@open-mercato/core 0.8.1-develop.7263.1.bbc6db3437 → 0.8.1-develop.7267.1.2e95af80a6

package/dist/modules/communication_channels/commands/deliver-outbound-message.js

@@ -339,6 +339,11 @@ const deliverOutboundMessageCommand = {
           providerKey: channel.providerKey,
           channelType: channel.channelType,
           direction: "outbound",
+          // #6095: same contract as the inbound path — the send time travels on
+          // the event so consumers (the customers timeline) date their rows
+          // from it instead of reading the ExternalMessage row across the
+          // module boundary. ISO string because this event is persistent.
+          providerTimestamp: externalMessage.providerTimestamp instanceof Date ? externalMessage.providerTimestamp.toISOString() : null,
           tenantId: input.scope.tenantId,
           organizationId: input.scope.organizationId ?? null
         },

package/dist/modules/communication_channels/commands/deliver-outbound-message.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/deliver-outbound-message.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport { resolveOutboundReplyExternalId, stripCallerReplyTargeting } from '../lib/outbound-reply-ref'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst moduleLogger = createLogger('communication_channels').child({ component: 'deliver-outbound-message' })\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    //\n    // Key the org on the CHANNEL's own org, not the message's org. Tenant-wide\n    // channels store `organization_id = NULL` and their credentials live at\n    // `organization_id = tenantId` (see connect-credential-channel.ts), so\n    // `channel.organizationId ?? tenantId` matches the write key for both\n    // org-scoped and tenant-wide channels. Keying on the message org would\n    // resolve `{}` the moment a tenant-wide provider delivers from a message\n    // that carries a non-null org.\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: channel.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => moduleLogger.warn('credential refresh diagnostic', { details: args }),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      moduleLogger.warn('thread token unavailable, proceeding without it', { err: tokenErr })\n    }\n\n    // (4c) Chat-provider reply threading \u2014 resolve the provider-native id of the\n    // message this one answers so a threading adapter can attach it (Discord's\n    // `message_reference`). Email adapters ignore this and keep threading on the\n    // `inReplyTo` / `references` headers built above. Best-effort like the thread\n    // token: an unresolvable parent sends an unthreaded reply rather than failing\n    // a delivery.\n    let replyToExternalId: string | null = null\n    try {\n      replyToExternalId = await resolveOutboundReplyExternalId(em, {\n        parentMessageId: message.parentMessageId ?? null,\n        externalConversationId: mapping.externalConversationId,\n        capabilities: adapter.capabilities,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n      })\n    } catch (replyRefErr) {\n      moduleLogger.warn('outbound reply reference unavailable, sending unthreaded', {\n        err: replyRefErr,\n      })\n    }\n    if (!replyToExternalId && message.parentMessageId && adapter.capabilities?.threading === true) {\n      // The provider threads and the caller asked for a reply, yet nothing\n      // resolved \u2014 the parent never reached this channel, or it belongs to\n      // another conversation. Delivery is unaffected, but say so: an unthreaded\n      // reply is otherwise indistinguishable from a non-reply, which is exactly\n      // the silent-unreachability shape #5541 was filed about.\n      moduleLogger.debug('reply parent has no external id on this channel, sending unthreaded', {\n        messageId: message.id,\n        parentMessageId: message.parentMessageId,\n        conversationId: mapping.externalConversationId,\n      })\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          // Reply targeting is hub-resolved only. `send-as-user` merges\n          // caller-supplied metadata onto the link, so every reply-targeting key\n          // is stripped off the stored metadata here rather than merely\n          // out-ranked below: merge order settles the contest only when the hub\n          // resolved a parent, and the uncontested case \u2014 no `parentMessageId`,\n          // or a parent that does not resolve \u2014 is exactly the one a caller\n          // controls.\n          ...stripCallerReplyTargeting(baseMetadata),\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n          ...(replyToExternalId ? { replyToExternalId } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: channel.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...(converted.metadata ?? {}),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,gCAAgC,iCAAiC;AAE1E,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,eAAe,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,2BAA2B,CAAC;AAM3G,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAyCF,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAYA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,MACtD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,aAAa,KAAK,iCAAiC,EAAE,SAAS,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,mBAAa,KAAK,mDAAmD,EAAE,KAAK,SAAS,CAAC;AAAA,IACxF;AAQA,QAAI,oBAAmC;AACvC,QAAI;AACF,0BAAoB,MAAM,+BAA+B,IAAI;AAAA,QAC3D,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,wBAAwB,QAAQ;AAAA,QAChC,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,aAAa;AACpB,mBAAa,KAAK,4DAA4D;AAAA,QAC5E,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB,QAAQ,mBAAmB,QAAQ,cAAc,cAAc,MAAM;AAM7F,mBAAa,MAAM,uEAAuE;AAAA,QACxF,WAAW,QAAQ;AAAA,QACnB,iBAAiB,QAAQ;AAAA,QACzB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQnB,GAAG,0BAA0B,YAAY;AAAA,UACzC,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,UACpD,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACnD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,QACxD;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAI,UAAU,YAAY,CAAC;AAAA,QAC3B,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA,UACX,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport { resolveOutboundReplyExternalId, stripCallerReplyTargeting } from '../lib/outbound-reply-ref'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst moduleLogger = createLogger('communication_channels').child({ component: 'deliver-outbound-message' })\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    //\n    // Key the org on the CHANNEL's own org, not the message's org. Tenant-wide\n    // channels store `organization_id = NULL` and their credentials live at\n    // `organization_id = tenantId` (see connect-credential-channel.ts), so\n    // `channel.organizationId ?? tenantId` matches the write key for both\n    // org-scoped and tenant-wide channels. Keying on the message org would\n    // resolve `{}` the moment a tenant-wide provider delivers from a message\n    // that carries a non-null org.\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: channel.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => moduleLogger.warn('credential refresh diagnostic', { details: args }),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      moduleLogger.warn('thread token unavailable, proceeding without it', { err: tokenErr })\n    }\n\n    // (4c) Chat-provider reply threading \u2014 resolve the provider-native id of the\n    // message this one answers so a threading adapter can attach it (Discord's\n    // `message_reference`). Email adapters ignore this and keep threading on the\n    // `inReplyTo` / `references` headers built above. Best-effort like the thread\n    // token: an unresolvable parent sends an unthreaded reply rather than failing\n    // a delivery.\n    let replyToExternalId: string | null = null\n    try {\n      replyToExternalId = await resolveOutboundReplyExternalId(em, {\n        parentMessageId: message.parentMessageId ?? null,\n        externalConversationId: mapping.externalConversationId,\n        capabilities: adapter.capabilities,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n      })\n    } catch (replyRefErr) {\n      moduleLogger.warn('outbound reply reference unavailable, sending unthreaded', {\n        err: replyRefErr,\n      })\n    }\n    if (!replyToExternalId && message.parentMessageId && adapter.capabilities?.threading === true) {\n      // The provider threads and the caller asked for a reply, yet nothing\n      // resolved \u2014 the parent never reached this channel, or it belongs to\n      // another conversation. Delivery is unaffected, but say so: an unthreaded\n      // reply is otherwise indistinguishable from a non-reply, which is exactly\n      // the silent-unreachability shape #5541 was filed about.\n      moduleLogger.debug('reply parent has no external id on this channel, sending unthreaded', {\n        messageId: message.id,\n        parentMessageId: message.parentMessageId,\n        conversationId: mapping.externalConversationId,\n      })\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          // Reply targeting is hub-resolved only. `send-as-user` merges\n          // caller-supplied metadata onto the link, so every reply-targeting key\n          // is stripped off the stored metadata here rather than merely\n          // out-ranked below: merge order settles the contest only when the hub\n          // resolved a parent, and the uncontested case \u2014 no `parentMessageId`,\n          // or a parent that does not resolve \u2014 is exactly the one a caller\n          // controls.\n          ...stripCallerReplyTargeting(baseMetadata),\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n          ...(replyToExternalId ? { replyToExternalId } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: channel.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...(converted.metadata ?? {}),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          // #6095: same contract as the inbound path \u2014 the send time travels on\n          // the event so consumers (the customers timeline) date their rows\n          // from it instead of reading the ExternalMessage row across the\n          // module boundary. ISO string because this event is persistent.\n          providerTimestamp:\n            externalMessage.providerTimestamp instanceof Date\n              ? externalMessage.providerTimestamp.toISOString()\n              : null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,gCAAgC,iCAAiC;AAE1E,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,eAAe,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,2BAA2B,CAAC;AAM3G,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAyCF,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAYA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,MACtD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,aAAa,KAAK,iCAAiC,EAAE,SAAS,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,mBAAa,KAAK,mDAAmD,EAAE,KAAK,SAAS,CAAC;AAAA,IACxF;AAQA,QAAI,oBAAmC;AACvC,QAAI;AACF,0BAAoB,MAAM,+BAA+B,IAAI;AAAA,QAC3D,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,wBAAwB,QAAQ;AAAA,QAChC,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,aAAa;AACpB,mBAAa,KAAK,4DAA4D;AAAA,QAC5E,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB,QAAQ,mBAAmB,QAAQ,cAAc,cAAc,MAAM;AAM7F,mBAAa,MAAM,uEAAuE;AAAA,QACxF,WAAW,QAAQ;AAAA,QACnB,iBAAiB,QAAQ;AAAA,QACzB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQnB,GAAG,0BAA0B,YAAY;AAAA,UACzC,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,UACpD,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACnD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,QACxD;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAI,UAAU,YAAY,CAAC;AAAA,QAC3B,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,UAKX,mBACE,gBAAgB,6BAA6B,OACzC,gBAAgB,kBAAkB,YAAY,IAC9C;AAAA,UACN,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/commands/ingest-inbound-message.js

@@ -259,6 +259,12 @@ const ingestInboundMessageCommand = {
       // when the matcher returned null (no token / JWZ / subject hit).
       parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,
       isDraft: false,
+      // #6095: the platform message is dated when the provider received the
+      // mail, not when this worker ran. Otherwise a history import lands every
+      // message on the import minute and the inbox (sorted on `sent_at`) shows
+      // a 90-day mailbox as one block in import order. Adapters without a
+      // timestamp fall through to compose's own `new Date()`.
+      sentAt: m.timestamp ?? void 0,
       // Stable dedup key so a retried ingest (after a transient failure between
       // compose and the ExternalMessage anchor insert) reuses the message
       // composed by the first attempt instead of duplicating it. Mirrors the
@@ -384,6 +390,13 @@ const ingestInboundMessageCommand = {
         providerKey: input.providerKey,
         channelType: input.channelType,
         direction: "inbound",
+        // #6095: subscribers that date their own rows from this message (the
+        // customers timeline) need the provider's receive time, not the moment
+        // this worker ran. Carried here so no consumer has to read the
+        // ExternalMessage row across the module boundary. ISO string because a
+        // persistent event is serialized onto the queue; null when the adapter
+        // supplied no timestamp, which leaves the consumer's own fallback.
+        providerTimestamp: externalMessage.providerTimestamp instanceof Date ? externalMessage.providerTimestamp.toISOString() : null,
         tenantId: input.scope.tenantId,
         organizationId: input.scope.organizationId ?? null
       },

package/dist/modules/communication_channels/commands/ingest-inbound-message.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/ingest-inbound-message.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus, CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { htmlToPlainText } from '@open-mercato/shared/lib/html/htmlToPlainText'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { resolveContact } from '../lib/contact-resolver'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { matchThread, type ThreadMatch } from '../lib/thread-matcher'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { normalizedInboundMessageSchema } from '../data/validators'\nimport { resolveCommunicationChannelsSystemUserId } from '../lib/system-user'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'ingest-inbound-message' })\n\nconst ingestInputSchema = z.object({\n  channelId: z.string().uuid(),\n  providerKey: z.string().min(1),\n  channelType: z.string().min(1),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  message: normalizedInboundMessageSchema,\n})\n\nexport type IngestInboundMessageInput = z.infer<typeof ingestInputSchema>\n\nexport type IngestInboundMessageResult = {\n  status: 'created' | 'duplicate'\n  messageId?: string\n  externalConversationId?: string\n  externalMessageId?: string\n  channelLinkId?: string\n  threadMappingId?: string\n  contactPersonId?: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID = 'communication_channels.message.ingest_inbound'\n\n/**\n * Idempotently ingest a normalized inbound channel message.\n *\n * Steps (per SPEC-045d \u00A76):\n *   1. Dedup by `(channel_id, external_message_id)` \u2014 if a MessageChannelLink already\n *      exists for that pair, return `{ status: 'duplicate' }` without side effects.\n *   2. Create or load `ExternalConversation` by `(channel_id, external_conversation_id)`.\n *   3. Create or load `ChannelThreadMapping` (1:1 with ExternalConversation).\n *   4. Resolve CRM contact via adapter + QueryEngine (best-effort).\n *   5. Compose the platform `Message` via `messages.messages.compose` (separate transaction).\n *   6. Create `ExternalMessage` + `MessageChannelLink`.\n *   7. Emit `communication_channels.message.received` (and `.conversation.created` / `.contact.resolved` when applicable).\n *\n * The two-transaction model (compose-message-then-record-link) is acceptable for v1;\n * the link's unique-on-message-id constraint is the safety net against orphans. See\n * the pre-implementation analysis for a discussion of single-transaction alternatives.\n */\nconst ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, IngestInboundMessageResult> = {\n  id: COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = ingestInputSchema.parse(rawInput) as IngestInboundMessageInput\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Dedup: short-circuit if we've already processed this provider message.\n    // The unique constraint is on `messageId`, not (channel, externalMessageId).\n    // We must dedup by joining against ExternalMessage which IS uniquely indexed by\n    // (channel_id, external_message_id). Hub-side dedup is the authoritative gate.\n    const existingExternal = await findOneWithDecryption(\n      em,\n      ExternalMessage,\n      {\n        channelId: input.channelId,\n        externalMessageId: input.message.externalMessageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (existingExternal) {\n      return {\n        status: 'duplicate',\n        externalConversationId: existingExternal.conversationId,\n        externalMessageId: existingExternal.id,\n      }\n    }\n\n    // (1b) Spec B \u00A7 Sent-folder dedup.\n    //\n    // When an outbound message lands in the user's IMAP Sent folder (or\n    // when Gmail's \"send and archive\" deposits it in All Mail), the next\n    // poll will re-fetch it from INBOX as if it were inbound. Skip it\n    // here using the RFC 5322 `Message-ID` header \u2014 we recorded it on the\n    // outbound `MessageChannelLink.channelMetadata.messageId` at send time.\n    //\n    // We dedup ONLY on outbound links (direction='outbound') for the same\n    // channel \u2014 that way an inbound copy of someone ELSE's email that\n    // happens to share a Message-ID is still ingested normally.\n    const incomingMessageId = (() => {\n      const fromMeta = (input.message.channelMetadata as Record<string, unknown> | undefined)?.messageId\n      if (typeof fromMeta === 'string' && fromMeta.length > 0) return fromMeta\n      return null\n    })()\n    if (incomingMessageId) {\n      // MikroORM v7 dropped the Knex builder in favour of Kysely/raw SQL.\n      // We use a positional-placeholder raw query for the JSONB\n      // `channel_metadata->>messageId` comparison.\n      try {\n        const sentFolderHit = await em.getConnection().execute<Array<{ id: string }>>(\n          `SELECT link.id FROM message_channel_links AS link\n             INNER JOIN external_conversations AS conv\n               ON conv.id = link.external_conversation_id\n            WHERE link.tenant_id = ?\n              AND ((?::uuid IS NULL AND link.organization_id IS NULL) OR link.organization_id = ?::uuid)\n              AND conv.tenant_id = ?\n              AND ((?::uuid IS NULL AND conv.organization_id IS NULL) OR conv.organization_id = ?::uuid)\n              AND conv.channel_id = ?\n              AND link.direction = 'outbound'\n              AND link.channel_metadata->>'messageId' = ?\n            LIMIT 1`,\n          [\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.channelId,\n            incomingMessageId,\n          ],\n        )\n        if (Array.isArray(sentFolderHit) && sentFolderHit.length > 0) {\n          return {\n            status: 'duplicate',\n            externalConversationId: input.message.externalConversationId,\n            externalMessageId: input.message.externalMessageId,\n          }\n        }\n      } catch (dedupErr) {\n        // Sent-folder dedup is best-effort \u2014 a failure here must not abort\n        // ingest (better a possible duplicate than a lost inbound message).\n        logger.warn('sent-folder dedup query failed, continuing', { err: dedupErr })\n      }\n    }\n\n    // Channel + adapter lookup (the channel must exist + be active).\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${input.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${input.channelId} is inactive; refusing to ingest`)\n    }\n\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${input.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (2) ExternalConversation upsert by (channel_id, externalConversationId).\n    const m = input.message\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    let conversationCreated = false\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        subject: m.subject ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        lastMessageAt: m.timestamp ?? new Date(),\n        assignedUserId: channel.userId ?? null,\n      })\n      em.persist(conversation)\n      conversationCreated = true\n    }\n\n    // (3) ChannelThreadMapping upsert (1:1 with ExternalConversation per tenant).\n    let mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n\n    // Last-activity bump on an existing conversation. Applied AFTER the mapping\n    // lookup, immediately before the flush, so the scalar mutation and its flush\n    // stay adjacent with no query in between (core flush-ordering rule \u2014 a query\n    // between a scalar mutation and `em.flush()` can drop the change under some\n    // flush modes / subscriber configurations).\n    if (\n      !conversationCreated &&\n      m.timestamp &&\n      (!conversation.lastMessageAt || m.timestamp > conversation.lastMessageAt)\n    ) {\n      conversation.lastMessageAt = m.timestamp\n    }\n    // We'll fill `messageThreadId` after composing the platform Message (since the\n    // first inbound message becomes the thread root in the messages module).\n    await em.flush()\n\n    // (3b) Spec B \u2014 layered thread match.\n    //\n    // Resolve the inbound message to an existing platform thread using\n    // (in priority order):\n    //   1. Crypto token in References / In-Reply-To header (high confidence)\n    //   2. Crypto token in body hidden span or plain-text marker (high)\n    //   3. JWZ on Message-Id \u2194 stored `MessageChannelLink.channelMetadata.messageId` (medium)\n    //   4. Subject + participants in last 30 days, same channel (low)\n    //\n    // The matcher returns `null` when nothing hits \u2014 in that case we fall\n    // back to the existing `ChannelThreadMapping`-by-conversation-id lookup\n    // (which also returns null on first-ever inbound, in which case the\n    // compose command opens a new thread).\n    const metaForMatcher = (m.channelMetadata ?? {}) as Record<string, unknown>\n    let threadMatch: ThreadMatch | null = null\n    try {\n      threadMatch = await matchThread(\n        {\n          channelId: input.channelId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          messageId: extractStringFromMeta(metaForMatcher, 'messageId') ?? m.externalMessageId,\n          inReplyTo:\n            m.replyToExternalId ?? extractStringFromMeta(metaForMatcher, 'inReplyTo'),\n          references: extractStringArrayFromMeta(metaForMatcher, 'references'),\n          subject: m.subject ?? '',\n          fromAddress:\n            extractStringFromMeta(metaForMatcher, 'from') ?? m.senderIdentifier,\n          toAddresses: extractStringArrayFromMeta(metaForMatcher, 'to'),\n          ccAddresses: extractStringArrayFromMeta(metaForMatcher, 'cc'),\n          bodyPlain: m.bodyFormat === 'html' ? null : m.body ?? null,\n          bodyHtml: m.bodyFormat === 'html' ? m.body ?? null : null,\n          receivedAt: m.timestamp ?? new Date(),\n        },\n        { em },\n      )\n    } catch (matcherErr) {\n      // Matcher failure must not block ingest \u2014 fall back to the existing\n      // conversation-based thread mapping so the message still lands.\n      logger.warn('thread matcher failed, falling back to conversation mapping', { err: matcherErr })\n    }\n\n    // (4) Contact resolution (best-effort, advisory).\n    let contactHint: {\n      matchedPersonId?: string | null\n      email?: string\n      displayName?: string\n    } | null = null\n    try {\n      contactHint = await resolveContact(\n        {\n          adapter,\n          senderIdentifier: m.senderIdentifier,\n          senderDisplayName: m.senderDisplayName,\n          channelMetadata: m.channelMetadata,\n          credentials: {}, // credentials decrypted at the webhook route; resolver doesn't re-fetch\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? input.scope.tenantId,\n          },\n        },\n        { container: ctx.container },\n      )\n    } catch (contactErr) {\n      // Best-effort: contact resolution is advisory and must not abort ingest.\n      // Log like the sibling dedup/matcher catches so a misbehaving resolver is\n      // visible in operator logs instead of failing silently.\n      logger.warn('contact resolution failed, continuing without a CRM match', { err: contactErr })\n      contactHint = null\n    }\n    const matchedPersonId = contactHint?.matchedPersonId ?? null\n    if (matchedPersonId && conversation.contactPersonId !== matchedPersonId) {\n      conversation.contactPersonId = matchedPersonId\n      // Flush this scalar mutation before the system-user lookup below queries the\n      // same EntityManager. SPEC-018: a query between a scalar mutation and its\n      // flush can silently discard the pending UPDATE (mirrors the lastMessageAt\n      // bump above).\n      await em.flush()\n    }\n\n    // (5) Compose the platform Message via the messages module command.\n    //\n    // Sanitize against the `messages` module's validators (max 50_000 char body\n    // + non-empty subject) so real-world emails don't get rejected mid-ingest:\n    //   - HTML emails routinely exceed 50k (Gmail signatures, marketing\n    //     templates, RFC 5322 multipart). Truncate with a marker rather than\n    //     drop the whole message \u2014 the full raw body is still in\n    //     ExternalMessage.rawPayload if needed for forensic / forward use.\n    //   - Some legitimate messages have no subject (notifications, bounce\n    //     digests). Substitute a placeholder instead of failing ingest.\n    //   - HTML bodies land in the platform body as plain text rather than being\n    //     merely relabelled as `text`: `MarkdownContent` renders a `text` body\n    //     verbatim, so unconverted markup shows up as literal doctype, <style>\n    //     blocks and tags in the inbox preview and the detail body. The source\n    //     markup is untouched in `channelPayload.html`, which `data/enrichers.ts`\n    //     sanitizes into `_channelPayload.sanitizedHtml` for the channel-payload\n    //     renderer widget mounted at `detail:messages:message:body:after`.\n    //   - The plain-text alternative wins over conversion when the sender's\n    //     client supplied one (`multipart/alternative`), because that part is\n    //     what a human actually wrote; `html-to-text` output \u2014 inlined link\n    //     URLs, flattened tables, synthesized list markers \u2014 is the fallback for\n    //     HTML-only senders. `lib/email-mime.ts` preferred `bodyHtml` when\n    //     picking `body`, but preserved the text part at `channelPayload.text`.\n    const MAX_COMPOSE_BODY = 50_000\n    // Bound the synchronous parse: inbound mail is untrusted and the 5MB body\n    // ceiling from `lib/email-capabilities.ts` would otherwise block the ingest\n    // worker on a single oversized document. This cap counts markup bytes while\n    // MAX_COMPOSE_BODY counts text characters, so it can bite first \u2014 an\n    // ordinary marketing template or a long quoted thread is easily over 512KB\n    // of markup and still well under 50k characters of text. It therefore\n    // carries the same truncation marker, rather than ending mid-sentence with\n    // nothing to tell the reader the rest exists.\n    const MAX_HTML_PARSE_INPUT = 512 * 1024\n    const TRUNCATE_MARKER =\n      '\\n\\n[\u2026message truncated by Open Mercato \u2014 full body preserved in ExternalMessage.rawPayload]'\n    const sourceBody = m.body ?? ''\n    const plainAlternative =\n      typeof m.channelPayload?.text === 'string' ? m.channelPayload.text.trim() : ''\n    const convertHtmlBody = () => {\n      const converted = htmlToPlainText(sourceBody.slice(0, MAX_HTML_PARSE_INPUT))\n      return sourceBody.length > MAX_HTML_PARSE_INPUT ? converted + TRUNCATE_MARKER : converted\n    }\n    const rawBody = m.bodyFormat === 'html'\n      ? (plainAlternative || convertHtmlBody())\n      : sourceBody\n    const truncatedBody =\n      rawBody.length > MAX_COMPOSE_BODY\n        ? rawBody.slice(0, MAX_COMPOSE_BODY - TRUNCATE_MARKER.length) + TRUNCATE_MARKER\n        : rawBody\n    const safeSubject = (m.subject ?? '').trim() || '(no subject)'\n\n    // #6106: a per-user channel is its owner's inbox, so the owner is the\n    // default assignee. Without this fallback the first message of a thread\n    // (no mapping yet) and every message on an unassigned mapping had no\n    // recipient, and the participant-scoped inbox showed it to nobody. A\n    // manual assignment stays authoritative; tenant-wide channels have no owner.\n    const routedAssigneeId = mapping?.assignedUserId ?? channel.userId ?? null\n\n    const composeInput = {\n      type: `channel.${input.providerKey}`,\n      visibility: 'public' as const,\n      sourceEntityType: 'communication_channels.external_conversation',\n      sourceEntityId: conversation.id,\n      externalEmail: contactHint?.email ?? undefined,\n      externalName: contactHint?.displayName ?? m.senderDisplayName,\n      // #4975: tells the hub which identity contract applies to this sender.\n      // Email-typed channels keep the mandatory `externalEmail`; providers whose\n      // senders have no address (Discord, Slack, SMS\u2026) are validated without it.\n      // The messages validator fails closed on any type it does not recognize.\n      sourceChannelType: input.channelType,\n      // #6093: this message came in from the channel, so the recipient below\n      // is internal routing (the conversation's assignee), not an external\n      // addressee. Without the flag the hub's \"no recipients on a public\n      // message\" rule rejected every message in an assigned conversation and\n      // the worker dropped it as a permanent failure.\n      inboundFromChannel: true,\n      recipients: routedAssigneeId\n        ? [{ userId: routedAssigneeId, type: 'to' as const }]\n        : [],\n      subject: safeSubject,\n      body: truncatedBody,\n      bodyFormat: (m.bodyFormat === 'html' ? 'text' : m.bodyFormat) as 'text' | 'markdown',\n      priority: 'normal' as const,\n      sendViaEmail: false,\n      // Spec B: matcher-resolved thread id takes priority over the existing\n      // conversation-based mapping. Falls through to `mapping?.messageThreadId`\n      // when the matcher returned null (no token / JWZ / subject hit).\n      parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,\n      isDraft: false,\n      // Stable dedup key so a retried ingest (after a transient failure between\n      // compose and the ExternalMessage anchor insert) reuses the message\n      // composed by the first attempt instead of duplicating it. Mirrors the\n      // (channel, externalMessageId) ExternalMessage anchor's natural key.\n      idempotencyKey: m.externalMessageId\n        ? `cc:${input.channelId}:${m.externalMessageId}`\n        : undefined,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId,\n      userId: await resolveCommunicationChannelsSystemUserId(\n        em,\n        input.scope.tenantId,\n        mapping?.assignedUserId ?? null,\n      ),\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const composeResult = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: passthroughCommandCtx(ctx, input.scope),\n      },\n    )\n    const message = composeResult.result\n    if (!message?.id) {\n      throw new Error('messages.messages.compose did not return a message id')\n    }\n\n    // (3 continued) Create or update ChannelThreadMapping now that we have a threadId.\n    if (!mapping) {\n      mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId: message.threadId ?? message.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        externalThreadRef: m.externalConversationId,\n        assignedUserId: channel.userId ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(mapping)\n    }\n\n    // (6) Create ExternalMessage + MessageChannelLink (hub-side records).\n    //\n    // The PrimaryKey for both uses `defaultRaw: 'gen_random_uuid()'` \u2014 a\n    // Postgres-side default that doesn't populate the entity's `id` field\n    // until after the INSERT returns. If we let MikroORM generate both, then\n    // `em.create(MessageChannelLink, { externalMessageId: externalMessage.id })`\n    // reads `undefined` for `externalMessage.id` (it hasn't been flushed yet)\n    // and writes NULL to `message_channel_links.external_message_id`,\n    // breaking the FK and causing downstream joins to silently return 0 rows.\n    //\n    // Pre-generating both UUIDs client-side fixes the cross-row reference\n    // problem and keeps the single-transaction flush semantics intact.\n    const externalMessageRowId = randomUUID()\n    const channelLinkRowId = randomUUID()\n    const externalMessage = em.create(ExternalMessage, {\n      id: externalMessageRowId,\n      channelId: input.channelId,\n      conversationId: conversation.id,\n      externalMessageId: m.externalMessageId,\n      direction: 'inbound',\n      senderIdentifier: m.senderIdentifier,\n      senderDisplayName: m.senderDisplayName ?? null,\n      providerTimestamp: m.timestamp,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(externalMessage)\n\n    // Spec B: annotate the link with which thread-matcher strategy resolved\n    // this message (or `'new-thread'` when matcher returned null and we\n    // opened a fresh thread). Surfaced to observability + future UI (\"this\n    // thread match is low-confidence \u2014 confirm or move\").\n    const matcherAnnotatedMetadata: Record<string, unknown> = {\n      ...((m.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n      threadMatchStrategy: threadMatch?.matchedBy ?? 'new-thread',\n      threadMatchConfidence: threadMatch?.confidence ?? 'low',\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      id: channelLinkRowId,\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessageRowId,\n      providerKey: input.providerKey,\n      channelType: input.channelType,\n      direction: 'inbound',\n      deliveryStatus: 'received',\n      channelPayload: m.channelPayload,\n      channelContentType: m.channelContentType,\n      channelMetadata: matcherAnnotatedMetadata,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(channelLink)\n\n    try {\n      await em.flush()\n    } catch (flushErr) {\n      // Concurrency guard: the pre-check at (1) is not atomic with this insert,\n      // so a poll re-fetch racing a push notification (or two push deliveries)\n      // can both pass the check and reach here. The `(channel_id,\n      // external_message_id)` unique index rejects the loser with a 23505. Treat\n      // that as a duplicate \u2014 returning here (instead of throwing) prevents the\n      // message from being dead-lettered and retried forever. The winning job\n      // already recorded the message + link.\n      if (isUniqueViolation(flushErr)) {\n        return {\n          status: 'duplicate',\n          externalConversationId: conversation.id,\n          externalMessageId: m.externalMessageId,\n        }\n      }\n      throw flushErr\n    }\n\n    // (7) Emit events \u2014 order matters for downstream subscribers.\n    if (conversationCreated) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.conversation.created',\n        {\n          conversationId: conversation.id,\n          channelId: input.channelId,\n          providerKey: input.providerKey,\n          channelType: input.channelType,\n          externalConversationId: m.externalConversationId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    if (matchedPersonId) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.contact.resolved',\n        {\n          conversationId: conversation.id,\n          contactPersonId: matchedPersonId,\n          providerKey: input.providerKey,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    await emitCommunicationChannelsEvent(\n      'communication_channels.message.received',\n      {\n        messageId: message.id,\n        externalMessageId: externalMessage.id,\n        channelLinkId: channelLink.id,\n        conversationId: conversation.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        channelType: input.channelType,\n        direction: 'inbound',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'created',\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessage.id,\n      channelLinkId: channelLink.id,\n      threadMappingId: mapping.id,\n      contactPersonId: matchedPersonId,\n    }\n  },\n}\n\n\n/**\n * Build a runtime context for the nested `messages.messages.compose` call.\n *\n * The compose command expects a `CommandRuntimeContext`. For inbound webhook\n * processing there is no platform user; we pass `auth: null` and use the tenant\n * scope from our input.\n */\nfunction passthroughCommandCtx(\n  parent: CommandRuntimeContext,\n  scope: IngestInboundMessageInput['scope'],\n): CommandRuntimeContext {\n  return {\n    container: parent.container,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n}\n\n/**\n * Pull a string value from the provider's `channelMetadata` map. Returns\n * `null` (not `undefined`) when the key is absent or the value isn't a\n * string \u2014 keeps the matcher's input shape predictable.\n */\nfunction extractStringFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string | null {\n  const value = meta[key]\n  if (typeof value === 'string' && value.length > 0) return value\n  return null\n}\n\n/**\n * Pull a string[] value from the provider's `channelMetadata` map.\n * Filters out non-string entries defensively. Returns an empty array\n * when the key is absent or the value isn't an array.\n */\nfunction extractStringArrayFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string[] {\n  const value = meta[key]\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is string => typeof item === 'string')\n}\n\nregisterCommand(ingestInboundMessageCommand)\n\nexport default ingestInboundMessageCommand\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAG/B,SAAS,mBAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gDAAgD;AACzD,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAEnG,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA,EACD,SAAS;AACX,CAAC;AAcM,MAAM,mDAAmD;AAmBhE,MAAM,8BAAqG;AAAA,EACzG,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAE9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAMA,UAAM,mBAAmB,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,mBAAmB,MAAM,QAAQ;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,wBAAwB,iBAAiB;AAAA,QACzC,mBAAmB,iBAAiB;AAAA,MACtC;AAAA,IACF;AAaA,UAAM,qBAAqB,MAAM;AAC/B,YAAM,WAAY,MAAM,QAAQ,iBAAyD;AACzF,UAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,aAAO;AAAA,IACT,GAAG;AACH,QAAI,mBAAmB;AAIrB,UAAI;AACF,cAAM,gBAAgB,MAAM,GAAG,cAAc,EAAE;AAAA,UAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWA;AAAA,YACE,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS,GAAG;AAC5D,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,wBAAwB,MAAM,QAAQ;AAAA,YACtC,mBAAmB,MAAM,QAAQ;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,UAAU;AAGjB,eAAO,KAAK,8CAA8C,EAAE,KAAK,SAAS,CAAC;AAAA,MAC7E;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,MAAM,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACpF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,MAAM,SAAS,kCAAkC;AAAA,IACzF;AAEA,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,MAAM,WAAW;AAAA,MAE/E;AAAA,IACF;AAGA,UAAM,IAAI,MAAM;AAChB,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,sBAAsB;AAC1B,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,SAAS,EAAE,WAAW;AAAA,QACtB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,eAAe,EAAE,aAAa,oBAAI,KAAK;AAAA,QACvC,gBAAgB,QAAQ,UAAU;AAAA,MACpC,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,4BAAsB;AAAA,IACxB;AAGA,QAAI,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAOA,QACE,CAAC,uBACD,EAAE,cACD,CAAC,aAAa,iBAAiB,EAAE,YAAY,aAAa,gBAC3D;AACA,mBAAa,gBAAgB,EAAE;AAAA,IACjC;AAGA,UAAM,GAAG,MAAM;AAef,UAAM,iBAAkB,EAAE,mBAAmB,CAAC;AAC9C,QAAI,cAAkC;AACtC,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,sBAAsB,gBAAgB,WAAW,KAAK,EAAE;AAAA,UACnE,WACE,EAAE,qBAAqB,sBAAsB,gBAAgB,WAAW;AAAA,UAC1E,YAAY,2BAA2B,gBAAgB,YAAY;AAAA,UACnE,SAAS,EAAE,WAAW;AAAA,UACtB,aACE,sBAAsB,gBAAgB,MAAM,KAAK,EAAE;AAAA,UACrD,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,WAAW,EAAE,eAAe,SAAS,OAAO,EAAE,QAAQ;AAAA,UACtD,UAAU,EAAE,eAAe,SAAS,EAAE,QAAQ,OAAO;AAAA,UACrD,YAAY,EAAE,aAAa,oBAAI,KAAK;AAAA,QACtC;AAAA,QACA,EAAE,GAAG;AAAA,MACP;AAAA,IACF,SAAS,YAAY;AAGnB,aAAO,KAAK,+DAA+D,EAAE,KAAK,WAAW,CAAC;AAAA,IAChG;AAGA,QAAI,cAIO;AACX,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE;AAAA,UACA,kBAAkB,EAAE;AAAA,UACpB,mBAAmB,EAAE;AAAA,UACrB,iBAAiB,EAAE;AAAA,UACnB,aAAa,CAAC;AAAA;AAAA,UACd,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,EAAE,WAAW,IAAI,UAAU;AAAA,MAC7B;AAAA,IACF,SAAS,YAAY;AAInB,aAAO,KAAK,6DAA6D,EAAE,KAAK,WAAW,CAAC;AAC5F,oBAAc;AAAA,IAChB;AACA,UAAM,kBAAkB,aAAa,mBAAmB;AACxD,QAAI,mBAAmB,aAAa,oBAAoB,iBAAiB;AACvE,mBAAa,kBAAkB;AAK/B,YAAM,GAAG,MAAM;AAAA,IACjB;AAyBA,UAAM,mBAAmB;AASzB,UAAM,uBAAuB,MAAM;AACnC,UAAM,kBACJ;AACF,UAAM,aAAa,EAAE,QAAQ;AAC7B,UAAM,mBACJ,OAAO,EAAE,gBAAgB,SAAS,WAAW,EAAE,eAAe,KAAK,KAAK,IAAI;AAC9E,UAAM,kBAAkB,MAAM;AAC5B,YAAM,YAAY,gBAAgB,WAAW,MAAM,GAAG,oBAAoB,CAAC;AAC3E,aAAO,WAAW,SAAS,uBAAuB,YAAY,kBAAkB;AAAA,IAClF;AACA,UAAM,UAAU,EAAE,eAAe,SAC5B,oBAAoB,gBAAgB,IACrC;AACJ,UAAM,gBACJ,QAAQ,SAAS,mBACb,QAAQ,MAAM,GAAG,mBAAmB,gBAAgB,MAAM,IAAI,kBAC9D;AACN,UAAM,eAAe,EAAE,WAAW,IAAI,KAAK,KAAK;AAOhD,UAAM,mBAAmB,SAAS,kBAAkB,QAAQ,UAAU;AAEtE,UAAM,eAAe;AAAA,MACnB,MAAM,WAAW,MAAM,WAAW;AAAA,MAClC,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB,gBAAgB,aAAa;AAAA,MAC7B,eAAe,aAAa,SAAS;AAAA,MACrC,cAAc,aAAa,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5C,mBAAmB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMzB,oBAAoB;AAAA,MACpB,YAAY,mBACR,CAAC,EAAE,QAAQ,kBAAkB,MAAM,KAAc,CAAC,IAClD,CAAC;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,YAAa,EAAE,eAAe,SAAS,SAAS,EAAE;AAAA,MAClD,UAAU;AAAA,MACV,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,iBAAiB,aAAa,mBAAmB,SAAS;AAAA,MAC1D,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA,MAKT,gBAAgB,EAAE,oBACd,MAAM,MAAM,SAAS,IAAI,EAAE,iBAAiB,KAC5C;AAAA,MACJ,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,SAAS,kBAAkB;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,gBAAgB,MAAM,WAAW;AAAA,MACrC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,sBAAsB,KAAK,MAAM,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAGA,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,OAAO,sBAAsB;AAAA,QACxC,wBAAwB,aAAa;AAAA,QACrC,iBAAiB,QAAQ,YAAY,QAAQ;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,gBAAgB,QAAQ,UAAU;AAAA,QAClC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAcA,UAAM,uBAAuB,WAAW;AACxC,UAAM,mBAAmB,WAAW;AACpC,UAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,MACjD,IAAI;AAAA,MACJ,WAAW,MAAM;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,mBAAmB,EAAE;AAAA,MACrB,WAAW;AAAA,MACX,kBAAkB,EAAE;AAAA,MACpB,mBAAmB,EAAE,qBAAqB;AAAA,MAC1C,mBAAmB,EAAE;AAAA,MACrB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,eAAe;AAM1B,UAAM,2BAAoD;AAAA,MACxD,GAAK,EAAE,mBAA2D,CAAC;AAAA,MACnE,qBAAqB,aAAa,aAAa;AAAA,MAC/C,uBAAuB,aAAa,cAAc;AAAA,IACpD;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD,IAAI;AAAA,MACJ,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB,EAAE;AAAA,MAClB,oBAAoB,EAAE;AAAA,MACtB,iBAAiB;AAAA,MACjB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,WAAW;AAEtB,QAAI;AACF,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,UAAU;AAQjB,UAAI,kBAAkB,QAAQ,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,wBAAwB,aAAa;AAAA,UACrC,mBAAmB,EAAE;AAAA,QACvB;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,qBAAqB;AACvB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB,wBAAwB,EAAE;AAAA,UAC1B,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,iBAAiB;AACnB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,iBAAiB;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,mBAAmB,gBAAgB;AAAA,QACnC,eAAe,YAAY;AAAA,QAC3B,gBAAgB,aAAa;AAAA,QAC7B,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA,QACX,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB,gBAAgB;AAAA,MACnC,eAAe,YAAY;AAAA,MAC3B,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF;AAUA,SAAS,sBACP,QACA,OACuB;AACvB,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AACF;AAOA,SAAS,sBACP,MACA,KACe;AACf,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAO;AACT;AAOA,SAAS,2BACP,MACA,KACU;AACV,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,gBAAgB,2BAA2B;AAE3C,IAAO,iCAAQ;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus, CommandHandler, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { htmlToPlainText } from '@open-mercato/shared/lib/html/htmlToPlainText'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { resolveContact } from '../lib/contact-resolver'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { matchThread, type ThreadMatch } from '../lib/thread-matcher'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { normalizedInboundMessageSchema } from '../data/validators'\nimport { resolveCommunicationChannelsSystemUserId } from '../lib/system-user'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'ingest-inbound-message' })\n\nconst ingestInputSchema = z.object({\n  channelId: z.string().uuid(),\n  providerKey: z.string().min(1),\n  channelType: z.string().min(1),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  message: normalizedInboundMessageSchema,\n})\n\nexport type IngestInboundMessageInput = z.infer<typeof ingestInputSchema>\n\nexport type IngestInboundMessageResult = {\n  status: 'created' | 'duplicate'\n  messageId?: string\n  externalConversationId?: string\n  externalMessageId?: string\n  channelLinkId?: string\n  threadMappingId?: string\n  contactPersonId?: string | null\n}\n\nexport const COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID = 'communication_channels.message.ingest_inbound'\n\n/**\n * Idempotently ingest a normalized inbound channel message.\n *\n * Steps (per SPEC-045d \u00A76):\n *   1. Dedup by `(channel_id, external_message_id)` \u2014 if a MessageChannelLink already\n *      exists for that pair, return `{ status: 'duplicate' }` without side effects.\n *   2. Create or load `ExternalConversation` by `(channel_id, external_conversation_id)`.\n *   3. Create or load `ChannelThreadMapping` (1:1 with ExternalConversation).\n *   4. Resolve CRM contact via adapter + QueryEngine (best-effort).\n *   5. Compose the platform `Message` via `messages.messages.compose` (separate transaction).\n *   6. Create `ExternalMessage` + `MessageChannelLink`.\n *   7. Emit `communication_channels.message.received` (and `.conversation.created` / `.contact.resolved` when applicable).\n *\n * The two-transaction model (compose-message-then-record-link) is acceptable for v1;\n * the link's unique-on-message-id constraint is the safety net against orphans. See\n * the pre-implementation analysis for a discussion of single-transaction alternatives.\n */\nconst ingestInboundMessageCommand: CommandHandler<IngestInboundMessageInput, IngestInboundMessageResult> = {\n  id: COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = ingestInputSchema.parse(rawInput) as IngestInboundMessageInput\n\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Dedup: short-circuit if we've already processed this provider message.\n    // The unique constraint is on `messageId`, not (channel, externalMessageId).\n    // We must dedup by joining against ExternalMessage which IS uniquely indexed by\n    // (channel_id, external_message_id). Hub-side dedup is the authoritative gate.\n    const existingExternal = await findOneWithDecryption(\n      em,\n      ExternalMessage,\n      {\n        channelId: input.channelId,\n        externalMessageId: input.message.externalMessageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (existingExternal) {\n      return {\n        status: 'duplicate',\n        externalConversationId: existingExternal.conversationId,\n        externalMessageId: existingExternal.id,\n      }\n    }\n\n    // (1b) Spec B \u00A7 Sent-folder dedup.\n    //\n    // When an outbound message lands in the user's IMAP Sent folder (or\n    // when Gmail's \"send and archive\" deposits it in All Mail), the next\n    // poll will re-fetch it from INBOX as if it were inbound. Skip it\n    // here using the RFC 5322 `Message-ID` header \u2014 we recorded it on the\n    // outbound `MessageChannelLink.channelMetadata.messageId` at send time.\n    //\n    // We dedup ONLY on outbound links (direction='outbound') for the same\n    // channel \u2014 that way an inbound copy of someone ELSE's email that\n    // happens to share a Message-ID is still ingested normally.\n    const incomingMessageId = (() => {\n      const fromMeta = (input.message.channelMetadata as Record<string, unknown> | undefined)?.messageId\n      if (typeof fromMeta === 'string' && fromMeta.length > 0) return fromMeta\n      return null\n    })()\n    if (incomingMessageId) {\n      // MikroORM v7 dropped the Knex builder in favour of Kysely/raw SQL.\n      // We use a positional-placeholder raw query for the JSONB\n      // `channel_metadata->>messageId` comparison.\n      try {\n        const sentFolderHit = await em.getConnection().execute<Array<{ id: string }>>(\n          `SELECT link.id FROM message_channel_links AS link\n             INNER JOIN external_conversations AS conv\n               ON conv.id = link.external_conversation_id\n            WHERE link.tenant_id = ?\n              AND ((?::uuid IS NULL AND link.organization_id IS NULL) OR link.organization_id = ?::uuid)\n              AND conv.tenant_id = ?\n              AND ((?::uuid IS NULL AND conv.organization_id IS NULL) OR conv.organization_id = ?::uuid)\n              AND conv.channel_id = ?\n              AND link.direction = 'outbound'\n              AND link.channel_metadata->>'messageId' = ?\n            LIMIT 1`,\n          [\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.scope.tenantId,\n            input.scope.organizationId ?? null,\n            input.scope.organizationId ?? null,\n            input.channelId,\n            incomingMessageId,\n          ],\n        )\n        if (Array.isArray(sentFolderHit) && sentFolderHit.length > 0) {\n          return {\n            status: 'duplicate',\n            externalConversationId: input.message.externalConversationId,\n            externalMessageId: input.message.externalMessageId,\n          }\n        }\n      } catch (dedupErr) {\n        // Sent-folder dedup is best-effort \u2014 a failure here must not abort\n        // ingest (better a possible duplicate than a lost inbound message).\n        logger.warn('sent-folder dedup query failed, continuing', { err: dedupErr })\n      }\n    }\n\n    // Channel + adapter lookup (the channel must exist + be active).\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: input.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${input.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${input.channelId} is inactive; refusing to ingest`)\n    }\n\n    const adapter = adapterRegistry.get(input.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${input.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (2) ExternalConversation upsert by (channel_id, externalConversationId).\n    const m = input.message\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    let conversationCreated = false\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: input.channelId,\n        externalConversationId: m.externalConversationId,\n        subject: m.subject ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        lastMessageAt: m.timestamp ?? new Date(),\n        assignedUserId: channel.userId ?? null,\n      })\n      em.persist(conversation)\n      conversationCreated = true\n    }\n\n    // (3) ChannelThreadMapping upsert (1:1 with ExternalConversation per tenant).\n    let mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n\n    // Last-activity bump on an existing conversation. Applied AFTER the mapping\n    // lookup, immediately before the flush, so the scalar mutation and its flush\n    // stay adjacent with no query in between (core flush-ordering rule \u2014 a query\n    // between a scalar mutation and `em.flush()` can drop the change under some\n    // flush modes / subscriber configurations).\n    if (\n      !conversationCreated &&\n      m.timestamp &&\n      (!conversation.lastMessageAt || m.timestamp > conversation.lastMessageAt)\n    ) {\n      conversation.lastMessageAt = m.timestamp\n    }\n    // We'll fill `messageThreadId` after composing the platform Message (since the\n    // first inbound message becomes the thread root in the messages module).\n    await em.flush()\n\n    // (3b) Spec B \u2014 layered thread match.\n    //\n    // Resolve the inbound message to an existing platform thread using\n    // (in priority order):\n    //   1. Crypto token in References / In-Reply-To header (high confidence)\n    //   2. Crypto token in body hidden span or plain-text marker (high)\n    //   3. JWZ on Message-Id \u2194 stored `MessageChannelLink.channelMetadata.messageId` (medium)\n    //   4. Subject + participants in last 30 days, same channel (low)\n    //\n    // The matcher returns `null` when nothing hits \u2014 in that case we fall\n    // back to the existing `ChannelThreadMapping`-by-conversation-id lookup\n    // (which also returns null on first-ever inbound, in which case the\n    // compose command opens a new thread).\n    const metaForMatcher = (m.channelMetadata ?? {}) as Record<string, unknown>\n    let threadMatch: ThreadMatch | null = null\n    try {\n      threadMatch = await matchThread(\n        {\n          channelId: input.channelId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          messageId: extractStringFromMeta(metaForMatcher, 'messageId') ?? m.externalMessageId,\n          inReplyTo:\n            m.replyToExternalId ?? extractStringFromMeta(metaForMatcher, 'inReplyTo'),\n          references: extractStringArrayFromMeta(metaForMatcher, 'references'),\n          subject: m.subject ?? '',\n          fromAddress:\n            extractStringFromMeta(metaForMatcher, 'from') ?? m.senderIdentifier,\n          toAddresses: extractStringArrayFromMeta(metaForMatcher, 'to'),\n          ccAddresses: extractStringArrayFromMeta(metaForMatcher, 'cc'),\n          bodyPlain: m.bodyFormat === 'html' ? null : m.body ?? null,\n          bodyHtml: m.bodyFormat === 'html' ? m.body ?? null : null,\n          receivedAt: m.timestamp ?? new Date(),\n        },\n        { em },\n      )\n    } catch (matcherErr) {\n      // Matcher failure must not block ingest \u2014 fall back to the existing\n      // conversation-based thread mapping so the message still lands.\n      logger.warn('thread matcher failed, falling back to conversation mapping', { err: matcherErr })\n    }\n\n    // (4) Contact resolution (best-effort, advisory).\n    let contactHint: {\n      matchedPersonId?: string | null\n      email?: string\n      displayName?: string\n    } | null = null\n    try {\n      contactHint = await resolveContact(\n        {\n          adapter,\n          senderIdentifier: m.senderIdentifier,\n          senderDisplayName: m.senderDisplayName,\n          channelMetadata: m.channelMetadata,\n          credentials: {}, // credentials decrypted at the webhook route; resolver doesn't re-fetch\n          scope: {\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? input.scope.tenantId,\n          },\n        },\n        { container: ctx.container },\n      )\n    } catch (contactErr) {\n      // Best-effort: contact resolution is advisory and must not abort ingest.\n      // Log like the sibling dedup/matcher catches so a misbehaving resolver is\n      // visible in operator logs instead of failing silently.\n      logger.warn('contact resolution failed, continuing without a CRM match', { err: contactErr })\n      contactHint = null\n    }\n    const matchedPersonId = contactHint?.matchedPersonId ?? null\n    if (matchedPersonId && conversation.contactPersonId !== matchedPersonId) {\n      conversation.contactPersonId = matchedPersonId\n      // Flush this scalar mutation before the system-user lookup below queries the\n      // same EntityManager. SPEC-018: a query between a scalar mutation and its\n      // flush can silently discard the pending UPDATE (mirrors the lastMessageAt\n      // bump above).\n      await em.flush()\n    }\n\n    // (5) Compose the platform Message via the messages module command.\n    //\n    // Sanitize against the `messages` module's validators (max 50_000 char body\n    // + non-empty subject) so real-world emails don't get rejected mid-ingest:\n    //   - HTML emails routinely exceed 50k (Gmail signatures, marketing\n    //     templates, RFC 5322 multipart). Truncate with a marker rather than\n    //     drop the whole message \u2014 the full raw body is still in\n    //     ExternalMessage.rawPayload if needed for forensic / forward use.\n    //   - Some legitimate messages have no subject (notifications, bounce\n    //     digests). Substitute a placeholder instead of failing ingest.\n    //   - HTML bodies land in the platform body as plain text rather than being\n    //     merely relabelled as `text`: `MarkdownContent` renders a `text` body\n    //     verbatim, so unconverted markup shows up as literal doctype, <style>\n    //     blocks and tags in the inbox preview and the detail body. The source\n    //     markup is untouched in `channelPayload.html`, which `data/enrichers.ts`\n    //     sanitizes into `_channelPayload.sanitizedHtml` for the channel-payload\n    //     renderer widget mounted at `detail:messages:message:body:after`.\n    //   - The plain-text alternative wins over conversion when the sender's\n    //     client supplied one (`multipart/alternative`), because that part is\n    //     what a human actually wrote; `html-to-text` output \u2014 inlined link\n    //     URLs, flattened tables, synthesized list markers \u2014 is the fallback for\n    //     HTML-only senders. `lib/email-mime.ts` preferred `bodyHtml` when\n    //     picking `body`, but preserved the text part at `channelPayload.text`.\n    const MAX_COMPOSE_BODY = 50_000\n    // Bound the synchronous parse: inbound mail is untrusted and the 5MB body\n    // ceiling from `lib/email-capabilities.ts` would otherwise block the ingest\n    // worker on a single oversized document. This cap counts markup bytes while\n    // MAX_COMPOSE_BODY counts text characters, so it can bite first \u2014 an\n    // ordinary marketing template or a long quoted thread is easily over 512KB\n    // of markup and still well under 50k characters of text. It therefore\n    // carries the same truncation marker, rather than ending mid-sentence with\n    // nothing to tell the reader the rest exists.\n    const MAX_HTML_PARSE_INPUT = 512 * 1024\n    const TRUNCATE_MARKER =\n      '\\n\\n[\u2026message truncated by Open Mercato \u2014 full body preserved in ExternalMessage.rawPayload]'\n    const sourceBody = m.body ?? ''\n    const plainAlternative =\n      typeof m.channelPayload?.text === 'string' ? m.channelPayload.text.trim() : ''\n    const convertHtmlBody = () => {\n      const converted = htmlToPlainText(sourceBody.slice(0, MAX_HTML_PARSE_INPUT))\n      return sourceBody.length > MAX_HTML_PARSE_INPUT ? converted + TRUNCATE_MARKER : converted\n    }\n    const rawBody = m.bodyFormat === 'html'\n      ? (plainAlternative || convertHtmlBody())\n      : sourceBody\n    const truncatedBody =\n      rawBody.length > MAX_COMPOSE_BODY\n        ? rawBody.slice(0, MAX_COMPOSE_BODY - TRUNCATE_MARKER.length) + TRUNCATE_MARKER\n        : rawBody\n    const safeSubject = (m.subject ?? '').trim() || '(no subject)'\n\n    // #6106: a per-user channel is its owner's inbox, so the owner is the\n    // default assignee. Without this fallback the first message of a thread\n    // (no mapping yet) and every message on an unassigned mapping had no\n    // recipient, and the participant-scoped inbox showed it to nobody. A\n    // manual assignment stays authoritative; tenant-wide channels have no owner.\n    const routedAssigneeId = mapping?.assignedUserId ?? channel.userId ?? null\n\n    const composeInput = {\n      type: `channel.${input.providerKey}`,\n      visibility: 'public' as const,\n      sourceEntityType: 'communication_channels.external_conversation',\n      sourceEntityId: conversation.id,\n      externalEmail: contactHint?.email ?? undefined,\n      externalName: contactHint?.displayName ?? m.senderDisplayName,\n      // #4975: tells the hub which identity contract applies to this sender.\n      // Email-typed channels keep the mandatory `externalEmail`; providers whose\n      // senders have no address (Discord, Slack, SMS\u2026) are validated without it.\n      // The messages validator fails closed on any type it does not recognize.\n      sourceChannelType: input.channelType,\n      // #6093: this message came in from the channel, so the recipient below\n      // is internal routing (the conversation's assignee), not an external\n      // addressee. Without the flag the hub's \"no recipients on a public\n      // message\" rule rejected every message in an assigned conversation and\n      // the worker dropped it as a permanent failure.\n      inboundFromChannel: true,\n      recipients: routedAssigneeId\n        ? [{ userId: routedAssigneeId, type: 'to' as const }]\n        : [],\n      subject: safeSubject,\n      body: truncatedBody,\n      bodyFormat: (m.bodyFormat === 'html' ? 'text' : m.bodyFormat) as 'text' | 'markdown',\n      priority: 'normal' as const,\n      sendViaEmail: false,\n      // Spec B: matcher-resolved thread id takes priority over the existing\n      // conversation-based mapping. Falls through to `mapping?.messageThreadId`\n      // when the matcher returned null (no token / JWZ / subject hit).\n      parentMessageId: threadMatch?.messageThreadId ?? mapping?.messageThreadId,\n      isDraft: false,\n      // #6095: the platform message is dated when the provider received the\n      // mail, not when this worker ran. Otherwise a history import lands every\n      // message on the import minute and the inbox (sorted on `sent_at`) shows\n      // a 90-day mailbox as one block in import order. Adapters without a\n      // timestamp fall through to compose's own `new Date()`.\n      sentAt: m.timestamp ?? undefined,\n      // Stable dedup key so a retried ingest (after a transient failure between\n      // compose and the ExternalMessage anchor insert) reuses the message\n      // composed by the first attempt instead of duplicating it. Mirrors the\n      // (channel, externalMessageId) ExternalMessage anchor's natural key.\n      idempotencyKey: m.externalMessageId\n        ? `cc:${input.channelId}:${m.externalMessageId}`\n        : undefined,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId,\n      userId: await resolveCommunicationChannelsSystemUserId(\n        em,\n        input.scope.tenantId,\n        mapping?.assignedUserId ?? null,\n      ),\n    }\n\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const composeResult = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: passthroughCommandCtx(ctx, input.scope),\n      },\n    )\n    const message = composeResult.result\n    if (!message?.id) {\n      throw new Error('messages.messages.compose did not return a message id')\n    }\n\n    // (3 continued) Create or update ChannelThreadMapping now that we have a threadId.\n    if (!mapping) {\n      mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId: message.threadId ?? message.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        externalThreadRef: m.externalConversationId,\n        assignedUserId: channel.userId ?? null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(mapping)\n    }\n\n    // (6) Create ExternalMessage + MessageChannelLink (hub-side records).\n    //\n    // The PrimaryKey for both uses `defaultRaw: 'gen_random_uuid()'` \u2014 a\n    // Postgres-side default that doesn't populate the entity's `id` field\n    // until after the INSERT returns. If we let MikroORM generate both, then\n    // `em.create(MessageChannelLink, { externalMessageId: externalMessage.id })`\n    // reads `undefined` for `externalMessage.id` (it hasn't been flushed yet)\n    // and writes NULL to `message_channel_links.external_message_id`,\n    // breaking the FK and causing downstream joins to silently return 0 rows.\n    //\n    // Pre-generating both UUIDs client-side fixes the cross-row reference\n    // problem and keeps the single-transaction flush semantics intact.\n    const externalMessageRowId = randomUUID()\n    const channelLinkRowId = randomUUID()\n    const externalMessage = em.create(ExternalMessage, {\n      id: externalMessageRowId,\n      channelId: input.channelId,\n      conversationId: conversation.id,\n      externalMessageId: m.externalMessageId,\n      direction: 'inbound',\n      senderIdentifier: m.senderIdentifier,\n      senderDisplayName: m.senderDisplayName ?? null,\n      providerTimestamp: m.timestamp,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(externalMessage)\n\n    // Spec B: annotate the link with which thread-matcher strategy resolved\n    // this message (or `'new-thread'` when matcher returned null and we\n    // opened a fresh thread). Surfaced to observability + future UI (\"this\n    // thread match is low-confidence \u2014 confirm or move\").\n    const matcherAnnotatedMetadata: Record<string, unknown> = {\n      ...((m.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n      threadMatchStrategy: threadMatch?.matchedBy ?? 'new-thread',\n      threadMatchConfidence: threadMatch?.confidence ?? 'low',\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      id: channelLinkRowId,\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessageRowId,\n      providerKey: input.providerKey,\n      channelType: input.channelType,\n      direction: 'inbound',\n      deliveryStatus: 'received',\n      channelPayload: m.channelPayload,\n      channelContentType: m.channelContentType,\n      channelMetadata: matcherAnnotatedMetadata,\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    })\n    em.persist(channelLink)\n\n    try {\n      await em.flush()\n    } catch (flushErr) {\n      // Concurrency guard: the pre-check at (1) is not atomic with this insert,\n      // so a poll re-fetch racing a push notification (or two push deliveries)\n      // can both pass the check and reach here. The `(channel_id,\n      // external_message_id)` unique index rejects the loser with a 23505. Treat\n      // that as a duplicate \u2014 returning here (instead of throwing) prevents the\n      // message from being dead-lettered and retried forever. The winning job\n      // already recorded the message + link.\n      if (isUniqueViolation(flushErr)) {\n        return {\n          status: 'duplicate',\n          externalConversationId: conversation.id,\n          externalMessageId: m.externalMessageId,\n        }\n      }\n      throw flushErr\n    }\n\n    // (7) Emit events \u2014 order matters for downstream subscribers.\n    if (conversationCreated) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.conversation.created',\n        {\n          conversationId: conversation.id,\n          channelId: input.channelId,\n          providerKey: input.providerKey,\n          channelType: input.channelType,\n          externalConversationId: m.externalConversationId,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    if (matchedPersonId) {\n      await emitCommunicationChannelsEvent(\n        'communication_channels.contact.resolved',\n        {\n          conversationId: conversation.id,\n          contactPersonId: matchedPersonId,\n          providerKey: input.providerKey,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n    }\n    await emitCommunicationChannelsEvent(\n      'communication_channels.message.received',\n      {\n        messageId: message.id,\n        externalMessageId: externalMessage.id,\n        channelLinkId: channelLink.id,\n        conversationId: conversation.id,\n        channelId: input.channelId,\n        providerKey: input.providerKey,\n        channelType: input.channelType,\n        direction: 'inbound',\n        // #6095: subscribers that date their own rows from this message (the\n        // customers timeline) need the provider's receive time, not the moment\n        // this worker ran. Carried here so no consumer has to read the\n        // ExternalMessage row across the module boundary. ISO string because a\n        // persistent event is serialized onto the queue; null when the adapter\n        // supplied no timestamp, which leaves the consumer's own fallback.\n        providerTimestamp:\n          externalMessage.providerTimestamp instanceof Date\n            ? externalMessage.providerTimestamp.toISOString()\n            : null,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n\n    return {\n      status: 'created',\n      messageId: message.id,\n      externalConversationId: conversation.id,\n      externalMessageId: externalMessage.id,\n      channelLinkId: channelLink.id,\n      threadMappingId: mapping.id,\n      contactPersonId: matchedPersonId,\n    }\n  },\n}\n\n\n/**\n * Build a runtime context for the nested `messages.messages.compose` call.\n *\n * The compose command expects a `CommandRuntimeContext`. For inbound webhook\n * processing there is no platform user; we pass `auth: null` and use the tenant\n * scope from our input.\n */\nfunction passthroughCommandCtx(\n  parent: CommandRuntimeContext,\n  scope: IngestInboundMessageInput['scope'],\n): CommandRuntimeContext {\n  return {\n    container: parent.container,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n}\n\n/**\n * Pull a string value from the provider's `channelMetadata` map. Returns\n * `null` (not `undefined`) when the key is absent or the value isn't a\n * string \u2014 keeps the matcher's input shape predictable.\n */\nfunction extractStringFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string | null {\n  const value = meta[key]\n  if (typeof value === 'string' && value.length > 0) return value\n  return null\n}\n\n/**\n * Pull a string[] value from the provider's `channelMetadata` map.\n * Filters out non-string entries defensively. Returns an empty array\n * when the key is absent or the value isn't an array.\n */\nfunction extractStringArrayFromMeta(\n  meta: Record<string, unknown>,\n  key: string,\n): string[] {\n  const value = meta[key]\n  if (!Array.isArray(value)) return []\n  return value.filter((item): item is string => typeof item === 'string')\n}\n\nregisterCommand(ingestInboundMessageCommand)\n\nexport default ingestInboundMessageCommand\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB;AAChC,SAAS,sCAAsC;AAC/C,SAAS,sBAAsB;AAG/B,SAAS,mBAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sCAAsC;AAC/C,SAAS,gDAAgD;AACzD,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,yBAAyB,CAAC;AAEnG,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAC7B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA,EACD,SAAS;AACX,CAAC;AAcM,MAAM,mDAAmD;AAmBhE,MAAM,8BAAqG;AAAA,EACzG,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,kBAAkB,MAAM,QAAQ;AAE9C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAMA,UAAM,mBAAmB,MAAM;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,mBAAmB,MAAM,QAAQ;AAAA,QACjC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,kBAAkB;AACpB,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,wBAAwB,iBAAiB;AAAA,QACzC,mBAAmB,iBAAiB;AAAA,MACtC;AAAA,IACF;AAaA,UAAM,qBAAqB,MAAM;AAC/B,YAAM,WAAY,MAAM,QAAQ,iBAAyD;AACzF,UAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,aAAO;AAAA,IACT,GAAG;AACH,QAAI,mBAAmB;AAIrB,UAAI;AACF,cAAM,gBAAgB,MAAM,GAAG,cAAc,EAAE;AAAA,UAC7C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAWA;AAAA,YACE,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM;AAAA,YACZ,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM,MAAM,kBAAkB;AAAA,YAC9B,MAAM;AAAA,YACN;AAAA,UACF;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,aAAa,KAAK,cAAc,SAAS,GAAG;AAC5D,iBAAO;AAAA,YACL,QAAQ;AAAA,YACR,wBAAwB,MAAM,QAAQ;AAAA,YACtC,mBAAmB,MAAM,QAAQ;AAAA,UACnC;AAAA,QACF;AAAA,MACF,SAAS,UAAU;AAGjB,eAAO,KAAK,8CAA8C,EAAE,KAAK,SAAS,CAAC;AAAA,MAC7E;AAAA,IACF;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,MAAM,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACpF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,MAAM,SAAS,kCAAkC;AAAA,IACzF;AAEA,UAAM,UAAU,gBAAgB,IAAI,MAAM,WAAW;AACrD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,MAAM,WAAW;AAAA,MAE/E;AAAA,IACF;AAGA,UAAM,IAAI,MAAM;AAChB,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,sBAAsB;AAC1B,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,wBAAwB,EAAE;AAAA,QAC1B,SAAS,EAAE,WAAW;AAAA,QACtB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,eAAe,EAAE,aAAa,oBAAI,KAAK;AAAA,QACvC,gBAAgB,QAAQ,UAAU;AAAA,MACpC,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,4BAAsB;AAAA,IACxB;AAGA,QAAI,UAAU,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAOA,QACE,CAAC,uBACD,EAAE,cACD,CAAC,aAAa,iBAAiB,EAAE,YAAY,aAAa,gBAC3D;AACA,mBAAa,gBAAgB,EAAE;AAAA,IACjC;AAGA,UAAM,GAAG,MAAM;AAef,UAAM,iBAAkB,EAAE,mBAAmB,CAAC;AAC9C,QAAI,cAAkC;AACtC,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE,WAAW,MAAM;AAAA,UACjB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,sBAAsB,gBAAgB,WAAW,KAAK,EAAE;AAAA,UACnE,WACE,EAAE,qBAAqB,sBAAsB,gBAAgB,WAAW;AAAA,UAC1E,YAAY,2BAA2B,gBAAgB,YAAY;AAAA,UACnE,SAAS,EAAE,WAAW;AAAA,UACtB,aACE,sBAAsB,gBAAgB,MAAM,KAAK,EAAE;AAAA,UACrD,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,aAAa,2BAA2B,gBAAgB,IAAI;AAAA,UAC5D,WAAW,EAAE,eAAe,SAAS,OAAO,EAAE,QAAQ;AAAA,UACtD,UAAU,EAAE,eAAe,SAAS,EAAE,QAAQ,OAAO;AAAA,UACrD,YAAY,EAAE,aAAa,oBAAI,KAAK;AAAA,QACtC;AAAA,QACA,EAAE,GAAG;AAAA,MACP;AAAA,IACF,SAAS,YAAY;AAGnB,aAAO,KAAK,+DAA+D,EAAE,KAAK,WAAW,CAAC;AAAA,IAChG;AAGA,QAAI,cAIO;AACX,QAAI;AACF,oBAAc,MAAM;AAAA,QAClB;AAAA,UACE;AAAA,UACA,kBAAkB,EAAE;AAAA,UACpB,mBAAmB,EAAE;AAAA,UACrB,iBAAiB,EAAE;AAAA,UACnB,aAAa,CAAC;AAAA;AAAA,UACd,OAAO;AAAA,YACL,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB,MAAM,MAAM;AAAA,UAC5D;AAAA,QACF;AAAA,QACA,EAAE,WAAW,IAAI,UAAU;AAAA,MAC7B;AAAA,IACF,SAAS,YAAY;AAInB,aAAO,KAAK,6DAA6D,EAAE,KAAK,WAAW,CAAC;AAC5F,oBAAc;AAAA,IAChB;AACA,UAAM,kBAAkB,aAAa,mBAAmB;AACxD,QAAI,mBAAmB,aAAa,oBAAoB,iBAAiB;AACvE,mBAAa,kBAAkB;AAK/B,YAAM,GAAG,MAAM;AAAA,IACjB;AAyBA,UAAM,mBAAmB;AASzB,UAAM,uBAAuB,MAAM;AACnC,UAAM,kBACJ;AACF,UAAM,aAAa,EAAE,QAAQ;AAC7B,UAAM,mBACJ,OAAO,EAAE,gBAAgB,SAAS,WAAW,EAAE,eAAe,KAAK,KAAK,IAAI;AAC9E,UAAM,kBAAkB,MAAM;AAC5B,YAAM,YAAY,gBAAgB,WAAW,MAAM,GAAG,oBAAoB,CAAC;AAC3E,aAAO,WAAW,SAAS,uBAAuB,YAAY,kBAAkB;AAAA,IAClF;AACA,UAAM,UAAU,EAAE,eAAe,SAC5B,oBAAoB,gBAAgB,IACrC;AACJ,UAAM,gBACJ,QAAQ,SAAS,mBACb,QAAQ,MAAM,GAAG,mBAAmB,gBAAgB,MAAM,IAAI,kBAC9D;AACN,UAAM,eAAe,EAAE,WAAW,IAAI,KAAK,KAAK;AAOhD,UAAM,mBAAmB,SAAS,kBAAkB,QAAQ,UAAU;AAEtE,UAAM,eAAe;AAAA,MACnB,MAAM,WAAW,MAAM,WAAW;AAAA,MAClC,YAAY;AAAA,MACZ,kBAAkB;AAAA,MAClB,gBAAgB,aAAa;AAAA,MAC7B,eAAe,aAAa,SAAS;AAAA,MACrC,cAAc,aAAa,eAAe,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5C,mBAAmB,MAAM;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMzB,oBAAoB;AAAA,MACpB,YAAY,mBACR,CAAC,EAAE,QAAQ,kBAAkB,MAAM,KAAc,CAAC,IAClD,CAAC;AAAA,MACL,SAAS;AAAA,MACT,MAAM;AAAA,MACN,YAAa,EAAE,eAAe,SAAS,SAAS,EAAE;AAAA,MAClD,UAAU;AAAA,MACV,cAAc;AAAA;AAAA;AAAA;AAAA,MAId,iBAAiB,aAAa,mBAAmB,SAAS;AAAA,MAC1D,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMT,QAAQ,EAAE,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,MAKvB,gBAAgB,EAAE,oBACd,MAAM,MAAM,SAAS,IAAI,EAAE,iBAAiB,KAC5C;AAAA,MACJ,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM;AAAA,MAC5B,QAAQ,MAAM;AAAA,QACZ;AAAA,QACA,MAAM,MAAM;AAAA,QACZ,SAAS,kBAAkB;AAAA,MAC7B;AAAA,IACF;AAEA,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,gBAAgB,MAAM,WAAW;AAAA,MACrC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK,sBAAsB,KAAK,MAAM,KAAK;AAAA,MAC7C;AAAA,IACF;AACA,UAAM,UAAU,cAAc;AAC9B,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AAGA,QAAI,CAAC,SAAS;AACZ,gBAAU,GAAG,OAAO,sBAAsB;AAAA,QACxC,wBAAwB,aAAa;AAAA,QACrC,iBAAiB,QAAQ,YAAY,QAAQ;AAAA,QAC7C,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,mBAAmB,EAAE;AAAA,QACrB,gBAAgB,QAAQ,UAAU;AAAA,QAClC,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAcA,UAAM,uBAAuB,WAAW;AACxC,UAAM,mBAAmB,WAAW;AACpC,UAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,MACjD,IAAI;AAAA,MACJ,WAAW,MAAM;AAAA,MACjB,gBAAgB,aAAa;AAAA,MAC7B,mBAAmB,EAAE;AAAA,MACrB,WAAW;AAAA,MACX,kBAAkB,EAAE;AAAA,MACpB,mBAAmB,EAAE,qBAAqB;AAAA,MAC1C,mBAAmB,EAAE;AAAA,MACrB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,eAAe;AAM1B,UAAM,2BAAoD;AAAA,MACxD,GAAK,EAAE,mBAA2D,CAAC;AAAA,MACnE,qBAAqB,aAAa,aAAa;AAAA,MAC/C,uBAAuB,aAAa,cAAc;AAAA,IACpD;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD,IAAI;AAAA,MACJ,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM;AAAA,MACnB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB,EAAE;AAAA,MAClB,oBAAoB,EAAE;AAAA,MACtB,iBAAiB;AAAA,MACjB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD,CAAC;AACD,OAAG,QAAQ,WAAW;AAEtB,QAAI;AACF,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,UAAU;AAQjB,UAAI,kBAAkB,QAAQ,GAAG;AAC/B,eAAO;AAAA,UACL,QAAQ;AAAA,UACR,wBAAwB,aAAa;AAAA,UACrC,mBAAmB,EAAE;AAAA,QACvB;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAGA,QAAI,qBAAqB;AACvB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,WAAW,MAAM;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,aAAa,MAAM;AAAA,UACnB,wBAAwB,EAAE;AAAA,UAC1B,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,QAAI,iBAAiB;AACnB,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,gBAAgB,aAAa;AAAA,UAC7B,iBAAiB;AAAA,UACjB,aAAa,MAAM;AAAA,UACnB,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAAA,IACF;AACA,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,mBAAmB,gBAAgB;AAAA,QACnC,eAAe,YAAY;AAAA,QAC3B,gBAAgB,aAAa;AAAA,QAC7B,WAAW,MAAM;AAAA,QACjB,aAAa,MAAM;AAAA,QACnB,aAAa,MAAM;AAAA,QACnB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOX,mBACE,gBAAgB,6BAA6B,OACzC,gBAAgB,kBAAkB,YAAY,IAC9C;AAAA,QACN,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,QAAQ;AAAA,MACnB,wBAAwB,aAAa;AAAA,MACrC,mBAAmB,gBAAgB;AAAA,MACnC,eAAe,YAAY;AAAA,MAC3B,iBAAiB,QAAQ;AAAA,MACzB,iBAAiB;AAAA,IACnB;AAAA,EACF;AACF;AAUA,SAAS,sBACP,QACA,OACuB;AACvB,SAAO;AAAA,IACL,WAAW,OAAO;AAAA,IAClB,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AACF;AAOA,SAAS,sBACP,MACA,KACe;AACf,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAC1D,SAAO;AACT;AAOA,SAAS,2BACP,MACA,KACU;AACV,QAAM,QAAQ,KAAK,GAAG;AACtB,MAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,SAAO,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,QAAQ;AACxE;AAEA,gBAAgB,2BAA2B;AAE3C,IAAO,iCAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/lib/email-mime.js

@@ -216,6 +216,19 @@ function extractHeaders(headers) {
   }
   return out;
 }
+const MAX_MIME_DATE_FUTURE_SKEW_MS = 24 * 60 * 60 * 1e3;
+function isValidDate(value) {
+  return value instanceof Date && !Number.isNaN(value.getTime());
+}
+function resolveInboundTimestamp(input) {
+  if (isValidDate(input.receivedAt)) return input.receivedAt;
+  const now = input.now ?? /* @__PURE__ */ new Date();
+  if (isValidDate(input.mimeDate) && input.mimeDate.getTime() <= now.getTime() + MAX_MIME_DATE_FUTURE_SKEW_MS) {
+    return input.mimeDate;
+  }
+  if (isValidDate(input.fallbackDate)) return input.fallbackDate;
+  return now;
+}
 function normalizeMimeInbound(options) {
   const { parsed } = options;
   const messageId = stripBrackets(parsed.messageId) ?? options.fallbackMessageId;
@@ -256,7 +269,11 @@ function normalizeMimeInbound(options) {
     body,
     bodyFormat,
     attachments,
-    timestamp: parsed.date ? new Date(parsed.date) : options.fallbackDate ?? /* @__PURE__ */ new Date(),
+    timestamp: resolveInboundTimestamp({
+      receivedAt: options.receivedAt,
+      mimeDate: parsed.date ? new Date(parsed.date) : void 0,
+      fallbackDate: options.fallbackDate
+    }),
     replyToExternalId: inReplyTo ?? void 0,
     channelPayload,
     channelContentType: "email/mime",
@@ -289,6 +306,7 @@ export {
   normalizeMimeInbound,
   parseReferences,
   referencesFromMeta,
+  resolveInboundTimestamp,
   sanitizeHeaderValue,
   stringOrUndefined,
   stripBrackets,