (await em.getConnection().execute(\n    `INSERT INTO messages\n       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,\n        is_draft, sent_at, visibility, source_entity_type, source_entity_id,\n        tenant_id, organization_id, created_at, updated_at)\n     VALUES\n       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',\n        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,\n        ?, ?, now(), now())\n     RETURNING id`,\n    [\n      `channel.${providerKey}`,\n      body.messageThreadId ?? null,\n      userId,\n      body.subject ?? '(no subject)',\n      body.bodyText ?? '',\n      body.channelId,\n      tenantId,\n      organizationId,\n    ],\n  )) as Array<{ id: string }>\n  const messageId = messageRows[0]?.id\n  if (!messageId) {\n    return NextResponse.json({ error: '[internal] failed to seed message row' }, { status: 500 })\n  }\n\n  const link = em.create(MessageChannelLink, {\n    messageId,\n    externalConversationId: conversation.id,\n    providerKey,\n    channelType: 'email',\n    direction: 'inbound',\n    deliveryStatus: 'delivered',\n    channelPayload: {\n      ...(body.from !== undefined ? { from: body.from } : {}),\n      ...(body.to !== undefined ? { to: body.to } : {}),\n      ...(body.cc !== undefined ? { cc: body.cc } : {}),\n      ...(body.subject !== undefined ? { subject: body.subject } : {}),\n      ...(body.bodyText !== undefined ? { text: body.bodyText } : {}),\n      ...(body.inReplyTo !== undefined ? { inReplyTo: body.inReplyTo } : {}),\n      ...(body.references !== undefined ? { references: body.references } : {}),\n    },\n    channelContentType: 'text/plain',\n    channelMetadata: {\n      ...(body.messageId !== undefined ? { messageId: body.messageId } : {}),\n    },\n    tenantId,\n    organizationId,\n  })\n  em.persist(link)\n  await em.flush()\n\n  // Optionally mirror `ingest-inbound-message`: a real inbound message always\n  // lands a ChannelThreadMapping that the reaction + thread-assign routes use to\n  // resolve the owning channel. Seeded inbound messages skip it by default; opt\n  // in for tests that exercise those routes. Keyed by `messageThreadId ?? messageId`\n  // to match how those commands resolve the mapping (`message.threadId ?? message.id`).\n  if (body.createThreadMapping) {\n    const mapping = em.create(ChannelThreadMapping, {\n      externalConversationId: conversation.id,\n      messageThreadId: body.messageThreadId ?? messageId,\n      channelId: body.channelId,\n      providerKey,\n      externalThreadRef: conversation.externalConversationId,\n      tenantId,\n      organizationId,\n    })\n    em.persist(mapping)\n    await em.flush()\n  }\n\n  // Emit the hub event through the real event bus so the persistent customers\n  // link-channel-message-received subscriber is enqueued to the `events` queue.\n  await emitCommunicationChannelsEvent(\n    'communication_channels.message.received',\n    {\n      channelLinkId: link.id,\n      channelId: body.channelId,\n      providerKey,\n      direction: 'inbound',\n      tenantId,\n      organizationId,\n    },\n    { persistent: true },\n  )\n\n  return NextResponse.json(\n    { channelLinkId: link.id, messageId, conversationId: conversation.id },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary:\n        'Test-only: seed a connected channel, ingest a real inbound message, or emit a seeded inbound link (env-gated)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel seeded / inbound message emitted' },\n        { status: 401, description: 'Unauthorized' },\n        {\n          status: 404,\n          description:\n            'Test channel seeding disabled (production default), or the requested channel does not belong to the caller',\n        },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Seed failed' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0BAA0B,8BAA8B;AACjE;AAAA,EACE;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAmCA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzF,MAAM,qBAAqB,EAAE,MAAM;AAAA,EACjC,EAAE,OAAO;AAAA,EACT;AAAA,EACA,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD,gBAAgB,EAAE,KAAK,CAAC,SAAS,MAAM,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAgBnD,oBAAoB,EACjB,OAAO,EACP,IAAI,CAAC,EACL,IAAI,EAAE,EACN,MAAM,eAAe,EACrB,SAAS;AACd,CAAC;AAaD,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,QAAQ,EAAE,QAAQ,gBAAgB;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,kBAAkB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,mBAAmB,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAChD,MAAM,EAAE,OAAO,EAAE,IAAI,GAAM,EAAE,SAAS;AAAA,EACtC,mBAAmB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC5C,wBAAwB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACnD,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,QAAQ,EAAE,QAAQ,cAAc;AAAA;AAAA,EAEhC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,MAAM,mBAAmB,SAAS;AAAA,EAClC,IAAI,mBAAmB,SAAS;AAAA,EAChC,IAAI,mBAAmB,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,aAAa,EAAE,mBAAmB,UAAU;AAAA,EAChD;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,eAAsB,KAAK,KAAiC;AAG1D,MAAI,CAAC,4BAA4B,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAG/C,kCAAgC;AAEhC,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,SAAS,KAAK;AAEpB,MAAI,KAAK,WAAW,mBAAmB;AACrC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,eAAe,KAAK,mBAAmB;AAM7C,UAAM,cAAc,eAChB,EAAE,QAAQ,KAAK,sBAAsB,kBAAkB,KAAK,GAAG,IAC/D;AAAA,MACE,UAAU,KAAK,sBAAsB,aAAa,KAAK;AAAA,MACvD,aAAa,KAAK,sBAAsB,aAAa,KAAK;AAAA,IAC5D;AACJ,UAAM,QAAuC;AAAA,MAC3C,aAAa,eAAe,8BAA8B;AAAA,MAC1D,aACE,KAAK,eAAe,aAAa,eAAe,UAAU,EAAE,WAAW,KAAK;AAAA,MAC9E;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,uCAAuC,QAAQ,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,KAAK,sBAAsB,KAAK,uBAAuB,MAAM,aAAa;AAC5E,YAAM,SAAU,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,YAAM,YAAY,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,OAAO,WAAW,SAAS;AAAA,QACjC;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,WAAW;AACd,eAAO,aAAa;AAAA,UAClB,EAAE,OAAO,sEAAsE;AAAA,UAC/E,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,gBAAU,cAAc,KAAK;AAC7B,YAAM,OAAO,MAAM;AAAA,IACrB;AACA,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,WAAW,OAAO;AAAA,QAClB,oBAAoB,OAAO;AAAA,QAC3B,aAAa,KAAK,sBAAsB,MAAM;AAAA,MAChD;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAG3D,QAAM,cACJ,KAAK,WAAW,iBAAiB,KAAK,eAAe,yBAAyB;AAKhF,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT;AAAA,MACA;AAAA,MACA,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAMA,MAAI,eAAyB,CAAC;AAC9B,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,EAAE,UAAU,eAAe,CAAC;AACnE,mBAAe,KAAK,eAAe,CAAC,GAAG,IAAI,MAAM,QAAQ,KAAK,QAAQ,IAAI,IAAI,WAAW,CAAC;AAAA,EAC5F,QAAQ;AACN,mBAAe,CAAC;AAAA,EAClB;AACA,MAAI;AACF;AAAA,MACE,EAAE,QAAQ,aAAa,OAAO;AAAA,MAC9B;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,QAAI,eAAe,0BAA0B;AAC3C,aAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1E;AACA,UAAM,SAAU,IAAgC,cAAc;AAC9D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,gBAAgB;AAAA,MAC9D,EAAE,OAAO;AAAA,IACX;AAAA,EACF;AAEA,MAAI,KAAK,WAAW,kBAAkB;AASpC,UAAM,qBAAqB,aAAa;AACxC,QAAI,uBAAuB,6BAA6B;AACtD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OACE,oFACW,KAAK,SAAS,QAAQ,kBAAkB;AAAA,QACvD;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,kBAAkB,UAAU,QAAQ,wBAAwB;AAGlE,UAAM,UAAU,gBAAgB,IAAI,kBAAkB;AACtD,QAAI,CAAC,SAAS;AACZ,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,sDAAsD;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,aAAa,MAAM,QAAQ,iBAAiB;AAAA,MAChD,KAAK;AAAA,QACH,mBAAmB,KAAK;AAAA,QACxB,wBAAwB,KAAK;AAAA,QAC7B,kBAAkB,KAAK;AAAA,QACvB,mBAAmB,KAAK;AAAA,QACxB,MAAM,KAAK,QAAQ;AAAA,MACrB;AAAA,MACA,WAAW;AAAA,MACX,UAAU,CAAC;AAAA,IACb,CAAC;AAED,UAAM,cAAc;AAAA,MAClB,WAAW,KAAK;AAAA,MAChB,aAAa;AAAA,MACb,aAAa,aAAa;AAAA,MAC1B,OAAO,EAAE,UAAU,eAAe;AAAA,MAClC,SAAS;AAAA,IACX;AAEA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,kDAAkD;AAAA,MAClD,OAAO;AAAA,MACP,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AAED,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,QAAQ,OAAO;AAAA,QACf,WAAW,OAAO,aAAa;AAAA,QAC/B,gBAAgB,OAAO,0BAA0B;AAAA,QACjD,eAAe,OAAO,iBAAiB;AAAA,QACvC,aAAa,aAAa;AAAA,MAC5B;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAKA,QAAM,eAAe,GAAG,OAAO,sBAAsB;AAAA,IACnD,WAAW,KAAK;AAAA,IAChB,wBAAwB,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IAC5F,SAAS,KAAK,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA,eAAe,oBAAI,KAAK;AAAA,EAC1B,CAAC;AACD,KAAG,QAAQ,YAAY;AACvB,QAAM,GAAG,MAAM;AAMf,QAAM,cAAe,MAAM,GAAG,cAAc,EAAE;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA;AAAA,MACE,WAAW,WAAW;AAAA,MACtB,KAAK,mBAAmB;AAAA,MACxB;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,KAAK,YAAY;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,YAAY,CAAC,GAAG;AAClC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,OAAO,GAAG,OAAO,oBAAoB;AAAA,IACzC;AAAA,IACA,wBAAwB,aAAa;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,MACd,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,aAAa,SAAY,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzE;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAOf,MAAI,KAAK,qBAAqB;AAC5B,UAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,MAC9C,wBAAwB,aAAa;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,MACzC,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,mBAAmB,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,OAAO;AAClB,UAAM,GAAG,MAAM;AAAA,EACjB;AAIA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,aAAa;AAAA,IAClB,EAAE,eAAe,KAAK,IAAI,WAAW,gBAAgB,aAAa,GAAG;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SACE;AAAA,MACF,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,QACJ;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/lib/access-control.js

@@ -8,6 +8,10 @@ function channelOrgScopeWhereFromFilter(filter) {
   if (!organizationIds || organizationIds.length === 0) return {};
   return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] };
 }
+function channelOwnerScopeWhere(currentUserId) {
+  if (!currentUserId) return { userId: null };
+  return { $or: [{ userId: null }, { userId: currentUserId }] };
+}
 function assertCanAccessChannel(channel, currentUserId, userFeatures) {
   if (!channel) {
     throw new ChannelAccessDeniedError("Channel not found");
@@ -48,6 +52,7 @@ export {
   assertCanAccessChannel,
   assertCanManageChannel,
   channelOrgScopeWhere,
-  channelOrgScopeWhereFromFilter
+  channelOrgScopeWhereFromFilter,
+  channelOwnerScopeWhere
 };
 //# sourceMappingURL=access-control.js.map

package/dist/modules/communication_channels/lib/access-control.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/access-control.ts"],
-  "sourcesContent": ["import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\n/**\n * Per-user channel access control \u2014 service-layer authorization helpers.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be read or managed ONLY by its owner \u2014 not even an admin\n * or superadmin can act on another user's personal mailbox. Tenant-wide /\n * shared channels (`userId == null`, e.g. WhatsApp Business / Slack workspaces)\n * remain accessible to any caller the route already feature-gated.\n *\n * Routes also narrow at the SQL layer (the admin channel list returns\n * `user_id IS NULL` rows only; the profile list filters `user_id =\n * currentUser.id`); these helpers are the per-channel authorization backstop a\n * route calls once it has loaded the row.\n */\n\nexport const ADMIN_FEATURE = 'communication_channels.admin'\n\n/**\n * Org-scoping fragment for reading/managing channels.\n *\n * Tenant-wide channels are stored with `organization_id IS NULL` (the\n * tenant-scoped push providers FCM/APNs/Expo do this deliberately \u2014 see\n * `connect-credential-channel.ts`). They are visible and manageable from ANY\n * org in the tenant, so a read scoped to the caller's selected org must also\n * match the NULL rows; otherwise a channel connected while an admin had a\n * non-null org would be invisible to every listing/detail query (and vice\n * versa). Org-scoped channels (`organization_id = <org>`) stay scoped to their\n * org.\n *\n * Spread the result into a MikroORM `where` object alongside `tenantId` etc.\n */\nexport function channelOrgScopeWhere(\n  orgId: string | null | undefined,\n): Record<string, unknown> {\n  return orgId\n    ? { $or: [{ organizationId: orgId }, { organizationId: null }] }\n    : { organizationId: null }\n}\n\n/**\n * Same NULL-inclusive org scoping, expressed over a resolved\n * `OrganizationScopeFilter` (`resolveOrganizationScopeFilter`) rather than a\n * single org id.\n *\n * Read routes scope on the caller's *selected* organization (the\n * `om_selected_org` cookie the top-bar switcher writes), not on the org baked\n * into the session token (#5012) \u2014 that resolution yields a list of org ids, or\n * `undefined` when the caller is unrestricted (super-admin viewing all orgs).\n * An unrestricted caller sees every channel in the tenant, so the fragment is\n * empty; a restricted one gets their orgs plus the tenant-wide (`NULL`) rows.\n */\nexport function channelOrgScopeWhereFromFilter(\n  filter: { organizationIds: string[] | undefined } | null | undefined,\n): Record<string, unknown> {\n  const organizationIds = filter?.organizationIds\n  if (!organizationIds || organizationIds.length === 0) return {}\n  return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }\n}\n\n/**\n * Throws when the caller may not access a specific channel. Returns silently\n * when access is allowed.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be acted on ONLY by its owner \u2014 not even an admin /\n * superadmin can poll, test-send, import history from, register push on, or\n * delete another user's personal mailbox. Tenant-wide channels\n * (`userId == null`, e.g. WhatsApp Business / Slack workspaces) remain\n * accessible to any caller the route already feature-gated.\n *\n * `userFeatures` is retained on the signature (callers pass it) but no longer\n * grants a bypass; it is reserved for the v2 admin-oversight feature.\n *\n * Callers MUST pass the fully decrypted channel row \u2014 we read `userId` directly.\n */\nexport function assertCanAccessChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  void userFeatures\n  // Tenant-wide / shared channel \u2014 accessible to all callers.\n  if (channel.userId == null) return\n  // Personal mailbox \u2014 owner only, regardless of admin grants (v1).\n  if (channel.userId !== currentUserId) {\n    throw new ChannelAccessDeniedError(\n      'Channel is a personal mailbox owned by another user',\n    )\n  }\n}\n\n/**\n * Authorization for MANAGING (mutating) a channel \u2014 disconnect, poll, set\n * primary, import history, register push. Encodes the per-user ownership rule:\n *\n *   - **Personal mailbox** (`userId` set): the **owner has full control** of\n *     their own account; any other caller \u2014 admin included \u2014 is denied (v1\n *     strict owner-only, no bypass). Routes gate these on\n *     `communication_channels.connect_user_channel` so every email user reaches\n *     this check for their own channels.\n *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp\n *     Business / Slack workspaces): requires the route's `elevatedFeature`\n *     (`communication_channels.manage`, `\u2026channel.push.manage`, or\n *     `\u2026channel.import_history`). Evaluated by the shared feature policy.\n *\n * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking\n * existence) when the caller may not manage the channel.\n */\nexport function assertCanManageChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n  elevatedFeature: string,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  // Personal mailbox \u2014 owner only. The owner manages their own account fully\n  // (gated by connect_user_channel at the route); no admin bypass in v1.\n  if (channel.userId != null) {\n    if (channel.userId !== currentUserId) {\n      throw new ChannelAccessDeniedError('Channel is a personal mailbox owned by another user')\n    }\n    return\n  }\n  // Tenant-wide / shared channel \u2014 requires the elevated management feature.\n  const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []\n  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {\n    throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)\n  }\n}\n\n/**\n * Stable error class so route handlers can map to a 403 instead of leaking the\n * underlying message verbatim. Subclasses `Error` for compatibility with the\n * platform's error logging helpers.\n */\nexport class ChannelAccessDeniedError extends Error {\n  override name = 'ChannelAccessDeniedError'\n  readonly statusCode = 403\n}\n"],
-  "mappings": "AAAA,SAAS,yBAAyB;AAiB3B,MAAM,gBAAgB;AAgBtB,SAAS,qBACd,OACyB;AACzB,SAAO,QACH,EAAE,KAAK,CAAC,EAAE,gBAAgB,MAAM,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE,IAC7D,EAAE,gBAAgB,KAAK;AAC7B;AAcO,SAAS,+BACd,QACyB;AACzB,QAAM,kBAAkB,QAAQ;AAChC,MAAI,CAAC,mBAAmB,gBAAgB,WAAW,EAAG,QAAO,CAAC;AAC9D,SAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AACzF;AAkBO,SAAS,uBACd,SACA,eACA,cACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AACA,OAAK;AAEL,MAAI,QAAQ,UAAU,KAAM;AAE5B,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,uBACd,SACA,eACA,cACA,iBACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AAGA,MAAI,QAAQ,UAAU,MAAM;AAC1B,QAAI,QAAQ,WAAW,eAAe;AACpC,YAAM,IAAI,yBAAyB,qDAAqD;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AACtE,MAAI,CAAC,kBAAkB,CAAC,eAAe,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC9D,UAAM,IAAI,yBAAyB,uCAAuC,eAAe,GAAG;AAAA,EAC9F;AACF;AAOO,MAAM,iCAAiC,MAAM;AAAA,EAA7C;AAAA;AACL,SAAS,OAAO;AAChB,SAAS,aAAa;AAAA;AACxB;",
+  "sourcesContent": ["import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\n/**\n * Per-user channel access control \u2014 service-layer authorization helpers.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be read or managed ONLY by its owner \u2014 not even an admin\n * or superadmin can act on another user's personal mailbox. Tenant-wide /\n * shared channels (`userId == null`, e.g. WhatsApp Business / Slack workspaces)\n * remain accessible to any caller the route already feature-gated.\n *\n * Routes also narrow at the SQL layer (the admin channel list returns\n * `user_id IS NULL` rows only; the profile list filters `user_id =\n * currentUser.id`); these helpers are the per-channel authorization backstop a\n * route calls once it has loaded the row.\n */\n\nexport const ADMIN_FEATURE = 'communication_channels.admin'\n\n/**\n * Org-scoping fragment for reading/managing channels.\n *\n * Tenant-wide channels are stored with `organization_id IS NULL` (the\n * tenant-scoped push providers FCM/APNs/Expo do this deliberately \u2014 see\n * `connect-credential-channel.ts`). They are visible and manageable from ANY\n * org in the tenant, so a read scoped to the caller's selected org must also\n * match the NULL rows; otherwise a channel connected while an admin had a\n * non-null org would be invisible to every listing/detail query (and vice\n * versa). Org-scoped channels (`organization_id = <org>`) stay scoped to their\n * org.\n *\n * Spread the result into a MikroORM `where` object alongside `tenantId` etc.\n */\nexport function channelOrgScopeWhere(\n  orgId: string | null | undefined,\n): Record<string, unknown> {\n  return orgId\n    ? { $or: [{ organizationId: orgId }, { organizationId: null }] }\n    : { organizationId: null }\n}\n\n/**\n * Same NULL-inclusive org scoping, expressed over a resolved\n * `OrganizationScopeFilter` (`resolveOrganizationScopeFilter`) rather than a\n * single org id.\n *\n * Read routes scope on the caller's *selected* organization (the\n * `om_selected_org` cookie the top-bar switcher writes), not on the org baked\n * into the session token (#5012) \u2014 that resolution yields a list of org ids, or\n * `undefined` when the caller is unrestricted (super-admin viewing all orgs).\n * An unrestricted caller sees every channel in the tenant, so the fragment is\n * empty; a restricted one gets their orgs plus the tenant-wide (`NULL`) rows.\n */\nexport function channelOrgScopeWhereFromFilter(\n  filter: { organizationIds: string[] | undefined } | null | undefined,\n): Record<string, unknown> {\n  const organizationIds = filter?.organizationIds\n  if (!organizationIds || organizationIds.length === 0) return {}\n  return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }\n}\n\n/**\n * Ownership fragment for LISTING channels \u2014 the SQL-layer twin of\n * {@link assertCanAccessChannel}.\n *\n * Routes have historically hardcoded one of the two halves of the rule: the\n * admin channel list narrows to `user_id IS NULL`, the profile list narrows to\n * `user_id = <caller>`. A provider-scoped listing needs both, because which half\n * a channel falls into is decided by the connect flow the provider offers, not\n * by the listing. Hardcoding `userId: null` is what made the Discord AI\n * auto-reply panel structurally empty (#5602): every route the product exposes\n * for connecting a Discord bot writes `user_id = auth.sub`, so the filter\n * excluded the only channels that can exist.\n *\n * The clause admits exactly what the assert allows and nothing more \u2014 shared\n * channels, plus the caller's own personal ones. It grants no admin bypass, in\n * line with v1 strict owner-only: a personal mailbox stays invisible to everyone\n * but its owner. An anonymous caller (no user id) sees shared channels only.\n *\n * Spread into a MikroORM `where`, or nest under `$and` when another fragment in\n * the same query already claims `$or` (`channelOrgScopeWhereFromFilter` does).\n */\nexport function channelOwnerScopeWhere(\n  currentUserId: string | null | undefined,\n): Record<string, unknown> {\n  if (!currentUserId) return { userId: null }\n  return { $or: [{ userId: null }, { userId: currentUserId }] }\n}\n\n/**\n * Throws when the caller may not access a specific channel. Returns silently\n * when access is allowed.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be acted on ONLY by its owner \u2014 not even an admin /\n * superadmin can poll, test-send, import history from, register push on, or\n * delete another user's personal mailbox. Tenant-wide channels\n * (`userId == null`, e.g. WhatsApp Business / Slack workspaces) remain\n * accessible to any caller the route already feature-gated.\n *\n * `userFeatures` is retained on the signature (callers pass it) but no longer\n * grants a bypass; it is reserved for the v2 admin-oversight feature.\n *\n * Callers MUST pass the fully decrypted channel row \u2014 we read `userId` directly.\n */\nexport function assertCanAccessChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  void userFeatures\n  // Tenant-wide / shared channel \u2014 accessible to all callers.\n  if (channel.userId == null) return\n  // Personal mailbox \u2014 owner only, regardless of admin grants (v1).\n  if (channel.userId !== currentUserId) {\n    throw new ChannelAccessDeniedError(\n      'Channel is a personal mailbox owned by another user',\n    )\n  }\n}\n\n/**\n * Authorization for MANAGING (mutating) a channel \u2014 disconnect, poll, set\n * primary, import history, register push. Encodes the per-user ownership rule:\n *\n *   - **Personal mailbox** (`userId` set): the **owner has full control** of\n *     their own account; any other caller \u2014 admin included \u2014 is denied (v1\n *     strict owner-only, no bypass). Routes gate these on\n *     `communication_channels.connect_user_channel` so every email user reaches\n *     this check for their own channels.\n *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp\n *     Business / Slack workspaces): requires the route's `elevatedFeature`\n *     (`communication_channels.manage`, `\u2026channel.push.manage`, or\n *     `\u2026channel.import_history`). Evaluated by the shared feature policy.\n *\n * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking\n * existence) when the caller may not manage the channel.\n */\nexport function assertCanManageChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n  elevatedFeature: string,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  // Personal mailbox \u2014 owner only. The owner manages their own account fully\n  // (gated by connect_user_channel at the route); no admin bypass in v1.\n  if (channel.userId != null) {\n    if (channel.userId !== currentUserId) {\n      throw new ChannelAccessDeniedError('Channel is a personal mailbox owned by another user')\n    }\n    return\n  }\n  // Tenant-wide / shared channel \u2014 requires the elevated management feature.\n  const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []\n  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {\n    throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)\n  }\n}\n\n/**\n * Stable error class so route handlers can map to a 403 instead of leaking the\n * underlying message verbatim. Subclasses `Error` for compatibility with the\n * platform's error logging helpers.\n */\nexport class ChannelAccessDeniedError extends Error {\n  override name = 'ChannelAccessDeniedError'\n  readonly statusCode = 403\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAiB3B,MAAM,gBAAgB;AAgBtB,SAAS,qBACd,OACyB;AACzB,SAAO,QACH,EAAE,KAAK,CAAC,EAAE,gBAAgB,MAAM,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE,IAC7D,EAAE,gBAAgB,KAAK;AAC7B;AAcO,SAAS,+BACd,QACyB;AACzB,QAAM,kBAAkB,QAAQ;AAChC,MAAI,CAAC,mBAAmB,gBAAgB,WAAW,EAAG,QAAO,CAAC;AAC9D,SAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AACzF;AAuBO,SAAS,uBACd,eACyB;AACzB,MAAI,CAAC,cAAe,QAAO,EAAE,QAAQ,KAAK;AAC1C,SAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,cAAc,CAAC,EAAE;AAC9D;AAkBO,SAAS,uBACd,SACA,eACA,cACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AACA,OAAK;AAEL,MAAI,QAAQ,UAAU,KAAM;AAE5B,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,uBACd,SACA,eACA,cACA,iBACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AAGA,MAAI,QAAQ,UAAU,MAAM;AAC1B,QAAI,QAAQ,WAAW,eAAe;AACpC,YAAM,IAAI,yBAAyB,qDAAqD;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AACtE,MAAI,CAAC,kBAAkB,CAAC,eAAe,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC9D,UAAM,IAAI,yBAAyB,uCAAuC,eAAe,GAAG;AAAA,EAC9F;AACF;AAOO,MAAM,iCAAiC,MAAM;AAAA,EAA7C;AAAA;AACL,SAAS,OAAO;AAChB,SAAS,aAAa;AAAA;AACxB;",
   "names": []
 }

package/dist/modules/communication_channels/lib/system-user.js

@@ -1,3 +1,4 @@
+import { lookupHashCandidates } from "@open-mercato/shared/lib/encryption/aes";
 const COMMUNICATION_CHANNELS_SYSTEM_USER_ID = "00000000-0000-0000-0000-000000000000";
 function systemUserEmail(tenantId) {
   return `system+communication_channels@${tenantId}.local`;
@@ -5,9 +6,13 @@ function systemUserEmail(tenantId) {
 async function resolveCommunicationChannelsSystemUserId(em, tenantId, fallbackId) {
   try {
     const expectedEmail = systemUserEmail(tenantId);
-    const qb = em.createQueryBuilder("auth.users", "u");
-    const row = await qb.select(["u.id"]).where({ email: expectedEmail, tenant_id: tenantId }).limit(1).execute("get").catch(() => null);
-    const id = row?.id;
+    const emailHashes = lookupHashCandidates(expectedEmail);
+    const placeholders = emailHashes.map(() => "?").join(", ");
+    const rows = await em.getConnection().execute(
+      `SELECT id FROM users WHERE email_hash IN (${placeholders}) AND tenant_id = ? AND deleted_at IS NULL LIMIT 1`,
+      [...emailHashes, tenantId]
+    );
+    const id = Array.isArray(rows) ? rows[0]?.id : void 0;
     if (typeof id === "string" && id.length > 0) return id;
   } catch {
   }