@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/communication_channels/setup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/communication_channels/setup.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CommunicationChannel } from './data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'\nimport { isTestChannelSeedingEnabled, TEST_SEED_PROVIDER_KEY } from './lib/test-seed'\n\nconst logger = createLogger('communication_channels')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Sender the test-seed channel presents. Shared by the channel row's\n * `externalIdentifier` and its seeded credentials so both describe one address.\n */\nconst TEST_SEED_FROM_ADDRESS = 'system@test-seed.local'\n\n/**\n * Tick interval in seconds. Default 60s per email integration spec\n * \u00A7 Hub Deltas \u2192 Delta 6 (scheduler mechanism).\n */\nconst POLL_TICK_INTERVAL_SECONDS = Math.max(\n  10,\n  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? '60', 10) || 60,\n)\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * seedDefaults instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stablePollTickScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    admin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    manager: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n    ],\n    employee: [\n      'communication_channels.view',\n      'communication_channels.react',\n      'communication_channels.connect_user_channel',\n    ],\n  },\n\n  async seedDefaults({ container, organizationId, tenantId }) {\n    if (isTestChannelSeedingEnabled() && process.env.SYSTEM_EMAIL_PROVIDER === TEST_SEED_PROVIDER_KEY) {\n      const em = (container.resolve('em') as EntityManager).fork()\n      const existing = await findOneWithDecryption(\n        em,\n        CommunicationChannel,\n        {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          tenantId,\n          organizationId,\n          userId: null,\n          deletedAt: null,\n        },\n        undefined,\n        { tenantId, organizationId },\n      )\n      if (!existing) {\n        em.persist(em.create(CommunicationChannel, {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          displayName: 'Test Seed System Email',\n          externalIdentifier: TEST_SEED_FROM_ADDRESS,\n          userId: null,\n          isPrimary: false,\n          isActive: true,\n          status: 'connected',\n          tenantId,\n          organizationId,\n        }))\n        await em.flush()\n      }\n\n      /**\n       * Seeding the channel row without credentials is not a neutral state \u2014 it is a\n       * fail-closed one. Once a tenant owns a Hub channel, `resolveTenantCredentials`\n       * deliberately refuses to fall back to instance-wide env credentials, so every\n       * tenant-scoped send throws `SYSTEM_EMAIL_CREDENTIALS_NOT_CONFIGURED`. Callers that\n       * treat a failed send as a failed write (customer invitations roll back and return\n       * 502) then fail outright rather than merely losing the email.\n       *\n       * Seeding credentials alongside the row makes the harness model a tenant that\n       * finished configuring its provider, which is also the only one of the three\n       * credential cases the integration suite would otherwise never exercise.\n       */\n      // Best-effort, like the scheduler registration below: credential storage needs the\n      // integrations module and a usable encryption key, and neither is guaranteed in every\n      // harness. A failure here must not abort tenant initialization for every other module.\n      try {\n        const credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n        const testSeedIntegrationId = `channel_${TEST_SEED_PROVIDER_KEY}`\n        const credentialScope = { tenantId, organizationId, userId: null }\n        const existingCredentials = await credentialsService.resolve(testSeedIntegrationId, credentialScope)\n        if (!existingCredentials) {\n          await credentialsService.save(\n            testSeedIntegrationId,\n            { testSeed: true, fromAddress: TEST_SEED_FROM_ADDRESS },\n            credentialScope,\n          )\n        }\n      } catch (error) {\n        logger.warn('Test-seed email credentials could not be stored; tenant-scoped sends will fail closed', {\n          err: error,\n          tenantId,\n          organizationId,\n        })\n      }\n    }\n\n    /**\n     * Register the per-channel polling tick with `@open-mercato/scheduler`.\n     *\n     * Per email integration spec \u00A7 Hub Deltas \u2192 Delta 6: every\n     * `POLL_TICK_INTERVAL_SECONDS` (default 60s), enqueue a single\n     * `communication-channels-poll-tick` job that enumerates due channels and\n     * fans out to the `communication-channels-poll` queue.\n     *\n     * The registration is per-organization (one tick row per org/tenant pair)\n     * so multi-tenant deploys schedule independently. Skipped silently when the\n     * scheduler module isn't enabled \u2014 keeps the hub usable in scheduler-less\n     * test harnesses.\n     */\n    const cradle = container as { hasRegistration?: (name: string) => boolean }\n    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n      return\n    }\n    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n    // Best-effort: a scheduler failure must not abort tenant initialization for\n    // every other module (mirrors the ai_assistant setup pattern). The schedule\n    // ids are deterministic uuids so re-runs upsert idempotently.\n    try {\n      await schedulerService.register({\n        id: stablePollTickScheduleId(organizationId),\n        name: 'Communication channels poll tick',\n        description:\n          `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'interval',\n        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,\n        targetPayload: {\n          scope: { tenantId, organizationId },\n        },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n\n      // Spec C \u00A7 Phase C4 \u2014 Gmail watch renewal cron, per-org so multi-tenant\n      // deploys schedule independently.\n      await schedulerService.register({\n        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),\n        name: 'Gmail watch renewal',\n        description:\n          'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'cron',\n        scheduleValue: '0 4 * * *',\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,\n        targetPayload: { scope: { tenantId, organizationId } },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n    } catch (error) {\n      logger.warn('Failed to register module schedules', { err: error })\n    }\n  },\n}\n\nexport default setup\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B,8BAA8B;AAEpE,MAAM,SAAS,aAAa,wBAAwB;AAsCpD,MAAM,yBAAyB;AAM/B,MAAM,6BAA6B,KAAK;AAAA,EACtC;AAAA,EACA,OAAO,SAAS,QAAQ,IAAI,sCAAsC,MAAM,EAAE,KAAK;AACjF;AAQA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,oCAAoC,cAAc,EAAE;AAChF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,gBAAgB,SAAS,GAAG;AAC1D,QAAI,4BAA4B,KAAK,QAAQ,IAAI,0BAA0B,wBAAwB;AACjG,YAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,UAAU;AACb,WAAG,QAAQ,GAAG,OAAO,sBAAsB;AAAA,UACzC,aAAa;AAAA,UACb,aAAa;AAAA,UACb,aAAa;AAAA,UACb,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,WAAW;AAAA,UACX,UAAU;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC,CAAC;AACF,cAAM,GAAG,MAAM;AAAA,MACjB;AAiBA,UAAI;AACF,cAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,cAAM,wBAAwB,WAAW,sBAAsB;AAC/D,cAAM,kBAAkB,EAAE,UAAU,gBAAgB,QAAQ,KAAK;AACjE,cAAM,sBAAsB,MAAM,mBAAmB,QAAQ,uBAAuB,eAAe;AACnG,YAAI,CAAC,qBAAqB;AACxB,gBAAM,mBAAmB;AAAA,YACvB;AAAA,YACA,EAAE,UAAU,MAAM,aAAa,uBAAuB;AAAA,YACtD;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,eAAO,KAAK,yFAAyF;AAAA,UACnG,KAAK;AAAA,UACL;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAeA,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F;AAAA,IACF;AACA,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAI7D,QAAI;AACF,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,yBAAyB,cAAc;AAAA,QAC3C,MAAM;AAAA,QACN,aACE,4CAA4C,0BAA0B;AAAA,QACxE,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe,GAAG,0BAA0B;AAAA,QAC5C,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe;AAAA,UACb,OAAO,EAAE,UAAU,eAAe;AAAA,QACpC;AAAA,QACA,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAID,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,mBAAmB,4CAA4C,cAAc,EAAE;AAAA,QACnF,MAAM;AAAA,QACN,aACE;AAAA,QACF,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe;AAAA,QACf,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe,EAAE,OAAO,EAAE,UAAU,eAAe,EAAE;AAAA,QACrD,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,IACnE;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'\nimport { CommunicationChannel } from './data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES } from './lib/queue'\nimport { isTestChannelSeedingEnabled, TEST_SEED_PROVIDER_KEY } from './lib/test-seed'\n\nconst logger = createLogger('communication_channels')\n\ntype SchedulerServiceLike = {\n  register: (registration: {\n    id: string\n    name: string\n    scopeType: 'system' | 'organization' | 'tenant'\n    organizationId?: string\n    tenantId?: string\n    scheduleType: 'cron' | 'interval'\n    scheduleValue: string\n    timezone?: string\n    targetType: 'queue' | 'command'\n    targetQueue?: string\n    targetPayload?: unknown\n    sourceType?: 'user' | 'module'\n    sourceModule?: string\n    isEnabled?: boolean\n    description?: string\n  }) => Promise<void>\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Sender the test-seed channel presents. Shared by the channel row's\n * `externalIdentifier` and its seeded credentials so both describe one address.\n */\nconst TEST_SEED_FROM_ADDRESS = 'system@test-seed.local'\n\n/**\n * Tick interval in seconds. Default 60s per email integration spec\n * \u00A7 Hub Deltas \u2192 Delta 6 (scheduler mechanism).\n */\nconst POLL_TICK_INTERVAL_SECONDS = Math.max(\n  10,\n  Number.parseInt(process.env.OM_HUB_POLL_SCHEDULER_TICK_SECONDS ?? '60', 10) || 60,\n)\n\n/**\n * `scheduled_jobs.id` is a uuid column, so a module-owned schedule's stable\n * registration key must be hashed into a uuid rather than used verbatim \u2014 this\n * keeps `schedulerService.register()` an idempotent upsert across re-runs of\n * seedDefaults instead of trying to insert a raw string into the uuid PK.\n */\nfunction stableScheduleUuid(stableKey: string): string {\n  const hex = createHash('sha256').update(stableKey).digest('hex')\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20, 32)}`\n}\n\nfunction stablePollTickScheduleId(organizationId: string): string {\n  return stableScheduleUuid(`communication_channels:poll-tick:${organizationId}`)\n}\n\nexport const setup: ModuleSetupConfig = {\n  defaultRoleFeatures: {\n    superadmin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    admin: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n      'communication_channels.connect_tenant_channel',\n      'communication_channels.admin',\n      'communication_channels.channel.import_history',\n      'communication_channels.channel.push.manage',\n    ],\n    manager: [\n      'communication_channels.view',\n      'communication_channels.manage',\n      'communication_channels.react',\n      'communication_channels.assign',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n    employee: [\n      'communication_channels.view',\n      'communication_channels.react',\n      'communication_channels.connect_user_channel',\n      'communication_channels.share_own_channel',\n    ],\n  },\n\n  async seedDefaults({ container, organizationId, tenantId }) {\n    if (isTestChannelSeedingEnabled() && process.env.SYSTEM_EMAIL_PROVIDER === TEST_SEED_PROVIDER_KEY) {\n      const em = (container.resolve('em') as EntityManager).fork()\n      const existing = await findOneWithDecryption(\n        em,\n        CommunicationChannel,\n        {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          tenantId,\n          organizationId,\n          userId: null,\n          deletedAt: null,\n        },\n        undefined,\n        { tenantId, organizationId },\n      )\n      if (!existing) {\n        em.persist(em.create(CommunicationChannel, {\n          providerKey: TEST_SEED_PROVIDER_KEY,\n          channelType: 'email',\n          displayName: 'Test Seed System Email',\n          externalIdentifier: TEST_SEED_FROM_ADDRESS,\n          userId: null,\n          isPrimary: false,\n          isActive: true,\n          status: 'connected',\n          tenantId,\n          organizationId,\n        }))\n        await em.flush()\n      }\n\n      /**\n       * Seeding the channel row without credentials is not a neutral state \u2014 it is a\n       * fail-closed one. Once a tenant owns a Hub channel, `resolveTenantCredentials`\n       * deliberately refuses to fall back to instance-wide env credentials, so every\n       * tenant-scoped send throws `SYSTEM_EMAIL_CREDENTIALS_NOT_CONFIGURED`. Callers that\n       * treat a failed send as a failed write (customer invitations roll back and return\n       * 502) then fail outright rather than merely losing the email.\n       *\n       * Seeding credentials alongside the row makes the harness model a tenant that\n       * finished configuring its provider, which is also the only one of the three\n       * credential cases the integration suite would otherwise never exercise.\n       */\n      // Best-effort, like the scheduler registration below: credential storage needs the\n      // integrations module and a usable encryption key, and neither is guaranteed in every\n      // harness. A failure here must not abort tenant initialization for every other module.\n      try {\n        const credentialsService = container.resolve('integrationCredentialsService') as CredentialsServiceLike\n        const testSeedIntegrationId = `channel_${TEST_SEED_PROVIDER_KEY}`\n        const credentialScope = { tenantId, organizationId, userId: null }\n        const existingCredentials = await credentialsService.resolve(testSeedIntegrationId, credentialScope)\n        if (!existingCredentials) {\n          await credentialsService.save(\n            testSeedIntegrationId,\n            { testSeed: true, fromAddress: TEST_SEED_FROM_ADDRESS },\n            credentialScope,\n          )\n        }\n      } catch (error) {\n        logger.warn('Test-seed email credentials could not be stored; tenant-scoped sends will fail closed', {\n          err: error,\n          tenantId,\n          organizationId,\n        })\n      }\n    }\n\n    /**\n     * Register the per-channel polling tick with `@open-mercato/scheduler`.\n     *\n     * Per email integration spec \u00A7 Hub Deltas \u2192 Delta 6: every\n     * `POLL_TICK_INTERVAL_SECONDS` (default 60s), enqueue a single\n     * `communication-channels-poll-tick` job that enumerates due channels and\n     * fans out to the `communication-channels-poll` queue.\n     *\n     * The registration is per-organization (one tick row per org/tenant pair)\n     * so multi-tenant deploys schedule independently. Skipped silently when the\n     * scheduler module isn't enabled \u2014 keeps the hub usable in scheduler-less\n     * test harnesses.\n     */\n    const cradle = container as { hasRegistration?: (name: string) => boolean }\n    if (typeof cradle.hasRegistration !== 'function' || !cradle.hasRegistration('schedulerService')) {\n      return\n    }\n    const schedulerService = container.resolve('schedulerService') as SchedulerServiceLike\n    // Best-effort: a scheduler failure must not abort tenant initialization for\n    // every other module (mirrors the ai_assistant setup pattern). The schedule\n    // ids are deterministic uuids so re-runs upsert idempotently.\n    try {\n      await schedulerService.register({\n        id: stablePollTickScheduleId(organizationId),\n        name: 'Communication channels poll tick',\n        description:\n          `Enumerates active polling channels every ${POLL_TICK_INTERVAL_SECONDS}s and enqueues per-channel poll jobs.`,\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'interval',\n        scheduleValue: `${POLL_TICK_INTERVAL_SECONDS}s`,\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.pollTick,\n        targetPayload: {\n          scope: { tenantId, organizationId },\n        },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n\n      // Spec C \u00A7 Phase C4 \u2014 Gmail watch renewal cron, per-org so multi-tenant\n      // deploys schedule independently.\n      await schedulerService.register({\n        id: stableScheduleUuid(`communication_channels:gmail-renew-watch:${organizationId}`),\n        name: 'Gmail watch renewal',\n        description:\n          'Daily 04:00 UTC. Re-issues gmail.users.watch for channels within OM_PUSH_RENEWAL_GMAIL_LEAD_HOURS of expiry.',\n        scopeType: 'organization',\n        organizationId,\n        tenantId,\n        scheduleType: 'cron',\n        scheduleValue: '0 4 * * *',\n        timezone: 'UTC',\n        targetType: 'queue',\n        targetQueue: COMMUNICATION_CHANNELS_QUEUES.gmailRenewWatch,\n        targetPayload: { scope: { tenantId, organizationId } },\n        sourceType: 'module',\n        sourceModule: 'communication_channels',\n        isEnabled: true,\n      })\n    } catch (error) {\n      logger.warn('Failed to register module schedules', { err: error })\n    }\n  },\n}\n\nexport default setup\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAE3B,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B,8BAA8B;AAEpE,MAAM,SAAS,aAAa,wBAAwB;AAsCpD,MAAM,yBAAyB;AAM/B,MAAM,6BAA6B,KAAK;AAAA,EACtC;AAAA,EACA,OAAO,SAAS,QAAQ,IAAI,sCAAsC,MAAM,EAAE,KAAK;AACjF;AAQA,SAAS,mBAAmB,WAA2B;AACrD,QAAM,MAAM,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AAC/D,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC;AAC9G;AAEA,SAAS,yBAAyB,gBAAgC;AAChE,SAAO,mBAAmB,oCAAoC,cAAc,EAAE;AAChF;AAEO,MAAM,QAA2B;AAAA,EACtC,qBAAqB;AAAA,IACnB,YAAY;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,aAAa,EAAE,WAAW,gBAAgB,SAAS,GAAG;AAC1D,QAAI,4BAA4B,KAAK,QAAQ,IAAI,0BAA0B,wBAAwB;AACjG,YAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,YAAM,WAAW,MAAM;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,UACE,aAAa;AAAA,UACb,aAAa;AAAA,UACb;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA,EAAE,UAAU,eAAe;AAAA,MAC7B;AACA,UAAI,CAAC,UAAU;AACb,WAAG,QAAQ,GAAG,OAAO,sBAAsB;AAAA,UACzC,aAAa;AAAA,UACb,aAAa;AAAA,UACb,aAAa;AAAA,UACb,oBAAoB;AAAA,UACpB,QAAQ;AAAA,UACR,WAAW;AAAA,UACX,UAAU;AAAA,UACV,QAAQ;AAAA,UACR;AAAA,UACA;AAAA,QACF,CAAC,CAAC;AACF,cAAM,GAAG,MAAM;AAAA,MACjB;AAiBA,UAAI;AACF,cAAM,qBAAqB,UAAU,QAAQ,+BAA+B;AAC5E,cAAM,wBAAwB,WAAW,sBAAsB;AAC/D,cAAM,kBAAkB,EAAE,UAAU,gBAAgB,QAAQ,KAAK;AACjE,cAAM,sBAAsB,MAAM,mBAAmB,QAAQ,uBAAuB,eAAe;AACnG,YAAI,CAAC,qBAAqB;AACxB,gBAAM,mBAAmB;AAAA,YACvB;AAAA,YACA,EAAE,UAAU,MAAM,aAAa,uBAAuB;AAAA,YACtD;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,OAAO;AACd,eAAO,KAAK,yFAAyF;AAAA,UACnG,KAAK;AAAA,UACL;AAAA,UACA;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AAeA,UAAM,SAAS;AACf,QAAI,OAAO,OAAO,oBAAoB,cAAc,CAAC,OAAO,gBAAgB,kBAAkB,GAAG;AAC/F;AAAA,IACF;AACA,UAAM,mBAAmB,UAAU,QAAQ,kBAAkB;AAI7D,QAAI;AACF,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,yBAAyB,cAAc;AAAA,QAC3C,MAAM;AAAA,QACN,aACE,4CAA4C,0BAA0B;AAAA,QACxE,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe,GAAG,0BAA0B;AAAA,QAC5C,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe;AAAA,UACb,OAAO,EAAE,UAAU,eAAe;AAAA,QACpC;AAAA,QACA,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAID,YAAM,iBAAiB,SAAS;AAAA,QAC9B,IAAI,mBAAmB,4CAA4C,cAAc,EAAE;AAAA,QACnF,MAAM;AAAA,QACN,aACE;AAAA,QACF,WAAW;AAAA,QACX;AAAA,QACA;AAAA,QACA,cAAc;AAAA,QACd,eAAe;AAAA,QACf,UAAU;AAAA,QACV,YAAY;AAAA,QACZ,aAAa,8BAA8B;AAAA,QAC3C,eAAe,EAAE,OAAO,EAAE,UAAU,eAAe,EAAE;AAAA,QACrD,YAAY;AAAA,QACZ,cAAc;AAAA,QACd,WAAW;AAAA,MACb,CAAC;AAAA,IACH,SAAS,OAAO;AACd,aAAO,KAAK,uCAAuC,EAAE,KAAK,MAAM,CAAC;AAAA,IACnE;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/communication_channels/subscribers/outbound-bridge.js

@@ -1,6 +1,9 @@
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from "../data/entities.js";
 import { Message } from "../../messages/data/entities.js";
+import { SEND_AS_USER_SOURCE_ENTITY_TYPE } from "../../messages/lib/messageSourceEntityTypes.js";
+import { isIngestedInboundMessage } from "../lib/inbound-message-origin.js";
+import { isOutboundDeliveryIntended } from "../lib/outbound-delivery-intent.js";
 import { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from "../lib/queue.js";
 const metadata = {
   event: "messages.message.sent",
@@ -36,10 +39,10 @@ async function handler(payload, ctx) {
     dscope
   );
   if (!message) return;
-  if (message.sourceEntityType === "communication_channels.send_as_user") {
+  if (message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE) {
     return;
   }
-  if (message.sourceEntityType === "communication_channels.external_conversation") {
+  if (!isOutboundDeliveryIntended({ message, forwardedFromMessageId: payload.forwardedFrom })) {
     return;
   }
   if (!message.threadId) return;
@@ -66,6 +69,9 @@ async function handler(payload, ctx) {
     void 0,
     dscope
   );
+  if (await isIngestedInboundMessage(em, { message, existingLink, tenantId: payload.tenantId })) {
+    return;
+  }
   if (existingLink && (existingLink.deliveryStatus === "queued" || existingLink.deliveryStatus === "pending" || existingLink.deliveryStatus === "sent" || existingLink.deliveryStatus === "delivered" || existingLink.deliveryStatus === "read")) {
     return;
   }

package/dist/modules/communication_channels/subscribers/outbound-bridge.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/subscribers/outbound-bridge.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from '../data/entities'\nimport { Message } from '../../messages/data/entities'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\n\n/**\n * Subscriber: outbound bridge.\n *\n * Listens to `messages.message.sent` and, when the Message lives in a channel-linked\n * thread, enqueues a delivery job to the `communication-channels-outbound` queue.\n *\n * Per the pre-implementation analysis we **re-fetch the Message by ID** rather than\n * trusting the event payload \u2014 this keeps the subscriber decoupled from the\n * `messages.message.sent` payload shape, so any future addition/removal of fields\n * in the messages module doesn't break this bridge.\n *\n * Idempotency: we check for an existing `MessageChannelLink` with `direction='outbound'`\n * and `deliveryStatus IN ('queued','pending','sent','delivered','read')`. If found, we\n * skip \u2014 the message is already delivered or has a delivery in flight. Including the\n * in-flight states ('queued'/'pending') stops a replayed `messages.message.sent` from\n * enqueueing a second delivery job while the worker is mid-send. The command-side check\n * is the authoritative gate, but this cheap subscriber-level check avoids redundant jobs.\n *\n * Internal-only messages (no `ChannelThreadMapping` for the threadId) are skipped\n * silently \u2014 this is the expected steady-state for the majority of platform messages.\n */\nexport const metadata = {\n  event: 'messages.message.sent',\n  persistent: true,\n  id: 'communication_channels:outbound-bridge',\n}\n\ntype MessageSentPayload = {\n  messageId: string\n  senderUserId?: string\n  recipientUserIds?: string[]\n  sendViaEmail?: boolean\n  externalEmail?: string | null\n  tenantId: string\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  /** Canonical event-bus context: `resolve` is exposed directly (no `.container` wrapper). */\n  resolve: <T = unknown>(name: string) => T\n  /** Some callers wrap in a `container` \u2014 supported for forward-compat. */\n  container?: { resolve: <T = unknown>(name: string) => T }\n}\n\nfunction resolveFromCtx<T = unknown>(ctx: SubscriberContext, name: string): T {\n  if (typeof ctx?.resolve === 'function') return ctx.resolve<T>(name)\n  if (ctx?.container && typeof ctx.container.resolve === 'function') {\n    return ctx.container.resolve<T>(name)\n  }\n  throw new Error(`outbound-bridge: subscriber context has no resolver (looking for '${name}')`)\n}\n\nexport default async function handler(\n  payload: MessageSentPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  if (!payload?.messageId || !payload.tenantId) {\n    return\n  }\n\n  const em = (resolveFromCtx<EntityManager>(ctx, 'em')).fork()\n  const dscope = {\n    tenantId: payload.tenantId,\n    organizationId: payload.organizationId ?? null,\n  }\n\n  // (a) Re-fetch the Message \u2014 no payload-shape coupling.\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: payload.messageId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!message) return\n  if (message.sourceEntityType === 'communication_channels.send_as_user') {\n    return\n  }\n  // Inbound ingest path: when `ingest-inbound-message` composes a new platform\n  // Message for an incoming email, the messages module also emits\n  // `messages.message.sent` (the Message row is fresh and marked sent). Without\n  // this guard, we'd treat it as outbound and queue a redundant SMTP delivery \u2014\n  // which fails because inbound MCLs carry recipient info in `channelPayload`,\n  // not `channelMetadata`, and the failure marker then leaks back onto the\n  // inbound link itself.\n  if (message.sourceEntityType === 'communication_channels.external_conversation') {\n    return\n  }\n  if (!message.threadId) return // Internal-only; no channel routing.\n\n  // (b) Look up the channel mapping by threadId.\n  const mapping = await findOneWithDecryption(\n    em,\n    ChannelThreadMapping,\n    {\n      messageThreadId: message.threadId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!mapping) return // Internal-only thread; skip silently.\n\n  // (c) Idempotency \u2014 skip if already delivered.\n  const existingLink = await findOneWithDecryption(\n    em,\n    MessageChannelLink,\n    {\n      messageId: message.id,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  if (\n    existingLink &&\n    (existingLink.deliveryStatus === 'queued' ||\n      existingLink.deliveryStatus === 'pending' ||\n      existingLink.deliveryStatus === 'sent' ||\n      existingLink.deliveryStatus === 'delivered' ||\n      existingLink.deliveryStatus === 'read')\n  ) {\n    return\n  }\n\n  // (c2) Per-user ownership gate. Outbound delivery sends with the CHANNEL\n  // OWNER's credentials (workers/outbound-delivery \u2192 deliver-outbound-message),\n  // so we may only bridge a platform message into a per-user channel when the\n  // message's sender OWNS that channel. Tenant-wide channels (userId == null \u2014\n  // shared inboxes) accept any sender. Without this, composing into another\n  // user's channel-linked thread would send from their connected account\n  // (impersonation). Mirrors lib/send-as-user and the reaction ownership gate.\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: mapping.channelId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) return\n  if (channel.userId != null && channel.userId !== message.senderUserId) {\n    return\n  }\n\n  // (d) Enqueue the delivery worker.\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const job: OutboundDeliveryPayload = {\n    messageId: message.id,\n    scope: {\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    attempt: 1,\n  }\n  await queue.enqueue(job as unknown as Record<string, unknown>)\n}\n"],
-  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,sBAAsB,sBAAsB,0BAA0B;AAC/E,SAAS,eAAe;AACxB,SAAS,+BAA+B,qCAAqC;AAwBtE,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAmBA,SAAS,eAA4B,KAAwB,MAAiB;AAC5E,MAAI,OAAO,KAAK,YAAY,WAAY,QAAO,IAAI,QAAW,IAAI;AAClE,MAAI,KAAK,aAAa,OAAO,IAAI,UAAU,YAAY,YAAY;AACjE,WAAO,IAAI,UAAU,QAAW,IAAI;AAAA,EACtC;AACA,QAAM,IAAI,MAAM,qEAAqE,IAAI,IAAI;AAC/F;AAEA,eAAO,QACL,SACA,KACe;AACf,MAAI,CAAC,SAAS,aAAa,CAAC,QAAQ,UAAU;AAC5C;AAAA,EACF;AAEA,QAAM,KAAM,eAA8B,KAAK,IAAI,EAAG,KAAK;AAC3D,QAAM,SAAS;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ,kBAAkB;AAAA,EAC5C;AAGA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,qBAAqB,uCAAuC;AACtE;AAAA,EACF;AAQA,MAAI,QAAQ,qBAAqB,gDAAgD;AAC/E;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAU;AAGvB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,iBAAiB,QAAQ;AAAA,MACzB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AAGd,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MACE,iBACC,aAAa,mBAAmB,YAC/B,aAAa,mBAAmB,aAChC,aAAa,mBAAmB,UAChC,aAAa,mBAAmB,eAChC,aAAa,mBAAmB,SAClC;AACA;AAAA,EACF;AASA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,QAAQ,cAAc;AACrE;AAAA,EACF;AAGA,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,MAA+B;AAAA,IACnC,WAAW,QAAQ;AAAA,IACnB,OAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,GAAyC;AAC/D;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { ChannelThreadMapping, CommunicationChannel, MessageChannelLink } from '../data/entities'\nimport { Message } from '../../messages/data/entities'\nimport { SEND_AS_USER_SOURCE_ENTITY_TYPE } from '../../messages/lib/messageSourceEntityTypes'\nimport { isIngestedInboundMessage } from '../lib/inbound-message-origin'\nimport { isOutboundDeliveryIntended } from '../lib/outbound-delivery-intent'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\n\n/**\n * Subscriber: outbound bridge.\n *\n * Listens to `messages.message.sent` and, when the Message lives in a channel-linked\n * thread, enqueues a delivery job to the `communication-channels-outbound` queue.\n *\n * Per the pre-implementation analysis we **re-fetch the Message by ID** rather than\n * trusting the event payload \u2014 this keeps the subscriber decoupled from the\n * `messages.message.sent` payload shape, so any future addition/removal of fields\n * in the messages module doesn't break this bridge.\n *\n * Idempotency: we check for an existing `MessageChannelLink` with `direction='outbound'`\n * and `deliveryStatus IN ('queued','pending','sent','delivered','read')`. If found, we\n * skip \u2014 the message is already delivered or has a delivery in flight. Including the\n * in-flight states ('queued'/'pending') stops a replayed `messages.message.sent` from\n * enqueueing a second delivery job while the worker is mid-send. The command-side check\n * is the authoritative gate, but this cheap subscriber-level check avoids redundant jobs.\n *\n * Internal-only messages (no `ChannelThreadMapping` for the threadId) are skipped\n * silently \u2014 this is the expected steady-state for the majority of platform messages.\n */\nexport const metadata = {\n  event: 'messages.message.sent',\n  persistent: true,\n  id: 'communication_channels:outbound-bridge',\n}\n\ntype MessageSentPayload = {\n  messageId: string\n  senderUserId?: string\n  recipientUserIds?: string[]\n  sendViaEmail?: boolean\n  externalEmail?: string | null\n  /**\n   * Set by `messages.messages.forward` to the message the forward was built\n   * from. The only place an operator's delivery intent is recorded \u2014 see\n   * `lib/outbound-delivery-intent`.\n   */\n  forwardedFrom?: string | null\n  tenantId: string\n  organizationId?: string | null\n}\n\ntype SubscriberContext = {\n  /** Canonical event-bus context: `resolve` is exposed directly (no `.container` wrapper). */\n  resolve: <T = unknown>(name: string) => T\n  /** Some callers wrap in a `container` \u2014 supported for forward-compat. */\n  container?: { resolve: <T = unknown>(name: string) => T }\n}\n\nfunction resolveFromCtx<T = unknown>(ctx: SubscriberContext, name: string): T {\n  if (typeof ctx?.resolve === 'function') return ctx.resolve<T>(name)\n  if (ctx?.container && typeof ctx.container.resolve === 'function') {\n    return ctx.container.resolve<T>(name)\n  }\n  throw new Error(`outbound-bridge: subscriber context has no resolver (looking for '${name}')`)\n}\n\nexport default async function handler(\n  payload: MessageSentPayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  if (!payload?.messageId || !payload.tenantId) {\n    return\n  }\n\n  const em = (resolveFromCtx<EntityManager>(ctx, 'em')).fork()\n  const dscope = {\n    tenantId: payload.tenantId,\n    organizationId: payload.organizationId ?? null,\n  }\n\n  // (a) Re-fetch the Message \u2014 no payload-shape coupling.\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: payload.messageId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!message) return\n  if (message.sourceEntityType === SEND_AS_USER_SOURCE_ENTITY_TYPE) {\n    return\n  }\n  // (a1) Intent gate. The origin test at (c1) answers \"did the ingest command\n  // compose this?\"; this one answers \"did an operator mean this to leave the\n  // platform?\". Between them sits every internal message that shares the channel\n  // thread \u2014 most importantly a forward, whose body is the quoted conversation\n  // plus the operator's own commentary about the correspondent. Free (no query),\n  // so it runs before the mapping lookup.\n  if (!isOutboundDeliveryIntended({ message, forwardedFromMessageId: payload.forwardedFrom })) {\n    return\n  }\n  if (!message.threadId) return // Internal-only; no channel routing.\n\n  // (b) Look up the channel mapping by threadId.\n  const mapping = await findOneWithDecryption(\n    em,\n    ChannelThreadMapping,\n    {\n      messageThreadId: message.threadId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!mapping) return // Internal-only thread; skip silently.\n\n  // (c) Idempotency \u2014 skip if already delivered.\n  const existingLink = await findOneWithDecryption(\n    em,\n    MessageChannelLink,\n    {\n      messageId: message.id,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    undefined,\n    dscope,\n  )\n  // (c1) Inbound ingest path: when `ingest-inbound-message` composes a platform\n  // Message for an incoming message, the messages module also emits\n  // `messages.message.sent` (the Message row is fresh and marked sent). Without\n  // this guard we'd treat it as outbound and queue a redundant delivery \u2014 which\n  // fails because inbound MCLs carry recipient info in `channelPayload`, not\n  // `channelMetadata`, and the failure marker then leaks back onto the inbound\n  // link itself.\n  //\n  // The guard used to be `sourceEntityType === external_conversation`, but an\n  // operator's reply inherits that value from the message it answers, so every\n  // operator message in a channel thread was dropped here \u2014 silently, which is\n  // the delivery half of #5535. `isIngestedInboundMessage` distinguishes the\n  // ingested message from an operator's own message in the same conversation.\n  if (await isIngestedInboundMessage(em, { message, existingLink, tenantId: payload.tenantId })) {\n    return\n  }\n\n  if (\n    existingLink &&\n    (existingLink.deliveryStatus === 'queued' ||\n      existingLink.deliveryStatus === 'pending' ||\n      existingLink.deliveryStatus === 'sent' ||\n      existingLink.deliveryStatus === 'delivered' ||\n      existingLink.deliveryStatus === 'read')\n  ) {\n    return\n  }\n\n  // (c2) Per-user ownership gate. Outbound delivery sends with the CHANNEL\n  // OWNER's credentials (workers/outbound-delivery \u2192 deliver-outbound-message),\n  // so we may only bridge a platform message into a per-user channel when the\n  // message's sender OWNS that channel. Tenant-wide channels (userId == null \u2014\n  // shared inboxes) accept any sender. Without this, composing into another\n  // user's channel-linked thread would send from their connected account\n  // (impersonation). Mirrors lib/send-as-user and the reaction ownership gate.\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: mapping.channelId,\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) return\n  if (channel.userId != null && channel.userId !== message.senderUserId) {\n    return\n  }\n\n  // (d) Enqueue the delivery worker.\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const job: OutboundDeliveryPayload = {\n    messageId: message.id,\n    scope: {\n      tenantId: payload.tenantId,\n      organizationId: payload.organizationId ?? null,\n    },\n    attempt: 1,\n  }\n  await queue.enqueue(job as unknown as Record<string, unknown>)\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,sBAAsB,sBAAsB,0BAA0B;AAC/E,SAAS,eAAe;AACxB,SAAS,uCAAuC;AAChD,SAAS,gCAAgC;AACzC,SAAS,kCAAkC;AAC3C,SAAS,+BAA+B,qCAAqC;AAwBtE,MAAM,WAAW;AAAA,EACtB,OAAO;AAAA,EACP,YAAY;AAAA,EACZ,IAAI;AACN;AAyBA,SAAS,eAA4B,KAAwB,MAAiB;AAC5E,MAAI,OAAO,KAAK,YAAY,WAAY,QAAO,IAAI,QAAW,IAAI;AAClE,MAAI,KAAK,aAAa,OAAO,IAAI,UAAU,YAAY,YAAY;AACjE,WAAO,IAAI,UAAU,QAAW,IAAI;AAAA,EACtC;AACA,QAAM,IAAI,MAAM,qEAAqE,IAAI,IAAI;AAC/F;AAEA,eAAO,QACL,SACA,KACe;AACf,MAAI,CAAC,SAAS,aAAa,CAAC,QAAQ,UAAU;AAC5C;AAAA,EACF;AAEA,QAAM,KAAM,eAA8B,KAAK,IAAI,EAAG,KAAK;AAC3D,QAAM,SAAS;AAAA,IACb,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ,kBAAkB;AAAA,EAC5C;AAGA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,qBAAqB,iCAAiC;AAChE;AAAA,EACF;AAOA,MAAI,CAAC,2BAA2B,EAAE,SAAS,wBAAwB,QAAQ,cAAc,CAAC,GAAG;AAC3F;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAU;AAGvB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,iBAAiB,QAAQ;AAAA,MACzB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AAGd,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,QAAQ;AAAA,MACnB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAcA,MAAI,MAAM,yBAAyB,IAAI,EAAE,SAAS,cAAc,UAAU,QAAQ,SAAS,CAAC,GAAG;AAC7F;AAAA,EACF;AAEA,MACE,iBACC,aAAa,mBAAmB,YAC/B,aAAa,mBAAmB,aAChC,aAAa,mBAAmB,UAChC,aAAa,mBAAmB,eAChC,aAAa,mBAAmB,SAClC;AACA;AAAA,EACF;AASA,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC1C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS;AACd,MAAI,QAAQ,UAAU,QAAQ,QAAQ,WAAW,QAAQ,cAAc;AACrE;AAAA,EACF;AAGA,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,MAA+B;AAAA,IACnC,WAAW,QAAQ;AAAA,IACnB,OAAO;AAAA,MACL,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB;AAAA,IAC5C;AAAA,IACA,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,GAAyC;AAC/D;",
   "names": []
 }

package/dist/modules/communication_channels/workers/gmail-history-sync.js

@@ -70,7 +70,7 @@ async function handle(job, ctx) {
   try {
     page = await adapter.applyPushNotification({
       credentials,
-      scope: { tenantId: scope.tenantId, organizationId: scope.organizationId ?? scope.tenantId },
+      scope: { tenantId: scope.tenantId, organizationId: channel.organizationId ?? null },
       channelState: channel.channelState ?? {},
       notification: job.payload.notification
     });

package/dist/modules/communication_channels/workers/gmail-history-sync.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/workers/gmail-history-sync.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n} from '../commands/ingest-inbound-message'\nimport { COMMUNICATION_CHANNELS_QUEUES } from '../lib/queue'\nimport { preservePushState } from '../lib/push-state'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError } from '../lib/error-classification'\nimport { writeIngestDeadLetter } from '../lib/dead-letter'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'gmail-history-sync' })\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push delivery worker.\n *\n * One job per verified webhook notification. Calls\n * `adapter.applyPushNotification(...)` to walk `users.history.list` from the\n * channel's stored `historyId`, then dispatches each message through\n * `ingest-inbound-message` (same path as the polling worker).\n *\n * Concurrency: bounded by the queue's default (10). Per-channel ordering is\n * NOT guaranteed across notifications \u2014 but the ingest command is idempotent\n * on `(channel_id, external_message_id)`, and Gmail's history cursor advances\n * monotonically per channel, so out-of-order replay is safe.\n */\nexport type GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n  /** Self-re-enqueue drain counter (bounds the multi-page drain loop). */\n  drainPage?: number\n}\n\n/** Hard cap on self-re-enqueue drain pages \u2014 guards against an adapter that\n *  returns `hasMore` with a non-advancing cursor (a tight, unbounded loop). */\nconst MAX_DRAIN_PAGES = 100\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  id: 'communication_channels:gmail-history-sync',\n  concurrency: 5,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\nexport default async function handle(\n  job: QueuedJob<GmailHistorySyncJobPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const { channelId, scope } = job.payload\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!channel) {\n    logger.warn('channel not found (skip)', { channelId })\n    return\n  }\n  if (!channel.isActive || channel.status !== 'connected') return\n\n  const adapter = adapterRegistry?.get(channel.providerKey)\n  if (!adapter || typeof adapter.applyPushNotification !== 'function') {\n    logger.warn('adapter does not support applyPushNotification', { providerKey: channel.providerKey })\n    return\n  }\n\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId ?? scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    { adapter, channelId: channel.id, credentials, scope: credentialsScope },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  let page\n  try {\n    page = await adapter.applyPushNotification({\n      credentials,\n      scope: { tenantId: scope.tenantId, organizationId: scope.organizationId ?? scope.tenantId },\n      channelState: (channel.channelState as Record<string, unknown> | null) ?? {},\n      notification: job.payload.notification as unknown as Record<string, unknown>,\n    })\n  } catch (err) {\n    const classification = classifyOutboundError(err)\n    if (classification.transient) throw err\n    logger.warn('permanent failure applying push for channel', { channelId: channel.id, reason: classification.message })\n    return\n  }\n\n  const messages = Array.isArray(page?.messages) ? page.messages : []\n  if (messages.length > 0) {\n    const commandBus = ctx.resolve<CommandBus>('commandBus')\n    const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n    const commandCtx = {\n      container: containerProxy as never,\n      auth: null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId ?? null,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n    }\n    for (const message of messages) {\n      try {\n        const input: IngestInboundMessageInput = {\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          scope: { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },\n          message,\n        }\n        await commandBus.execute(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n          input,\n          ctx: commandCtx as never,\n        })\n      } catch (err) {\n        const classification = classifyOutboundError(err)\n        if (classification.transient) {\n          // Per-message commit semantics from Spec B: re-throw so queue\n          // retry re-runs from a safe point.\n          throw err\n        }\n        logger.warn('permanent ingest failure for channel', { channelId: channel.id, reason: classification.message })\n        await writeIngestDeadLetter({ em, scope, channel, message, err, errorMessage: classification.message })\n      }\n    }\n  }\n\n  // Persist the adapter's advanced cursor (encoded in nextCursor) back to\n  // channel.channelState. fetchHistory's nextCursor is a base64-JSON blob\n  // mirroring the new GmailChannelState \u2014 same as the polling worker writes.\n  if (page?.nextCursor) {\n    try {\n      const decoded = JSON.parse(Buffer.from(page.nextCursor, 'base64').toString('utf-8')) as Record<string, unknown>\n      // Carry the push keys forward via preservePushState rather than spreading\n      // the decoded cursor wholesale: a blind spread would retain a stale\n      // `pendingHistoryPageToken` after a completed drain and mis-route the next\n      // push notification.\n      channel.channelState = preservePushState(channel.channelState, decoded)\n      channel.lastPolledAt = new Date()\n      await em.flush()\n    } catch (err) {\n      logger.warn('failed to persist next cursor for channel', { channelId: channel.id, err })\n    }\n  }\n\n  if (page?.hasMore && page?.nextCursor) {\n    // Re-enqueue self so the drain continues. The Pub/Sub notification fired\n    // once, but `history.list` may need multiple pages on a busy mailbox.\n    // Bound the drain and add a small delay so an adapter that returns\n    // `hasMore: true` with a non-advancing cursor cannot spin a tight,\n    // unthrottled re-enqueue loop against the provider/queue.\n    const drainPage = job.payload.drainPage ?? 0\n    if (drainPage < MAX_DRAIN_PAGES) {\n      const queue = (await import('../lib/queue')).getCommunicationChannelsQueue(\n        COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n      )\n      await queue.enqueue(\n        { ...job.payload, drainPage: drainPage + 1 } as unknown as Record<string, unknown>,\n        { delayMs: 250 },\n      )\n    } else {\n      logger.warn('drain page cap reached; stopping re-enqueue', { maxDrainPages: MAX_DRAIN_PAGES, channelId })\n    }\n  }\n}\n"],
-  "mappings": "AAGA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,qCAAqC;AAC9C,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAEtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAyB/F,MAAM,kBAAkB;AAEjB,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAkBA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,WAAW,MAAM,IAAI,IAAI;AACjC,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AAEpF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,4BAA4B,EAAE,UAAU,CAAC;AACrD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,YAAa;AAEzD,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,WAAW,OAAO,QAAQ,0BAA0B,YAAY;AACnE,WAAO,KAAK,kDAAkD,EAAE,aAAa,QAAQ,YAAY,CAAC;AAClG;AAAA,EACF;AAEA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM,kBAAkB,MAAM;AAAA,IAC9C,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB,EAAE,SAAS,WAAW,QAAQ,IAAI,aAAa,OAAO,iBAAiB;AAAA,IACvE,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAExB,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,sBAAsB;AAAA,MACzC;AAAA,MACA,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,kBAAkB,MAAM,SAAS;AAAA,MAC1F,cAAe,QAAQ,gBAAmD,CAAC;AAAA,MAC3E,cAAc,IAAI,QAAQ;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,iBAAiB,sBAAsB,GAAG;AAChD,QAAI,eAAe,UAAW,OAAM;AACpC,WAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AACpH;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,WAAW,CAAC;AAClE,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,UAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,UAAM,aAAa;AAAA,MACjB,WAAW;AAAA,MACX,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,MAAM,kBAAkB;AAAA,MAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,IACnE;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI;AACF,cAAM,QAAmC;AAAA,UACvC,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,UAChF;AAAA,QACF;AACA,cAAM,WAAW,QAAQ,kDAAkD;AAAA,UACzE;AAAA,UACA,KAAK;AAAA,QACP,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,iBAAiB,sBAAsB,GAAG;AAChD,YAAI,eAAe,WAAW;AAG5B,gBAAM;AAAA,QACR;AACA,eAAO,KAAK,wCAAwC,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AAC7G,cAAM,sBAAsB,EAAE,IAAI,OAAO,SAAS,SAAS,KAAK,cAAc,eAAe,QAAQ,CAAC;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AAKA,MAAI,MAAM,YAAY;AACpB,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,OAAO,KAAK,KAAK,YAAY,QAAQ,EAAE,SAAS,OAAO,CAAC;AAKnF,cAAQ,eAAe,kBAAkB,QAAQ,cAAc,OAAO;AACtE,cAAQ,eAAe,oBAAI,KAAK;AAChC,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,KAAK;AACZ,aAAO,KAAK,6CAA6C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,IACzF;AAAA,EACF;AAEA,MAAI,MAAM,WAAW,MAAM,YAAY;AAMrC,UAAM,YAAY,IAAI,QAAQ,aAAa;AAC3C,QAAI,YAAY,iBAAiB;AAC/B,YAAM,SAAS,MAAM,OAAO,cAAc,GAAG;AAAA,QAC3C,8BAA8B;AAAA,MAChC;AACA,YAAM,MAAM;AAAA,QACV,EAAE,GAAG,IAAI,SAAS,WAAW,YAAY,EAAE;AAAA,QAC3C,EAAE,SAAS,IAAI;AAAA,MACjB;AAAA,IACF,OAAO;AACL,aAAO,KAAK,+CAA+C,EAAE,eAAe,iBAAiB,UAAU,CAAC;AAAA,IAC1G;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n} from '../commands/ingest-inbound-message'\nimport { COMMUNICATION_CHANNELS_QUEUES } from '../lib/queue'\nimport { preservePushState } from '../lib/push-state'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError } from '../lib/error-classification'\nimport { writeIngestDeadLetter } from '../lib/dead-letter'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'gmail-history-sync' })\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push delivery worker.\n *\n * One job per verified webhook notification. Calls\n * `adapter.applyPushNotification(...)` to walk `users.history.list` from the\n * channel's stored `historyId`, then dispatches each message through\n * `ingest-inbound-message` (same path as the polling worker).\n *\n * Concurrency: bounded by the queue's default (10). Per-channel ordering is\n * NOT guaranteed across notifications \u2014 but the ingest command is idempotent\n * on `(channel_id, external_message_id)`, and Gmail's history cursor advances\n * monotonically per channel, so out-of-order replay is safe.\n */\nexport type GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n  /** Self-re-enqueue drain counter (bounds the multi-page drain loop). */\n  drainPage?: number\n}\n\n/** Hard cap on self-re-enqueue drain pages \u2014 guards against an adapter that\n *  returns `hasMore` with a non-advancing cursor (a tight, unbounded loop). */\nconst MAX_DRAIN_PAGES = 100\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  id: 'communication_channels:gmail-history-sync',\n  concurrency: 5,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\nexport default async function handle(\n  job: QueuedJob<GmailHistorySyncJobPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const { channelId, scope } = job.payload\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!channel) {\n    logger.warn('channel not found (skip)', { channelId })\n    return\n  }\n  if (!channel.isActive || channel.status !== 'connected') return\n\n  const adapter = adapterRegistry?.get(channel.providerKey)\n  if (!adapter || typeof adapter.applyPushNotification !== 'function') {\n    logger.warn('adapter does not support applyPushNotification', { providerKey: channel.providerKey })\n    return\n  }\n\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId ?? scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    { adapter, channelId: channel.id, credentials, scope: credentialsScope },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  let page\n  try {\n    page = await adapter.applyPushNotification({\n      credentials,\n      scope: { tenantId: scope.tenantId, organizationId: channel.organizationId ?? null },\n      channelState: (channel.channelState as Record<string, unknown> | null) ?? {},\n      notification: job.payload.notification as unknown as Record<string, unknown>,\n    })\n  } catch (err) {\n    const classification = classifyOutboundError(err)\n    if (classification.transient) throw err\n    logger.warn('permanent failure applying push for channel', { channelId: channel.id, reason: classification.message })\n    return\n  }\n\n  const messages = Array.isArray(page?.messages) ? page.messages : []\n  if (messages.length > 0) {\n    const commandBus = ctx.resolve<CommandBus>('commandBus')\n    const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n    const commandCtx = {\n      container: containerProxy as never,\n      auth: null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId ?? null,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n    }\n    for (const message of messages) {\n      try {\n        const input: IngestInboundMessageInput = {\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          scope: { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },\n          message,\n        }\n        await commandBus.execute(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n          input,\n          ctx: commandCtx as never,\n        })\n      } catch (err) {\n        const classification = classifyOutboundError(err)\n        if (classification.transient) {\n          // Per-message commit semantics from Spec B: re-throw so queue\n          // retry re-runs from a safe point.\n          throw err\n        }\n        logger.warn('permanent ingest failure for channel', { channelId: channel.id, reason: classification.message })\n        await writeIngestDeadLetter({ em, scope, channel, message, err, errorMessage: classification.message })\n      }\n    }\n  }\n\n  // Persist the adapter's advanced cursor (encoded in nextCursor) back to\n  // channel.channelState. fetchHistory's nextCursor is a base64-JSON blob\n  // mirroring the new GmailChannelState \u2014 same as the polling worker writes.\n  if (page?.nextCursor) {\n    try {\n      const decoded = JSON.parse(Buffer.from(page.nextCursor, 'base64').toString('utf-8')) as Record<string, unknown>\n      // Carry the push keys forward via preservePushState rather than spreading\n      // the decoded cursor wholesale: a blind spread would retain a stale\n      // `pendingHistoryPageToken` after a completed drain and mis-route the next\n      // push notification.\n      channel.channelState = preservePushState(channel.channelState, decoded)\n      channel.lastPolledAt = new Date()\n      await em.flush()\n    } catch (err) {\n      logger.warn('failed to persist next cursor for channel', { channelId: channel.id, err })\n    }\n  }\n\n  if (page?.hasMore && page?.nextCursor) {\n    // Re-enqueue self so the drain continues. The Pub/Sub notification fired\n    // once, but `history.list` may need multiple pages on a busy mailbox.\n    // Bound the drain and add a small delay so an adapter that returns\n    // `hasMore: true` with a non-advancing cursor cannot spin a tight,\n    // unthrottled re-enqueue loop against the provider/queue.\n    const drainPage = job.payload.drainPage ?? 0\n    if (drainPage < MAX_DRAIN_PAGES) {\n      const queue = (await import('../lib/queue')).getCommunicationChannelsQueue(\n        COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n      )\n      await queue.enqueue(\n        { ...job.payload, drainPage: drainPage + 1 } as unknown as Record<string, unknown>,\n        { delayMs: 250 },\n      )\n    } else {\n      logger.warn('drain page cap reached; stopping re-enqueue', { maxDrainPages: MAX_DRAIN_PAGES, channelId })\n    }\n  }\n}\n"],
+  "mappings": "AAGA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,qCAAqC;AAC9C,SAAS,yBAAyB;AAClC,SAAS,kCAAkC;AAC3C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAEtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAyB/F,MAAM,kBAAkB;AAEjB,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAkBA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,WAAW,MAAM,IAAI,IAAI;AACjC,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AAEpF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,4BAA4B,EAAE,UAAU,CAAC;AACrD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,YAAa;AAEzD,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,WAAW,OAAO,QAAQ,0BAA0B,YAAY;AACnE,WAAO,KAAK,kDAAkD,EAAE,aAAa,QAAQ,YAAY,CAAC;AAClG;AAAA,EACF;AAEA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM,kBAAkB,MAAM;AAAA,IAC9C,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB,EAAE,SAAS,WAAW,QAAQ,IAAI,aAAa,OAAO,iBAAiB;AAAA,IACvE,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAExB,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,QAAQ,sBAAsB;AAAA,MACzC;AAAA,MACA,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,QAAQ,kBAAkB,KAAK;AAAA,MAClF,cAAe,QAAQ,gBAAmD,CAAC;AAAA,MAC3E,cAAc,IAAI,QAAQ;AAAA,IAC5B,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,iBAAiB,sBAAsB,GAAG;AAChD,QAAI,eAAe,UAAW,OAAM;AACpC,WAAO,KAAK,+CAA+C,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AACpH;AAAA,EACF;AAEA,QAAM,WAAW,MAAM,QAAQ,MAAM,QAAQ,IAAI,KAAK,WAAW,CAAC;AAClE,MAAI,SAAS,SAAS,GAAG;AACvB,UAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,UAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,UAAM,aAAa;AAAA,MACjB,WAAW;AAAA,MACX,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,MAAM,kBAAkB;AAAA,MAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,IACnE;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI;AACF,cAAM,QAAmC;AAAA,UACvC,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,OAAO,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,UAChF;AAAA,QACF;AACA,cAAM,WAAW,QAAQ,kDAAkD;AAAA,UACzE;AAAA,UACA,KAAK;AAAA,QACP,CAAC;AAAA,MACH,SAAS,KAAK;AACZ,cAAM,iBAAiB,sBAAsB,GAAG;AAChD,YAAI,eAAe,WAAW;AAG5B,gBAAM;AAAA,QACR;AACA,eAAO,KAAK,wCAAwC,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AAC7G,cAAM,sBAAsB,EAAE,IAAI,OAAO,SAAS,SAAS,KAAK,cAAc,eAAe,QAAQ,CAAC;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AAKA,MAAI,MAAM,YAAY;AACpB,QAAI;AACF,YAAM,UAAU,KAAK,MAAM,OAAO,KAAK,KAAK,YAAY,QAAQ,EAAE,SAAS,OAAO,CAAC;AAKnF,cAAQ,eAAe,kBAAkB,QAAQ,cAAc,OAAO;AACtE,cAAQ,eAAe,oBAAI,KAAK;AAChC,YAAM,GAAG,MAAM;AAAA,IACjB,SAAS,KAAK;AACZ,aAAO,KAAK,6CAA6C,EAAE,WAAW,QAAQ,IAAI,IAAI,CAAC;AAAA,IACzF;AAAA,EACF;AAEA,MAAI,MAAM,WAAW,MAAM,YAAY;AAMrC,UAAM,YAAY,IAAI,QAAQ,aAAa;AAC3C,QAAI,YAAY,iBAAiB;AAC/B,YAAM,SAAS,MAAM,OAAO,cAAc,GAAG;AAAA,QAC3C,8BAA8B;AAAA,MAChC;AACA,YAAM,MAAM;AAAA,QACV,EAAE,GAAG,IAAI,SAAS,WAAW,YAAY,EAAE;AAAA,QAC3C,EAAE,SAAS,IAAI;AAAA,MACjB;AAAA,IACF,OAAO;AACL,aAAO,KAAK,+CAA+C,EAAE,eAAe,iBAAiB,UAAU,CAAC;AAAA,IAC1G;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/communication_channels/workers/poll-channel.js

@@ -92,7 +92,7 @@ async function handle(job, ctx) {
       channelState: channel.channelState ?? void 0,
       scope: {
         tenantId: scope.tenantId,
-        organizationId: scope.organizationId ?? scope.tenantId
+        organizationId: channel.organizationId ?? null
       },
       // `contactFilter.sinceDays` is a hint to provider adapters about how far
       // back to look on first-poll bootstrap. For UID-incremental polls (every

package/dist/modules/communication_channels/workers/poll-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/workers/poll-channel.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n} from '../commands/ingest-inbound-message'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport { preservePushState } from '../lib/push-state'\nimport { isHubPolledChannel } from '../lib/polling-eligibility'\nimport { writeIngestDeadLetter } from '../lib/dead-letter'\nimport { classifyOutboundError, computeBackoffMs, isReauthError } from '../lib/error-classification'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'poll-channel' })\n\n/**\n * Job payload for the `communication-channels-poll` queue.\n *\n * One job per channel per scheduler tick. The poll-tick worker (sibling file)\n * enumerates due channels and enqueues these jobs.\n */\nexport type PollChannelJobPayload = {\n  channelId: string\n  scope: {\n    tenantId: string\n    organizationId: string | null\n  }\n  /** Attempt count, 1-based; used for retry-backoff decisions. */\n  attempt?: number\n  /** Self-re-enqueue drain counter (bounds the multi-page `hasMore` drain loop). */\n  drainPage?: number\n}\n\nexport const POLL_CHANNEL_MAX_ATTEMPTS = 3\n\n/**\n * Hard cap on `hasMore` self-re-enqueue drain pages \u2014 guards against an adapter\n * that returns `hasMore: true` with a non-advancing (pinned) cursor, which would\n * otherwise spin a tight, unthrottled re-enqueue loop. Mirrors the same guard in\n * `gmail-history-sync`.\n */\nconst MAX_DRAIN_PAGES = 100\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.poll,\n  id: 'communication_channels:poll-channel',\n  concurrency: 10,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Poll a single channel for inbound messages.\n *\n * Per SPEC-045d \u00A7 6 (with email-spec \u00A7 Hub Deltas \u2192 Delta 6 polling extensions):\n *   1. Load the channel; skip when `is_active === false` or `status !== 'connected'`.\n *   2. Skip when the adapter declares `realtimePush !== false` (it doesn't want polling).\n *   3. Refresh credentials if OAuth and within the expiry window.\n *   4. Call `adapter.fetchHistory({ channelId, credentials, since: lastPolledAt })`.\n *   5. For each normalized message, dispatch `ingest_inbound_message` (idempotent on\n *      `(channel_id, external_message_id)`).\n *   6. Update `channel.lastPolledAt = NOW()` on success.\n *   7. On error: classify, set `channel.status` accordingly, set `last_error`, emit\n *      `channel.requires_reauth` on 401, retry transient failures up to MAX.\n *\n * The hub doesn't drain a remote mailbox indefinitely \u2014 `fetchHistory` returns a\n * single page (provider decides the size). If the provider has more, the next tick\n * picks it up after the configured `poll_interval_seconds`.\n */\nexport default async function handle(\n  job: QueuedJob<PollChannelJobPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const { channelId, scope, attempt = 1, drainPage = 0 } = job.payload\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!channel) {\n    logger.warn('channel not found (skipping)', { channelId })\n    return\n  }\n  if (!channel.isActive) return\n  // Allow `connected` (normal poll) and `error` (Spec B \u00A7 B5 auto-recovery\n  // sweep enqueues these intentionally \u2014 on a successful poll below we\n  // flip them back to `connected`). `requires_reauth` and `disconnected`\n  // are owned by the credential-refresh and disconnect flows.\n  if (channel.status !== 'connected' && channel.status !== 'error') return\n\n  const adapter = adapterRegistry?.get(channel.providerKey)\n  if (!adapter) {\n    logger.warn('no adapter for provider', { providerKey: channel.providerKey, channelId })\n    return\n  }\n  // Adapter opted out of polling \u2014 webhook and gateway providers.\n  if (!isHubPolledChannel(channel.capabilities)) {\n    // realtimePush is `true` (default for back-compat) \u2014 don't poll push providers.\n    return\n  }\n  if (typeof adapter.fetchHistory !== 'function') {\n    // Adapter doesn't implement history fetching \u2014 nothing we can do.\n    return\n  }\n\n  // Credentials.\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  // Per-user credentials scope: pass `channel.userId` so the credentials\n  // service returns this user's row, not whoever connected the provider last.\n  // See review R2-C1 / N1 (2026-05-26).\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId ?? scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    {\n      adapter,\n      channelId: channel.id,\n      credentials,\n      scope: credentialsScope,\n    },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  // Fetch a single page of history.\n  // `channelState` is the provider-specific resumption cursor \u2014 Gmail historyId,\n  // IMAP UIDVALIDITY+UIDNEXT, etc. We persist it across\n  // ticks on `channel.channelState` so each poll resumes from the prior one\n  // instead of running a full mailbox resync. Empty / NULL = \"first poll;\n  // bootstrap the cursor from the provider\".\n  let normalized: NormalizedInboundMessage[] = []\n  let nextCursor: string | undefined\n  let hasMore = false\n  try {\n    const result = await adapter.fetchHistory({\n      conversationId: channel.externalIdentifier ?? channel.id,\n      credentials,\n      cursor: channel.lastPolledAt ? channel.lastPolledAt.toISOString() : undefined,\n      channelState: (channel.channelState as Record<string, unknown> | null) ?? undefined,\n      scope: {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId ?? scope.tenantId,\n      },\n      // `contactFilter.sinceDays` is a hint to provider adapters about how far\n      // back to look on first-poll bootstrap. For UID-incremental polls (every\n      // tick after the first), adapters ignore this and just fetch new mail\n      // since the persisted cursor.\n      contactFilter: { addresses: [], sinceDays: 7 },\n    })\n    normalized = Array.isArray(result?.messages) ? result.messages : []\n    nextCursor = result?.nextCursor\n    hasMore = result?.hasMore === true\n  } catch (err) {\n    await handlePollError(err, em, channel, scope, attempt, job.payload)\n    return\n  }\n\n  // Dispatch ingest commands for each message.\n  const commandBus = ctx.resolve<CommandBus>('commandBus')\n  const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n  const commandCtx = {\n    container: containerProxy as never,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n  // Spec B \u00A7 Per-message commit + dead-letter:\n  //   - Permanent failure (malformed MIME, schema, contract violation):\n  //     write to channel_ingest_dead_letter, log, advance cursor anyway so\n  //     the bad blob never stalls the channel again.\n  //   - Transient failure (DB drop, network blip): abort the loop without\n  //     advancing the cursor. The next tick re-fetches the same page;\n  //     idempotency via the (channel_id, external_message_id) unique\n  //     constraint means already-ingested messages no-op on the retry.\n  let transientIngestAbort = false\n  for (const message of normalized) {\n    try {\n      const input: IngestInboundMessageInput = {\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        scope: {\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId ?? null,\n        },\n        message,\n      }\n      await commandBus.execute(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n        input,\n        ctx: commandCtx as never,\n      })\n    } catch (err) {\n      const classification = classifyOutboundError(err)\n      if (classification.transient) {\n        logger.warn('transient ingest failure; aborting page so cursor is not advanced', { channelId: channel.id, reason: classification.message })\n        transientIngestAbort = true\n        break\n      }\n      // Permanent \u2014 write to dead-letter so an operator can replay later.\n      // The shared helper is best-effort (never throws) and idempotent on\n      // `(channelId, externalMessageId)`, so a replayed page that fails the\n      // same message again does not insert a duplicate row.\n      await writeIngestDeadLetter({\n        em,\n        scope,\n        channel,\n        message,\n        err,\n        errorMessage: classification.message,\n      })\n      logger.warn('permanent ingest failure; recorded in dead-letter and advancing cursor', { channelId: channel.id, externalMessageId: message.externalMessageId, reason: classification.message })\n    }\n  }\n\n  // Transient abort: keep prior cursor + lastPolledAt so the next tick\n  // re-fetches the same page (idempotent at the DB layer).\n  if (transientIngestAbort) {\n    channel.lastError = 'transient_ingest_failure'\n    await em.flush()\n    return\n  }\n\n  // Update poll cursor + clear any stale error state.\n  channel.lastPolledAt = new Date()\n  if (channel.lastError) channel.lastError = null\n  // Recover the channel from any prior non-fatal error state. The previous\n  // poll(s) may have set status='error' after exhausting transient-retry\n  // attempts, but a fresh successful poll means the upstream is healthy\n  // again \u2014 flip it back to 'connected' so the scheduler keeps it in\n  // rotation and the user doesn't have to manually reconnect.\n  // We DON'T touch 'requires_reauth' here (that lifecycle state is owned\n  // by the credential-refresh / OAuth flow) or 'disconnected' (owned by\n  // the cascade-on-user-delete subscriber).\n  if (channel.status === 'error') {\n    channel.status = 'connected'\n  }\n  // Providers encode their cursor as base64-encoded JSON in `nextCursor`; we\n  // decode it back to an object so the next tick can pass it straight into\n  // `fetchHistory` as `channelState`. Decode failures fall back to the prior\n  // state (next tick bootstraps from there).\n  //\n  // Push-delivery state (Spec C) \u2014 watch/subscription identifiers and expiry \u2014 is\n  // owned by the push register/renew commands, not the sync cursor. A provider's\n  // `fetchHistory` returns only sync-cursor fields, so persisting the decoded\n  // cursor as a full replace would silently wipe push state and stop\n  // `gmail-renew-watch` from renewing it. Carry\n  // the hub-owned push keys forward whenever the new cursor omits them.\n  if (typeof nextCursor === 'string' && nextCursor.length > 0) {\n    const decoded = decodeChannelStateCursor(nextCursor)\n    if (decoded) {\n      channel.channelState = preservePushState(channel.channelState, decoded)\n    }\n  }\n  await em.flush()\n\n  // Drain contract (review H1, 2026-05-26): adapters that have additional\n  // pages beyond this tick's batch (large mailboxes, mid-deltaLink walks,\n  // UID overflows) signal `hasMore: true`. The persisted `channelState`\n  // already encodes the mid-drain resumption token (Gmail `pendingHistoryPageToken`,\n  // IMAP non-terminal `uidNext`). Re-enqueue with\n  // a small delay so we keep draining without overrunning rate limits.\n  if (hasMore) {\n    // Bound the drain: an adapter that returns `hasMore: true` with a\n    // non-advancing cursor (e.g. a persistently-failing message that pins the\n    // Gmail cursor via `hardFailed`) must not spin an unthrottled loop. Stop\n    // at MAX_DRAIN_PAGES; the next scheduled poll tick re-checks the channel.\n    if (drainPage < MAX_DRAIN_PAGES) {\n      const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.poll)\n      await queue.enqueue(\n        { channelId: channel.id, scope, attempt: 1, drainPage: drainPage + 1 } as unknown as Record<string, unknown>,\n        { delayMs: 250 },\n      )\n    } else {\n      logger.warn('drain page cap reached; stopping re-enqueue until the next scheduled tick', { maxDrainPages: MAX_DRAIN_PAGES, channelId: channel.id })\n    }\n  }\n}\n\nfunction decodeChannelStateCursor(cursor: string): Record<string, unknown> | null {\n  try {\n    const decoded = Buffer.from(cursor, 'base64').toString('utf8')\n    const parsed = JSON.parse(decoded) as unknown\n    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\nasync function handlePollError(\n  err: unknown,\n  em: EntityManager,\n  channel: CommunicationChannel,\n  scope: PollChannelJobPayload['scope'],\n  attempt: number,\n  payload: PollChannelJobPayload,\n): Promise<void> {\n  const classification = classifyOutboundError(err)\n  channel.lastError = classification.message\n\n  if (isReauthError(classification)) {\n    channel.status = 'requires_reauth'\n    await em.flush()\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.requires_reauth',\n      {\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        reason: classification.message,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n    return\n  }\n\n  if (classification.transient && attempt < POLL_CHANNEL_MAX_ATTEMPTS) {\n    // Transient error \u2014 re-enqueue with backoff. Channel status stays\n    // `connected` so the scheduler keeps it in rotation.\n    await em.flush()\n    const next: PollChannelJobPayload = { ...payload, attempt: attempt + 1 }\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.poll)\n    await queue.enqueue(next as unknown as Record<string, unknown>, {\n      delayMs: computeBackoffMs(attempt),\n    })\n    return\n  }\n\n  // Permanent or attempts exhausted \u2014 mark channel as error and stop the loop.\n  channel.status = 'error'\n  await em.flush()\n}\n"],
-  "mappings": "AAGA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,+BAA+B,qCAAqC;AAC7E,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB,kBAAkB,qBAAqB;AACvE,SAAS,kCAAkC;AAC3C,SAAS,sCAAsC;AAG/C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAoBlF,MAAM,4BAA4B;AAQzC,MAAM,kBAAkB;AAEjB,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAoCA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,WAAW,OAAO,UAAU,GAAG,YAAY,EAAE,IAAI,IAAI;AAC7D,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AAEpF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,gCAAgC,EAAE,UAAU,CAAC;AACzD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAU;AAKvB,MAAI,QAAQ,WAAW,eAAe,QAAQ,WAAW,QAAS;AAElE,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,2BAA2B,EAAE,aAAa,QAAQ,aAAa,UAAU,CAAC;AACtF;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,QAAQ,YAAY,GAAG;AAE7C;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,iBAAiB,YAAY;AAE9C;AAAA,EACF;AAGA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAIA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM,kBAAkB,MAAM;AAAA,IAC9C,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAQxB,MAAI,aAAyC,CAAC;AAC9C,MAAI;AACJ,MAAI,UAAU;AACd,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa;AAAA,MACxC,gBAAgB,QAAQ,sBAAsB,QAAQ;AAAA,MACtD;AAAA,MACA,QAAQ,QAAQ,eAAe,QAAQ,aAAa,YAAY,IAAI;AAAA,MACpE,cAAe,QAAQ,gBAAmD;AAAA,MAC1E,OAAO;AAAA,QACL,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM,kBAAkB,MAAM;AAAA,MAChD;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,eAAe,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE;AAAA,IAC/C,CAAC;AACD,iBAAa,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,CAAC;AAClE,iBAAa,QAAQ;AACrB,cAAU,QAAQ,YAAY;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,gBAAgB,KAAK,IAAI,SAAS,OAAO,SAAS,IAAI,OAAO;AACnE;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,QAAM,aAAa;AAAA,IACjB,WAAW;AAAA,IACX,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AASA,MAAI,uBAAuB;AAC3B,aAAW,WAAW,YAAY;AAChC,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,OAAO;AAAA,UACL,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM,kBAAkB;AAAA,QAC1C;AAAA,QACA;AAAA,MACF;AACA,YAAM,WAAW,QAAQ,kDAAkD;AAAA,QACzE;AAAA,QACA,KAAK;AAAA,MACP,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,iBAAiB,sBAAsB,GAAG;AAChD,UAAI,eAAe,WAAW;AAC5B,eAAO,KAAK,qEAAqE,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AAC1I,+BAAuB;AACvB;AAAA,MACF;AAKA,YAAM,sBAAsB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,eAAe;AAAA,MAC/B,CAAC;AACD,aAAO,KAAK,0EAA0E,EAAE,WAAW,QAAQ,IAAI,mBAAmB,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,CAAC;AAAA,IAC/L;AAAA,EACF;AAIA,MAAI,sBAAsB;AACxB,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AACf;AAAA,EACF;AAGA,UAAQ,eAAe,oBAAI,KAAK;AAChC,MAAI,QAAQ,UAAW,SAAQ,YAAY;AAS3C,MAAI,QAAQ,WAAW,SAAS;AAC9B,YAAQ,SAAS;AAAA,EACnB;AAYA,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,GAAG;AAC3D,UAAM,UAAU,yBAAyB,UAAU;AACnD,QAAI,SAAS;AACX,cAAQ,eAAe,kBAAkB,QAAQ,cAAc,OAAO;AAAA,IACxE;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AAQf,MAAI,SAAS;AAKX,QAAI,YAAY,iBAAiB;AAC/B,YAAM,QAAQ,8BAA8B,8BAA8B,IAAI;AAC9E,YAAM,MAAM;AAAA,QACV,EAAE,WAAW,QAAQ,IAAI,OAAO,SAAS,GAAG,WAAW,YAAY,EAAE;AAAA,QACrE,EAAE,SAAS,IAAI;AAAA,MACjB;AAAA,IACF,OAAO;AACL,aAAO,KAAK,6EAA6E,EAAE,eAAe,iBAAiB,WAAW,QAAQ,GAAG,CAAC;AAAA,IACpJ;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAAgD;AAChF,MAAI;AACF,UAAM,UAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC7D,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,QAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBACb,KACA,IACA,SACA,OACA,SACA,SACe;AACf,QAAM,iBAAiB,sBAAsB,GAAG;AAChD,UAAQ,YAAY,eAAe;AAEnC,MAAI,cAAc,cAAc,GAAG;AACjC,YAAQ,SAAS;AACjB,UAAM,GAAG,MAAM;AACf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,QAAQ,eAAe;AAAA,QACvB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM,kBAAkB;AAAA,MAC1C;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AACA;AAAA,EACF;AAEA,MAAI,eAAe,aAAa,UAAU,2BAA2B;AAGnE,UAAM,GAAG,MAAM;AACf,UAAM,OAA8B,EAAE,GAAG,SAAS,SAAS,UAAU,EAAE;AACvE,UAAM,QAAQ,8BAA8B,8BAA8B,IAAI;AAC9E,UAAM,MAAM,QAAQ,MAA4C;AAAA,MAC9D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AACD;AAAA,EACF;AAGA,UAAQ,SAAS;AACjB,QAAM,GAAG,MAAM;AACjB;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID,\n  type IngestInboundMessageInput,\n} from '../commands/ingest-inbound-message'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport { preservePushState } from '../lib/push-state'\nimport { isHubPolledChannel } from '../lib/polling-eligibility'\nimport { writeIngestDeadLetter } from '../lib/dead-letter'\nimport { classifyOutboundError, computeBackoffMs, isReauthError } from '../lib/error-classification'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport type { NormalizedInboundMessage } from '../lib/adapter'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'poll-channel' })\n\n/**\n * Job payload for the `communication-channels-poll` queue.\n *\n * One job per channel per scheduler tick. The poll-tick worker (sibling file)\n * enumerates due channels and enqueues these jobs.\n */\nexport type PollChannelJobPayload = {\n  channelId: string\n  scope: {\n    tenantId: string\n    organizationId: string | null\n  }\n  /** Attempt count, 1-based; used for retry-backoff decisions. */\n  attempt?: number\n  /** Self-re-enqueue drain counter (bounds the multi-page `hasMore` drain loop). */\n  drainPage?: number\n}\n\nexport const POLL_CHANNEL_MAX_ATTEMPTS = 3\n\n/**\n * Hard cap on `hasMore` self-re-enqueue drain pages \u2014 guards against an adapter\n * that returns `hasMore: true` with a non-advancing (pinned) cursor, which would\n * otherwise spin a tight, unthrottled re-enqueue loop. Mirrors the same guard in\n * `gmail-history-sync`.\n */\nconst MAX_DRAIN_PAGES = 100\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.poll,\n  id: 'communication_channels:poll-channel',\n  concurrency: 10,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\n/**\n * Poll a single channel for inbound messages.\n *\n * Per SPEC-045d \u00A7 6 (with email-spec \u00A7 Hub Deltas \u2192 Delta 6 polling extensions):\n *   1. Load the channel; skip when `is_active === false` or `status !== 'connected'`.\n *   2. Skip when the adapter declares `realtimePush !== false` (it doesn't want polling).\n *   3. Refresh credentials if OAuth and within the expiry window.\n *   4. Call `adapter.fetchHistory({ channelId, credentials, since: lastPolledAt })`.\n *   5. For each normalized message, dispatch `ingest_inbound_message` (idempotent on\n *      `(channel_id, external_message_id)`).\n *   6. Update `channel.lastPolledAt = NOW()` on success.\n *   7. On error: classify, set `channel.status` accordingly, set `last_error`, emit\n *      `channel.requires_reauth` on 401, retry transient failures up to MAX.\n *\n * The hub doesn't drain a remote mailbox indefinitely \u2014 `fetchHistory` returns a\n * single page (provider decides the size). If the provider has more, the next tick\n * picks it up after the configured `poll_interval_seconds`.\n */\nexport default async function handle(\n  job: QueuedJob<PollChannelJobPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  const { channelId, scope, attempt = 1, drainPage = 0 } = job.payload\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: channelId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    scope,\n  )\n  if (!channel) {\n    logger.warn('channel not found (skipping)', { channelId })\n    return\n  }\n  if (!channel.isActive) return\n  // Allow `connected` (normal poll) and `error` (Spec B \u00A7 B5 auto-recovery\n  // sweep enqueues these intentionally \u2014 on a successful poll below we\n  // flip them back to `connected`). `requires_reauth` and `disconnected`\n  // are owned by the credential-refresh and disconnect flows.\n  if (channel.status !== 'connected' && channel.status !== 'error') return\n\n  const adapter = adapterRegistry?.get(channel.providerKey)\n  if (!adapter) {\n    logger.warn('no adapter for provider', { providerKey: channel.providerKey, channelId })\n    return\n  }\n  // Adapter opted out of polling \u2014 webhook and gateway providers.\n  if (!isHubPolledChannel(channel.capabilities)) {\n    // realtimePush is `true` (default for back-compat) \u2014 don't poll push providers.\n    return\n  }\n  if (typeof adapter.fetchHistory !== 'function') {\n    // Adapter doesn't implement history fetching \u2014 nothing we can do.\n    return\n  }\n\n  // Credentials.\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  // Per-user credentials scope: pass `channel.userId` so the credentials\n  // service returns this user's row, not whoever connected the provider last.\n  // See review R2-C1 / N1 (2026-05-26).\n  const credentialsScope = {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId ?? scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  let credentials: Record<string, unknown> = {}\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    {\n      adapter,\n      channelId: channel.id,\n      credentials,\n      scope: credentialsScope,\n    },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  // Fetch a single page of history.\n  // `channelState` is the provider-specific resumption cursor \u2014 Gmail historyId,\n  // IMAP UIDVALIDITY+UIDNEXT, etc. We persist it across\n  // ticks on `channel.channelState` so each poll resumes from the prior one\n  // instead of running a full mailbox resync. Empty / NULL = \"first poll;\n  // bootstrap the cursor from the provider\".\n  let normalized: NormalizedInboundMessage[] = []\n  let nextCursor: string | undefined\n  let hasMore = false\n  try {\n    const result = await adapter.fetchHistory({\n      conversationId: channel.externalIdentifier ?? channel.id,\n      credentials,\n      cursor: channel.lastPolledAt ? channel.lastPolledAt.toISOString() : undefined,\n      channelState: (channel.channelState as Record<string, unknown> | null) ?? undefined,\n      scope: {\n        tenantId: scope.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      // `contactFilter.sinceDays` is a hint to provider adapters about how far\n      // back to look on first-poll bootstrap. For UID-incremental polls (every\n      // tick after the first), adapters ignore this and just fetch new mail\n      // since the persisted cursor.\n      contactFilter: { addresses: [], sinceDays: 7 },\n    })\n    normalized = Array.isArray(result?.messages) ? result.messages : []\n    nextCursor = result?.nextCursor\n    hasMore = result?.hasMore === true\n  } catch (err) {\n    await handlePollError(err, em, channel, scope, attempt, job.payload)\n    return\n  }\n\n  // Dispatch ingest commands for each message.\n  const commandBus = ctx.resolve<CommandBus>('commandBus')\n  const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n  const commandCtx = {\n    container: containerProxy as never,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: scope.organizationId ?? null,\n    organizationIds: scope.organizationId ? [scope.organizationId] : null,\n  }\n  // Spec B \u00A7 Per-message commit + dead-letter:\n  //   - Permanent failure (malformed MIME, schema, contract violation):\n  //     write to channel_ingest_dead_letter, log, advance cursor anyway so\n  //     the bad blob never stalls the channel again.\n  //   - Transient failure (DB drop, network blip): abort the loop without\n  //     advancing the cursor. The next tick re-fetches the same page;\n  //     idempotency via the (channel_id, external_message_id) unique\n  //     constraint means already-ingested messages no-op on the retry.\n  let transientIngestAbort = false\n  for (const message of normalized) {\n    try {\n      const input: IngestInboundMessageInput = {\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        scope: {\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId ?? null,\n        },\n        message,\n      }\n      await commandBus.execute(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {\n        input,\n        ctx: commandCtx as never,\n      })\n    } catch (err) {\n      const classification = classifyOutboundError(err)\n      if (classification.transient) {\n        logger.warn('transient ingest failure; aborting page so cursor is not advanced', { channelId: channel.id, reason: classification.message })\n        transientIngestAbort = true\n        break\n      }\n      // Permanent \u2014 write to dead-letter so an operator can replay later.\n      // The shared helper is best-effort (never throws) and idempotent on\n      // `(channelId, externalMessageId)`, so a replayed page that fails the\n      // same message again does not insert a duplicate row.\n      await writeIngestDeadLetter({\n        em,\n        scope,\n        channel,\n        message,\n        err,\n        errorMessage: classification.message,\n      })\n      logger.warn('permanent ingest failure; recorded in dead-letter and advancing cursor', { channelId: channel.id, externalMessageId: message.externalMessageId, reason: classification.message })\n    }\n  }\n\n  // Transient abort: keep prior cursor + lastPolledAt so the next tick\n  // re-fetches the same page (idempotent at the DB layer).\n  if (transientIngestAbort) {\n    channel.lastError = 'transient_ingest_failure'\n    await em.flush()\n    return\n  }\n\n  // Update poll cursor + clear any stale error state.\n  channel.lastPolledAt = new Date()\n  if (channel.lastError) channel.lastError = null\n  // Recover the channel from any prior non-fatal error state. The previous\n  // poll(s) may have set status='error' after exhausting transient-retry\n  // attempts, but a fresh successful poll means the upstream is healthy\n  // again \u2014 flip it back to 'connected' so the scheduler keeps it in\n  // rotation and the user doesn't have to manually reconnect.\n  // We DON'T touch 'requires_reauth' here (that lifecycle state is owned\n  // by the credential-refresh / OAuth flow) or 'disconnected' (owned by\n  // the cascade-on-user-delete subscriber).\n  if (channel.status === 'error') {\n    channel.status = 'connected'\n  }\n  // Providers encode their cursor as base64-encoded JSON in `nextCursor`; we\n  // decode it back to an object so the next tick can pass it straight into\n  // `fetchHistory` as `channelState`. Decode failures fall back to the prior\n  // state (next tick bootstraps from there).\n  //\n  // Push-delivery state (Spec C) \u2014 watch/subscription identifiers and expiry \u2014 is\n  // owned by the push register/renew commands, not the sync cursor. A provider's\n  // `fetchHistory` returns only sync-cursor fields, so persisting the decoded\n  // cursor as a full replace would silently wipe push state and stop\n  // `gmail-renew-watch` from renewing it. Carry\n  // the hub-owned push keys forward whenever the new cursor omits them.\n  if (typeof nextCursor === 'string' && nextCursor.length > 0) {\n    const decoded = decodeChannelStateCursor(nextCursor)\n    if (decoded) {\n      channel.channelState = preservePushState(channel.channelState, decoded)\n    }\n  }\n  await em.flush()\n\n  // Drain contract (review H1, 2026-05-26): adapters that have additional\n  // pages beyond this tick's batch (large mailboxes, mid-deltaLink walks,\n  // UID overflows) signal `hasMore: true`. The persisted `channelState`\n  // already encodes the mid-drain resumption token (Gmail `pendingHistoryPageToken`,\n  // IMAP non-terminal `uidNext`). Re-enqueue with\n  // a small delay so we keep draining without overrunning rate limits.\n  if (hasMore) {\n    // Bound the drain: an adapter that returns `hasMore: true` with a\n    // non-advancing cursor (e.g. a persistently-failing message that pins the\n    // Gmail cursor via `hardFailed`) must not spin an unthrottled loop. Stop\n    // at MAX_DRAIN_PAGES; the next scheduled poll tick re-checks the channel.\n    if (drainPage < MAX_DRAIN_PAGES) {\n      const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.poll)\n      await queue.enqueue(\n        { channelId: channel.id, scope, attempt: 1, drainPage: drainPage + 1 } as unknown as Record<string, unknown>,\n        { delayMs: 250 },\n      )\n    } else {\n      logger.warn('drain page cap reached; stopping re-enqueue until the next scheduled tick', { maxDrainPages: MAX_DRAIN_PAGES, channelId: channel.id })\n    }\n  }\n}\n\nfunction decodeChannelStateCursor(cursor: string): Record<string, unknown> | null {\n  try {\n    const decoded = Buffer.from(cursor, 'base64').toString('utf8')\n    const parsed = JSON.parse(decoded) as unknown\n    if (parsed && typeof parsed === 'object' && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\nasync function handlePollError(\n  err: unknown,\n  em: EntityManager,\n  channel: CommunicationChannel,\n  scope: PollChannelJobPayload['scope'],\n  attempt: number,\n  payload: PollChannelJobPayload,\n): Promise<void> {\n  const classification = classifyOutboundError(err)\n  channel.lastError = classification.message\n\n  if (isReauthError(classification)) {\n    channel.status = 'requires_reauth'\n    await em.flush()\n    await emitCommunicationChannelsEvent(\n      'communication_channels.channel.requires_reauth',\n      {\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        reason: classification.message,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId ?? null,\n      },\n      { persistent: true },\n    )\n    return\n  }\n\n  if (classification.transient && attempt < POLL_CHANNEL_MAX_ATTEMPTS) {\n    // Transient error \u2014 re-enqueue with backoff. Channel status stays\n    // `connected` so the scheduler keeps it in rotation.\n    await em.flush()\n    const next: PollChannelJobPayload = { ...payload, attempt: attempt + 1 }\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.poll)\n    await queue.enqueue(next as unknown as Record<string, unknown>, {\n      delayMs: computeBackoffMs(attempt),\n    })\n    return\n  }\n\n  // Permanent or attempts exhausted \u2014 mark channel as error and stop the loop.\n  channel.status = 'error'\n  await em.flush()\n}\n"],
+  "mappings": "AAGA,SAAS,6BAA6B;AACtC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,+BAA+B,qCAAqC;AAC7E,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AACnC,SAAS,6BAA6B;AACtC,SAAS,uBAAuB,kBAAkB,qBAAqB;AACvE,SAAS,kCAAkC;AAC3C,SAAS,sCAAsC;AAG/C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,eAAe,CAAC;AAoBlF,MAAM,4BAA4B;AAQzC,MAAM,kBAAkB;AAEjB,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAoCA,eAAO,OACL,KACA,KACe;AACf,QAAM,EAAE,WAAW,OAAO,UAAU,GAAG,YAAY,EAAE,IAAI,IAAI;AAC7D,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AAEpF,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM,kBAAkB;AAAA,MACxC,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,gCAAgC,EAAE,UAAU,CAAC;AACzD;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,SAAU;AAKvB,MAAI,QAAQ,WAAW,eAAe,QAAQ,WAAW,QAAS;AAElE,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO,KAAK,2BAA2B,EAAE,aAAa,QAAQ,aAAa,UAAU,CAAC;AACtF;AAAA,EACF;AAEA,MAAI,CAAC,mBAAmB,QAAQ,YAAY,GAAG;AAE7C;AAAA,EACF;AACA,MAAI,OAAO,QAAQ,iBAAiB,YAAY;AAE9C;AAAA,EACF;AAGA,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAIA,QAAM,mBAAmB;AAAA,IACvB,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM,kBAAkB,MAAM;AAAA,IAC9C,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,cAAuC,CAAC;AAC5C,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAQxB,MAAI,aAAyC,CAAC;AAC9C,MAAI;AACJ,MAAI,UAAU;AACd,MAAI;AACF,UAAM,SAAS,MAAM,QAAQ,aAAa;AAAA,MACxC,gBAAgB,QAAQ,sBAAsB,QAAQ;AAAA,MACtD;AAAA,MACA,QAAQ,QAAQ,eAAe,QAAQ,aAAa,YAAY,IAAI;AAAA,MACpE,cAAe,QAAQ,gBAAmD;AAAA,MAC1E,OAAO;AAAA,QACL,UAAU,MAAM;AAAA,QAChB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,MAKA,eAAe,EAAE,WAAW,CAAC,GAAG,WAAW,EAAE;AAAA,IAC/C,CAAC;AACD,iBAAa,MAAM,QAAQ,QAAQ,QAAQ,IAAI,OAAO,WAAW,CAAC;AAClE,iBAAa,QAAQ;AACrB,cAAU,QAAQ,YAAY;AAAA,EAChC,SAAS,KAAK;AACZ,UAAM,gBAAgB,KAAK,IAAI,SAAS,OAAO,SAAS,IAAI,OAAO;AACnE;AAAA,EACF;AAGA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,QAAM,aAAa;AAAA,IACjB,WAAW;AAAA,IACX,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,MAAM,kBAAkB;AAAA,IAChD,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,EACnE;AASA,MAAI,uBAAuB;AAC3B,aAAW,WAAW,YAAY;AAChC,QAAI;AACF,YAAM,QAAmC;AAAA,QACvC,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,OAAO;AAAA,UACL,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM,kBAAkB;AAAA,QAC1C;AAAA,QACA;AAAA,MACF;AACA,YAAM,WAAW,QAAQ,kDAAkD;AAAA,QACzE;AAAA,QACA,KAAK;AAAA,MACP,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,iBAAiB,sBAAsB,GAAG;AAChD,UAAI,eAAe,WAAW;AAC5B,eAAO,KAAK,qEAAqE,EAAE,WAAW,QAAQ,IAAI,QAAQ,eAAe,QAAQ,CAAC;AAC1I,+BAAuB;AACvB;AAAA,MACF;AAKA,YAAM,sBAAsB;AAAA,QAC1B;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,cAAc,eAAe;AAAA,MAC/B,CAAC;AACD,aAAO,KAAK,0EAA0E,EAAE,WAAW,QAAQ,IAAI,mBAAmB,QAAQ,mBAAmB,QAAQ,eAAe,QAAQ,CAAC;AAAA,IAC/L;AAAA,EACF;AAIA,MAAI,sBAAsB;AACxB,YAAQ,YAAY;AACpB,UAAM,GAAG,MAAM;AACf;AAAA,EACF;AAGA,UAAQ,eAAe,oBAAI,KAAK;AAChC,MAAI,QAAQ,UAAW,SAAQ,YAAY;AAS3C,MAAI,QAAQ,WAAW,SAAS;AAC9B,YAAQ,SAAS;AAAA,EACnB;AAYA,MAAI,OAAO,eAAe,YAAY,WAAW,SAAS,GAAG;AAC3D,UAAM,UAAU,yBAAyB,UAAU;AACnD,QAAI,SAAS;AACX,cAAQ,eAAe,kBAAkB,QAAQ,cAAc,OAAO;AAAA,IACxE;AAAA,EACF;AACA,QAAM,GAAG,MAAM;AAQf,MAAI,SAAS;AAKX,QAAI,YAAY,iBAAiB;AAC/B,YAAM,QAAQ,8BAA8B,8BAA8B,IAAI;AAC9E,YAAM,MAAM;AAAA,QACV,EAAE,WAAW,QAAQ,IAAI,OAAO,SAAS,GAAG,WAAW,YAAY,EAAE;AAAA,QACrE,EAAE,SAAS,IAAI;AAAA,MACjB;AAAA,IACF,OAAO;AACL,aAAO,KAAK,6EAA6E,EAAE,eAAe,iBAAiB,WAAW,QAAQ,GAAG,CAAC;AAAA,IACpJ;AAAA,EACF;AACF;AAEA,SAAS,yBAAyB,QAAgD;AAChF,MAAI;AACF,UAAM,UAAU,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC7D,UAAM,SAAS,KAAK,MAAM,OAAO;AACjC,QAAI,UAAU,OAAO,WAAW,YAAY,CAAC,MAAM,QAAQ,MAAM,GAAG;AAClE,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,gBACb,KACA,IACA,SACA,OACA,SACA,SACe;AACf,QAAM,iBAAiB,sBAAsB,GAAG;AAChD,UAAQ,YAAY,eAAe;AAEnC,MAAI,cAAc,cAAc,GAAG;AACjC,YAAQ,SAAS;AACjB,UAAM,GAAG,MAAM;AACf,UAAM;AAAA,MACJ;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,QAAQ,eAAe;AAAA,QACvB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM,kBAAkB;AAAA,MAC1C;AAAA,MACA,EAAE,YAAY,KAAK;AAAA,IACrB;AACA;AAAA,EACF;AAEA,MAAI,eAAe,aAAa,UAAU,2BAA2B;AAGnE,UAAM,GAAG,MAAM;AACf,UAAM,OAA8B,EAAE,GAAG,SAAS,SAAS,UAAU,EAAE;AACvE,UAAM,QAAQ,8BAA8B,8BAA8B,IAAI;AAC9E,UAAM,MAAM,QAAQ,MAA4C;AAAA,MAC9D,SAAS,iBAAiB,OAAO;AAAA,IACnC,CAAC;AACD;AAAA,EACF;AAGA,UAAQ,SAAS;AACjB,QAAM,GAAG,MAAM;AACjB;",
   "names": []
 }

package/dist/modules/communication_channels/workers/reaction-processor.js

@@ -131,7 +131,7 @@ async function callAdapterOutbound(payload, ctx, action) {
         credentials,
         scope: {
           tenantId: payload.scope.tenantId,
-          organizationId: payload.scope.organizationId ?? payload.scope.tenantId
+          organizationId: channel.organizationId ?? null
         }
       });
     } else {
@@ -146,7 +146,7 @@ async function callAdapterOutbound(payload, ctx, action) {
         credentials,
         scope: {
           tenantId: payload.scope.tenantId,
-          organizationId: payload.scope.organizationId ?? payload.scope.tenantId
+          organizationId: channel.organizationId ?? null
         }
       });
     }

package/dist/modules/communication_channels/workers/reaction-processor.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/workers/reaction-processor.ts"],
-  "sourcesContent": ["import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,\n  type ProcessInboundReactionInput,\n  type ProcessInboundReactionResult,\n} from '../commands/process-inbound-reaction'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport { classifyOutboundError, computeBackoffMs } from '../lib/error-classification'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  REACTION_PROCESSOR_MAX_ATTEMPTS,\n  type ReactionInboundJob,\n  type ReactionOutboundRemoveJob,\n  type ReactionOutboundSendJob,\n  type ReactionProcessorPayload,\n} from '../lib/reaction-processor-types'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'reaction-processor' })\n\nexport type { ReactionProcessorPayload }\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.reactions,\n  id: 'communication_channels:reaction-processor',\n  concurrency: 10,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\n/**\n * Unified reaction worker \u2014 handles inbound, outbound-send, and outbound-remove\n * jobs from the `communication-channels-reactions` queue via a discriminated payload.\n *\n *   - `inbound` \u2014 dispatches the `process_inbound_reaction` command which\n *     applies provider semantics and emits `.reaction.added/.removed`.\n *   - `outbound_send` \u2014 calls `adapter.sendReaction?(...)`. The local\n *     `MessageReaction` row was already created by the API/command layer\n *     for UX responsiveness; this worker just notifies the provider.\n *   - `outbound_remove` \u2014 calls `adapter.removeReaction?(...)`. The local\n *     row was already deleted by the API/command layer.\n *\n * Retry: transient failures re-enqueue with exponential backoff up to\n * `REACTION_PROCESSOR_MAX_ATTEMPTS = 3`. Permanent failures stop. Reactions\n * are inherently low-stakes (a missed reaction is annoying, not data loss),\n * so we do not surface failures via a dedicated event; provider errors are\n * logged through `integrationLogService` when available.\n */\nexport default async function handle(\n  job: QueuedJob<ReactionProcessorPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  switch (job.payload.kind) {\n    case 'inbound':\n      await handleInbound(job.payload, ctx)\n      return\n    case 'outbound_send':\n      await handleOutboundSend(job.payload, ctx)\n      return\n    case 'outbound_remove':\n      await handleOutboundRemove(job.payload, ctx)\n      return\n    default: {\n      // exhaustiveness check\n      const exhaustive: never = job.payload\n      throw new Error(`Unknown reaction job kind: ${JSON.stringify(exhaustive)}`)\n    }\n  }\n}\n\nasync function handleInbound(payload: ReactionInboundJob, ctx: HandlerContext): Promise<void> {\n  const commandBus = ctx.resolve<CommandBus>('commandBus')\n  const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n  const commandCtx = {\n    container: containerProxy as never,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: payload.scope.organizationId ?? null,\n    organizationIds: payload.scope.organizationId ? [payload.scope.organizationId] : null,\n  }\n  const input: ProcessInboundReactionInput = {\n    channelId: payload.channelId,\n    providerKey: payload.providerKey,\n    channelType: payload.channelType,\n    scope: payload.scope,\n    event: payload.event,\n  }\n  await commandBus.execute<ProcessInboundReactionInput, ProcessInboundReactionResult>(\n    COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,\n    { input, ctx: commandCtx as never },\n  )\n}\n\nasync function handleOutboundSend(payload: ReactionOutboundSendJob, ctx: HandlerContext): Promise<void> {\n  const result = await callAdapterOutbound(payload, ctx, 'send')\n  await maybeRetry(result, payload, ctx)\n}\n\nasync function handleOutboundRemove(\n  payload: ReactionOutboundRemoveJob,\n  ctx: HandlerContext,\n): Promise<void> {\n  const result = await callAdapterOutbound(payload, ctx, 'remove')\n  await maybeRetry(result, payload, ctx)\n}\n\ntype AdapterCallResult =\n  | { status: 'ok' }\n  | { status: 'no_adapter'; message: string }\n  | { status: 'channel_inactive'; message: string }\n  | { status: 'failed'; transient: boolean; message: string }\n\nasync function callAdapterOutbound(\n  payload: ReactionOutboundSendJob | ReactionOutboundRemoveJob,\n  ctx: HandlerContext,\n  action: 'send' | 'remove',\n): Promise<AdapterCallResult> {\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n  const adapter = adapterRegistry?.get(payload.providerKey)\n  if (!adapter) {\n    return { status: 'no_adapter', message: `No adapter for provider '${payload.providerKey}'` }\n  }\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: payload.channelId,\n      tenantId: payload.scope.tenantId,\n      organizationId: payload.scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    payload.scope,\n  )\n  if (!channel) {\n    return { status: 'no_adapter', message: `Channel ${payload.channelId} not found` }\n  }\n  if (!channel.isActive) {\n    return { status: 'channel_inactive', message: `Channel ${payload.channelId} is inactive` }\n  }\n\n  // Credentials. Per-user scoping via `channel.userId` (review R2-C1 / N1).\n  type CredentialsServiceLike = {\n    resolve: (\n      integrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n    save?: (\n      integrationId: string,\n      credentials: Record<string, unknown>,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<void>\n  }\n  let credentials: Record<string, unknown> = {}\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: payload.scope.tenantId,\n    organizationId: payload.scope.organizationId ?? payload.scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    {\n      adapter,\n      channelId: channel.id,\n      credentials,\n      scope: credentialsScope,\n    },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  try {\n    if (action === 'send') {\n      if (typeof adapter.sendReaction !== 'function') {\n        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no sendReaction` }\n      }\n      const sendPayload = payload as ReactionOutboundSendJob\n      await adapter.sendReaction({\n        externalMessageId: sendPayload.messageId, // platform message id; the adapter maps to provider id via its own channel-link lookup if needed\n        conversationId: sendPayload.conversationId ?? '',\n        emoji: sendPayload.emoji,\n        credentials,\n        scope: {\n          tenantId: payload.scope.tenantId,\n          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,\n        },\n      })\n    } else {\n      if (typeof adapter.removeReaction !== 'function') {\n        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no removeReaction` }\n      }\n      const removePayload = payload as ReactionOutboundRemoveJob\n      await adapter.removeReaction({\n        externalMessageId: removePayload.externalReactionId ?? removePayload.messageId,\n        conversationId: removePayload.conversationId ?? '',\n        emoji: removePayload.emoji,\n        credentials,\n        scope: {\n          tenantId: payload.scope.tenantId,\n          organizationId: payload.scope.organizationId ?? payload.scope.tenantId,\n        },\n      })\n    }\n    return { status: 'ok' }\n  } catch (err) {\n    const classification = classifyOutboundError(err)\n    return {\n      status: 'failed',\n      transient: classification.transient,\n      message: classification.message,\n    }\n  }\n}\n\nasync function maybeRetry(\n  result: AdapterCallResult,\n  payload: ReactionProcessorPayload,\n  ctx: HandlerContext,\n): Promise<void> {\n  if (result.status === 'ok') return\n  if (result.status === 'no_adapter' || result.status === 'channel_inactive') {\n    // Permanent \u2014 log and stop.\n    logger.error('reaction processing failed', { status: result.status, reason: result.message })\n    return\n  }\n  if (!result.transient) {\n    logger.error('permanent reaction processing failure', { reason: result.message })\n    return\n  }\n  const attempt = payload.attempt ?? 1\n  if (attempt >= REACTION_PROCESSOR_MAX_ATTEMPTS) {\n    logger.error('giving up on reaction processing', { attempt, reason: result.message })\n    return\n  }\n  const next: ReactionProcessorPayload = { ...payload, attempt: attempt + 1 }\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n  await queue.enqueue(next as unknown as Record<string, unknown>, {\n    delayMs: computeBackoffMs(attempt),\n  })\n}\n"],
-  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,+BAA+B,qCAAqC;AAC7E,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAKK;AACP,SAAS,kCAAkC;AAE3C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAIxF,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAwBA,eAAO,OACL,KACA,KACe;AACf,UAAQ,IAAI,QAAQ,MAAM;AAAA,IACxB,KAAK;AACH,YAAM,cAAc,IAAI,SAAS,GAAG;AACpC;AAAA,IACF,KAAK;AACH,YAAM,mBAAmB,IAAI,SAAS,GAAG;AACzC;AAAA,IACF,KAAK;AACH,YAAM,qBAAqB,IAAI,SAAS,GAAG;AAC3C;AAAA,IACF,SAAS;AAEP,YAAM,aAAoB,IAAI;AAC9B,YAAM,IAAI,MAAM,8BAA8B,KAAK,UAAU,UAAU,CAAC,EAAE;AAAA,IAC5E;AAAA,EACF;AACF;AAEA,eAAe,cAAc,SAA6B,KAAoC;AAC5F,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,QAAM,aAAa;AAAA,IACjB,WAAW;AAAA,IACX,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,QAAQ,MAAM,kBAAkB;AAAA,IACxD,iBAAiB,QAAQ,MAAM,iBAAiB,CAAC,QAAQ,MAAM,cAAc,IAAI;AAAA,EACnF;AACA,QAAM,QAAqC;AAAA,IACzC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,aAAa,QAAQ;AAAA,IACrB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB;AACA,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,OAAO,KAAK,WAAoB;AAAA,EACpC;AACF;AAEA,eAAe,mBAAmB,SAAkC,KAAoC;AACtG,QAAM,SAAS,MAAM,oBAAoB,SAAS,KAAK,MAAM;AAC7D,QAAM,WAAW,QAAQ,SAAS,GAAG;AACvC;AAEA,eAAe,qBACb,SACA,KACe;AACf,QAAM,SAAS,MAAM,oBAAoB,SAAS,KAAK,QAAQ;AAC/D,QAAM,WAAW,QAAQ,SAAS,GAAG;AACvC;AAQA,eAAe,oBACb,SACA,KACA,QAC4B;AAC5B,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AACpF,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,QAAQ,cAAc,SAAS,4BAA4B,QAAQ,WAAW,IAAI;AAAA,EAC7F;AACA,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ,MAAM;AAAA,MACxB,gBAAgB,QAAQ,MAAM,kBAAkB;AAAA,MAChD,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,QAAQ,cAAc,SAAS,WAAW,QAAQ,SAAS,aAAa;AAAA,EACnF;AACA,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,QAAQ,oBAAoB,SAAS,WAAW,QAAQ,SAAS,eAAe;AAAA,EAC3F;AAcA,MAAI,cAAuC,CAAC;AAC5C,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,QAAQ,MAAM;AAAA,IACxB,gBAAgB,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AAAA,IAC9D,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAExB,MAAI;AACF,QAAI,WAAW,QAAQ;AACrB,UAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,eAAO,EAAE,QAAQ,cAAc,SAAS,YAAY,QAAQ,WAAW,wBAAwB;AAAA,MACjG;AACA,YAAM,cAAc;AACpB,YAAM,QAAQ,aAAa;AAAA,QACzB,mBAAmB,YAAY;AAAA;AAAA,QAC/B,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,OAAO,YAAY;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,QAAQ,MAAM;AAAA,UACxB,gBAAgB,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL,UAAI,OAAO,QAAQ,mBAAmB,YAAY;AAChD,eAAO,EAAE,QAAQ,cAAc,SAAS,YAAY,QAAQ,WAAW,0BAA0B;AAAA,MACnG;AACA,YAAM,gBAAgB;AACtB,YAAM,QAAQ,eAAe;AAAA,QAC3B,mBAAmB,cAAc,sBAAsB,cAAc;AAAA,QACrE,gBAAgB,cAAc,kBAAkB;AAAA,QAChD,OAAO,cAAc;AAAA,QACrB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,QAAQ,MAAM;AAAA,UACxB,gBAAgB,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AAAA,QAChE;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,UAAM,iBAAiB,sBAAsB,GAAG;AAChD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,eAAe,WACb,QACA,SACA,KACe;AACf,MAAI,OAAO,WAAW,KAAM;AAC5B,MAAI,OAAO,WAAW,gBAAgB,OAAO,WAAW,oBAAoB;AAE1E,WAAO,MAAM,8BAA8B,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC5F;AAAA,EACF;AACA,MAAI,CAAC,OAAO,WAAW;AACrB,WAAO,MAAM,yCAAyC,EAAE,QAAQ,OAAO,QAAQ,CAAC;AAChF;AAAA,EACF;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,WAAW,iCAAiC;AAC9C,WAAO,MAAM,oCAAoC,EAAE,SAAS,QAAQ,OAAO,QAAQ,CAAC;AACpF;AAAA,EACF;AACA,QAAM,OAAiC,EAAE,GAAG,SAAS,SAAS,UAAU,EAAE;AAC1E,QAAM,QAAQ,8BAA8B,8BAA8B,SAAS;AACnF,QAAM,MAAM,QAAQ,MAA4C;AAAA,IAC9D,SAAS,iBAAiB,OAAO;AAAA,EACnC,CAAC;AACH;",
+  "sourcesContent": ["import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,\n  type ProcessInboundReactionInput,\n  type ProcessInboundReactionResult,\n} from '../commands/process-inbound-reaction'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from '../lib/queue'\nimport { classifyOutboundError, computeBackoffMs } from '../lib/error-classification'\nimport { CommunicationChannel } from '../data/entities'\nimport {\n  REACTION_PROCESSOR_MAX_ATTEMPTS,\n  type ReactionInboundJob,\n  type ReactionOutboundRemoveJob,\n  type ReactionOutboundSendJob,\n  type ReactionProcessorPayload,\n} from '../lib/reaction-processor-types'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels').child({ component: 'reaction-processor' })\n\nexport type { ReactionProcessorPayload }\n\nexport const metadata: WorkerMeta = {\n  queue: COMMUNICATION_CHANNELS_QUEUES.reactions,\n  id: 'communication_channels:reaction-processor',\n  concurrency: 10,\n}\n\ntype HandlerContext = JobContext & {\n  resolve: <T = unknown>(name: string) => T\n}\n\n/**\n * Unified reaction worker \u2014 handles inbound, outbound-send, and outbound-remove\n * jobs from the `communication-channels-reactions` queue via a discriminated payload.\n *\n *   - `inbound` \u2014 dispatches the `process_inbound_reaction` command which\n *     applies provider semantics and emits `.reaction.added/.removed`.\n *   - `outbound_send` \u2014 calls `adapter.sendReaction?(...)`. The local\n *     `MessageReaction` row was already created by the API/command layer\n *     for UX responsiveness; this worker just notifies the provider.\n *   - `outbound_remove` \u2014 calls `adapter.removeReaction?(...)`. The local\n *     row was already deleted by the API/command layer.\n *\n * Retry: transient failures re-enqueue with exponential backoff up to\n * `REACTION_PROCESSOR_MAX_ATTEMPTS = 3`. Permanent failures stop. Reactions\n * are inherently low-stakes (a missed reaction is annoying, not data loss),\n * so we do not surface failures via a dedicated event; provider errors are\n * logged through `integrationLogService` when available.\n */\nexport default async function handle(\n  job: QueuedJob<ReactionProcessorPayload>,\n  ctx: HandlerContext,\n): Promise<void> {\n  switch (job.payload.kind) {\n    case 'inbound':\n      await handleInbound(job.payload, ctx)\n      return\n    case 'outbound_send':\n      await handleOutboundSend(job.payload, ctx)\n      return\n    case 'outbound_remove':\n      await handleOutboundRemove(job.payload, ctx)\n      return\n    default: {\n      // exhaustiveness check\n      const exhaustive: never = job.payload\n      throw new Error(`Unknown reaction job kind: ${JSON.stringify(exhaustive)}`)\n    }\n  }\n}\n\nasync function handleInbound(payload: ReactionInboundJob, ctx: HandlerContext): Promise<void> {\n  const commandBus = ctx.resolve<CommandBus>('commandBus')\n  const containerProxy = { resolve: ctx.resolve.bind(ctx) }\n  const commandCtx = {\n    container: containerProxy as never,\n    auth: null,\n    organizationScope: null,\n    selectedOrganizationId: payload.scope.organizationId ?? null,\n    organizationIds: payload.scope.organizationId ? [payload.scope.organizationId] : null,\n  }\n  const input: ProcessInboundReactionInput = {\n    channelId: payload.channelId,\n    providerKey: payload.providerKey,\n    channelType: payload.channelType,\n    scope: payload.scope,\n    event: payload.event,\n  }\n  await commandBus.execute<ProcessInboundReactionInput, ProcessInboundReactionResult>(\n    COMMUNICATION_CHANNELS_PROCESS_INBOUND_REACTION_COMMAND_ID,\n    { input, ctx: commandCtx as never },\n  )\n}\n\nasync function handleOutboundSend(payload: ReactionOutboundSendJob, ctx: HandlerContext): Promise<void> {\n  const result = await callAdapterOutbound(payload, ctx, 'send')\n  await maybeRetry(result, payload, ctx)\n}\n\nasync function handleOutboundRemove(\n  payload: ReactionOutboundRemoveJob,\n  ctx: HandlerContext,\n): Promise<void> {\n  const result = await callAdapterOutbound(payload, ctx, 'remove')\n  await maybeRetry(result, payload, ctx)\n}\n\ntype AdapterCallResult =\n  | { status: 'ok' }\n  | { status: 'no_adapter'; message: string }\n  | { status: 'channel_inactive'; message: string }\n  | { status: 'failed'; transient: boolean; message: string }\n\nasync function callAdapterOutbound(\n  payload: ReactionOutboundSendJob | ReactionOutboundRemoveJob,\n  ctx: HandlerContext,\n  action: 'send' | 'remove',\n): Promise<AdapterCallResult> {\n  const adapterRegistry = ctx.resolve<ChannelAdapterRegistry>('channelAdapterRegistry')\n  const adapter = adapterRegistry?.get(payload.providerKey)\n  if (!adapter) {\n    return { status: 'no_adapter', message: `No adapter for provider '${payload.providerKey}'` }\n  }\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: payload.channelId,\n      tenantId: payload.scope.tenantId,\n      organizationId: payload.scope.organizationId ?? null,\n      deletedAt: null,\n    },\n    undefined,\n    payload.scope,\n  )\n  if (!channel) {\n    return { status: 'no_adapter', message: `Channel ${payload.channelId} not found` }\n  }\n  if (!channel.isActive) {\n    return { status: 'channel_inactive', message: `Channel ${payload.channelId} is inactive` }\n  }\n\n  // Credentials. Per-user scoping via `channel.userId` (review R2-C1 / N1).\n  type CredentialsServiceLike = {\n    resolve: (\n      integrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n    save?: (\n      integrationId: string,\n      credentials: Record<string, unknown>,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<void>\n  }\n  let credentials: Record<string, unknown> = {}\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = ctx.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n  const credentialsScope = {\n    tenantId: payload.scope.tenantId,\n    organizationId: payload.scope.organizationId ?? payload.scope.tenantId,\n    userId: channel.userId ?? null,\n  }\n  if (channel.credentialsRef && credentialsService) {\n    try {\n      credentials =\n        (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n    } catch {\n      credentials = {}\n    }\n  }\n  const refreshed = await refreshCredentialsIfNeeded(\n    {\n      adapter,\n      channelId: channel.id,\n      credentials,\n      scope: credentialsScope,\n    },\n    { credentialsService },\n  )\n  credentials = refreshed.credentials\n\n  try {\n    if (action === 'send') {\n      if (typeof adapter.sendReaction !== 'function') {\n        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no sendReaction` }\n      }\n      const sendPayload = payload as ReactionOutboundSendJob\n      await adapter.sendReaction({\n        externalMessageId: sendPayload.messageId, // platform message id; the adapter maps to provider id via its own channel-link lookup if needed\n        conversationId: sendPayload.conversationId ?? '',\n        emoji: sendPayload.emoji,\n        credentials,\n        scope: {\n          tenantId: payload.scope.tenantId,\n          organizationId: channel.organizationId ?? null,\n        },\n      })\n    } else {\n      if (typeof adapter.removeReaction !== 'function') {\n        return { status: 'no_adapter', message: `Adapter '${adapter.providerKey}' has no removeReaction` }\n      }\n      const removePayload = payload as ReactionOutboundRemoveJob\n      await adapter.removeReaction({\n        externalMessageId: removePayload.externalReactionId ?? removePayload.messageId,\n        conversationId: removePayload.conversationId ?? '',\n        emoji: removePayload.emoji,\n        credentials,\n        scope: {\n          tenantId: payload.scope.tenantId,\n          organizationId: channel.organizationId ?? null,\n        },\n      })\n    }\n    return { status: 'ok' }\n  } catch (err) {\n    const classification = classifyOutboundError(err)\n    return {\n      status: 'failed',\n      transient: classification.transient,\n      message: classification.message,\n    }\n  }\n}\n\nasync function maybeRetry(\n  result: AdapterCallResult,\n  payload: ReactionProcessorPayload,\n  ctx: HandlerContext,\n): Promise<void> {\n  if (result.status === 'ok') return\n  if (result.status === 'no_adapter' || result.status === 'channel_inactive') {\n    // Permanent \u2014 log and stop.\n    logger.error('reaction processing failed', { status: result.status, reason: result.message })\n    return\n  }\n  if (!result.transient) {\n    logger.error('permanent reaction processing failure', { reason: result.message })\n    return\n  }\n  const attempt = payload.attempt ?? 1\n  if (attempt >= REACTION_PROCESSOR_MAX_ATTEMPTS) {\n    logger.error('giving up on reaction processing', { attempt, reason: result.message })\n    return\n  }\n  const next: ReactionProcessorPayload = { ...payload, attempt: attempt + 1 }\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n  await queue.enqueue(next as unknown as Record<string, unknown>, {\n    delayMs: computeBackoffMs(attempt),\n  })\n}\n"],
+  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,OAGK;AACP,SAAS,+BAA+B,qCAAqC;AAC7E,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,OAKK;AACP,SAAS,kCAAkC;AAE3C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,qBAAqB,CAAC;AAIxF,MAAM,WAAuB;AAAA,EAClC,OAAO,8BAA8B;AAAA,EACrC,IAAI;AAAA,EACJ,aAAa;AACf;AAwBA,eAAO,OACL,KACA,KACe;AACf,UAAQ,IAAI,QAAQ,MAAM;AAAA,IACxB,KAAK;AACH,YAAM,cAAc,IAAI,SAAS,GAAG;AACpC;AAAA,IACF,KAAK;AACH,YAAM,mBAAmB,IAAI,SAAS,GAAG;AACzC;AAAA,IACF,KAAK;AACH,YAAM,qBAAqB,IAAI,SAAS,GAAG;AAC3C;AAAA,IACF,SAAS;AAEP,YAAM,aAAoB,IAAI;AAC9B,YAAM,IAAI,MAAM,8BAA8B,KAAK,UAAU,UAAU,CAAC,EAAE;AAAA,IAC5E;AAAA,EACF;AACF;AAEA,eAAe,cAAc,SAA6B,KAAoC;AAC5F,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,iBAAiB,EAAE,SAAS,IAAI,QAAQ,KAAK,GAAG,EAAE;AACxD,QAAM,aAAa;AAAA,IACjB,WAAW;AAAA,IACX,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,wBAAwB,QAAQ,MAAM,kBAAkB;AAAA,IACxD,iBAAiB,QAAQ,MAAM,iBAAiB,CAAC,QAAQ,MAAM,cAAc,IAAI;AAAA,EACnF;AACA,QAAM,QAAqC;AAAA,IACzC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB,aAAa,QAAQ;AAAA,IACrB,OAAO,QAAQ;AAAA,IACf,OAAO,QAAQ;AAAA,EACjB;AACA,QAAM,WAAW;AAAA,IACf;AAAA,IACA,EAAE,OAAO,KAAK,WAAoB;AAAA,EACpC;AACF;AAEA,eAAe,mBAAmB,SAAkC,KAAoC;AACtG,QAAM,SAAS,MAAM,oBAAoB,SAAS,KAAK,MAAM;AAC7D,QAAM,WAAW,QAAQ,SAAS,GAAG;AACvC;AAEA,eAAe,qBACb,SACA,KACe;AACf,QAAM,SAAS,MAAM,oBAAoB,SAAS,KAAK,QAAQ;AAC/D,QAAM,WAAW,QAAQ,SAAS,GAAG;AACvC;AAQA,eAAe,oBACb,SACA,KACA,QAC4B;AAC5B,QAAM,kBAAkB,IAAI,QAAgC,wBAAwB;AACpF,QAAM,UAAU,iBAAiB,IAAI,QAAQ,WAAW;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,QAAQ,cAAc,SAAS,4BAA4B,QAAQ,WAAW,IAAI;AAAA,EAC7F;AACA,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,QAAQ,MAAM;AAAA,MACxB,gBAAgB,QAAQ,MAAM,kBAAkB;AAAA,MAChD,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACA,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,QAAQ,cAAc,SAAS,WAAW,QAAQ,SAAS,aAAa;AAAA,EACnF;AACA,MAAI,CAAC,QAAQ,UAAU;AACrB,WAAO,EAAE,QAAQ,oBAAoB,SAAS,WAAW,QAAQ,SAAS,eAAe;AAAA,EAC3F;AAcA,MAAI,cAAuC,CAAC;AAC5C,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,IAAI,QAAgC,+BAA+B;AAAA,EAC1F,QAAQ;AACN,yBAAqB;AAAA,EACvB;AACA,QAAM,mBAAmB;AAAA,IACvB,UAAU,QAAQ,MAAM;AAAA,IACxB,gBAAgB,QAAQ,MAAM,kBAAkB,QAAQ,MAAM;AAAA,IAC9D,QAAQ,QAAQ,UAAU;AAAA,EAC5B;AACA,MAAI,QAAQ,kBAAkB,oBAAoB;AAChD,QAAI;AACF,oBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,IAC/F,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AAAA,EACF;AACA,QAAM,YAAY,MAAM;AAAA,IACtB;AAAA,MACE;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB;AAAA,MACA,OAAO;AAAA,IACT;AAAA,IACA,EAAE,mBAAmB;AAAA,EACvB;AACA,gBAAc,UAAU;AAExB,MAAI;AACF,QAAI,WAAW,QAAQ;AACrB,UAAI,OAAO,QAAQ,iBAAiB,YAAY;AAC9C,eAAO,EAAE,QAAQ,cAAc,SAAS,YAAY,QAAQ,WAAW,wBAAwB;AAAA,MACjG;AACA,YAAM,cAAc;AACpB,YAAM,QAAQ,aAAa;AAAA,QACzB,mBAAmB,YAAY;AAAA;AAAA,QAC/B,gBAAgB,YAAY,kBAAkB;AAAA,QAC9C,OAAO,YAAY;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,QAAQ,MAAM;AAAA,UACxB,gBAAgB,QAAQ,kBAAkB;AAAA,QAC5C;AAAA,MACF,CAAC;AAAA,IACH,OAAO;AACL,UAAI,OAAO,QAAQ,mBAAmB,YAAY;AAChD,eAAO,EAAE,QAAQ,cAAc,SAAS,YAAY,QAAQ,WAAW,0BAA0B;AAAA,MACnG;AACA,YAAM,gBAAgB;AACtB,YAAM,QAAQ,eAAe;AAAA,QAC3B,mBAAmB,cAAc,sBAAsB,cAAc;AAAA,QACrE,gBAAgB,cAAc,kBAAkB;AAAA,QAChD,OAAO,cAAc;AAAA,QACrB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,QAAQ,MAAM;AAAA,UACxB,gBAAgB,QAAQ,kBAAkB;AAAA,QAC5C;AAAA,MACF,CAAC;AAAA,IACH;AACA,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB,SAAS,KAAK;AACZ,UAAM,iBAAiB,sBAAsB,GAAG;AAChD,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,WAAW,eAAe;AAAA,MAC1B,SAAS,eAAe;AAAA,IAC1B;AAAA,EACF;AACF;AAEA,eAAe,WACb,QACA,SACA,KACe;AACf,MAAI,OAAO,WAAW,KAAM;AAC5B,MAAI,OAAO,WAAW,gBAAgB,OAAO,WAAW,oBAAoB;AAE1E,WAAO,MAAM,8BAA8B,EAAE,QAAQ,OAAO,QAAQ,QAAQ,OAAO,QAAQ,CAAC;AAC5F;AAAA,EACF;AACA,MAAI,CAAC,OAAO,WAAW;AACrB,WAAO,MAAM,yCAAyC,EAAE,QAAQ,OAAO,QAAQ,CAAC;AAChF;AAAA,EACF;AACA,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,WAAW,iCAAiC;AAC9C,WAAO,MAAM,oCAAoC,EAAE,SAAS,QAAQ,OAAO,QAAQ,CAAC;AACpF;AAAA,EACF;AACA,QAAM,OAAiC,EAAE,GAAG,SAAS,SAAS,UAAU,EAAE;AAC1E,QAAM,QAAQ,8BAA8B,8BAA8B,SAAS;AACnF,QAAM,MAAM,QAAQ,MAA4C;AAAA,IAC9D,SAAS,iBAAiB,OAAO;AAAA,EACnC,CAAC;AACH;",
   "names": []
 }

package/dist/modules/configs/api/upgrade-actions/route.js

@@ -4,6 +4,7 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { executeUpgradeAction, getCurrentVersion, isUpgradeActionsEnabled, listPendingUpgradeActions } from "../../services/upgradeActionsService.js";
 import {
   configsTag,
@@ -29,7 +30,7 @@ async function resolveScope(req, translate) {
   const container = await createRequestContainer();
   const featureContext = await resolveFeatureCheckContext({ container, auth, request: req });
   const tenantId = featureContext.scope.tenantId ?? auth.tenantId ?? null;
-  const organizationId = featureContext.organizationId ?? featureContext.scope.selectedId ?? auth.orgId ?? null;
+  const organizationId = featureContext.organizationId ?? resolveSingleOrganizationIdOrDeny(featureContext.scope, auth) ?? null;
   if (!tenantId || !organizationId) {
     const message = translate(
       "upgrades.scopeRequired",

package/dist/modules/configs/api/upgrade-actions/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/configs/api/upgrade-actions/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { executeUpgradeAction, getCurrentVersion, isUpgradeActionsEnabled, listPendingUpgradeActions } from '../../services/upgradeActionsService'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  configsTag,\n  upgradeActionsListResponseSchema,\n  executeUpgradeActionRequestSchema,\n  executeUpgradeActionResponseSchema,\n  configErrorSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('configs')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['configs.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['configs.manage'] },\n} as const\n\nconst runSchema = z.object({\n  actionId: z.string().trim().min(1, 'action id required'),\n})\n\ntype Scope = { tenantId: string; organizationId: string }\n\nasync function resolveScope(\n  req: Request,\n  translate: (key: string, fallback?: string, params?: Record<string, unknown>) => string,\n): Promise<{ scope: Scope | null; container: Awaited<ReturnType<typeof createRequestContainer>> | null; error?: Response }> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return { scope: null, container: null, error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }\n  }\n  const container = await createRequestContainer()\n  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })\n  const tenantId = featureContext.scope.tenantId ?? auth.tenantId ?? null\n  const organizationId = featureContext.organizationId ?? featureContext.scope.selectedId ?? auth.orgId ?? null\n  if (!tenantId || !organizationId) {\n    const message = translate(\n      'upgrades.scopeRequired',\n      'Select an organization and tenant to apply this upgrade.'\n    )\n    return { scope: null, container, error: NextResponse.json({ error: message }, { status: 400 }) }\n  }\n  return {\n    scope: { tenantId, organizationId },\n    container,\n  }\n}\n\nexport async function GET(req: Request) {\n  if (!isUpgradeActionsEnabled()) {\n    return NextResponse.json({ version: getCurrentVersion(), actions: [] })\n  }\n  const { translate } = await resolveTranslations()\n  const scopedTranslate = (key: string, fallback?: string, params?: Record<string, unknown>) =>\n    translate(key, fallback, params as any)\n  const scopeResult = await resolveScope(req, scopedTranslate)\n  if (!scopeResult.scope) return scopeResult.error!\n\n  const container = scopeResult.container ?? (await createRequestContainer())\n  const em = container.resolve<EntityManager>('em')\n  const version = getCurrentVersion()\n  try {\n    const actions = await listPendingUpgradeActions(em, { ...scopeResult.scope, version })\n    const nextAction = actions[0]\n    const payload = nextAction\n      ? [{\n        id: nextAction.id,\n        version: nextAction.version,\n        message: translate(\n          nextAction.messageKey,\n          'The version {{version}} has been installed. To fully use all the features from this edition please do \"Install example catalog products and categories\".',\n          { version: nextAction.version }\n        ),\n        ctaLabel: translate(\n          nextAction.ctaKey,\n          'Install example catalog products and categories'\n        ),\n        successMessage: translate(\n          nextAction.successKey,\n          'Example catalog products and categories installed.'\n        ),\n        loadingLabel: nextAction.loadingKey\n          ? translate(nextAction.loadingKey, 'Installing\u2026')\n          : translate('upgrades.loading', 'Installing\u2026'),\n      }]\n      : []\n    return NextResponse.json({ version, actions: payload })\n  } catch (error) {\n    logger.error('failed to load upgrade actions', { component: 'upgrade-actions', err: error })\n    return NextResponse.json({ error: 'Failed to load upgrade actions' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  if (!isUpgradeActionsEnabled()) {\n    return NextResponse.json({ error: 'Upgrade actions are disabled' }, { status: 403 })\n  }\n  const { translate } = await resolveTranslations()\n  const scopedTranslate = (key: string, fallback?: string, params?: Record<string, unknown>) =>\n    translate(key, fallback, params as any)\n  const scopeResult = await resolveScope(req, scopedTranslate)\n  if (!scopeResult.scope) return scopeResult.error!\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    parsedBody = null\n  }\n  const parsed = runSchema.safeParse(parsedBody || {})\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const container = scopeResult.container ?? (await createRequestContainer())\n  const version = getCurrentVersion()\n\n  try {\n    const result = await executeUpgradeAction(container, {\n      actionId: parsed.data.actionId,\n      tenantId: scopeResult.scope.tenantId,\n      organizationId: scopeResult.scope.organizationId,\n      version,\n    })\n    const successMessage = translate(\n      result.action.successKey,\n      'Example catalog products and categories installed.'\n    )\n    return NextResponse.json({\n      status: result.status,\n      message: successMessage,\n      version,\n    })\n  } catch (error) {\n    logger.error('failed to execute upgrade action', { component: 'upgrade-actions', err: error })\n    const message = translate('upgrades.runFailed', 'We could not run this upgrade action.')\n    const details = error instanceof Error ? error.message : null\n    return NextResponse.json({ error: message, details }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: configsTag,\n  summary: 'Upgrade actions management',\n  methods: {\n    GET: {\n      summary: 'List pending upgrade actions',\n      description: 'Returns a list of pending upgrade actions for the current version. These are one-time setup tasks that need to be executed after upgrading to a new version. Requires organization and tenant context.',\n      responses: [\n        { status: 200, description: 'List of pending upgrade actions', schema: upgradeActionsListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing organization or tenant context', schema: configErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: configErrorSchema },\n        { status: 500, description: 'Failed to load upgrade actions', schema: configErrorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Execute upgrade action',\n      description: 'Executes a specific upgrade action by ID. Typically used for one-time setup tasks like seeding example data after version upgrade. Returns execution status and localized success message.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: executeUpgradeActionRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Upgrade action executed successfully', schema: executeUpgradeActionResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body or missing context', schema: configErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: configErrorSchema },\n        { status: 403, description: 'Upgrade actions are disabled', schema: configErrorSchema },\n        { status: 500, description: 'Failed to execute upgrade action', schema: configErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAC3C,SAAS,sBAAsB,mBAAmB,yBAAyB,iCAAiC;AAE5G;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,SAAS;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oBAAoB;AACzD,CAAC;AAID,eAAe,aACb,KACA,WAC0H;AAC1H,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,EAAE,OAAO,MAAM,WAAW,MAAM,OAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9G;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACzF,QAAM,WAAW,eAAe,MAAM,YAAY,KAAK,YAAY;AACnE,QAAM,iBAAiB,eAAe,kBAAkB,eAAe,MAAM,cAAc,KAAK,SAAS;AACzG,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACjG;AACA,SAAO;AAAA,IACL,OAAO,EAAE,UAAU,eAAe;AAAA,IAClC;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI,CAAC,wBAAwB,GAAG;AAC9B,WAAO,aAAa,KAAK,EAAE,SAAS,kBAAkB,GAAG,SAAS,CAAC,EAAE,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,kBAAkB,CAAC,KAAa,UAAmB,WACvD,UAAU,KAAK,UAAU,MAAa;AACxC,QAAM,cAAc,MAAM,aAAa,KAAK,eAAe;AAC3D,MAAI,CAAC,YAAY,MAAO,QAAO,YAAY;AAE3C,QAAM,YAAY,YAAY,aAAc,MAAM,uBAAuB;AACzE,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,UAAU,kBAAkB;AAClC,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,IAAI,EAAE,GAAG,YAAY,OAAO,QAAQ,CAAC;AACrF,UAAM,aAAa,QAAQ,CAAC;AAC5B,UAAM,UAAU,aACZ,CAAC;AAAA,MACD,IAAI,WAAW;AAAA,MACf,SAAS,WAAW;AAAA,MACpB,SAAS;AAAA,QACP,WAAW;AAAA,QACX;AAAA,QACA,EAAE,SAAS,WAAW,QAAQ;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,QACR,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,gBAAgB;AAAA,QACd,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,cAAc,WAAW,aACrB,UAAU,WAAW,YAAY,kBAAa,IAC9C,UAAU,oBAAoB,kBAAa;AAAA,IACjD,CAAC,IACC,CAAC;AACL,WAAO,aAAa,KAAK,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,EACxD,SAAS,OAAO;AACd,WAAO,MAAM,kCAAkC,EAAE,WAAW,mBAAmB,KAAK,MAAM,CAAC;AAC3F,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI,CAAC,wBAAwB,GAAG;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,kBAAkB,CAAC,KAAa,UAAmB,WACvD,UAAU,KAAK,UAAU,MAAa;AACxC,QAAM,cAAc,MAAM,aAAa,KAAK,eAAe;AAC3D,MAAI,CAAC,YAAY,MAAO,QAAO,YAAY;AAE3C,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,iBAAa;AAAA,EACf;AACA,QAAM,SAAS,UAAU,UAAU,cAAc,CAAC,CAAC;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,YAAY,YAAY,aAAc,MAAM,uBAAuB;AACzE,QAAM,UAAU,kBAAkB;AAElC,MAAI;AACF,UAAM,SAAS,MAAM,qBAAqB,WAAW;AAAA,MACnD,UAAU,OAAO,KAAK;AAAA,MACtB,UAAU,YAAY,MAAM;AAAA,MAC5B,gBAAgB,YAAY,MAAM;AAAA,MAClC;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB;AAAA,MACrB,OAAO,OAAO;AAAA,MACd;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,WAAW,mBAAmB,KAAK,MAAM,CAAC;AAC7F,UAAM,UAAU,UAAU,sBAAsB,uCAAuC;AACvF,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,SAAS,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,iCAAiC;AAAA,MAC1G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,kBAAkB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,kBAAkB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,kBAAkB;AAAA,MAC1F;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,mCAAmC;AAAA,MACjH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,kBAAkB;AAAA,QACjG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,kBAAkB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,kBAAkB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,kBAAkB;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { executeUpgradeAction, getCurrentVersion, isUpgradeActionsEnabled, listPendingUpgradeActions } from '../../services/upgradeActionsService'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport {\n  configsTag,\n  upgradeActionsListResponseSchema,\n  executeUpgradeActionRequestSchema,\n  executeUpgradeActionResponseSchema,\n  configErrorSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('configs')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['configs.manage'] },\n  POST: { requireAuth: true, requireFeatures: ['configs.manage'] },\n} as const\n\nconst runSchema = z.object({\n  actionId: z.string().trim().min(1, 'action id required'),\n})\n\ntype Scope = { tenantId: string; organizationId: string }\n\nasync function resolveScope(\n  req: Request,\n  translate: (key: string, fallback?: string, params?: Record<string, unknown>) => string,\n): Promise<{ scope: Scope | null; container: Awaited<ReturnType<typeof createRequestContainer>> | null; error?: Response }> {\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return { scope: null, container: null, error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }) }\n  }\n  const container = await createRequestContainer()\n  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })\n  const tenantId = featureContext.scope.tenantId ?? auth.tenantId ?? null\n  const organizationId = featureContext.organizationId ?? resolveSingleOrganizationIdOrDeny(featureContext.scope, auth) ?? null\n  if (!tenantId || !organizationId) {\n    const message = translate(\n      'upgrades.scopeRequired',\n      'Select an organization and tenant to apply this upgrade.'\n    )\n    return { scope: null, container, error: NextResponse.json({ error: message }, { status: 400 }) }\n  }\n  return {\n    scope: { tenantId, organizationId },\n    container,\n  }\n}\n\nexport async function GET(req: Request) {\n  if (!isUpgradeActionsEnabled()) {\n    return NextResponse.json({ version: getCurrentVersion(), actions: [] })\n  }\n  const { translate } = await resolveTranslations()\n  const scopedTranslate = (key: string, fallback?: string, params?: Record<string, unknown>) =>\n    translate(key, fallback, params as any)\n  const scopeResult = await resolveScope(req, scopedTranslate)\n  if (!scopeResult.scope) return scopeResult.error!\n\n  const container = scopeResult.container ?? (await createRequestContainer())\n  const em = container.resolve<EntityManager>('em')\n  const version = getCurrentVersion()\n  try {\n    const actions = await listPendingUpgradeActions(em, { ...scopeResult.scope, version })\n    const nextAction = actions[0]\n    const payload = nextAction\n      ? [{\n        id: nextAction.id,\n        version: nextAction.version,\n        message: translate(\n          nextAction.messageKey,\n          'The version {{version}} has been installed. To fully use all the features from this edition please do \"Install example catalog products and categories\".',\n          { version: nextAction.version }\n        ),\n        ctaLabel: translate(\n          nextAction.ctaKey,\n          'Install example catalog products and categories'\n        ),\n        successMessage: translate(\n          nextAction.successKey,\n          'Example catalog products and categories installed.'\n        ),\n        loadingLabel: nextAction.loadingKey\n          ? translate(nextAction.loadingKey, 'Installing\u2026')\n          : translate('upgrades.loading', 'Installing\u2026'),\n      }]\n      : []\n    return NextResponse.json({ version, actions: payload })\n  } catch (error) {\n    logger.error('failed to load upgrade actions', { component: 'upgrade-actions', err: error })\n    return NextResponse.json({ error: 'Failed to load upgrade actions' }, { status: 500 })\n  }\n}\n\nexport async function POST(req: Request) {\n  if (!isUpgradeActionsEnabled()) {\n    return NextResponse.json({ error: 'Upgrade actions are disabled' }, { status: 403 })\n  }\n  const { translate } = await resolveTranslations()\n  const scopedTranslate = (key: string, fallback?: string, params?: Record<string, unknown>) =>\n    translate(key, fallback, params as any)\n  const scopeResult = await resolveScope(req, scopedTranslate)\n  if (!scopeResult.scope) return scopeResult.error!\n\n  let parsedBody: unknown\n  try {\n    parsedBody = await req.json()\n  } catch {\n    parsedBody = null\n  }\n  const parsed = runSchema.safeParse(parsedBody || {})\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const container = scopeResult.container ?? (await createRequestContainer())\n  const version = getCurrentVersion()\n\n  try {\n    const result = await executeUpgradeAction(container, {\n      actionId: parsed.data.actionId,\n      tenantId: scopeResult.scope.tenantId,\n      organizationId: scopeResult.scope.organizationId,\n      version,\n    })\n    const successMessage = translate(\n      result.action.successKey,\n      'Example catalog products and categories installed.'\n    )\n    return NextResponse.json({\n      status: result.status,\n      message: successMessage,\n      version,\n    })\n  } catch (error) {\n    logger.error('failed to execute upgrade action', { component: 'upgrade-actions', err: error })\n    const message = translate('upgrades.runFailed', 'We could not run this upgrade action.')\n    const details = error instanceof Error ? error.message : null\n    return NextResponse.json({ error: message, details }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: configsTag,\n  summary: 'Upgrade actions management',\n  methods: {\n    GET: {\n      summary: 'List pending upgrade actions',\n      description: 'Returns a list of pending upgrade actions for the current version. These are one-time setup tasks that need to be executed after upgrading to a new version. Requires organization and tenant context.',\n      responses: [\n        { status: 200, description: 'List of pending upgrade actions', schema: upgradeActionsListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Missing organization or tenant context', schema: configErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: configErrorSchema },\n        { status: 500, description: 'Failed to load upgrade actions', schema: configErrorSchema },\n      ],\n    },\n    POST: {\n      summary: 'Execute upgrade action',\n      description: 'Executes a specific upgrade action by ID. Typically used for one-time setup tasks like seeding example data after version upgrade. Returns execution status and localized success message.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: executeUpgradeActionRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Upgrade action executed successfully', schema: executeUpgradeActionResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request body or missing context', schema: configErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: configErrorSchema },\n        { status: 403, description: 'Upgrade actions are disabled', schema: configErrorSchema },\n        { status: 500, description: 'Failed to execute upgrade action', schema: configErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,kCAAkC;AAC3C,SAAS,yCAAyC;AAClD,SAAS,sBAAsB,mBAAmB,yBAAyB,iCAAiC;AAE5G;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,SAAS;AAE9B,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AAAA,EAC9D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gBAAgB,EAAE;AACjE;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,oBAAoB;AACzD,CAAC;AAID,eAAe,aACb,KACA,WAC0H;AAC1H,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,EAAE,OAAO,MAAM,WAAW,MAAM,OAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAC9G;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,iBAAiB,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACzF,QAAM,WAAW,eAAe,MAAM,YAAY,KAAK,YAAY;AACnE,QAAM,iBAAiB,eAAe,kBAAkB,kCAAkC,eAAe,OAAO,IAAI,KAAK;AACzH,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,UAAM,UAAU;AAAA,MACd;AAAA,MACA;AAAA,IACF;AACA,WAAO,EAAE,OAAO,MAAM,WAAW,OAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACjG;AACA,SAAO;AAAA,IACL,OAAO,EAAE,UAAU,eAAe;AAAA,IAClC;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI,CAAC,wBAAwB,GAAG;AAC9B,WAAO,aAAa,KAAK,EAAE,SAAS,kBAAkB,GAAG,SAAS,CAAC,EAAE,CAAC;AAAA,EACxE;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,kBAAkB,CAAC,KAAa,UAAmB,WACvD,UAAU,KAAK,UAAU,MAAa;AACxC,QAAM,cAAc,MAAM,aAAa,KAAK,eAAe;AAC3D,MAAI,CAAC,YAAY,MAAO,QAAO,YAAY;AAE3C,QAAM,YAAY,YAAY,aAAc,MAAM,uBAAuB;AACzE,QAAM,KAAK,UAAU,QAAuB,IAAI;AAChD,QAAM,UAAU,kBAAkB;AAClC,MAAI;AACF,UAAM,UAAU,MAAM,0BAA0B,IAAI,EAAE,GAAG,YAAY,OAAO,QAAQ,CAAC;AACrF,UAAM,aAAa,QAAQ,CAAC;AAC5B,UAAM,UAAU,aACZ,CAAC;AAAA,MACD,IAAI,WAAW;AAAA,MACf,SAAS,WAAW;AAAA,MACpB,SAAS;AAAA,QACP,WAAW;AAAA,QACX;AAAA,QACA,EAAE,SAAS,WAAW,QAAQ;AAAA,MAChC;AAAA,MACA,UAAU;AAAA,QACR,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,gBAAgB;AAAA,QACd,WAAW;AAAA,QACX;AAAA,MACF;AAAA,MACA,cAAc,WAAW,aACrB,UAAU,WAAW,YAAY,kBAAa,IAC9C,UAAU,oBAAoB,kBAAa;AAAA,IACjD,CAAC,IACC,CAAC;AACL,WAAO,aAAa,KAAK,EAAE,SAAS,SAAS,QAAQ,CAAC;AAAA,EACxD,SAAS,OAAO;AACd,WAAO,MAAM,kCAAkC,EAAE,WAAW,mBAAmB,KAAK,MAAM,CAAC;AAC3F,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI,CAAC,wBAAwB,GAAG;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,+BAA+B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AACA,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,kBAAkB,CAAC,KAAa,UAAmB,WACvD,UAAU,KAAK,UAAU,MAAa;AACxC,QAAM,cAAc,MAAM,aAAa,KAAK,eAAe;AAC3D,MAAI,CAAC,YAAY,MAAO,QAAO,YAAY;AAE3C,MAAI;AACJ,MAAI;AACF,iBAAa,MAAM,IAAI,KAAK;AAAA,EAC9B,QAAQ;AACN,iBAAa;AAAA,EACf;AACA,QAAM,SAAS,UAAU,UAAU,cAAc,CAAC,CAAC;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7E;AAEA,QAAM,YAAY,YAAY,aAAc,MAAM,uBAAuB;AACzE,QAAM,UAAU,kBAAkB;AAElC,MAAI;AACF,UAAM,SAAS,MAAM,qBAAqB,WAAW;AAAA,MACnD,UAAU,OAAO,KAAK;AAAA,MACtB,UAAU,YAAY,MAAM;AAAA,MAC5B,gBAAgB,YAAY,MAAM;AAAA,MAClC;AAAA,IACF,CAAC;AACD,UAAM,iBAAiB;AAAA,MACrB,OAAO,OAAO;AAAA,MACd;AAAA,IACF;AACA,WAAO,aAAa,KAAK;AAAA,MACvB,QAAQ,OAAO;AAAA,MACf,SAAS;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,oCAAoC,EAAE,WAAW,mBAAmB,KAAK,MAAM,CAAC;AAC7F,UAAM,UAAU,UAAU,sBAAsB,uCAAuC;AACvF,UAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,SAAS,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,iCAAiC;AAAA,MAC1G;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C,QAAQ,kBAAkB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,kBAAkB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,kBAAkB;AAAA,MAC1F;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,mCAAmC;AAAA,MACjH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,kBAAkB;AAAA,QACjG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,kBAAkB;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,kBAAkB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,oCAAoC,QAAQ,kBAAkB;AAAA,MAC5F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/configs/cli.js

@@ -1,7 +1,7 @@
 import { runWithCacheTenant } from "@open-mercato/cache";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { parseBooleanToken } from "@open-mercato/shared/lib/boolean";
-import { DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from "../notifications/lib/deliveryConfig.js";
+import { STORED_DEFAULT_NOTIFICATION_DELIVERY_CONFIG, NOTIFICATIONS_DELIVERY_CONFIG_KEY } from "../notifications/lib/deliveryConfig.js";
 import { Tenant } from "../directory/data/entities.js";
 import {
   collectCacheStats,
@@ -270,7 +270,7 @@ const restoreDefaults = {
           {
             moduleId: "notifications",
             name: NOTIFICATIONS_DELIVERY_CONFIG_KEY,
-            value: DEFAULT_NOTIFICATION_DELIVERY_CONFIG
+            value: STORED_DEFAULT_NOTIFICATION_DELIVERY_CONFIG
           }
         ],
         { force: true }