@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/communication_channels/lib/access-control.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/access-control.ts"],
-  "sourcesContent": ["import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\n/**\n * Per-user channel access control \u2014 service-layer authorization helpers.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be read or managed ONLY by its owner \u2014 not even an admin\n * or superadmin can act on another user's personal mailbox. Tenant-wide /\n * shared channels (`userId == null`, e.g. WhatsApp Business / Slack workspaces)\n * remain accessible to any caller the route already feature-gated.\n *\n * Routes also narrow at the SQL layer (the admin channel list returns\n * `user_id IS NULL` rows only; the profile list filters `user_id =\n * currentUser.id`); these helpers are the per-channel authorization backstop a\n * route calls once it has loaded the row.\n */\n\nexport const ADMIN_FEATURE = 'communication_channels.admin'\n\n/**\n * Org-scoping fragment for reading/managing channels.\n *\n * Tenant-wide channels are stored with `organization_id IS NULL` (the\n * tenant-scoped push providers FCM/APNs/Expo do this deliberately \u2014 see\n * `connect-credential-channel.ts`). They are visible and manageable from ANY\n * org in the tenant, so a read scoped to the caller's selected org must also\n * match the NULL rows; otherwise a channel connected while an admin had a\n * non-null org would be invisible to every listing/detail query (and vice\n * versa). Org-scoped channels (`organization_id = <org>`) stay scoped to their\n * org.\n *\n * Spread the result into a MikroORM `where` object alongside `tenantId` etc.\n */\nexport function channelOrgScopeWhere(\n  orgId: string | null | undefined,\n): Record<string, unknown> {\n  return orgId\n    ? { $or: [{ organizationId: orgId }, { organizationId: null }] }\n    : { organizationId: null }\n}\n\n/**\n * Same NULL-inclusive org scoping, expressed over a resolved\n * `OrganizationScopeFilter` (`resolveOrganizationScopeFilter`) rather than a\n * single org id.\n *\n * Read routes scope on the caller's *selected* organization (the\n * `om_selected_org` cookie the top-bar switcher writes), not on the org baked\n * into the session token (#5012) \u2014 that resolution yields a list of org ids, or\n * `undefined` when the caller is unrestricted (super-admin viewing all orgs).\n * An unrestricted caller sees every channel in the tenant, so the fragment is\n * empty; a restricted one gets their orgs plus the tenant-wide (`NULL`) rows.\n */\nexport function channelOrgScopeWhereFromFilter(\n  filter: { organizationIds: string[] | undefined } | null | undefined,\n): Record<string, unknown> {\n  const organizationIds = filter?.organizationIds\n  if (!organizationIds || organizationIds.length === 0) return {}\n  return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }\n}\n\n/**\n * Ownership fragment for LISTING channels \u2014 the SQL-layer twin of\n * {@link assertCanAccessChannel}.\n *\n * Routes have historically hardcoded one of the two halves of the rule: the\n * admin channel list narrows to `user_id IS NULL`, the profile list narrows to\n * `user_id = <caller>`. A provider-scoped listing needs both, because which half\n * a channel falls into is decided by the connect flow the provider offers, not\n * by the listing. Hardcoding `userId: null` is what made the Discord AI\n * auto-reply panel structurally empty (#5602): every route the product exposes\n * for connecting a Discord bot writes `user_id = auth.sub`, so the filter\n * excluded the only channels that can exist.\n *\n * The clause admits exactly what the assert allows and nothing more \u2014 shared\n * channels, plus the caller's own personal ones. It grants no admin bypass, in\n * line with v1 strict owner-only: a personal mailbox stays invisible to everyone\n * but its owner. An anonymous caller (no user id) sees shared channels only.\n *\n * Spread into a MikroORM `where`, or nest under `$and` when another fragment in\n * the same query already claims `$or` (`channelOrgScopeWhereFromFilter` does).\n */\nexport function channelOwnerScopeWhere(\n  currentUserId: string | null | undefined,\n): Record<string, unknown> {\n  if (!currentUserId) return { userId: null }\n  return { $or: [{ userId: null }, { userId: currentUserId }] }\n}\n\n/**\n * Throws when the caller may not access a specific channel. Returns silently\n * when access is allowed.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be acted on ONLY by its owner \u2014 not even an admin /\n * superadmin can poll, test-send, import history from, register push on, or\n * delete another user's personal mailbox. Tenant-wide channels\n * (`userId == null`, e.g. WhatsApp Business / Slack workspaces) remain\n * accessible to any caller the route already feature-gated.\n *\n * `userFeatures` is retained on the signature (callers pass it) but no longer\n * grants a bypass; it is reserved for the v2 admin-oversight feature.\n *\n * Callers MUST pass the fully decrypted channel row \u2014 we read `userId` directly.\n */\nexport function assertCanAccessChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  void userFeatures\n  // Tenant-wide / shared channel \u2014 accessible to all callers.\n  if (channel.userId == null) return\n  // Personal mailbox \u2014 owner only, regardless of admin grants (v1).\n  if (channel.userId !== currentUserId) {\n    throw new ChannelAccessDeniedError(\n      'Channel is a personal mailbox owned by another user',\n    )\n  }\n}\n\n/**\n * Authorization for MANAGING (mutating) a channel \u2014 disconnect, poll, set\n * primary, import history, register push. Encodes the per-user ownership rule:\n *\n *   - **Personal mailbox** (`userId` set): the **owner has full control** of\n *     their own account; any other caller \u2014 admin included \u2014 is denied (v1\n *     strict owner-only, no bypass). Routes gate these on\n *     `communication_channels.connect_user_channel` so every email user reaches\n *     this check for their own channels.\n *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp\n *     Business / Slack workspaces): requires the route's `elevatedFeature`\n *     (`communication_channels.manage`, `\u2026channel.push.manage`, or\n *     `\u2026channel.import_history`). Evaluated by the shared feature policy.\n *\n * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking\n * existence) when the caller may not manage the channel.\n */\nexport function assertCanManageChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n  elevatedFeature: string,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  // Personal mailbox \u2014 owner only. The owner manages their own account fully\n  // (gated by connect_user_channel at the route); no admin bypass in v1.\n  if (channel.userId != null) {\n    if (channel.userId !== currentUserId) {\n      throw new ChannelAccessDeniedError('Channel is a personal mailbox owned by another user')\n    }\n    return\n  }\n  // Tenant-wide / shared channel \u2014 requires the elevated management feature.\n  const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []\n  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {\n    throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)\n  }\n}\n\n/**\n * Stable error class so route handlers can map to a 403 instead of leaking the\n * underlying message verbatim. Subclasses `Error` for compatibility with the\n * platform's error logging helpers.\n */\nexport class ChannelAccessDeniedError extends Error {\n  override name = 'ChannelAccessDeniedError'\n  readonly statusCode = 403\n}\n"],
-  "mappings": "AAAA,SAAS,yBAAyB;AAiB3B,MAAM,gBAAgB;AAgBtB,SAAS,qBACd,OACyB;AACzB,SAAO,QACH,EAAE,KAAK,CAAC,EAAE,gBAAgB,MAAM,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE,IAC7D,EAAE,gBAAgB,KAAK;AAC7B;AAcO,SAAS,+BACd,QACyB;AACzB,QAAM,kBAAkB,QAAQ;AAChC,MAAI,CAAC,mBAAmB,gBAAgB,WAAW,EAAG,QAAO,CAAC;AAC9D,SAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AACzF;AAuBO,SAAS,uBACd,eACyB;AACzB,MAAI,CAAC,cAAe,QAAO,EAAE,QAAQ,KAAK;AAC1C,SAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,cAAc,CAAC,EAAE;AAC9D;AAkBO,SAAS,uBACd,SACA,eACA,cACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AACA,OAAK;AAEL,MAAI,QAAQ,UAAU,KAAM;AAE5B,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,uBACd,SACA,eACA,cACA,iBACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AAGA,MAAI,QAAQ,UAAU,MAAM;AAC1B,QAAI,QAAQ,WAAW,eAAe;AACpC,YAAM,IAAI,yBAAyB,qDAAqD;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AACtE,MAAI,CAAC,kBAAkB,CAAC,eAAe,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC9D,UAAM,IAAI,yBAAyB,uCAAuC,eAAe,GAAG;AAAA,EAC9F;AACF;AAOO,MAAM,iCAAiC,MAAM;AAAA,EAA7C;AAAA;AACL,SAAS,OAAO;AAChB,SAAS,aAAa;AAAA;AACxB;",
+  "sourcesContent": ["import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\n\n/**\n * Per-user channel access control \u2014 service-layer authorization helpers.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be read or managed ONLY by its owner \u2014 not even an admin\n * or superadmin can act on another user's personal mailbox. Tenant-wide /\n * shared channels (`userId == null`, e.g. WhatsApp Business / Slack workspaces)\n * remain accessible to any caller the route already feature-gated.\n *\n * Routes also narrow at the SQL layer (the admin channel list returns\n * `user_id IS NULL` rows only; the profile list filters `user_id =\n * currentUser.id`); these helpers are the per-channel authorization backstop a\n * route calls once it has loaded the row.\n */\n\nexport const ADMIN_FEATURE = 'communication_channels.admin'\n\n/**\n * Org-scoping fragment for reading/managing channels.\n *\n * Tenant-wide channels are stored with `organization_id IS NULL` (the\n * tenant-scoped push providers FCM/APNs/Expo do this deliberately \u2014 see\n * `connect-credential-channel.ts`). They are visible and manageable from ANY\n * org in the tenant, so a read scoped to the caller's selected org must also\n * match the NULL rows; otherwise a channel connected while an admin had a\n * non-null org would be invisible to every listing/detail query (and vice\n * versa). Org-scoped channels (`organization_id = <org>`) stay scoped to their\n * org.\n *\n * Spread the result into a MikroORM `where` object alongside `tenantId` etc.\n */\nexport function channelOrgScopeWhere(\n  orgId: string | null | undefined,\n): Record<string, unknown> {\n  return orgId\n    ? { $or: [{ organizationId: orgId }, { organizationId: null }] }\n    : { organizationId: null }\n}\n\n/**\n * Same NULL-inclusive org scoping, expressed over a resolved\n * `OrganizationScopeFilter` (`resolveOrganizationScopeFilter`) rather than a\n * single org id.\n *\n * Read routes scope on the caller's *selected* organization (the\n * `om_selected_org` cookie the top-bar switcher writes), not on the org baked\n * into the session token (#5012) \u2014 that resolution yields a list of org ids, or\n * `undefined` when the caller is unrestricted (super-admin viewing all orgs).\n * An unrestricted caller sees every channel in the tenant, so the fragment is\n * empty; a restricted one gets their orgs plus the tenant-wide (`NULL`) rows.\n * An explicitly empty organization list is deny-all, including tenant-wide\n * rows, because it represents a resolved restricted scope with no visibility.\n */\nexport function channelOrgScopeWhereFromFilter(\n  filter: { organizationIds: string[] | undefined } | null | undefined,\n): Record<string, unknown> {\n  const organizationIds = filter?.organizationIds\n  if (organizationIds === undefined) return {}\n  if (organizationIds.length === 0) return { organizationId: { $in: [] } }\n  return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }\n}\n\n/**\n * Ownership fragment for LISTING channels \u2014 the SQL-layer twin of\n * {@link assertCanAccessChannel}.\n *\n * Routes have historically hardcoded one of the two halves of the rule: the\n * admin channel list narrows to `user_id IS NULL`, the profile list narrows to\n * `user_id = <caller>`. A provider-scoped listing needs both, because which half\n * a channel falls into is decided by the connect flow the provider offers, not\n * by the listing. Hardcoding `userId: null` is what made the Discord AI\n * auto-reply panel structurally empty (#5602): every route the product exposes\n * for connecting a Discord bot writes `user_id = auth.sub`, so the filter\n * excluded the only channels that can exist.\n *\n * The clause admits exactly what the assert allows and nothing more \u2014 shared\n * channels, plus the caller's own personal ones. It grants no admin bypass, in\n * line with v1 strict owner-only: a personal mailbox stays invisible to everyone\n * but its owner. An anonymous caller (no user id) sees shared channels only.\n *\n * Spread into a MikroORM `where`, or nest under `$and` when another fragment in\n * the same query already claims `$or` (`channelOrgScopeWhereFromFilter` does).\n */\nexport function channelOwnerScopeWhere(\n  currentUserId: string | null | undefined,\n): Record<string, unknown> {\n  if (!currentUserId) return { userId: null }\n  return { $or: [{ userId: null }, { userId: currentUserId }] }\n}\n\n/**\n * Throws when the caller may not access a specific channel. Returns silently\n * when access is allowed.\n *\n * Personal mailbox privacy (v1: strict owner-only). A per-user channel\n * (`userId` set) may be acted on ONLY by its owner \u2014 not even an admin /\n * superadmin can poll, test-send, import history from, register push on, or\n * delete another user's personal mailbox. Tenant-wide channels\n * (`userId == null`, e.g. WhatsApp Business / Slack workspaces) remain\n * accessible to any caller the route already feature-gated.\n *\n * `userFeatures` is retained on the signature (callers pass it) but no longer\n * grants a bypass; it is reserved for the v2 admin-oversight feature.\n *\n * Callers MUST pass the fully decrypted channel row \u2014 we read `userId` directly.\n */\nexport function assertCanAccessChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  void userFeatures\n  // Tenant-wide / shared channel \u2014 accessible to all callers.\n  if (channel.userId == null) return\n  // Personal mailbox \u2014 owner only, regardless of admin grants (v1).\n  if (channel.userId !== currentUserId) {\n    throw new ChannelAccessDeniedError(\n      'Channel is a personal mailbox owned by another user',\n    )\n  }\n}\n\n/**\n * Authorization for MANAGING (mutating) a channel \u2014 disconnect, poll, set\n * primary, import history, register push. Encodes the per-user ownership rule:\n *\n *   - **Personal mailbox** (`userId` set): the **owner has full control** of\n *     their own account; any other caller \u2014 admin included \u2014 is denied (v1\n *     strict owner-only, no bypass). Routes gate these on\n *     `communication_channels.connect_user_channel` so every email user reaches\n *     this check for their own channels.\n *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp\n *     Business / Slack workspaces): requires the route's `elevatedFeature`\n *     (`communication_channels.manage`, `\u2026channel.push.manage`, or\n *     `\u2026channel.import_history`). Evaluated by the shared feature policy.\n *\n * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking\n * existence) when the caller may not manage the channel.\n */\nexport function assertCanManageChannel(\n  channel: { userId?: string | null } | null | undefined,\n  currentUserId: string | null | undefined,\n  userFeatures: string[] | null | undefined,\n  elevatedFeature: string,\n): void {\n  if (!channel) {\n    // Defensive: callers pre-check existence and return 404, so this is\n    // unreachable in practice. Throw the typed access error (route-mapped to a\n    // masked 404) rather than a bare Error that would surface as a 500.\n    throw new ChannelAccessDeniedError('Channel not found')\n  }\n  // Personal mailbox \u2014 owner only. The owner manages their own account fully\n  // (gated by connect_user_channel at the route); no admin bypass in v1.\n  if (channel.userId != null) {\n    if (channel.userId !== currentUserId) {\n      throw new ChannelAccessDeniedError('Channel is a personal mailbox owned by another user')\n    }\n    return\n  }\n  // Tenant-wide / shared channel \u2014 requires the elevated management feature.\n  const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []\n  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {\n    throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)\n  }\n}\n\n/**\n * Stable error class so route handlers can map to a 403 instead of leaking the\n * underlying message verbatim. Subclasses `Error` for compatibility with the\n * platform's error logging helpers.\n */\nexport class ChannelAccessDeniedError extends Error {\n  override name = 'ChannelAccessDeniedError'\n  readonly statusCode = 403\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAiB3B,MAAM,gBAAgB;AAgBtB,SAAS,qBACd,OACyB;AACzB,SAAO,QACH,EAAE,KAAK,CAAC,EAAE,gBAAgB,MAAM,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE,IAC7D,EAAE,gBAAgB,KAAK;AAC7B;AAgBO,SAAS,+BACd,QACyB;AACzB,QAAM,kBAAkB,QAAQ;AAChC,MAAI,oBAAoB,OAAW,QAAO,CAAC;AAC3C,MAAI,gBAAgB,WAAW,EAAG,QAAO,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,EAAE;AACvE,SAAO,EAAE,KAAK,CAAC,EAAE,gBAAgB,EAAE,KAAK,gBAAgB,EAAE,GAAG,EAAE,gBAAgB,KAAK,CAAC,EAAE;AACzF;AAuBO,SAAS,uBACd,eACyB;AACzB,MAAI,CAAC,cAAe,QAAO,EAAE,QAAQ,KAAK;AAC1C,SAAO,EAAE,KAAK,CAAC,EAAE,QAAQ,KAAK,GAAG,EAAE,QAAQ,cAAc,CAAC,EAAE;AAC9D;AAkBO,SAAS,uBACd,SACA,eACA,cACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AACA,OAAK;AAEL,MAAI,QAAQ,UAAU,KAAM;AAE5B,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACF;AAmBO,SAAS,uBACd,SACA,eACA,cACA,iBACM;AACN,MAAI,CAAC,SAAS;AAIZ,UAAM,IAAI,yBAAyB,mBAAmB;AAAA,EACxD;AAGA,MAAI,QAAQ,UAAU,MAAM;AAC1B,QAAI,QAAQ,WAAW,eAAe;AACpC,YAAM,IAAI,yBAAyB,qDAAqD;AAAA,IAC1F;AACA;AAAA,EACF;AAEA,QAAM,kBAAkB,MAAM,QAAQ,YAAY,IAAI,eAAe,CAAC;AACtE,MAAI,CAAC,kBAAkB,CAAC,eAAe,GAAG,EAAE,gBAAgB,CAAC,GAAG;AAC9D,UAAM,IAAI,yBAAyB,uCAAuC,eAAe,GAAG;AAAA,EAC9F;AACF;AAOO,MAAM,iCAAiC,MAAM;AAAA,EAA7C;AAAA;AACL,SAAS,OAAO;AAChB,SAAS,aAAa;AAAA;AACxB;",
   "names": []
 }

package/dist/modules/communication_channels/lib/channel-thread-access.js

@@ -0,0 +1,60 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { assertCanAccessChannel, channelOrgScopeWhere } from "./access-control.js";
+import { ChannelThreadMapping, CommunicationChannel } from "../data/entities.js";
+const logger = createLogger("communication_channels").child({ component: "channel-thread-access" });
+async function resolveChannelThreadAccess(container, scope, reference, actor) {
+  const messageThreadId = reference.messageThreadId ?? null;
+  const externalConversationId = reference.externalConversationId ?? null;
+  if (!messageThreadId && !externalConversationId) return null;
+  const em = container.resolve("em").fork();
+  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null };
+  const baseFilter = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null };
+  const mapping = await findOneWithDecryption(
+    em,
+    ChannelThreadMapping,
+    messageThreadId ? { messageThreadId, ...baseFilter } : { externalConversationId, ...baseFilter },
+    void 0,
+    dscope
+  );
+  if (!mapping) return null;
+  const channel = await findOneWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      id: mapping.channelId,
+      tenantId: scope.tenantId,
+      ...channelOrgScopeWhere(scope.organizationId),
+      deletedAt: null
+    },
+    void 0,
+    dscope
+  );
+  if (!channel) return null;
+  let canAccess = true;
+  try {
+    assertCanAccessChannel(channel, actor.userId, actor.features);
+  } catch {
+    canAccess = false;
+  }
+  return {
+    messageThreadId: mapping.messageThreadId,
+    externalConversationId: mapping.externalConversationId,
+    channelId: mapping.channelId,
+    channelType: channel.channelType,
+    canAccess
+  };
+}
+async function resolveChannelThreadAccessSafely(container, scope, reference, actor) {
+  try {
+    return await resolveChannelThreadAccess(container, scope, reference, actor);
+  } catch (err) {
+    logger.warn("channel thread access resolution failed, treating the thread as internal", { err });
+    return null;
+  }
+}
+export {
+  resolveChannelThreadAccess,
+  resolveChannelThreadAccessSafely
+};
+//# sourceMappingURL=channel-thread-access.js.map

package/dist/modules/communication_channels/lib/channel-thread-access.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/channel-thread-access.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { assertCanAccessChannel, channelOrgScopeWhere } from './access-control'\nimport { ChannelThreadMapping, CommunicationChannel } from '../data/entities'\n\nconst logger = createLogger('communication_channels').child({ component: 'channel-thread-access' })\n\nexport type ChannelThreadScope = {\n  tenantId: string\n  organizationId: string | null\n}\n\nexport type ChannelThreadReference = {\n  /** `messages.message.thread_id` of the thread the caller is acting on. */\n  messageThreadId?: string | null\n  /** `ExternalConversation.id`, as carried by a message's `sourceEntityId`. */\n  externalConversationId?: string | null\n}\n\nexport type ChannelThreadActor = {\n  userId: string | null\n  features: string[]\n}\n\nexport type ChannelThreadAccess = {\n  messageThreadId: string\n  externalConversationId: string\n  channelId: string\n  channelType: string\n  /** Whether {@link ChannelThreadActor} may act on the channel behind this thread. */\n  canAccess: boolean\n}\n\n/**\n * Resolve the channel behind a message thread and decide whether the caller may\n * act on it (#5535).\n *\n * An inbound channel message has a synthetic sender (the channel system user)\n * and, when the conversation is unassigned, no `message_recipients` row at all.\n * The `messages` module's sender-or-recipient predicate therefore denies every\n * operator on such a thread, including a tenant admin \u2014 the participant test\n * asks a question that a thread whose correspondent is not a platform user\n * cannot answer. For those threads the authorization that actually applies is\n * this module's own channel access rule, so `messages` resolves this facade\n * from DI (mirroring `communicationChannelsResolveChannelType`) instead of\n * reaching into these entities.\n *\n * `canAccess` reuses {@link assertCanAccessChannel}: a personal mailbox stays\n * owner-only, a tenant-wide / shared channel is open to any caller the route\n * already feature-gated. Returns `null` when the thread is not channel-linked \u2014\n * an internal message keeps the participant rule untouched.\n *\n * Always tenant/organization scoped: a thread that does not resolve inside the\n * caller's scope reads as not channel-linked rather than being looked up\n * globally.\n */\nexport async function resolveChannelThreadAccess(\n  container: AppContainer,\n  scope: ChannelThreadScope,\n  reference: ChannelThreadReference,\n  actor: ChannelThreadActor,\n): Promise<ChannelThreadAccess | null> {\n  const messageThreadId = reference.messageThreadId ?? null\n  const externalConversationId = reference.externalConversationId ?? null\n  if (!messageThreadId && !externalConversationId) return null\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }\n  const baseFilter = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }\n\n  const mapping = await findOneWithDecryption(\n    em,\n    ChannelThreadMapping,\n    messageThreadId ? { messageThreadId, ...baseFilter } : { externalConversationId, ...baseFilter },\n    undefined,\n    dscope,\n  )\n  if (!mapping) return null\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      id: mapping.channelId,\n      tenantId: scope.tenantId,\n      ...channelOrgScopeWhere(scope.organizationId),\n      deletedAt: null,\n    },\n    undefined,\n    dscope,\n  )\n  if (!channel) return null\n\n  let canAccess = true\n  try {\n    assertCanAccessChannel(channel, actor.userId, actor.features)\n  } catch {\n    canAccess = false\n  }\n\n  return {\n    messageThreadId: mapping.messageThreadId,\n    externalConversationId: mapping.externalConversationId,\n    channelId: mapping.channelId,\n    channelType: channel.channelType,\n    canAccess,\n  }\n}\n\n/**\n * Same contract, but never throws: a lookup failure degrades to \"not\n * channel-linked\", which leaves the caller on its pre-existing rule. For the\n * reply guard that is the fail-closed answer \u2014 the participant test still\n * applies and a transient database error cannot widen access.\n */\nexport async function resolveChannelThreadAccessSafely(\n  container: AppContainer,\n  scope: ChannelThreadScope,\n  reference: ChannelThreadReference,\n  actor: ChannelThreadActor,\n): Promise<ChannelThreadAccess | null> {\n  try {\n    return await resolveChannelThreadAccess(container, scope, reference, actor)\n  } catch (err) {\n    logger.warn('channel thread access resolution failed, treating the thread as internal', { err })\n    return null\n  }\n}\n\n/** DI service type for cross-module callers (resolve `communicationChannelsResolveChannelThreadAccess`). */\nexport type ResolveChannelThreadAccessService = typeof resolveChannelThreadAccessSafely\n"],
+  "mappings": "AAEA,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB,4BAA4B;AAC7D,SAAS,sBAAsB,4BAA4B;AAE3D,MAAM,SAAS,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAmDlG,eAAsB,2BACpB,WACA,OACA,WACA,OACqC;AACrC,QAAM,kBAAkB,UAAU,mBAAmB;AACrD,QAAM,yBAAyB,UAAU,0BAA0B;AACnE,MAAI,CAAC,mBAAmB,CAAC,uBAAwB,QAAO;AAExD,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,SAAS,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,kBAAkB,KAAK;AACxF,QAAM,aAAa,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,kBAAkB,KAAK;AAE5F,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,kBAAkB,EAAE,iBAAiB,GAAG,WAAW,IAAI,EAAE,wBAAwB,GAAG,WAAW;AAAA,IAC/F;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,QAAQ;AAAA,MACZ,UAAU,MAAM;AAAA,MAChB,GAAG,qBAAqB,MAAM,cAAc;AAAA,MAC5C,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO;AAErB,MAAI,YAAY;AAChB,MAAI;AACF,2BAAuB,SAAS,MAAM,QAAQ,MAAM,QAAQ;AAAA,EAC9D,QAAQ;AACN,gBAAY;AAAA,EACd;AAEA,SAAO;AAAA,IACL,iBAAiB,QAAQ;AAAA,IACzB,wBAAwB,QAAQ;AAAA,IAChC,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,IACrB;AAAA,EACF;AACF;AAQA,eAAsB,iCACpB,WACA,OACA,WACA,OACqC;AACrC,MAAI;AACF,WAAO,MAAM,2BAA2B,WAAW,OAAO,WAAW,KAAK;AAAA,EAC5E,SAAS,KAAK;AACZ,WAAO,KAAK,4EAA4E,EAAE,IAAI,CAAC;AAC/F,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/credential-refresh.js

@@ -1,5 +1,6 @@
 import { resolveOAuthClientCredentials } from "./oauth-client-config.js";
 const DEFAULT_REFRESH_WINDOW_MS = 6e4;
+const DEFAULT_IN_FLIGHT_TTL_MS = 12e4;
 const inFlightRefreshes = /* @__PURE__ */ new Map();
 async function refreshCredentialsIfNeeded(input, deps) {
   const log = deps?.logger ?? (() => {
@@ -12,12 +13,20 @@ async function refreshCredentialsIfNeeded(input, deps) {
     return { refreshed: false, credentials: input.credentials };
   }
   const existing = inFlightRefreshes.get(input.channelId);
-  if (existing) return existing;
+  if (existing) {
+    const inFlightTtl = input.inFlightTtlMs ?? DEFAULT_IN_FLIGHT_TTL_MS;
+    if (Date.now() - existing.startedAt <= inFlightTtl) return existing.promise;
+    log(
+      "[communication_channels] credential refresh still pending past its deadline; continuing with stored credentials for channel",
+      input.channelId
+    );
+    return { refreshed: false, credentials: input.credentials };
+  }
   const refreshCredentials = input.adapter.refreshCredentials.bind(input.adapter);
   const refreshPromise = runRefresh(input, refreshCredentials, deps, log).finally(() => {
     inFlightRefreshes.delete(input.channelId);
   });
-  inFlightRefreshes.set(input.channelId, refreshPromise);
+  inFlightRefreshes.set(input.channelId, { promise: refreshPromise, startedAt: Date.now() });
   return refreshPromise;
 }
 async function runRefresh(input, refreshCredentials, deps, log) {

package/dist/modules/communication_channels/lib/credential-refresh.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/credential-refresh.ts"],
-  "sourcesContent": ["import type {\n  ChannelAdapter,\n  OAuthClientConfig,\n  RefreshedCredentials,\n  TenantScope,\n} from './adapter'\nimport { resolveOAuthClientCredentials } from './oauth-client-config'\n\n/**\n * Optional credentials-service shape \u2014 matches the integrations module's\n * `CredentialsService`. We keep this loose so the helper compiles even when\n * the integrations module is disabled in a downstream app (the helper just\n * skips persistence in that case).\n */\n/**\n * Matches the real `CredentialsService.save(integrationId, credentials, scope)`\n * signature from `packages/core/src/modules/integrations/lib/credentials-service.ts`.\n * The legacy call sites had this argument order inverted; that bug was the root\n * cause of C1 in the 2026-05-26 review.\n *\n * `scope.userId` (added 2026-05-26 for per-user channels) lets the credentials\n * service write to a user-scoped row instead of overwriting the tenant-wide row.\n */\ntype CredentialsScope = TenantScope & { userId?: string | null }\ntype CredentialsServiceLike = {\n  resolve: (integrationId: string, scope: CredentialsScope) => Promise<Record<string, unknown> | null>\n  save?: (integrationId: string, credentials: Record<string, unknown>, scope: CredentialsScope) => Promise<void>\n}\n\nexport type RefreshCredentialsIfNeededInput = {\n  adapter: ChannelAdapter\n  channelId: string\n  /** Current decrypted credential blob. May contain `expiresAt` (Date or ISO string). */\n  credentials: Record<string, unknown>\n  scope: CredentialsScope\n  /** Refresh window \u2014 refresh when token expires within this many ms. Defaults to 60s. */\n  refreshWindowMs?: number\n  /** Force a refresh regardless of expiry \u2014 used after a 401 response from the provider. */\n  force?: boolean\n}\n\nexport type RefreshCredentialsIfNeededResult = {\n  refreshed: boolean\n  /** The latest credential blob to use for the outbound call. */\n  credentials: Record<string, unknown>\n}\n\nconst DEFAULT_REFRESH_WINDOW_MS = 60_000\n\n/**\n * In-process single-flight for credential refresh, keyed by `channelId`. The\n * outbound-delivery worker runs at concurrency 10 in ONE process, so two\n * concurrent sends on the same channel can both pass `shouldRefresh` and both\n * call `adapter.refreshCredentials`. With rotating refresh-token providers\n * (Gmail) the second exchange invalidates the first's token and\n * flaps the channel to `requires_reauth`. Coalescing concurrent refreshes for\n * the same channel onto one in-flight promise prevents that race for the common\n * single-process case. Entries are deleted in `finally` once settled.\n */\nconst inFlightRefreshes = new Map<string, Promise<RefreshCredentialsIfNeededResult>>()\n\n/**\n * Refresh OAuth credentials when an access token is near expiry, or when the\n * caller forces it (e.g. after a 401 response).\n *\n * Behaviour:\n *   - No-op when the adapter does not implement `refreshCredentials?`.\n *   - No-op when the credential blob has no `expiresAt` AND `force !== true`.\n *   - Returns the refreshed credentials in-memory; persistence to\n *     `integration_credentials` happens via the `CredentialsService` if it\n *     is registered AND exposes `save()` (best-effort \u2014 failures are logged\n *     but don't block the outbound call).\n */\nexport async function refreshCredentialsIfNeeded(\n  input: RefreshCredentialsIfNeededInput,\n  deps?: { credentialsService?: CredentialsServiceLike | null; logger?: (...args: unknown[]) => void },\n): Promise<RefreshCredentialsIfNeededResult> {\n  const log = deps?.logger ?? (() => {})\n  if (typeof input.adapter.refreshCredentials !== 'function') {\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  const refreshWindow = input.refreshWindowMs ?? DEFAULT_REFRESH_WINDOW_MS\n  if (!input.force && !shouldRefresh(input.credentials, refreshWindow)) {\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  // Coalesce concurrent refreshes for the same channel onto one in-flight\n  // promise so rotating refresh tokens are not exchanged twice in parallel.\n  const existing = inFlightRefreshes.get(input.channelId)\n  if (existing) return existing\n\n  const refreshCredentials = input.adapter.refreshCredentials.bind(input.adapter)\n  const refreshPromise = runRefresh(input, refreshCredentials, deps, log).finally(() => {\n    inFlightRefreshes.delete(input.channelId)\n  })\n  inFlightRefreshes.set(input.channelId, refreshPromise)\n  return refreshPromise\n}\n\nasync function runRefresh(\n  input: RefreshCredentialsIfNeededInput,\n  refreshCredentials: NonNullable<ChannelAdapter['refreshCredentials']>,\n  deps: { credentialsService?: CredentialsServiceLike | null; logger?: (...args: unknown[]) => void } | undefined,\n  log: (...args: unknown[]) => void,\n): Promise<RefreshCredentialsIfNeededResult> {\n  // Resolve the tenant's OAuth client config (clientId/clientSecret) the admin\n  // stored under the `channel_<providerKey>` integration at TENANT scope\n  // (userId = null). The adapter uses it for the token-endpoint call. We always\n  // resolve at tenant scope here \u2014 never the channel's per-user scope \u2014 because\n  // the per-user row holds the user's tokens, not the client app credentials.\n  let oauthClient: OAuthClientConfig | undefined\n  if (deps?.credentialsService) {\n    try {\n      const raw = await resolveOAuthClientCredentials(\n        deps.credentialsService,\n        input.adapter.providerKey,\n        { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId },\n      )\n      oauthClient = safeParseOAuthClient(raw)\n    } catch (resolveErr) {\n      log(\n        '[communication_channels] resolving OAuth client config failed:',\n        resolveErr instanceof Error ? resolveErr.message : resolveErr,\n      )\n    }\n  }\n\n  let result: RefreshedCredentials\n  try {\n    result = await refreshCredentials({\n      channelId: input.channelId,\n      credentials: input.credentials,\n      scope: input.scope,\n      oauthClient,\n    })\n  } catch (err) {\n    log('[communication_channels] refreshCredentials failed:', err instanceof Error ? err.message : err)\n    // Return current credentials \u2014 caller may still attempt the send with the old token.\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  const next = result?.credentials ?? input.credentials\n  if (deps?.credentialsService?.save) {\n    try {\n      await deps.credentialsService.save(\n        `channel_${input.adapter.providerKey}`,\n        result.expiresAt ? { ...next, expiresAt: result.expiresAt.toISOString() } : next,\n        input.scope,\n      )\n    } catch (saveErr) {\n      log('[communication_channels] persisting refreshed credentials failed:', saveErr instanceof Error ? saveErr.message : saveErr)\n    }\n  }\n\n  return { refreshed: true, credentials: next }\n}\n\nfunction shouldRefresh(credentials: Record<string, unknown>, windowMs: number): boolean {\n  const expiresAtRaw = credentials?.expiresAt\n  if (!expiresAtRaw) return false\n  const expiresAt = parseExpiresAt(expiresAtRaw)\n  if (!expiresAt) return false\n  return expiresAt.getTime() - Date.now() <= windowMs\n}\n\nfunction parseExpiresAt(raw: unknown): Date | null {\n  if (raw instanceof Date) return Number.isFinite(raw.getTime()) ? raw : null\n  if (typeof raw === 'string' || typeof raw === 'number') {\n    const date = new Date(raw)\n    return Number.isFinite(date.getTime()) ? date : null\n  }\n  return null\n}\n\n/**\n * Parse a raw `channel_<provider>` client-credential row into the\n * `OAuthClientConfig` shape adapters expect. Returns `undefined` when the row is\n * missing or malformed \u2014 adapters then fall back to the deprecated\n * `credentials._client` read path (one minor-release deprecation per Spec A).\n */\nfunction safeParseOAuthClient(raw: unknown): OAuthClientConfig | undefined {\n  if (!raw || typeof raw !== 'object') return undefined\n  const record = raw as Record<string, unknown>\n  const clientId = typeof record.clientId === 'string' ? record.clientId : undefined\n  if (!clientId) return undefined\n  const clientSecret =\n    typeof record.clientSecret === 'string' ? record.clientSecret : undefined\n  const scopes = Array.isArray(record.scopes)\n    ? record.scopes.filter((value): value is string => typeof value === 'string')\n    : undefined\n  return {\n    clientId,\n    ...(clientSecret !== undefined ? { clientSecret } : {}),\n    ...(scopes !== undefined ? { scopes } : {}),\n  }\n}\n"],
-  "mappings": "AAMA,SAAS,qCAAqC;AAyC9C,MAAM,4BAA4B;AAYlC,MAAM,oBAAoB,oBAAI,IAAuD;AAcrF,eAAsB,2BACpB,OACA,MAC2C;AAC3C,QAAM,MAAM,MAAM,WAAW,MAAM;AAAA,EAAC;AACpC,MAAI,OAAO,MAAM,QAAQ,uBAAuB,YAAY;AAC1D,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAEA,QAAM,gBAAgB,MAAM,mBAAmB;AAC/C,MAAI,CAAC,MAAM,SAAS,CAAC,cAAc,MAAM,aAAa,aAAa,GAAG;AACpE,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAIA,QAAM,WAAW,kBAAkB,IAAI,MAAM,SAAS;AACtD,MAAI,SAAU,QAAO;AAErB,QAAM,qBAAqB,MAAM,QAAQ,mBAAmB,KAAK,MAAM,OAAO;AAC9E,QAAM,iBAAiB,WAAW,OAAO,oBAAoB,MAAM,GAAG,EAAE,QAAQ,MAAM;AACpF,sBAAkB,OAAO,MAAM,SAAS;AAAA,EAC1C,CAAC;AACD,oBAAkB,IAAI,MAAM,WAAW,cAAc;AACrD,SAAO;AACT;AAEA,eAAe,WACb,OACA,oBACA,MACA,KAC2C;AAM3C,MAAI;AACJ,MAAI,MAAM,oBAAoB;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB,KAAK;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,MAC/E;AACA,oBAAc,qBAAqB,GAAG;AAAA,IACxC,SAAS,YAAY;AACnB;AAAA,QACE;AAAA,QACA,sBAAsB,QAAQ,WAAW,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,uDAAuD,eAAe,QAAQ,IAAI,UAAU,GAAG;AAEnG,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAEA,QAAM,OAAO,QAAQ,eAAe,MAAM;AAC1C,MAAI,MAAM,oBAAoB,MAAM;AAClC,QAAI;AACF,YAAM,KAAK,mBAAmB;AAAA,QAC5B,WAAW,MAAM,QAAQ,WAAW;AAAA,QACpC,OAAO,YAAY,EAAE,GAAG,MAAM,WAAW,OAAO,UAAU,YAAY,EAAE,IAAI;AAAA,QAC5E,MAAM;AAAA,MACR;AAAA,IACF,SAAS,SAAS;AAChB,UAAI,qEAAqE,mBAAmB,QAAQ,QAAQ,UAAU,OAAO;AAAA,IAC/H;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,MAAM,aAAa,KAAK;AAC9C;AAEA,SAAS,cAAc,aAAsC,UAA2B;AACtF,QAAM,eAAe,aAAa;AAClC,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,YAAY,eAAe,YAAY;AAC7C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,KAAK;AAC7C;AAEA,SAAS,eAAe,KAA2B;AACjD,MAAI,eAAe,KAAM,QAAO,OAAO,SAAS,IAAI,QAAQ,CAAC,IAAI,MAAM;AACvE,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAU;AACtD,UAAM,OAAO,IAAI,KAAK,GAAG;AACzB,WAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO;AAAA,EAClD;AACA,SAAO;AACT;AAQA,SAAS,qBAAqB,KAA6C;AACzE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,SAAS;AACf,QAAM,WAAW,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACzE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,eACJ,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AAClE,QAAM,SAAS,MAAM,QAAQ,OAAO,MAAM,IACtC,OAAO,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC1E;AACJ,SAAO;AAAA,IACL;AAAA,IACA,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,IACrD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AACF;",
+  "sourcesContent": ["import type {\n  ChannelAdapter,\n  OAuthClientConfig,\n  RefreshedCredentials,\n  TenantScope,\n} from './adapter'\nimport { resolveOAuthClientCredentials } from './oauth-client-config'\n\n/**\n * Optional credentials-service shape \u2014 matches the integrations module's\n * `CredentialsService`. We keep this loose so the helper compiles even when\n * the integrations module is disabled in a downstream app (the helper just\n * skips persistence in that case).\n */\n/**\n * Matches the real `CredentialsService.save(integrationId, credentials, scope)`\n * signature from `packages/core/src/modules/integrations/lib/credentials-service.ts`.\n * The legacy call sites had this argument order inverted; that bug was the root\n * cause of C1 in the 2026-05-26 review.\n *\n * `scope.userId` (added 2026-05-26 for per-user channels) lets the credentials\n * service write to a user-scoped row instead of overwriting the tenant-wide row.\n */\ntype CredentialsScope = TenantScope & { userId?: string | null }\ntype CredentialsServiceLike = {\n  resolve: (integrationId: string, scope: CredentialsScope) => Promise<Record<string, unknown> | null>\n  save?: (integrationId: string, credentials: Record<string, unknown>, scope: CredentialsScope) => Promise<void>\n}\n\nexport type RefreshCredentialsIfNeededInput = {\n  adapter: ChannelAdapter\n  channelId: string\n  /** Current decrypted credential blob. May contain `expiresAt` (Date or ISO string). */\n  credentials: Record<string, unknown>\n  scope: CredentialsScope\n  /** Refresh window \u2014 refresh when token expires within this many ms. Defaults to 60s. */\n  refreshWindowMs?: number\n  /** Force a refresh regardless of expiry \u2014 used after a 401 response from the provider. */\n  force?: boolean\n  /**\n   * How long a pending refresh for this channel is handed to later callers.\n   * Past this deadline later callers stop waiting on it and continue with their\n   * stored credentials; no second refresh starts while it is unsettled.\n   * Defaults to 2 minutes; `Infinity` waits on the pending refresh indefinitely.\n   */\n  inFlightTtlMs?: number\n}\n\nexport type RefreshCredentialsIfNeededResult = {\n  refreshed: boolean\n  /** The latest credential blob to use for the outbound call. */\n  credentials: Record<string, unknown>\n}\n\nconst DEFAULT_REFRESH_WINDOW_MS = 60_000\nconst DEFAULT_IN_FLIGHT_TTL_MS = 120_000\n\n/**\n * In-process single-flight for credential refresh, keyed by `channelId`. The\n * outbound-delivery worker runs at concurrency 10 in ONE process, so two\n * concurrent sends on the same channel can both pass `shouldRefresh` and both\n * call `adapter.refreshCredentials`. With rotating refresh-token providers\n * (Gmail) the second exchange invalidates the first's token and\n * flaps the channel to `requires_reauth`. Coalescing concurrent refreshes for\n * the same channel onto one in-flight promise prevents that race for the common\n * single-process case. Entries are deleted in `finally` once settled.\n *\n * A refresh that never settles (e.g. a token exchange whose response body is\n * never closed) would otherwise be handed to every later caller forever, so an\n * entry older than `inFlightTtlMs` is no longer shared: later callers proceed\n * with their stored credentials instead of hanging on it.\n */\ntype InFlightRefresh = { promise: Promise<RefreshCredentialsIfNeededResult>; startedAt: number }\nconst inFlightRefreshes = new Map<string, InFlightRefresh>()\n\n/**\n * Refresh OAuth credentials when an access token is near expiry, or when the\n * caller forces it (e.g. after a 401 response).\n *\n * Behaviour:\n *   - No-op when the adapter does not implement `refreshCredentials?`.\n *   - No-op when the credential blob has no `expiresAt` AND `force !== true`.\n *   - Returns the refreshed credentials in-memory; persistence to\n *     `integration_credentials` happens via the `CredentialsService` if it\n *     is registered AND exposes `save()` (best-effort \u2014 failures are logged\n *     but don't block the outbound call).\n */\nexport async function refreshCredentialsIfNeeded(\n  input: RefreshCredentialsIfNeededInput,\n  deps?: { credentialsService?: CredentialsServiceLike | null; logger?: (...args: unknown[]) => void },\n): Promise<RefreshCredentialsIfNeededResult> {\n  const log = deps?.logger ?? (() => {})\n  if (typeof input.adapter.refreshCredentials !== 'function') {\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  const refreshWindow = input.refreshWindowMs ?? DEFAULT_REFRESH_WINDOW_MS\n  if (!input.force && !shouldRefresh(input.credentials, refreshWindow)) {\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  // Coalesce concurrent refreshes for the same channel onto one in-flight\n  // promise so rotating refresh tokens are not exchanged twice in parallel.\n  const existing = inFlightRefreshes.get(input.channelId)\n  if (existing) {\n    const inFlightTtl = input.inFlightTtlMs ?? DEFAULT_IN_FLIGHT_TTL_MS\n    if (Date.now() - existing.startedAt <= inFlightTtl) return existing.promise\n    log(\n      '[communication_channels] credential refresh still pending past its deadline; continuing with stored credentials for channel',\n      input.channelId,\n    )\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  const refreshCredentials = input.adapter.refreshCredentials.bind(input.adapter)\n  const refreshPromise = runRefresh(input, refreshCredentials, deps, log).finally(() => {\n    inFlightRefreshes.delete(input.channelId)\n  })\n  inFlightRefreshes.set(input.channelId, { promise: refreshPromise, startedAt: Date.now() })\n  return refreshPromise\n}\n\nasync function runRefresh(\n  input: RefreshCredentialsIfNeededInput,\n  refreshCredentials: NonNullable<ChannelAdapter['refreshCredentials']>,\n  deps: { credentialsService?: CredentialsServiceLike | null; logger?: (...args: unknown[]) => void } | undefined,\n  log: (...args: unknown[]) => void,\n): Promise<RefreshCredentialsIfNeededResult> {\n  // Resolve the tenant's OAuth client config (clientId/clientSecret) the admin\n  // stored under the `channel_<providerKey>` integration at TENANT scope\n  // (userId = null). The adapter uses it for the token-endpoint call. We always\n  // resolve at tenant scope here \u2014 never the channel's per-user scope \u2014 because\n  // the per-user row holds the user's tokens, not the client app credentials.\n  let oauthClient: OAuthClientConfig | undefined\n  if (deps?.credentialsService) {\n    try {\n      const raw = await resolveOAuthClientCredentials(\n        deps.credentialsService,\n        input.adapter.providerKey,\n        { tenantId: input.scope.tenantId, organizationId: input.scope.organizationId },\n      )\n      oauthClient = safeParseOAuthClient(raw)\n    } catch (resolveErr) {\n      log(\n        '[communication_channels] resolving OAuth client config failed:',\n        resolveErr instanceof Error ? resolveErr.message : resolveErr,\n      )\n    }\n  }\n\n  let result: RefreshedCredentials\n  try {\n    result = await refreshCredentials({\n      channelId: input.channelId,\n      credentials: input.credentials,\n      scope: input.scope,\n      oauthClient,\n    })\n  } catch (err) {\n    log('[communication_channels] refreshCredentials failed:', err instanceof Error ? err.message : err)\n    // Return current credentials \u2014 caller may still attempt the send with the old token.\n    return { refreshed: false, credentials: input.credentials }\n  }\n\n  const next = result?.credentials ?? input.credentials\n  if (deps?.credentialsService?.save) {\n    try {\n      await deps.credentialsService.save(\n        `channel_${input.adapter.providerKey}`,\n        result.expiresAt ? { ...next, expiresAt: result.expiresAt.toISOString() } : next,\n        input.scope,\n      )\n    } catch (saveErr) {\n      log('[communication_channels] persisting refreshed credentials failed:', saveErr instanceof Error ? saveErr.message : saveErr)\n    }\n  }\n\n  return { refreshed: true, credentials: next }\n}\n\nfunction shouldRefresh(credentials: Record<string, unknown>, windowMs: number): boolean {\n  const expiresAtRaw = credentials?.expiresAt\n  if (!expiresAtRaw) return false\n  const expiresAt = parseExpiresAt(expiresAtRaw)\n  if (!expiresAt) return false\n  return expiresAt.getTime() - Date.now() <= windowMs\n}\n\nfunction parseExpiresAt(raw: unknown): Date | null {\n  if (raw instanceof Date) return Number.isFinite(raw.getTime()) ? raw : null\n  if (typeof raw === 'string' || typeof raw === 'number') {\n    const date = new Date(raw)\n    return Number.isFinite(date.getTime()) ? date : null\n  }\n  return null\n}\n\n/**\n * Parse a raw `channel_<provider>` client-credential row into the\n * `OAuthClientConfig` shape adapters expect. Returns `undefined` when the row is\n * missing or malformed \u2014 the Gmail adapter then fails refresh (legacy\n * `credentials._client` fallback was removed \u2014 see #3828 / UPGRADE_NOTES).\n */\nfunction safeParseOAuthClient(raw: unknown): OAuthClientConfig | undefined {\n  if (!raw || typeof raw !== 'object') return undefined\n  const record = raw as Record<string, unknown>\n  const clientId = typeof record.clientId === 'string' ? record.clientId : undefined\n  if (!clientId) return undefined\n  const clientSecret =\n    typeof record.clientSecret === 'string' ? record.clientSecret : undefined\n  const scopes = Array.isArray(record.scopes)\n    ? record.scopes.filter((value): value is string => typeof value === 'string')\n    : undefined\n  return {\n    clientId,\n    ...(clientSecret !== undefined ? { clientSecret } : {}),\n    ...(scopes !== undefined ? { scopes } : {}),\n  }\n}\n"],
+  "mappings": "AAMA,SAAS,qCAAqC;AAgD9C,MAAM,4BAA4B;AAClC,MAAM,2BAA2B;AAkBjC,MAAM,oBAAoB,oBAAI,IAA6B;AAc3D,eAAsB,2BACpB,OACA,MAC2C;AAC3C,QAAM,MAAM,MAAM,WAAW,MAAM;AAAA,EAAC;AACpC,MAAI,OAAO,MAAM,QAAQ,uBAAuB,YAAY;AAC1D,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAEA,QAAM,gBAAgB,MAAM,mBAAmB;AAC/C,MAAI,CAAC,MAAM,SAAS,CAAC,cAAc,MAAM,aAAa,aAAa,GAAG;AACpE,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAIA,QAAM,WAAW,kBAAkB,IAAI,MAAM,SAAS;AACtD,MAAI,UAAU;AACZ,UAAM,cAAc,MAAM,iBAAiB;AAC3C,QAAI,KAAK,IAAI,IAAI,SAAS,aAAa,YAAa,QAAO,SAAS;AACpE;AAAA,MACE;AAAA,MACA,MAAM;AAAA,IACR;AACA,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAEA,QAAM,qBAAqB,MAAM,QAAQ,mBAAmB,KAAK,MAAM,OAAO;AAC9E,QAAM,iBAAiB,WAAW,OAAO,oBAAoB,MAAM,GAAG,EAAE,QAAQ,MAAM;AACpF,sBAAkB,OAAO,MAAM,SAAS;AAAA,EAC1C,CAAC;AACD,oBAAkB,IAAI,MAAM,WAAW,EAAE,SAAS,gBAAgB,WAAW,KAAK,IAAI,EAAE,CAAC;AACzF,SAAO;AACT;AAEA,eAAe,WACb,OACA,oBACA,MACA,KAC2C;AAM3C,MAAI;AACJ,MAAI,MAAM,oBAAoB;AAC5B,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,QAChB,KAAK;AAAA,QACL,MAAM,QAAQ;AAAA,QACd,EAAE,UAAU,MAAM,MAAM,UAAU,gBAAgB,MAAM,MAAM,eAAe;AAAA,MAC/E;AACA,oBAAc,qBAAqB,GAAG;AAAA,IACxC,SAAS,YAAY;AACnB;AAAA,QACE;AAAA,QACA,sBAAsB,QAAQ,WAAW,UAAU;AAAA,MACrD;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,mBAAmB;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,aAAa,MAAM;AAAA,MACnB,OAAO,MAAM;AAAA,MACb;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,uDAAuD,eAAe,QAAQ,IAAI,UAAU,GAAG;AAEnG,WAAO,EAAE,WAAW,OAAO,aAAa,MAAM,YAAY;AAAA,EAC5D;AAEA,QAAM,OAAO,QAAQ,eAAe,MAAM;AAC1C,MAAI,MAAM,oBAAoB,MAAM;AAClC,QAAI;AACF,YAAM,KAAK,mBAAmB;AAAA,QAC5B,WAAW,MAAM,QAAQ,WAAW;AAAA,QACpC,OAAO,YAAY,EAAE,GAAG,MAAM,WAAW,OAAO,UAAU,YAAY,EAAE,IAAI;AAAA,QAC5E,MAAM;AAAA,MACR;AAAA,IACF,SAAS,SAAS;AAChB,UAAI,qEAAqE,mBAAmB,QAAQ,QAAQ,UAAU,OAAO;AAAA,IAC/H;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,MAAM,aAAa,KAAK;AAC9C;AAEA,SAAS,cAAc,aAAsC,UAA2B;AACtF,QAAM,eAAe,aAAa;AAClC,MAAI,CAAC,aAAc,QAAO;AAC1B,QAAM,YAAY,eAAe,YAAY;AAC7C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,UAAU,QAAQ,IAAI,KAAK,IAAI,KAAK;AAC7C;AAEA,SAAS,eAAe,KAA2B;AACjD,MAAI,eAAe,KAAM,QAAO,OAAO,SAAS,IAAI,QAAQ,CAAC,IAAI,MAAM;AACvE,MAAI,OAAO,QAAQ,YAAY,OAAO,QAAQ,UAAU;AACtD,UAAM,OAAO,IAAI,KAAK,GAAG;AACzB,WAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,OAAO;AAAA,EAClD;AACA,SAAO;AACT;AAQA,SAAS,qBAAqB,KAA6C;AACzE,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,QAAO;AAC5C,QAAM,SAAS;AACf,QAAM,WAAW,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AACzE,MAAI,CAAC,SAAU,QAAO;AACtB,QAAM,eACJ,OAAO,OAAO,iBAAiB,WAAW,OAAO,eAAe;AAClE,QAAM,SAAS,MAAM,QAAQ,OAAO,MAAM,IACtC,OAAO,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ,IAC1E;AACJ,SAAO;AAAA,IACL;AAAA,IACA,GAAI,iBAAiB,SAAY,EAAE,aAAa,IAAI,CAAC;AAAA,IACrD,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;AAAA,EAC3C;AACF;",
   "names": []
 }

package/dist/modules/communication_channels/lib/inbound-message-origin.js

@@ -0,0 +1,18 @@
+import { resolveCommunicationChannelsSystemUserId } from "./system-user.js";
+const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = "communication_channels.external_conversation";
+function buildInboundIdempotencyKey(channelId, externalMessageId) {
+  return `cc:${channelId}:${externalMessageId}`;
+}
+async function isIngestedInboundMessage(em, { message, existingLink, tenantId }) {
+  if (message.sourceEntityType !== EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return false;
+  if (existingLink?.direction === "inbound") return true;
+  if (typeof message.idempotencyKey === "string" && message.idempotencyKey.startsWith("cc:")) return true;
+  const systemUserId = await resolveCommunicationChannelsSystemUserId(em, tenantId);
+  return message.senderUserId === systemUserId;
+}
+export {
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  buildInboundIdempotencyKey,
+  isIngestedInboundMessage
+};
+//# sourceMappingURL=inbound-message-origin.js.map

package/dist/modules/communication_channels/lib/inbound-message-origin.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/inbound-message-origin.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveCommunicationChannelsSystemUserId } from './system-user'\n\n/**\n * Entity type a channel-backed conversation is exposed under on a message's\n * `sourceEntityType`. Written by `commands/ingest-inbound-message.ts` and\n * inherited by every operator message composed on the same conversation.\n */\nexport const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'\n\n/**\n * Dedup key `ingest-inbound-message` stamps on the platform message it composes,\n * so a retried ingest reuses the first attempt's message instead of duplicating\n * it. The `cc:` prefix also identifies the message as ingest-authored \u2014 see\n * {@link isIngestedInboundMessage}.\n */\nexport function buildInboundIdempotencyKey(channelId: string, externalMessageId: string): string {\n  return `cc:${channelId}:${externalMessageId}`\n}\n\ntype InboundMessageOriginInput = {\n  message: {\n    senderUserId: string\n    sourceEntityType?: string | null\n    idempotencyKey?: string | null\n  }\n  /** The `MessageChannelLink` already loaded for this message, if any. */\n  existingLink: { direction: 'inbound' | 'outbound' } | null | undefined\n  tenantId: string\n}\n\n/**\n * Whether a platform message in a channel-linked thread is the one\n * `ingest-inbound-message` composed for an incoming message \u2014 as opposed to a\n * message an operator wrote in the same conversation.\n *\n * The distinction matters because the messages module emits\n * `messages.message.sent` for both, and only the operator's message may be\n * delivered outbound. Before #5535 the discriminator was `sourceEntityType`\n * alone, which every operator reply inherits from the message it answers \u2014 so\n * operator replies were silently dropped along with the ingested messages.\n *\n * Three signals, checked cheapest-first, because the ingested message's inbound\n * `MessageChannelLink` is written *after* the compose command emits its event\n * and is therefore not guaranteed to be visible yet:\n *\n *   1. an inbound `MessageChannelLink` for this message \u2014 authoritative;\n *   2. the `cc:` ingest dedup key ({@link buildInboundIdempotencyKey}) \u2014 set\n *      whenever the provider supplied an external message id;\n *   3. the tenant's channel system user as the sender \u2014 the ingest attribution\n *      when the conversation has no assigned user.\n */\nexport async function isIngestedInboundMessage(\n  em: EntityManager,\n  { message, existingLink, tenantId }: InboundMessageOriginInput,\n): Promise<boolean> {\n  if (message.sourceEntityType !== EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE) return false\n  if (existingLink?.direction === 'inbound') return true\n  if (typeof message.idempotencyKey === 'string' && message.idempotencyKey.startsWith('cc:')) return true\n  const systemUserId = await resolveCommunicationChannelsSystemUserId(em, tenantId)\n  return message.senderUserId === systemUserId\n}\n"],
+  "mappings": "AACA,SAAS,gDAAgD;AAOlD,MAAM,2CAA2C;AAQjD,SAAS,2BAA2B,WAAmB,mBAAmC;AAC/F,SAAO,MAAM,SAAS,IAAI,iBAAiB;AAC7C;AAkCA,eAAsB,yBACpB,IACA,EAAE,SAAS,cAAc,SAAS,GAChB;AAClB,MAAI,QAAQ,qBAAqB,yCAA0C,QAAO;AAClF,MAAI,cAAc,cAAc,UAAW,QAAO;AAClD,MAAI,OAAO,QAAQ,mBAAmB,YAAY,QAAQ,eAAe,WAAW,KAAK,EAAG,QAAO;AACnG,QAAM,eAAe,MAAM,yCAAyC,IAAI,QAAQ;AAChF,SAAO,QAAQ,iBAAiB;AAClC;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/oauth-state.js

@@ -1,4 +1,6 @@
 import crypto from "node:crypto";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+const oauthStateLogger = createLogger("communication_channels").child({ component: "oauth-state" });
 const ALGORITHM = "aes-256-gcm";
 const IV_LENGTH = 12;
 const TAG_LENGTH = 16;
@@ -7,6 +9,7 @@ const HKDF_SALT = Buffer.from("open-mercato-channels-oauth-state-v1");
 const HKDF_INFO = Buffer.from("communication_channels-oauth-state-cookie");
 const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME = "om_cc_oauth_state";
 const DEFAULT_OAUTH_RETURN_URL = "/backend/profile/communication-channels";
+const COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG = "communication_channels:oauth-state";
 class OAuthStateError extends Error {
   constructor(message, code) {
     super(message);
@@ -48,6 +51,9 @@ function getSecret() {
   }
   return fallback;
 }
+function oauthStateConsumedCacheKey(tenantId, state) {
+  return `communication_channels:oauth-state:used:${tenantId}:${state}`;
+}
 function encryptOAuthState(payload) {
   const key = deriveKey(getSecret());
   const iv = crypto.randomBytes(IV_LENGTH);
@@ -96,6 +102,17 @@ function verifyOAuthState(input) {
   }
   return payload;
 }
+async function consumeOAuthStateOnce(store, payload, now = Date.now()) {
+  const key = oauthStateConsumedCacheKey(payload.tenantId, payload.state);
+  if (await store.has(key)) {
+    throw new OAuthStateError("State cookie already used", "replay");
+  }
+  const ttl = Math.max(payload.expiresAt - now, 1e3);
+  await store.set(key, 1, {
+    ttl,
+    tags: [`${COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG}:${payload.tenantId}`]
+  });
+}
 function createOAuthState(params) {
   const state = crypto.randomBytes(32).toString("base64url");
   const nonce = crypto.randomBytes(16).toString("base64url");
@@ -113,16 +130,36 @@ function createOAuthState(params) {
   const cookie = encryptOAuthState(payload);
   return { payload, cookie, stateParam: state };
 }
+let memoryCacheStartupWarningEmitted = false;
+function emitOAuthStateMemoryCacheStartupWarningIfNeeded(env = process.env) {
+  if (memoryCacheStartupWarningEmitted) return;
+  const strategy = (env.CACHE_STRATEGY ?? "memory").trim().toLowerCase();
+  if (strategy === "redis") return;
+  memoryCacheStartupWarningEmitted = true;
+  oauthStateLogger.warn(
+    `OAuth state single-use protection needs a store shared across replicas. CACHE_STRATEGY=${strategy} is per-process or per-node; multi-replica deployments MUST set CACHE_STRATEGY=redis.`,
+    { context: "startup", startup: true, cacheStrategy: strategy }
+  );
+}
+function resetOAuthStateMemoryCacheStartupWarningForTests() {
+  memoryCacheStartupWarningEmitted = false;
+}
+emitOAuthStateMemoryCacheStartupWarningIfNeeded();
 export {
+  COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG,
   COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME,
   COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,
   DEFAULT_OAUTH_RETURN_URL,
   OAuthStateError,
+  consumeOAuthStateOnce,
   createOAuthState,
   decryptOAuthState,
+  emitOAuthStateMemoryCacheStartupWarningIfNeeded,
   encryptOAuthState,
   isSafeOAuthReturnUrl,
   normalizeOAuthReturnUrl,
+  oauthStateConsumedCacheKey,
+  resetOAuthStateMemoryCacheStartupWarningForTests,
   verifyOAuthState
 };
 //# sourceMappingURL=oauth-state.js.map

package/dist/modules/communication_channels/lib/oauth-state.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/oauth-state.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\n\n/**\n * OAuth state-cookie helper for the communication_channels hub.\n *\n * **Ported (re-implemented locally), NOT imported, from `packages/enterprise/src/modules/sso/lib/state-cookie.ts`.**\n * Root `AGENTS.md` rule: `@open-mercato/core` MUST NOT import from `@open-mercato/enterprise`.\n *\n * Design (per email integration spec \u00A7 OSS Independence + \u00A7 Hub Deltas \u2192 Delta 7):\n *   - AES-256-GCM payload encryption.\n *   - HKDF (SHA-256) key derivation from `OM_HUB_OAUTH_STATE_KEY` (falling back to\n *     `KMS_MASTER_KEY`). In production those dedicated keys are required; only in\n *     dev/test do we fall back to `JWT_SECRET` so envs that configure one secret\n *     still work. Production refuses the `JWT_SECRET` fallback so a session-secret\n *     leak cannot also forge OAuth-state cookies.\n *   - 5-minute TTL \u2014 short window to bound replay surface.\n *   - Payload binds the initiating `userId` so the callback rejects state cookies\n *     used by a different session.\n *\n * The output is a base64url string that we set on an HttpOnly + SameSite=Lax cookie.\n * Forgery requires the encryption key (KMS-managed in production).\n */\n\nconst ALGORITHM = 'aes-256-gcm'\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 16\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS = 5 * 60 * 1000\nconst HKDF_SALT = Buffer.from('open-mercato-channels-oauth-state-v1')\nconst HKDF_INFO = Buffer.from('communication_channels-oauth-state-cookie')\n\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME =\n  'om_cc_oauth_state'\n\nexport const DEFAULT_OAUTH_RETURN_URL = '/backend/profile/communication-channels'\n\n/** Errors thrown by the helpers. Stable for tests + route mapping. */\nexport class OAuthStateError extends Error {\n  override name = 'OAuthStateError'\n  constructor(\n    message: string,\n    readonly code:\n      | 'missing_secret'\n      | 'invalid_cookie'\n      | 'expired'\n      | 'user_mismatch'\n      | 'decrypt_failed',\n  ) {\n    super(message)\n  }\n}\n\n/**\n * Canonical state-cookie payload \u2014 provider-agnostic. Each OAuth provider\n * adapter (Gmail, \u2026) packs its own per-flow nonce / verifier into\n * the `extra` field rather than extending this shape.\n */\nexport interface OAuthStatePayload {\n  /** Nonce-like opaque value mirrored into the OAuth `state` query parameter. */\n  state: string\n  /** Per-flow CSRF nonce, returned alongside the OAuth response. */\n  nonce: string\n  /** Tenant-scoped user that initiated the flow. Validated on callback. */\n  userId: string\n  /** Tenant scope so the callback can pin the channel to the same tenant. */\n  tenantId: string\n  /** Optional organization id for multi-org tenants. */\n  organizationId?: string | null\n  /** Provider key (e.g. `gmail`) \u2014 routes the callback. */\n  providerKey: string\n  /** Where to redirect on success. Defaults to the profile page in the route. */\n  returnUrl?: string\n  /** Wall-clock expiry (ms since epoch). */\n  expiresAt: number\n  /** Provider-specific extras (PKCE code_verifier, scopes, login_hint, \u2026). */\n  extra?: Record<string, unknown>\n}\n\nexport function isSafeOAuthReturnUrl(value: string | null | undefined): value is string {\n  if (typeof value !== 'string') return false\n  if (value.length === 0 || value.length > 2048) return false\n  if (!value.startsWith('/') || value.startsWith('//')) return false\n  if (value.includes('\\\\')) return false\n  try {\n    const base = new URL('https://open-mercato.local')\n    const parsed = new URL(value, base)\n    return parsed.origin === base.origin && parsed.pathname.startsWith('/')\n  } catch {\n    return false\n  }\n}\n\nexport function normalizeOAuthReturnUrl(\n  value: string | null | undefined,\n  fallback: string = DEFAULT_OAUTH_RETURN_URL,\n): string {\n  return isSafeOAuthReturnUrl(value) ? value : fallback\n}\n\nfunction deriveKey(secret: string): Buffer {\n  return Buffer.from(crypto.hkdfSync('sha256', secret, HKDF_SALT, HKDF_INFO, 32))\n}\n\nfunction getSecret(): string {\n  const dedicated = process.env.OM_HUB_OAUTH_STATE_KEY ?? process.env.KMS_MASTER_KEY\n  if (dedicated) return dedicated\n  // No dedicated key configured. Fail closed in production rather than deriving\n  // the state-cookie key from JWT_SECRET (the platform session-signing secret) \u2014\n  // sharing that key means a JWT_SECRET leak also lets an attacker forge OAuth\n  // state cookies, bypassing the userId/tenant binding. In non-production we fall\n  // back to JWT_SECRET so dev/test envs that only configure one secret still work.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error('[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production')\n  }\n  const fallback = process.env.JWT_SECRET\n  if (!fallback) {\n    throw new OAuthStateError(\n      'OM_HUB_OAUTH_STATE_KEY (or fallback KMS_MASTER_KEY / JWT_SECRET) must be set',\n      'missing_secret',\n    )\n  }\n  return fallback\n}\n\n/** Encrypt + sign a state payload. Output is a base64url string suitable for a cookie. */\nexport function encryptOAuthState(payload: OAuthStatePayload): string {\n  const key = deriveKey(getSecret())\n  const iv = crypto.randomBytes(IV_LENGTH)\n  const json = JSON.stringify(payload)\n\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])\n  const tag = cipher.getAuthTag()\n\n  return Buffer.concat([iv, tag, ciphertext]).toString('base64url')\n}\n\n/**\n * Decrypt + verify a state cookie. Returns the payload or `null` if the cookie\n * is malformed / tampered. Returns the payload (NOT null) when the cookie has\n * expired \u2014 callers should check `expiresAt` themselves with the verification\n * helper below for stable status codes.\n */\nexport function decryptOAuthState(cookie: string): OAuthStatePayload | null {\n  try {\n    const key = deriveKey(getSecret())\n    const combined = Buffer.from(cookie, 'base64url')\n    if (combined.length < IV_LENGTH + TAG_LENGTH) return null\n\n    const iv = combined.subarray(0, IV_LENGTH)\n    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH)\n    const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH)\n\n    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)\n    decipher.setAuthTag(tag)\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')\n\n    return JSON.parse(decrypted) as OAuthStatePayload\n  } catch {\n    return null\n  }\n}\n\n/**\n * Verify a state cookie against the current session.\n *\n * Throws an {@link OAuthStateError} with a stable `code` field on any check\n * failure so route handlers can map to consistent HTTP responses + redirect\n * flash codes.\n */\nexport function verifyOAuthState(input: {\n  cookie: string | null | undefined\n  expectedUserId: string\n  expectedProviderKey?: string\n  expectedState?: string\n  now?: number\n}): OAuthStatePayload {\n  if (!input.cookie) {\n    throw new OAuthStateError('Missing state cookie', 'invalid_cookie')\n  }\n  const payload = decryptOAuthState(input.cookie)\n  if (!payload) {\n    throw new OAuthStateError('Invalid state cookie', 'decrypt_failed')\n  }\n  const now = input.now ?? Date.now()\n  if (payload.expiresAt < now) {\n    throw new OAuthStateError('State cookie expired', 'expired')\n  }\n  if (payload.userId !== input.expectedUserId) {\n    throw new OAuthStateError('State cookie userId mismatch', 'user_mismatch')\n  }\n  if (input.expectedProviderKey && payload.providerKey !== input.expectedProviderKey) {\n    throw new OAuthStateError('State cookie providerKey mismatch', 'invalid_cookie')\n  }\n  if (input.expectedState && payload.state !== input.expectedState) {\n    throw new OAuthStateError('State cookie state nonce mismatch', 'invalid_cookie')\n  }\n  return payload\n}\n\n/**\n * Create a fresh state payload + matching `state` query parameter. PKCE\n * verifiers are NOT generated here \u2014 the provider adapter decides whether it\n * needs PKCE and packs the verifier into `extra` itself.\n */\nexport function createOAuthState(params: {\n  userId: string\n  tenantId: string\n  organizationId?: string | null\n  providerKey: string\n  returnUrl?: string\n  extra?: Record<string, unknown>\n}): { payload: OAuthStatePayload; cookie: string; stateParam: string } {\n  const state = crypto.randomBytes(32).toString('base64url')\n  const nonce = crypto.randomBytes(16).toString('base64url')\n  const payload: OAuthStatePayload = {\n    state,\n    nonce,\n    userId: params.userId,\n    tenantId: params.tenantId,\n    organizationId: params.organizationId ?? null,\n    providerKey: params.providerKey,\n    returnUrl: params.returnUrl,\n    extra: params.extra,\n    expiresAt: Date.now() + COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,\n  }\n  const cookie = encryptOAuthState(payload)\n  return { payload, cookie, stateParam: state }\n}\n"],
-  "mappings": "AAAA,OAAO,YAAY;AAuBnB,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,aAAa;AACZ,MAAM,4CAA4C,IAAI,KAAK;AAClE,MAAM,YAAY,OAAO,KAAK,sCAAsC;AACpE,MAAM,YAAY,OAAO,KAAK,2CAA2C;AAElE,MAAM,iDACX;AAEK,MAAM,2BAA2B;AAGjC,MAAM,wBAAwB,MAAM;AAAA,EAEzC,YACE,SACS,MAMT;AACA,UAAM,OAAO;AAPJ;AAHX,SAAS,OAAO;AAAA,EAWhB;AACF;AA4BO,SAAS,qBAAqB,OAAmD;AACtF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,KAAM,QAAO;AACtD,MAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AAC7D,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,4BAA4B;AACjD,UAAM,SAAS,IAAI,IAAI,OAAO,IAAI;AAClC,WAAO,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS,WAAW,GAAG;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBACd,OACA,WAAmB,0BACX;AACR,SAAO,qBAAqB,KAAK,IAAI,QAAQ;AAC/C;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,OAAO,KAAK,OAAO,SAAS,UAAU,QAAQ,WAAW,WAAW,EAAE,CAAC;AAChF;AAEA,SAAS,YAAoB;AAC3B,QAAM,YAAY,QAAQ,IAAI,0BAA0B,QAAQ,IAAI;AACpE,MAAI,UAAW,QAAO;AAMtB,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,kBAAkB,SAAoC;AACpE,QAAM,MAAM,UAAU,UAAU,CAAC;AACjC,QAAM,KAAK,OAAO,YAAY,SAAS;AACvC,QAAM,OAAO,KAAK,UAAU,OAAO;AAEnC,QAAM,SAAS,OAAO,eAAe,WAAW,KAAK,EAAE;AACvD,QAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;AAC9E,QAAM,MAAM,OAAO,WAAW;AAE9B,SAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,SAAS,WAAW;AAClE;AAQO,SAAS,kBAAkB,QAA0C;AAC1E,MAAI;AACF,UAAM,MAAM,UAAU,UAAU,CAAC;AACjC,UAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAChD,QAAI,SAAS,SAAS,YAAY,WAAY,QAAO;AAErD,UAAM,KAAK,SAAS,SAAS,GAAG,SAAS;AACzC,UAAM,MAAM,SAAS,SAAS,WAAW,YAAY,UAAU;AAC/D,UAAM,aAAa,SAAS,SAAS,YAAY,UAAU;AAE3D,UAAM,WAAW,OAAO,iBAAiB,WAAW,KAAK,EAAE;AAC3D,aAAS,WAAW,GAAG;AACvB,UAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM;AAEhG,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,iBAAiB,OAMX;AACpB,MAAI,CAAC,MAAM,QAAQ;AACjB,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,UAAU,kBAAkB,MAAM,MAAM;AAC9C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,MAAI,QAAQ,YAAY,KAAK;AAC3B,UAAM,IAAI,gBAAgB,wBAAwB,SAAS;AAAA,EAC7D;AACA,MAAI,QAAQ,WAAW,MAAM,gBAAgB;AAC3C,UAAM,IAAI,gBAAgB,gCAAgC,eAAe;AAAA,EAC3E;AACA,MAAI,MAAM,uBAAuB,QAAQ,gBAAgB,MAAM,qBAAqB;AAClF,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,MAAI,MAAM,iBAAiB,QAAQ,UAAU,MAAM,eAAe;AAChE,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,SAAO;AACT;AAOO,SAAS,iBAAiB,QAOsC;AACrE,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,UAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,WAAW,KAAK,IAAI,IAAI;AAAA,EAC1B;AACA,QAAM,SAAS,kBAAkB,OAAO;AACxC,SAAO,EAAE,SAAS,QAAQ,YAAY,MAAM;AAC9C;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst oauthStateLogger = createLogger('communication_channels').child({ component: 'oauth-state' })\n\n/**\n * OAuth state-cookie helper for the communication_channels hub.\n *\n * **Ported (re-implemented locally), NOT imported, from `packages/enterprise/src/modules/sso/lib/state-cookie.ts`.**\n * Root `AGENTS.md` rule: `@open-mercato/core` MUST NOT import from `@open-mercato/enterprise`.\n *\n * Design (per email integration spec \u00A7 OSS Independence + \u00A7 Hub Deltas \u2192 Delta 7):\n *   - AES-256-GCM payload encryption.\n *   - HKDF (SHA-256) key derivation from `OM_HUB_OAUTH_STATE_KEY` (falling back to\n *     `KMS_MASTER_KEY`). In production those dedicated keys are required; only in\n *     dev/test do we fall back to `JWT_SECRET` so envs that configure one secret\n *     still work. Production refuses the `JWT_SECRET` fallback so a session-secret\n *     leak cannot also forge OAuth-state cookies.\n *   - 5-minute TTL \u2014 short window to bound replay surface.\n *   - Payload binds the initiating `userId` so the callback rejects state cookies\n *     used by a different session.\n *   - Single-use consume-on-read via a short-TTL cache marker keyed by\n *     `tenantId:state` (see {@link consumeOAuthStateOnce}) so a captured cookie\n *     cannot re-drive the callback within the TTL. **This guarantee only holds\n *     across all replicas when `CACHE_STRATEGY=redis`.** With\n *     `CACHE_STRATEGY=memory` (the default) the marker is process-local \u2014 a\n *     replayed callback that reaches a different replica succeeds within the TTL.\n *     Multi-replica deployments MUST use a shared cache (`CACHE_STRATEGY=redis`).\n *\n * The output is a base64url string that we set on an HttpOnly + SameSite=Lax cookie.\n * Forgery requires the encryption key (KMS-managed in production).\n */\n\nconst ALGORITHM = 'aes-256-gcm'\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 16\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS = 5 * 60 * 1000\nconst HKDF_SALT = Buffer.from('open-mercato-channels-oauth-state-v1')\nconst HKDF_INFO = Buffer.from('communication_channels-oauth-state-cookie')\n\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME =\n  'om_cc_oauth_state'\n\nexport const DEFAULT_OAUTH_RETURN_URL = '/backend/profile/communication-channels'\n\n/** Cache tag for OAuth-state consume markers (invalidation / diagnostics). */\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG =\n  'communication_channels:oauth-state'\n\n/** Errors thrown by the helpers. Stable for tests + route mapping. */\nexport class OAuthStateError extends Error {\n  override name = 'OAuthStateError'\n  constructor(\n    message: string,\n    readonly code:\n      | 'missing_secret'\n      | 'invalid_cookie'\n      | 'expired'\n      | 'user_mismatch'\n      | 'decrypt_failed'\n      | 'replay',\n  ) {\n    super(message)\n  }\n}\n\n/**\n * Canonical state-cookie payload \u2014 provider-agnostic. Each OAuth provider\n * adapter (Gmail, \u2026) packs its own per-flow nonce / verifier into\n * the `extra` field rather than extending this shape.\n */\nexport interface OAuthStatePayload {\n  /** Nonce-like opaque value mirrored into the OAuth `state` query parameter. */\n  state: string\n  /** Per-flow CSRF nonce, returned alongside the OAuth response. */\n  nonce: string\n  /** Tenant-scoped user that initiated the flow. Validated on callback. */\n  userId: string\n  /** Tenant scope so the callback can pin the channel to the same tenant. */\n  tenantId: string\n  /** Optional organization id for multi-org tenants. */\n  organizationId?: string | null\n  /** Provider key (e.g. `gmail`) \u2014 routes the callback. */\n  providerKey: string\n  /** Where to redirect on success. Defaults to the profile page in the route. */\n  returnUrl?: string\n  /** Wall-clock expiry (ms since epoch). */\n  expiresAt: number\n  /** Provider-specific extras (PKCE code_verifier, scopes, login_hint, \u2026). */\n  extra?: Record<string, unknown>\n}\n\n/**\n * Minimal cache surface used by {@link consumeOAuthStateOnce}. Matches the\n * `has` / `set` subset of `@open-mercato/cache`'s `CacheStrategy` so callers\n * can pass `container.resolve('cache')` directly.\n */\nexport type OAuthStateConsumeStore = {\n  has(key: string): Promise<boolean>\n  set(\n    key: string,\n    value: unknown,\n    options?: { ttl?: number; tags?: string[] },\n  ): Promise<void>\n}\n\nexport function isSafeOAuthReturnUrl(value: string | null | undefined): value is string {\n  if (typeof value !== 'string') return false\n  if (value.length === 0 || value.length > 2048) return false\n  if (!value.startsWith('/') || value.startsWith('//')) return false\n  if (value.includes('\\\\')) return false\n  try {\n    const base = new URL('https://open-mercato.local')\n    const parsed = new URL(value, base)\n    return parsed.origin === base.origin && parsed.pathname.startsWith('/')\n  } catch {\n    return false\n  }\n}\n\nexport function normalizeOAuthReturnUrl(\n  value: string | null | undefined,\n  fallback: string = DEFAULT_OAUTH_RETURN_URL,\n): string {\n  return isSafeOAuthReturnUrl(value) ? value : fallback\n}\n\nfunction deriveKey(secret: string): Buffer {\n  return Buffer.from(crypto.hkdfSync('sha256', secret, HKDF_SALT, HKDF_INFO, 32))\n}\n\nfunction getSecret(): string {\n  const dedicated = process.env.OM_HUB_OAUTH_STATE_KEY ?? process.env.KMS_MASTER_KEY\n  if (dedicated) return dedicated\n  // No dedicated key configured. Fail closed in production rather than deriving\n  // the state-cookie key from JWT_SECRET (the platform session-signing secret) \u2014\n  // sharing that key means a JWT_SECRET leak also lets an attacker forge OAuth\n  // state cookies, bypassing the userId/tenant binding. In non-production we fall\n  // back to JWT_SECRET so dev/test envs that only configure one secret still work.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error('[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production')\n  }\n  const fallback = process.env.JWT_SECRET\n  if (!fallback) {\n    throw new OAuthStateError(\n      'OM_HUB_OAUTH_STATE_KEY (or fallback KMS_MASTER_KEY / JWT_SECRET) must be set',\n      'missing_secret',\n    )\n  }\n  return fallback\n}\n\n/** Cache key for a consumed OAuth `state` nonce. Exported for tests. */\nexport function oauthStateConsumedCacheKey(tenantId: string, state: string): string {\n  return `communication_channels:oauth-state:used:${tenantId}:${state}`\n}\n\n/** Encrypt + sign a state payload. Output is a base64url string suitable for a cookie. */\nexport function encryptOAuthState(payload: OAuthStatePayload): string {\n  const key = deriveKey(getSecret())\n  const iv = crypto.randomBytes(IV_LENGTH)\n  const json = JSON.stringify(payload)\n\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])\n  const tag = cipher.getAuthTag()\n\n  return Buffer.concat([iv, tag, ciphertext]).toString('base64url')\n}\n\n/**\n * Decrypt + verify a state cookie. Returns the payload or `null` if the cookie\n * is malformed / tampered. Returns the payload (NOT null) when the cookie has\n * expired \u2014 callers should check `expiresAt` themselves with the verification\n * helper below for stable status codes.\n */\nexport function decryptOAuthState(cookie: string): OAuthStatePayload | null {\n  try {\n    const key = deriveKey(getSecret())\n    const combined = Buffer.from(cookie, 'base64url')\n    if (combined.length < IV_LENGTH + TAG_LENGTH) return null\n\n    const iv = combined.subarray(0, IV_LENGTH)\n    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH)\n    const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH)\n\n    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)\n    decipher.setAuthTag(tag)\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')\n\n    return JSON.parse(decrypted) as OAuthStatePayload\n  } catch {\n    return null\n  }\n}\n\n/**\n * Verify a state cookie against the current session.\n *\n * Throws an {@link OAuthStateError} with a stable `code` field on any check\n * failure so route handlers can map to consistent HTTP responses + redirect\n * flash codes.\n *\n * Crypto + binding checks only \u2014 callers MUST also call\n * {@link consumeOAuthStateOnce} so the state cannot be replayed within the TTL.\n */\nexport function verifyOAuthState(input: {\n  cookie: string | null | undefined\n  expectedUserId: string\n  expectedProviderKey?: string\n  expectedState?: string\n  now?: number\n}): OAuthStatePayload {\n  if (!input.cookie) {\n    throw new OAuthStateError('Missing state cookie', 'invalid_cookie')\n  }\n  const payload = decryptOAuthState(input.cookie)\n  if (!payload) {\n    throw new OAuthStateError('Invalid state cookie', 'decrypt_failed')\n  }\n  const now = input.now ?? Date.now()\n  if (payload.expiresAt < now) {\n    throw new OAuthStateError('State cookie expired', 'expired')\n  }\n  if (payload.userId !== input.expectedUserId) {\n    throw new OAuthStateError('State cookie userId mismatch', 'user_mismatch')\n  }\n  if (input.expectedProviderKey && payload.providerKey !== input.expectedProviderKey) {\n    throw new OAuthStateError('State cookie providerKey mismatch', 'invalid_cookie')\n  }\n  if (input.expectedState && payload.state !== input.expectedState) {\n    throw new OAuthStateError('State cookie state nonce mismatch', 'invalid_cookie')\n  }\n  return payload\n}\n\n/**\n * Mark a verified OAuth `state` as consumed in a short-TTL store.\n *\n * First successful call records a used-marker until `expiresAt` (or 1s minimum).\n * A second call with the same `state` throws {@link OAuthStateError} `replay`.\n *\n * Call immediately after {@link verifyOAuthState} on the callback path so a\n * captured valid cookie cannot re-drive the flow within the cookie TTL.\n *\n * Note: the `has`\u2192`set` pattern is not atomic. Two concurrent callbacks racing\n * on the same `state` both pass the `has` check and both proceed \u2014 the\n * single-use guarantee requires an atomic `setNx` which `CacheStrategy` does\n * not currently expose. The race window is milliseconds; document it rather\n * than silently claiming it is closed.\n */\nexport async function consumeOAuthStateOnce(\n  store: OAuthStateConsumeStore,\n  payload: Pick<OAuthStatePayload, 'state' | 'expiresAt' | 'tenantId'>,\n  now: number = Date.now(),\n): Promise<void> {\n  const key = oauthStateConsumedCacheKey(payload.tenantId, payload.state)\n  if (await store.has(key)) {\n    throw new OAuthStateError('State cookie already used', 'replay')\n  }\n  const ttl = Math.max(payload.expiresAt - now, 1_000)\n  await store.set(key, 1, {\n    ttl,\n    tags: [`${COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG}:${payload.tenantId}`],\n  })\n}\n\n/**\n * Create a fresh state payload + matching `state` query parameter. PKCE\n * verifiers are NOT generated here \u2014 the provider adapter decides whether it\n * needs PKCE and packs the verifier into `extra` itself.\n */\nexport function createOAuthState(params: {\n  userId: string\n  tenantId: string\n  organizationId?: string | null\n  providerKey: string\n  returnUrl?: string\n  extra?: Record<string, unknown>\n}): { payload: OAuthStatePayload; cookie: string; stateParam: string } {\n  const state = crypto.randomBytes(32).toString('base64url')\n  const nonce = crypto.randomBytes(16).toString('base64url')\n  const payload: OAuthStatePayload = {\n    state,\n    nonce,\n    userId: params.userId,\n    tenantId: params.tenantId,\n    organizationId: params.organizationId ?? null,\n    providerKey: params.providerKey,\n    returnUrl: params.returnUrl,\n    extra: params.extra,\n    expiresAt: Date.now() + COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,\n  }\n  const cookie = encryptOAuthState(payload)\n  return { payload, cookie, stateParam: state }\n}\n\nlet memoryCacheStartupWarningEmitted = false\n\n/**\n * Emit a one-time startup warning unless the cache strategy is redis. Every other\n * strategy (memory, sqlite, jsonfile) keeps replay markers per process or per node,\n * so the single-use guarantee only holds across replicas on redis.\n */\nexport function emitOAuthStateMemoryCacheStartupWarningIfNeeded(\n  env: NodeJS.ProcessEnv = process.env,\n): void {\n  if (memoryCacheStartupWarningEmitted) return\n  const strategy = (env.CACHE_STRATEGY ?? 'memory').trim().toLowerCase()\n  if (strategy === 'redis') return\n  memoryCacheStartupWarningEmitted = true\n  oauthStateLogger.warn(\n    `OAuth state single-use protection needs a store shared across replicas. CACHE_STRATEGY=${strategy} is per-process or per-node; multi-replica deployments MUST set CACHE_STRATEGY=redis.`,\n    { context: 'startup', startup: true, cacheStrategy: strategy },\n  )\n}\n\n/** Test helper \u2014 reset the one-time startup warning latch. */\nexport function resetOAuthStateMemoryCacheStartupWarningForTests(): void {\n  memoryCacheStartupWarningEmitted = false\n}\n\nemitOAuthStateMemoryCacheStartupWarningIfNeeded()\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,oBAAoB;AAE7B,MAAM,mBAAmB,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AA8BlG,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,aAAa;AACZ,MAAM,4CAA4C,IAAI,KAAK;AAClE,MAAM,YAAY,OAAO,KAAK,sCAAsC;AACpE,MAAM,YAAY,OAAO,KAAK,2CAA2C;AAElE,MAAM,iDACX;AAEK,MAAM,2BAA2B;AAGjC,MAAM,+CACX;AAGK,MAAM,wBAAwB,MAAM;AAAA,EAEzC,YACE,SACS,MAOT;AACA,UAAM,OAAO;AARJ;AAHX,SAAS,OAAO;AAAA,EAYhB;AACF;AA0CO,SAAS,qBAAqB,OAAmD;AACtF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,KAAM,QAAO;AACtD,MAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AAC7D,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,4BAA4B;AACjD,UAAM,SAAS,IAAI,IAAI,OAAO,IAAI;AAClC,WAAO,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS,WAAW,GAAG;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBACd,OACA,WAAmB,0BACX;AACR,SAAO,qBAAqB,KAAK,IAAI,QAAQ;AAC/C;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,OAAO,KAAK,OAAO,SAAS,UAAU,QAAQ,WAAW,WAAW,EAAE,CAAC;AAChF;AAEA,SAAS,YAAoB;AAC3B,QAAM,YAAY,QAAQ,IAAI,0BAA0B,QAAQ,IAAI;AACpE,MAAI,UAAW,QAAO;AAMtB,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,2BAA2B,UAAkB,OAAuB;AAClF,SAAO,2CAA2C,QAAQ,IAAI,KAAK;AACrE;AAGO,SAAS,kBAAkB,SAAoC;AACpE,QAAM,MAAM,UAAU,UAAU,CAAC;AACjC,QAAM,KAAK,OAAO,YAAY,SAAS;AACvC,QAAM,OAAO,KAAK,UAAU,OAAO;AAEnC,QAAM,SAAS,OAAO,eAAe,WAAW,KAAK,EAAE;AACvD,QAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;AAC9E,QAAM,MAAM,OAAO,WAAW;AAE9B,SAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,SAAS,WAAW;AAClE;AAQO,SAAS,kBAAkB,QAA0C;AAC1E,MAAI;AACF,UAAM,MAAM,UAAU,UAAU,CAAC;AACjC,UAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAChD,QAAI,SAAS,SAAS,YAAY,WAAY,QAAO;AAErD,UAAM,KAAK,SAAS,SAAS,GAAG,SAAS;AACzC,UAAM,MAAM,SAAS,SAAS,WAAW,YAAY,UAAU;AAC/D,UAAM,aAAa,SAAS,SAAS,YAAY,UAAU;AAE3D,UAAM,WAAW,OAAO,iBAAiB,WAAW,KAAK,EAAE;AAC3D,aAAS,WAAW,GAAG;AACvB,UAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM;AAEhG,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,iBAAiB,OAMX;AACpB,MAAI,CAAC,MAAM,QAAQ;AACjB,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,UAAU,kBAAkB,MAAM,MAAM;AAC9C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,MAAI,QAAQ,YAAY,KAAK;AAC3B,UAAM,IAAI,gBAAgB,wBAAwB,SAAS;AAAA,EAC7D;AACA,MAAI,QAAQ,WAAW,MAAM,gBAAgB;AAC3C,UAAM,IAAI,gBAAgB,gCAAgC,eAAe;AAAA,EAC3E;AACA,MAAI,MAAM,uBAAuB,QAAQ,gBAAgB,MAAM,qBAAqB;AAClF,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,MAAI,MAAM,iBAAiB,QAAQ,UAAU,MAAM,eAAe;AAChE,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,SAAO;AACT;AAiBA,eAAsB,sBACpB,OACA,SACA,MAAc,KAAK,IAAI,GACR;AACf,QAAM,MAAM,2BAA2B,QAAQ,UAAU,QAAQ,KAAK;AACtE,MAAI,MAAM,MAAM,IAAI,GAAG,GAAG;AACxB,UAAM,IAAI,gBAAgB,6BAA6B,QAAQ;AAAA,EACjE;AACA,QAAM,MAAM,KAAK,IAAI,QAAQ,YAAY,KAAK,GAAK;AACnD,QAAM,MAAM,IAAI,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,GAAG,4CAA4C,IAAI,QAAQ,QAAQ,EAAE;AAAA,EAC9E,CAAC;AACH;AAOO,SAAS,iBAAiB,QAOsC;AACrE,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,UAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,WAAW,KAAK,IAAI,IAAI;AAAA,EAC1B;AACA,QAAM,SAAS,kBAAkB,OAAO;AACxC,SAAO,EAAE,SAAS,QAAQ,YAAY,MAAM;AAC9C;AAEA,IAAI,mCAAmC;AAOhC,SAAS,gDACd,MAAyB,QAAQ,KAC3B;AACN,MAAI,iCAAkC;AACtC,QAAM,YAAY,IAAI,kBAAkB,UAAU,KAAK,EAAE,YAAY;AACrE,MAAI,aAAa,QAAS;AAC1B,qCAAmC;AACnC,mBAAiB;AAAA,IACf,0FAA0F,QAAQ;AAAA,IAClG,EAAE,SAAS,WAAW,SAAS,MAAM,eAAe,SAAS;AAAA,EAC/D;AACF;AAGO,SAAS,mDAAyD;AACvE,qCAAmC;AACrC;AAEA,gDAAgD;",
   "names": []
 }

package/dist/modules/communication_channels/lib/outbound-delivery-intent.js

@@ -0,0 +1,12 @@
+function isOutboundDeliveryIntended({
+  message,
+  forwardedFromMessageId
+}) {
+  if (message.visibility !== "public") return false;
+  if (typeof forwardedFromMessageId === "string" && forwardedFromMessageId.length > 0) return false;
+  return true;
+}
+export {
+  isOutboundDeliveryIntended
+};
+//# sourceMappingURL=outbound-delivery-intent.js.map

package/dist/modules/communication_channels/lib/outbound-delivery-intent.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/lib/outbound-delivery-intent.ts"],
+  "sourcesContent": ["type OutboundDeliveryIntentInput = {\n  message: {\n    visibility?: 'public' | 'internal' | null\n  }\n  /**\n   * `forwardedFrom` as carried by the `messages.message.sent` payload \u2014 the id of\n   * the message a `messages.messages.forward` was built from, absent on every\n   * other compose path.\n   */\n  forwardedFromMessageId?: string | null\n}\n\n/**\n * Whether a platform message in a channel-linked thread was meant to leave the\n * platform, i.e. to be delivered to the external correspondent.\n *\n * The outbound bridge's origin test (`isIngestedInboundMessage`) answers a\n * narrower question \u2014 \"did the ingest command compose this?\" \u2014 and every\n * *internal* message sharing the channel thread falls between the two. This\n * predicate is the intent half, and it fails closed: only a message that is\n * explicitly public and not a forward is delivered.\n *\n * Two signals:\n *\n *   1. **`visibility !== 'public'`** \u2014 an internal note, or an internal compose\n *      filed against the conversation with an explicit `parentMessageId`.\n *      `api/route.ts` deliberately leaves such a compose on its own thread, and\n *      it must not be delivered either. The test is \"not explicitly public\"\n *      rather than \"explicitly internal\" because the messages module treats an\n *      **absent** visibility as internal \u2014 `data/validators.ts` refines a\n *      compose under `value.visibility ?? 'internal'`, `composeMessageCommand`\n *      persists `input.visibility ?? null`, and `lib/composeSourceChannelType.ts`\n *      asks `raw.visibility !== 'public'`. A caller that omits the field\n *      therefore stores `null` on a channel-linked thread, and reading that as\n *      public would deliver an internal note to the correspondent.\n *   2. **`forwardedFromMessageId`** \u2014 a forward. `forwardMessageCommand` files a\n *      forward on a channel thread as internal, which also keeps every reply\n *      under it internal (#6431). This signal is the backstop for the forward\n *      row itself if it ever reaches the bridge public; it cannot see replies\n *      under such a forward, which carry no `forwardedFrom`.\n *\n * Signal 2 reads the event payload rather than the `messages` row on purpose:\n * nothing persisted distinguishes a forward from a reply \u2014 both set\n * `parentMessageId` to the message they answer, and a `replyAll` reply carries\n * platform recipient rows just like a forward does \u2014 so the recorded intent in\n * the `messages.message.sent` payload is the only precise discriminator. Its\n * absence reads as \"not a forward\", which is why signal 1 is checked\n * independently rather than as a fallback.\n */\nexport function isOutboundDeliveryIntended({\n  message,\n  forwardedFromMessageId,\n}: OutboundDeliveryIntentInput): boolean {\n  if (message.visibility !== 'public') return false\n  if (typeof forwardedFromMessageId === 'string' && forwardedFromMessageId.length > 0) return false\n  return true\n}\n"],
+  "mappings": "AAiDO,SAAS,2BAA2B;AAAA,EACzC;AAAA,EACA;AACF,GAAyC;AACvC,MAAI,QAAQ,eAAe,SAAU,QAAO;AAC5C,MAAI,OAAO,2BAA2B,YAAY,uBAAuB,SAAS,EAAG,QAAO;AAC5F,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/communication_channels/lib/send-as-user.js

@@ -59,7 +59,7 @@ async function sendAsUser(container, actor, input) {
     recipients: [],
     subject: input.subject,
     body: messageBody,
-    bodyFormat: "text",
+    bodyFormat: input.body.bodyFormat === "markdown" ? "markdown" : "text",
     priority: "normal",
     sendViaEmail: false,
     parentMessageId: input.parentMessageId,

package/dist/modules/communication_channels/lib/send-as-user.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/send-as-user.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../data/entities'\nimport { ChannelMutationBlockedError, guardOutboundCreate } from './mutation-guards'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from './queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\nimport { htmlToText } from './email-mime'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels')\n\nexport type SendAsUserActor = {\n  userId: string\n  tenantId: string\n  organizationId: string | null\n  /** Forwarded as the messages compose command `ctx.auth`. */\n  auth?: unknown\n}\n\nexport type SendAsUserInput = {\n  userChannelId: string\n  to: string[]\n  cc?: string[]\n  bcc?: string[]\n  subject: string\n  body: { plain?: string; html?: string }\n  inReplyTo?: string\n  references?: string[]\n  /**\n   * Open Mercato `messages.message` id of the message being replied to. When\n   * set, the composed message joins that message's thread (the messages module\n   * derives `threadId` from the parent), so a CRM reply continues the existing\n   * conversation instead of starting a new thread. Optional \u2014 omitted for new\n   * threads.\n   */\n  parentMessageId?: string\n  /**\n   * Free-form metadata persisted on the resulting MessageChannelLink. Used by\n   * downstream subscribers (e.g. the customers module's link-channel-message\n   * subscriber) to anchor the sent message back to a CRM Person or honor a\n   * caller-specified visibility flag. The hub does not interpret these keys.\n   */\n  channelMetadata?: Record<string, unknown>\n}\n\nexport type SendAsUserResult =\n  | {\n      ok: true\n      messageId: string\n      threadId: string\n      channelId: string\n      providerKey: string\n    }\n  | { ok: false; status: number; error: string; fieldErrors?: Record<string, string> }\n\n/**\n * In-process send-as-user facade.\n *\n * Validates the actor owns `userChannelId`, composes the Message via the\n * messages module command, persists the outbound MessageChannelLink + thread\n * mapping, and enqueues delivery. Returns a discriminated result instead of an\n * HTTP Response so it can be invoked both by the `/send-as-user` route and by\n * other modules via DI (`container.resolve('communicationChannelsSendAsUser')`)\n * \u2014 no HTTP self-call required.\n */\nexport async function sendAsUser(\n  container: AppContainer,\n  actor: SendAsUserActor,\n  input: SendAsUserInput,\n): Promise<SendAsUserResult> {\n  if (!input.body.plain && !input.body.html) {\n    return { ok: false, status: 422, error: 'Either body.plain or body.html is required' }\n  }\n  // Re-validate here (not only in the HTTP route's zod schema) because this\n  // facade is also reachable via DI; `input.to[0]` below would otherwise become\n  // `undefined` for an empty recipient list.\n  if (!Array.isArray(input.to) || input.to.length === 0) {\n    return { ok: false, status: 422, error: 'At least one recipient is required' }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const { tenantId } = actor\n  const organizationId = actor.organizationId\n  const dscope = { tenantId, organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id: input.userChannelId, tenantId, organizationId, deletedAt: null },\n    undefined,\n    dscope,\n  )\n  if (!channel) return { ok: false, status: 404, error: 'Channel not found' }\n  if (channel.userId !== actor.userId) {\n    return { ok: false, status: 403, error: 'You can only send through channels you own' }\n  }\n\n  // Hub mutation guard: map known non-deliverable states (`requires_reauth`,\n  // `disconnected`) to a 422 with field-level errors; other transitional states\n  // fall through to the 409 below.\n  try {\n    await guardOutboundCreate(em, { channelId: channel.id, scope: dscope })\n  } catch (err) {\n    if (err instanceof ChannelMutationBlockedError) {\n      return { ok: false, status: 422, error: err.message, fieldErrors: err.errors }\n    }\n    throw err\n  }\n  if (!channel.isActive || channel.status !== 'connected') {\n    return {\n      ok: false,\n      status: 409,\n      error: `Channel is in status '${channel.status}' (not connected)`,\n    }\n  }\n\n  // Create the Message via the messages module compose command. The outbound\n  // subscriber picks it up via `messages.message.sent` and routes through the\n  // adapter chain.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  const messageBody = input.body.plain ?? htmlToText(input.body.html ?? '')\n  const composeInput = {\n    type: `channel.${channel.providerKey}`,\n    visibility: 'public' as const,\n    sourceEntityType: 'communication_channels.send_as_user',\n    sourceEntityId: channel.id,\n    externalEmail: input.to[0],\n    externalName: input.subject,\n    recipients: [],\n    subject: input.subject,\n    body: messageBody,\n    bodyFormat: 'text' as const,\n    priority: 'normal' as const,\n    sendViaEmail: false,\n    parentMessageId: input.parentMessageId,\n    isDraft: false,\n    tenantId,\n    organizationId,\n    userId: actor.userId,\n  }\n  let result\n  try {\n    result = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: {\n          container,\n          auth: actor.auth as never,\n          organizationScope: null,\n          selectedOrganizationId: organizationId,\n          organizationIds: organizationId ? [organizationId] : null,\n        },\n      },\n    )\n  } catch (err) {\n    logger.error('communication_channels send-as-user compose failed', { err })\n    return { ok: false, status: 500, error: '[internal] compose failed' }\n  }\n\n  const messageId = result.result.id\n  const messageThreadId = result.result.threadId ?? messageId\n  const externalThreadRef = `outbound:${messageThreadId}`\n\n  // Persist the conversation, thread mapping, and channel link as one unit. The\n  // conversation's id is DB-generated (`gen_random_uuid()`), so it must be\n  // flushed before the mapping/link can reference it \u2014 hence the eager flushes\n  // rather than `withAtomicFlush` (single trailing flush). `em.transactional`\n  // wraps the whole sequence so a mid-way failure rolls back all three writes\n  // instead of leaving an orphaned conversation row.\n  await em.transactional(async () => {\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        subject: input.subject,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n        lastMessageAt: new Date(),\n      })\n      em.persist(conversation)\n      await em.flush()\n    } else {\n      conversation.subject = conversation.subject ?? input.subject\n      conversation.assignedUserId = conversation.assignedUserId ?? actor.userId\n      conversation.lastMessageAt = new Date()\n      // Flush the scalar updates BEFORE the ChannelThreadMapping lookup below: a\n      // find/findOne on the same EntityManager between a scalar mutation and flush\n      // can silently drop the pending UPDATE (core AGENTS.md \u2192 Entity Update Safety).\n      await em.flush()\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!existingMapping) {\n      const mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId,\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        externalThreadRef,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n      })\n      em.persist(mapping)\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      messageId,\n      externalConversationId: conversation.id,\n      providerKey: channel.providerKey,\n      channelType: channel.channelType,\n      direction: 'outbound',\n      deliveryStatus: 'pending',\n      channelPayload: {\n        text: input.body.plain ?? messageBody,\n        ...(input.body.html ? { html: input.body.html } : {}),\n      },\n      channelContentType: input.body.html ? 'text/html' : 'text/plain',\n      channelMetadata: {\n        // Caller-supplied pass-through metadata merged FIRST so the validated\n        // routing fields below always win \u2014 a caller cannot override the\n        // recipients/subject/threading headers via `channelMetadata`.\n        ...(input.channelMetadata ?? {}),\n        to: input.to,\n        cc: input.cc ?? [],\n        bcc: input.bcc ?? [],\n        subject: input.subject,\n        inReplyTo: input.inReplyTo ?? null,\n        references: input.references ?? [],\n      },\n      tenantId,\n      organizationId,\n    })\n    em.persist(channelLink)\n    await em.flush()\n  })\n\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const deliveryJob: OutboundDeliveryPayload = {\n    messageId,\n    scope: dscope,\n    attempt: 1,\n  }\n  await queue.enqueue(deliveryJob as unknown as Record<string, unknown>)\n\n  return {\n    ok: true,\n    messageId,\n    threadId: messageThreadId,\n    channelId: channel.id,\n    providerKey: channel.providerKey,\n  }\n}\n\n/** DI service type for cross-module callers (resolve `communicationChannelsSendAsUser`). */\nexport type SendAsUserService = typeof sendAsUser\n"],
-  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B,2BAA2B;AACjE,SAAS,+BAA+B,qCAAqC;AAE7E,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB;AAwDpD,eAAsB,WACpB,WACA,OACA,OAC2B;AAC3B,MAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,KAAK,MAAM;AACzC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAIA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAE,KAAK,MAAM,GAAG,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,qCAAqC;AAAA,EAC/E;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,iBAAiB,MAAM;AAC7B,QAAM,SAAS,EAAE,UAAU,eAAe;AAE1C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,eAAe,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,oBAAoB;AAC1E,MAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAKA,MAAI;AACF,UAAM,oBAAoB,IAAI,EAAE,WAAW,QAAQ,IAAI,OAAO,OAAO,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,IAAI,SAAS,aAAa,IAAI,OAAO;AAAA,IAC/E;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,aAAa;AACvD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,OAAO,yBAAyB,QAAQ,MAAM;AAAA,IAChD;AAAA,EACF;AAKA,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,cAAc,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,QAAQ,EAAE;AACxE,QAAM,eAAe;AAAA,IACnB,MAAM,WAAW,QAAQ,WAAW;AAAA,IACpC,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,eAAe,MAAM,GAAG,CAAC;AAAA,IACzB,cAAc,MAAM;AAAA,IACpB,YAAY,CAAC;AAAA,IACb,SAAS,MAAM;AAAA,IACf,MAAM;AAAA,IACN,YAAY;AAAA,IACZ,UAAU;AAAA,IACV,cAAc;AAAA,IACd,iBAAiB,MAAM;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,WAAW;AAAA,MACxB;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,4BAA4B;AAAA,EACtE;AAEA,QAAM,YAAY,OAAO,OAAO;AAChC,QAAM,kBAAkB,OAAO,OAAO,YAAY;AAClD,QAAM,oBAAoB,YAAY,eAAe;AAQrD,QAAM,GAAG,cAAc,YAAY;AACjC,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,eAAe,oBAAI,KAAK;AAAA,MAC1B,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,mBAAa,UAAU,aAAa,WAAW,MAAM;AACrD,mBAAa,iBAAiB,aAAa,kBAAkB,MAAM;AACnE,mBAAa,gBAAgB,oBAAI,KAAK;AAItC,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,YAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,QAC9C,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,MACF,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD;AAAA,MACA,wBAAwB,aAAa;AAAA,MACrC,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,QACd,MAAM,MAAM,KAAK,SAAS;AAAA,QAC1B,GAAI,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD;AAAA,MACA,oBAAoB,MAAM,KAAK,OAAO,cAAc;AAAA,MACpD,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIf,GAAI,MAAM,mBAAmB,CAAC;AAAA,QAC9B,IAAI,MAAM;AAAA,QACV,IAAI,MAAM,MAAM,CAAC;AAAA,QACjB,KAAK,MAAM,OAAO,CAAC;AAAA,QACnB,SAAS,MAAM;AAAA,QACf,WAAW,MAAM,aAAa;AAAA,QAC9B,YAAY,MAAM,cAAc,CAAC;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,WAAW;AACtB,UAAM,GAAG,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,cAAuC;AAAA,IAC3C;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,WAAiD;AAErE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,EACvB;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../data/entities'\nimport { ChannelMutationBlockedError, guardOutboundCreate } from './mutation-guards'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from './queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\nimport { htmlToText } from './email-mime'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels')\n\nexport type SendAsUserActor = {\n  userId: string\n  tenantId: string\n  organizationId: string | null\n  /** Forwarded as the messages compose command `ctx.auth`. */\n  auth?: unknown\n}\n\nexport type SendAsUserInput = {\n  userChannelId: string\n  to: string[]\n  cc?: string[]\n  bcc?: string[]\n  subject: string\n  body: { plain?: string; html?: string; bodyFormat?: 'text' | 'markdown' }\n  inReplyTo?: string\n  references?: string[]\n  /**\n   * Open Mercato `messages.message` id of the message being replied to. When\n   * set, the composed message joins that message's thread (the messages module\n   * derives `threadId` from the parent), so a CRM reply continues the existing\n   * conversation instead of starting a new thread. Optional \u2014 omitted for new\n   * threads.\n   */\n  parentMessageId?: string\n  /**\n   * Free-form metadata persisted on the resulting MessageChannelLink. Used by\n   * downstream subscribers (e.g. the customers module's link-channel-message\n   * subscriber) to anchor the sent message back to a CRM Person or honor a\n   * caller-specified visibility flag. The hub does not interpret these keys.\n   */\n  channelMetadata?: Record<string, unknown>\n}\n\nexport type SendAsUserResult =\n  | {\n      ok: true\n      messageId: string\n      threadId: string\n      channelId: string\n      providerKey: string\n    }\n  | { ok: false; status: number; error: string; fieldErrors?: Record<string, string> }\n\n/**\n * In-process send-as-user facade.\n *\n * Validates the actor owns `userChannelId`, composes the Message via the\n * messages module command, persists the outbound MessageChannelLink + thread\n * mapping, and enqueues delivery. Returns a discriminated result instead of an\n * HTTP Response so it can be invoked both by the `/send-as-user` route and by\n * other modules via DI (`container.resolve('communicationChannelsSendAsUser')`)\n * \u2014 no HTTP self-call required.\n */\nexport async function sendAsUser(\n  container: AppContainer,\n  actor: SendAsUserActor,\n  input: SendAsUserInput,\n): Promise<SendAsUserResult> {\n  if (!input.body.plain && !input.body.html) {\n    return { ok: false, status: 422, error: 'Either body.plain or body.html is required' }\n  }\n  // Re-validate here (not only in the HTTP route's zod schema) because this\n  // facade is also reachable via DI; `input.to[0]` below would otherwise become\n  // `undefined` for an empty recipient list.\n  if (!Array.isArray(input.to) || input.to.length === 0) {\n    return { ok: false, status: 422, error: 'At least one recipient is required' }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const { tenantId } = actor\n  const organizationId = actor.organizationId\n  const dscope = { tenantId, organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id: input.userChannelId, tenantId, organizationId, deletedAt: null },\n    undefined,\n    dscope,\n  )\n  if (!channel) return { ok: false, status: 404, error: 'Channel not found' }\n  if (channel.userId !== actor.userId) {\n    return { ok: false, status: 403, error: 'You can only send through channels you own' }\n  }\n\n  // Hub mutation guard: map known non-deliverable states (`requires_reauth`,\n  // `disconnected`) to a 422 with field-level errors; other transitional states\n  // fall through to the 409 below.\n  try {\n    await guardOutboundCreate(em, { channelId: channel.id, scope: dscope })\n  } catch (err) {\n    if (err instanceof ChannelMutationBlockedError) {\n      return { ok: false, status: 422, error: err.message, fieldErrors: err.errors }\n    }\n    throw err\n  }\n  if (!channel.isActive || channel.status !== 'connected') {\n    return {\n      ok: false,\n      status: 409,\n      error: `Channel is in status '${channel.status}' (not connected)`,\n    }\n  }\n\n  // Create the Message via the messages module compose command. The outbound\n  // subscriber picks it up via `messages.message.sent` and routes through the\n  // adapter chain.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  const messageBody = input.body.plain ?? htmlToText(input.body.html ?? '')\n  const composeInput = {\n    type: `channel.${channel.providerKey}`,\n    visibility: 'public' as const,\n    sourceEntityType: 'communication_channels.send_as_user',\n    sourceEntityId: channel.id,\n    externalEmail: input.to[0],\n    externalName: input.subject,\n    recipients: [],\n    subject: input.subject,\n    body: messageBody,\n    bodyFormat: input.body.bodyFormat === 'markdown' ? ('markdown' as const) : ('text' as const),\n    priority: 'normal' as const,\n    sendViaEmail: false,\n    parentMessageId: input.parentMessageId,\n    isDraft: false,\n    tenantId,\n    organizationId,\n    userId: actor.userId,\n  }\n  let result\n  try {\n    result = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: {\n          container,\n          auth: actor.auth as never,\n          organizationScope: null,\n          selectedOrganizationId: organizationId,\n          organizationIds: organizationId ? [organizationId] : null,\n        },\n      },\n    )\n  } catch (err) {\n    logger.error('communication_channels send-as-user compose failed', { err })\n    return { ok: false, status: 500, error: '[internal] compose failed' }\n  }\n\n  const messageId = result.result.id\n  const messageThreadId = result.result.threadId ?? messageId\n  const externalThreadRef = `outbound:${messageThreadId}`\n\n  // Persist the conversation, thread mapping, and channel link as one unit. The\n  // conversation's id is DB-generated (`gen_random_uuid()`), so it must be\n  // flushed before the mapping/link can reference it \u2014 hence the eager flushes\n  // rather than `withAtomicFlush` (single trailing flush). `em.transactional`\n  // wraps the whole sequence so a mid-way failure rolls back all three writes\n  // instead of leaving an orphaned conversation row.\n  await em.transactional(async () => {\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        subject: input.subject,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n        lastMessageAt: new Date(),\n      })\n      em.persist(conversation)\n      await em.flush()\n    } else {\n      conversation.subject = conversation.subject ?? input.subject\n      conversation.assignedUserId = conversation.assignedUserId ?? actor.userId\n      conversation.lastMessageAt = new Date()\n      // Flush the scalar updates BEFORE the ChannelThreadMapping lookup below: a\n      // find/findOne on the same EntityManager between a scalar mutation and flush\n      // can silently drop the pending UPDATE (core AGENTS.md \u2192 Entity Update Safety).\n      await em.flush()\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!existingMapping) {\n      const mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId,\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        externalThreadRef,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n      })\n      em.persist(mapping)\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      messageId,\n      externalConversationId: conversation.id,\n      providerKey: channel.providerKey,\n      channelType: channel.channelType,\n      direction: 'outbound',\n      deliveryStatus: 'pending',\n      channelPayload: {\n        text: input.body.plain ?? messageBody,\n        ...(input.body.html ? { html: input.body.html } : {}),\n      },\n      channelContentType: input.body.html ? 'text/html' : 'text/plain',\n      channelMetadata: {\n        // Caller-supplied pass-through metadata merged FIRST so the validated\n        // routing fields below always win \u2014 a caller cannot override the\n        // recipients/subject/threading headers via `channelMetadata`.\n        ...(input.channelMetadata ?? {}),\n        to: input.to,\n        cc: input.cc ?? [],\n        bcc: input.bcc ?? [],\n        subject: input.subject,\n        inReplyTo: input.inReplyTo ?? null,\n        references: input.references ?? [],\n      },\n      tenantId,\n      organizationId,\n    })\n    em.persist(channelLink)\n    await em.flush()\n  })\n\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const deliveryJob: OutboundDeliveryPayload = {\n    messageId,\n    scope: dscope,\n    attempt: 1,\n  }\n  await queue.enqueue(deliveryJob as unknown as Record<string, unknown>)\n\n  return {\n    ok: true,\n    messageId,\n    threadId: messageThreadId,\n    channelId: channel.id,\n    providerKey: channel.providerKey,\n  }\n}\n\n/** DI service type for cross-module callers (resolve `communicationChannelsSendAsUser`). */\nexport type SendAsUserService = typeof sendAsUser\n"],
+  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B,2BAA2B;AACjE,SAAS,+BAA+B,qCAAqC;AAE7E,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB;AAwDpD,eAAsB,WACpB,WACA,OACA,OAC2B;AAC3B,MAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,KAAK,MAAM;AACzC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAIA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAE,KAAK,MAAM,GAAG,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,qCAAqC;AAAA,EAC/E;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,iBAAiB,MAAM;AAC7B,QAAM,SAAS,EAAE,UAAU,eAAe;AAE1C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,eAAe,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,oBAAoB;AAC1E,MAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAKA,MAAI;AACF,UAAM,oBAAoB,IAAI,EAAE,WAAW,QAAQ,IAAI,OAAO,OAAO,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,IAAI,SAAS,aAAa,IAAI,OAAO;AAAA,IAC/E;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,aAAa;AACvD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,OAAO,yBAAyB,QAAQ,MAAM;AAAA,IAChD;AAAA,EACF;AAKA,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,cAAc,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,QAAQ,EAAE;AACxE,QAAM,eAAe;AAAA,IACnB,MAAM,WAAW,QAAQ,WAAW;AAAA,IACpC,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,eAAe,MAAM,GAAG,CAAC;AAAA,IACzB,cAAc,MAAM;AAAA,IACpB,YAAY,CAAC;AAAA,IACb,SAAS,MAAM;AAAA,IACf,MAAM;AAAA,IACN,YAAY,MAAM,KAAK,eAAe,aAAc,aAAwB;AAAA,IAC5E,UAAU;AAAA,IACV,cAAc;AAAA,IACd,iBAAiB,MAAM;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,WAAW;AAAA,MACxB;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,4BAA4B;AAAA,EACtE;AAEA,QAAM,YAAY,OAAO,OAAO;AAChC,QAAM,kBAAkB,OAAO,OAAO,YAAY;AAClD,QAAM,oBAAoB,YAAY,eAAe;AAQrD,QAAM,GAAG,cAAc,YAAY;AACjC,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,eAAe,oBAAI,KAAK;AAAA,MAC1B,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,mBAAa,UAAU,aAAa,WAAW,MAAM;AACrD,mBAAa,iBAAiB,aAAa,kBAAkB,MAAM;AACnE,mBAAa,gBAAgB,oBAAI,KAAK;AAItC,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,YAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,QAC9C,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,MACF,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD;AAAA,MACA,wBAAwB,aAAa;AAAA,MACrC,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,QACd,MAAM,MAAM,KAAK,SAAS;AAAA,QAC1B,GAAI,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD;AAAA,MACA,oBAAoB,MAAM,KAAK,OAAO,cAAc;AAAA,MACpD,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIf,GAAI,MAAM,mBAAmB,CAAC;AAAA,QAC9B,IAAI,MAAM;AAAA,QACV,IAAI,MAAM,MAAM,CAAC;AAAA,QACjB,KAAK,MAAM,OAAO,CAAC;AAAA,QACnB,SAAS,MAAM;AAAA,QACf,WAAW,MAAM,aAAa;AAAA,QAC9B,YAAY,MAAM,cAAc,CAAC;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,WAAW;AACtB,UAAM,GAAG,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,cAAuC;AAAA,IAC3C;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,WAAiD;AAErE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,EACvB;AACF;",
   "names": []
 }

package/dist/modules/communication_channels/migrations/Migration20260825141000_communication_channels.js

@@ -0,0 +1,14 @@
+import { Migration } from "@mikro-orm/migrations";
+class Migration20260825141000_communication_channels extends Migration {
+  async up() {
+    this.addSql(`alter table "communication_channels" add column "visibility" text not null default 'private';`);
+    this.addSql(`update "communication_channels" set "visibility" = 'shared' where "user_id" is null;`);
+  }
+  async down() {
+    this.addSql(`alter table "communication_channels" drop column if exists "visibility";`);
+  }
+}
+export {
+  Migration20260825141000_communication_channels
+};
+//# sourceMappingURL=Migration20260825141000_communication_channels.js.map

package/dist/modules/communication_channels/migrations/Migration20260825141000_communication_channels.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/communication_channels/migrations/Migration20260825141000_communication_channels.ts"],
+  "sourcesContent": ["import { Migration } from '@mikro-orm/migrations';\n\nexport class Migration20260825141000_communication_channels extends Migration {\n\n  override async up(): Promise<void> {\n    this.addSql(`alter table \"communication_channels\" add column \"visibility\" text not null default 'private';`);\n\n    // MUST run in the same migration as the column addition.\n    //\n    // Tenant-scoped channels (`user_id IS NULL`) are shared by definition \u2014 that\n    // is what \"tenant-wide\" has always meant, and it is how every existing\n    // FCM/APNs/Expo push channel is configured. Landing the column with a bare\n    // DEFAULT 'private' would silently un-share all of them on deploy, which is\n    // an availability regression, not just a privacy one.\n    this.addSql(`update \"communication_channels\" set \"visibility\" = 'shared' where \"user_id\" is null;`);\n  }\n\n  override async down(): Promise<void> {\n    this.addSql(`alter table \"communication_channels\" drop column if exists \"visibility\";`);\n  }\n\n}\n"],
+  "mappings": "AAAA,SAAS,iBAAiB;AAEnB,MAAM,uDAAuD,UAAU;AAAA,EAE5E,MAAe,KAAoB;AACjC,SAAK,OAAO,+FAA+F;AAS3G,SAAK,OAAO,sFAAsF;AAAA,EACpG;AAAA,EAEA,MAAe,OAAsB;AACnC,SAAK,OAAO,0EAA0E;AAAA,EACxF;AAEF;",
+  "names": []
+}

package/dist/modules/communication_channels/setup.js

@@ -25,6 +25,7 @@ const setup = {
       "communication_channels.react",
       "communication_channels.assign",
       "communication_channels.connect_user_channel",
+      "communication_channels.share_own_channel",
       "communication_channels.connect_tenant_channel",
       "communication_channels.admin",
       "communication_channels.channel.import_history",
@@ -36,6 +37,7 @@ const setup = {
       "communication_channels.react",
       "communication_channels.assign",
       "communication_channels.connect_user_channel",
+      "communication_channels.share_own_channel",
       "communication_channels.connect_tenant_channel",
       "communication_channels.admin",
       "communication_channels.channel.import_history",
@@ -46,12 +48,14 @@ const setup = {
       "communication_channels.manage",
       "communication_channels.react",
       "communication_channels.assign",
-      "communication_channels.connect_user_channel"
+      "communication_channels.connect_user_channel",
+      "communication_channels.share_own_channel"
     ],
     employee: [
       "communication_channels.view",
       "communication_channels.react",
-      "communication_channels.connect_user_channel"
+      "communication_channels.connect_user_channel",
+      "communication_channels.share_own_channel"
     ]
   },
   async seedDefaults({ container, organizationId, tenantId }) {