@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/customers/lib/link-channel-message-handler.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/lib/link-channel-message-handler.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerEntity, CustomerInteraction } from '../data/entities'\nimport { findPeopleByAddresses, normalizeAddresses } from './findPeopleByAddresses'\nimport { emitCustomersEvent } from '../events'\nimport { INTERACTION_STATUS_COMPLETED } from './interactionStatus'\n\n/**\n * Shared implementation for the link-channel-message subscribers.\n *\n * The auto-discovery scanner requires a single string `event` value on each\n * subscriber file. Because we must handle both `communication_channels.message.received`\n * AND `.sent`, we use TWO thin subscriber files (link-channel-message-received.ts\n * and link-channel-message-sent.ts) that both delegate here.\n */\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Payload emitted by `communication_channels.message.received` and\n * `communication_channels.message.sent`.\n *\n * The canonical field is `channelLinkId` (as emitted by the hub). The alias\n * `messageChannelLinkId` is kept for test stubs and legacy compatibility.\n */\ntype LinkChannelMessagePayload = {\n  eventType?: string\n  /** UUID of the MessageChannelLink row (canonical hub field name). */\n  channelLinkId?: string\n  /** Alias used in some older stubs / test payloads. Prefer channelLinkId. */\n  messageChannelLinkId?: string\n  channelId?: string | null\n  tenantId?: string\n  organizationId?: string | null\n  providerKey?: string | null\n  direction?: 'inbound' | 'outbound' | null\n  /**\n   * The provider's own receive/send time, carried by the hub on the event\n   * (#6095). An ISO string when the event rode the queue, a Date for an\n   * in-process emit. Absent on events enqueued before the field existed and on\n   * adapters that supply no timestamp.\n   */\n  providerTimestamp?: string | Date | null\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst POSTGRES_UNIQUE_VIOLATION = '23505'\n\n// \u2500\u2500 Main handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport default async function handler(\n  payload: LinkChannelMessagePayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  // Resolve the link ID from either field name.\n  const linkId = payload?.channelLinkId ?? payload?.messageChannelLinkId\n  if (typeof linkId !== 'string' || !linkId) return\n\n  // Fail-closed when tenantId is missing \u2014 unscoped queries are unsafe.\n  if (typeof payload.tenantId !== 'string' || !payload.tenantId) return\n\n  const tenantId = payload.tenantId\n  const organizationId = payload.organizationId ?? null\n  // CustomerEntity and CustomerInteraction are organization-scoped. Without an\n  // organization id, fail closed instead of linking tenant-wide by email/thread.\n  if (!organizationId) return\n  const dscope = { tenantId, organizationId }\n\n  // em.fork() gives us an isolated identity map for this event.\n  const em = (ctx.resolve('em') as EntityManager).fork()\n\n  // \u2500\u2500 (1) Load the MessageChannelLink row \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The customers module MUST NOT import MessageChannelLink from the\n  // communication_channels module (cross-module ORM boundary rule in AGENTS.md).\n  // We use the entity class name as a string so MikroORM's identity map resolves\n  // it at runtime \u2014 the generated entity registry includes the hub's entities.\n  // Read through findOneWithDecryption so any encrypted columns on the hub\n  // entity are transparently decrypted (per the Encryption section in AGENTS.md).\n  const link = (await findOneWithDecryption(\n    em,\n    'MessageChannelLink' as any,\n    { id: linkId, tenantId, organizationId } as any,\n    undefined,\n    dscope,\n  )) as Record<string, unknown> | null\n\n  if (!link) return\n\n  const metaJson = (link.channelMetadata ?? null) as Record<string, unknown> | null\n  const payloadJson = (link.channelPayload ?? null) as Record<string, unknown> | null\n\n  // \u2500\u2500 (1b) Resolve when the email actually happened \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // `link.createdAt` is when the hub ingested the message, which for a history\n  // import is the import minute, not the day the mail arrived (#6095). The hub\n  // carries the provider's own timestamp on the event payload, so take it from\n  // there: reading the communication_channels ExternalMessage row here would\n  // cross the storage boundary (Cross-Module Coupling in AGENTS.md) and add a\n  // peer-table query per event. Resolved once and threaded through every branch\n  // below so the address-match and threading-inheritance paths agree.\n  const occurredAt = resolveOccurredAt(payload, link)\n\n  // \u2500\u2500 (2) Resolve the channel to get its owner userId \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The channel.userId is needed for two purposes:\n  //   - authorUserId on the CustomerInteraction row\n  //   - default visibility ('private' for user-scoped, 'shared' for tenant-scoped)\n  //\n  // We look up the channel only when channelId is provided in the event payload.\n  let channelUserId: string | null = null\n  if (typeof payload.channelId === 'string' && payload.channelId) {\n    const channel = (await findOneWithDecryption(\n      em,\n      'CommunicationChannel' as any,\n      { id: payload.channelId, tenantId, organizationId } as any,\n      undefined,\n      dscope,\n    )) as { userId?: string | null } | null\n    channelUserId = channel?.userId ?? null\n  }\n\n  // \u2500\u2500 (3) Collect recipient addresses \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The channel metadata shape differs by provider and direction:\n  //   - Outbound (Gmail): subject/to/cc/bcc/from are in channelMetadata\n  //     (merged from GmailEmailNativeMetadata by deliver-outbound-message.ts)\n  //   - Inbound (Gmail): from/to/cc/bcc/subject are in channelPayload\n  //     (from NormalizedInboundMessage.channelPayload)\n  //\n  // We check channelMetadata first (works for outbound + any provider that\n  // writes addresses there), then fall back to channelPayload for inbound.\n  const rawAddresses: unknown[] = []\n\n  // For inbound IMAP messages we ALWAYS read addresses from `channelPayload`,\n  // not `channelMetadata`. The IMAP adapter stores raw provider headers in\n  // `channelMetadata` (where `from` is a JSON-stringified string that's\n  // useless for address matching), and the structured normalized addresses\n  // in `channelPayload.from` / `.to` / `.cc` / `.bcc`. Reading metadata\n  // first poisoned `rawAddresses` with stringified-JSON garbage so the\n  // payload-fallback never ran.\n  //\n  // Priority: payloadJson (canonical normalized shape) \u2192 metaJson fallback\n  // (for legacy/outbound providers that still write addresses there).\n  if (payloadJson) {\n    collectAddressField(rawAddresses, payloadJson.from)\n    collectAddressField(rawAddresses, payloadJson.to)\n    collectAddressField(rawAddresses, payloadJson.cc)\n    collectAddressField(rawAddresses, payloadJson.bcc)\n  }\n\n  if (rawAddresses.length === 0 && metaJson) {\n    collectAddressField(rawAddresses, metaJson.from)\n    collectAddressField(rawAddresses, metaJson.to)\n    collectAddressField(rawAddresses, metaJson.cc)\n    collectAddressField(rawAddresses, metaJson.bcc)\n  }\n\n  const normalized = normalizeAddresses(rawAddresses as string[])\n\n  // \u2500\u2500 (4) Optional explicit crmPersonId hint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The outbound compose route stores `crmPersonId` in channelMetadata so the\n  // subscriber can link to the intended Person even if their address isn't in\n  // the recipient list (e.g. typo in To: field).\n  const crmPersonIdHint =\n    typeof metaJson?.crmPersonId === 'string' ? (metaJson!.crmPersonId as string) : null\n\n  // Defense-in-depth: the crmPersonId hint is written by the compose route\n  // (which already verifies tenant ownership), but the subscriber MUST re-verify\n  // the hinted Person belongs to THIS tenant before linking. Otherwise a stale or\n  // forged hint could attach an interaction to a Person in another tenant.\n  let crmPersonId: string | null = null\n  if (crmPersonIdHint) {\n    const hintedPerson = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      { id: crmPersonIdHint, kind: 'person', tenantId, organizationId, deletedAt: null } as any,\n      undefined,\n      dscope,\n    )\n    if (hintedPerson) crmPersonId = crmPersonIdHint\n  }\n\n  // Early exit: no addresses AND no hint \u2192 nothing to link.\n  if (normalized.length === 0 && !crmPersonId) {\n    // Before giving up, try threading-inheritance (TC-CRM-EMAIL-005).\n    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson, occurredAt)\n    return\n  }\n\n  // \u2500\u2500 (5) Resolve People by address \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const matched = await findPeopleByAddresses(em, normalized, tenantId, organizationId)\n  const personIdSet = new Set<string>(matched.map((m) => m.id))\n  if (crmPersonId) personIdSet.add(crmPersonId)\n\n  if (personIdSet.size === 0) {\n    // Try threading-inheritance before giving up.\n    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, metaJson, payloadJson, occurredAt)\n    return\n  }\n\n  // \u2500\u2500 (6) Determine visibility \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // Priority order:\n  //   1. Explicit `crmVisibility` in channelMetadata (set by compose route)\n  //   2. Channel owner: 'private' if user-scoped, 'shared' if tenant-scoped\n  const linkDirection =\n    link.direction === 'inbound' || link.direction === 'outbound' ? link.direction : null\n  const visibility: 'private' | 'shared' = resolveVisibility(metaJson, channelUserId, linkDirection)\n\n  // \u2500\u2500 (7) Extract subject / body / timestamps \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const subject =\n    typeof metaJson?.subject === 'string'\n      ? (metaJson!.subject as string)\n      : typeof payloadJson?.subject === 'string'\n        ? (payloadJson!.subject as string)\n        : null\n\n  const bodyText =\n    typeof metaJson?.bodyText === 'string'\n      ? (metaJson!.bodyText as string)\n      : typeof payloadJson?.text === 'string'\n        ? (payloadJson!.text as string)\n        : null\n\n  const providerKey =\n    typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n\n  // \u2500\u2500 (8) INSERT one CustomerInteraction per matched Person \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  await persistInteractions(\n    em,\n    personIdSet,\n    {\n      linkId,\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      title: subject,\n      body: bodyText,\n      authorUserId: channelUserId,\n      occurredAt,\n      visibility,\n      channelProviderKey: providerKey,\n    },\n  )\n}\n\n// \u2500\u2500 Threading-inheritance fallback \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * When direct address matching finds 0 people AND crmPersonId is absent, look\n * up parent message references from channelMetadata (`inReplyTo` + `references`).\n *\n * For each reference (an RFC2822 Message-ID), find a prior MessageChannelLink\n * in this tenant whose `channelMetadata.messageId` matches. For each such\n * parent link, find any existing email CustomerInteraction rows where\n * `externalMessageId = parent.id` \u2014 and link THIS message to the same Persons.\n *\n * This enables TC-CRM-EMAIL-005: a reply from an unknown address is still\n * attached to alice's timeline because the original thread was.\n */\nasync function handleThreadingInheritance(\n  em: EntityManager,\n  _link: Record<string, unknown>,\n  linkId: string,\n  tenantId: string,\n  organizationId: string | null,\n  channelUserId: string | null,\n  metaJson: Record<string, unknown> | null,\n  payloadJson: Record<string, unknown> | null,\n  occurredAt: Date,\n): Promise<void> {\n  // \u2500\u2500 Primary: inherit Person(s) from the hub's authoritative thread \u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The hub threads an inbound reply into the same `messages.message.thread_id`\n  // as the outbound that started the conversation (via the thread token /\n  // subject+participants matcher). That outbound is already linked to the CRM\n  // Person (through the `crmPersonId` hint set by the compose route). So a reply\n  // inherits the Person of any existing email interaction in the same thread.\n  //\n  // This is the dependable join where the alternatives are not:\n  //   - Address matching (`findPeopleByAddresses`) filters the *encrypted*\n  //     `primary_email` column by a plaintext value, which never matches when\n  //     tenant data encryption is on (ciphertext != plaintext).\n  //   - RFC Message-IDs are rewritten by some providers (e.g. Gmail) on send,\n  //     so the legacy In-Reply-To/References inheritance below also misses.\n  // The hub thread id survives both, so we resolve by it first.\n  const inboundMessageId = typeof _link.messageId === 'string' ? _link.messageId : null\n  if (inboundMessageId && organizationId) {\n    const threadPersonRows = (await em.getConnection().execute(\n      `SELECT DISTINCT ci.entity_id AS entity_id\n       FROM messages inbound_m\n       JOIN messages thread_m ON thread_m.thread_id = inbound_m.thread_id\n       JOIN message_channel_links mcl ON mcl.message_id = thread_m.id\n       JOIN customer_interactions ci ON ci.external_message_id = mcl.id\n       WHERE inbound_m.id = ?\n         AND inbound_m.tenant_id = ?\n         AND inbound_m.organization_id = ?\n         AND inbound_m.deleted_at IS NULL\n         AND inbound_m.thread_id IS NOT NULL\n         AND thread_m.tenant_id = ?\n         AND thread_m.organization_id = ?\n         AND thread_m.deleted_at IS NULL\n         AND mcl.tenant_id = ?\n         AND mcl.organization_id = ?\n         AND ci.tenant_id = ?\n         AND ci.organization_id = ?\n         AND ci.interaction_type = 'email'\n         AND ci.deleted_at IS NULL\n         AND ci.entity_id IS NOT NULL\n       LIMIT 200`,\n      [\n        inboundMessageId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n      ],\n    )) as Array<{ entity_id: string }>\n    const threadPersonIds = new Set<string>(\n      threadPersonRows.map((row) => row.entity_id).filter((id): id is string => !!id),\n    )\n    if (threadPersonIds.size > 0) {\n      const subject =\n        typeof metaJson?.subject === 'string'\n          ? (metaJson.subject as string)\n          : typeof payloadJson?.subject === 'string'\n            ? (payloadJson.subject as string)\n            : null\n      const bodyText =\n        typeof payloadJson?.text === 'string'\n          ? (payloadJson.text as string)\n          : typeof metaJson?.bodyText === 'string'\n            ? (metaJson.bodyText as string)\n            : null\n      const providerKey = typeof _link.providerKey === 'string' ? (_link.providerKey as string) : null\n      await persistInteractions(em, threadPersonIds, {\n        linkId,\n        tenantId,\n        organizationId,\n        interactionType: 'email',\n        title: subject,\n        body: bodyText,\n        authorUserId: channelUserId,\n        occurredAt,\n        visibility: channelUserId ? 'private' : 'shared',\n        channelProviderKey: providerKey,\n      })\n      return\n    }\n  }\n\n  // \u2500\u2500 Fallback: legacy In-Reply-To / References Message-ID inheritance \u2500\u2500\u2500\u2500\u2500\n  // Collect reference message-ids from inReplyTo + references\n  const refIds: string[] = []\n  const inReplyTo =\n    typeof metaJson?.inReplyTo === 'string'\n      ? stripBrackets(metaJson!.inReplyTo as string)\n      : typeof payloadJson?.inReplyTo === 'string'\n        ? stripBrackets(payloadJson!.inReplyTo as string)\n        : null\n  if (inReplyTo) refIds.push(inReplyTo)\n\n  const refs =\n    Array.isArray(metaJson?.references)\n      ? (metaJson!.references as unknown[])\n      : Array.isArray(payloadJson?.references)\n        ? (payloadJson!.references as unknown[])\n        : []\n  for (const r of refs) {\n    if (typeof r === 'string') {\n      const stripped = stripBrackets(r)\n      if (stripped && !refIds.includes(stripped)) refIds.push(stripped)\n    }\n  }\n\n  if (refIds.length === 0) return\n\n  // Find parent MessageChannelLinks whose channelMetadata.messageId is in refIds.\n  // Bounded lookup: narrow to the candidate Message-IDs directly in SQL instead\n  // of loading every link in the tenant and filtering in JS (which does not scale\n  // on a busy mailbox \u2014 this path runs for every inbound reply that didn't match a\n  // Person by address). channel_metadata is NOT an encrypted column, so a\n  // parameterized raw query is safe; we match both bracketed (`<id>`) and\n  // unbracketed (`id`) Message-ID storage forms, capped to a sane page.\n  const dscope = { tenantId, organizationId }\n  const messageIdCandidates = Array.from(\n    new Set(refIds.flatMap((ref) => [ref, `<${ref}>`])),\n  )\n  const placeholders = messageIdCandidates.map(() => '?').join(', ')\n  const parentLinkRows = (await em.getConnection().execute(\n    `SELECT id FROM message_channel_links\n     WHERE tenant_id = ?\n       AND organization_id = ?\n       AND channel_metadata->>'messageId' IN (${placeholders})\n     LIMIT 200`,\n    [tenantId, organizationId, ...messageIdCandidates],\n  )) as Array<{ id: string }>\n\n  const matchedParentIds = parentLinkRows.map((parentLink) => parentLink.id)\n\n  if (matchedParentIds.length === 0) return\n\n  // Find existing email CustomerInteraction rows for those parent links.\n  const parentInteractions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    {\n      externalMessageId: { $in: matchedParentIds },\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      deletedAt: null,\n    } as any,\n    undefined,\n    dscope,\n  )) as Array<{ entity: { id: string } }>\n\n  const inheritedPersonIdSet = new Set<string>(\n    parentInteractions.map((pi) => pi.entity?.id).filter(Boolean) as string[],\n  )\n\n  if (inheritedPersonIdSet.size === 0) return\n\n  const visibility: 'private' | 'shared' = channelUserId ? 'private' : 'shared'\n  const link = _link\n  const inheritedMeta = (link.channelMetadata ?? null) as Record<string, unknown> | null\n  const subject =\n    typeof inheritedMeta?.subject === 'string' ? (inheritedMeta.subject as string) : null\n  const providerKey =\n    typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n\n  await persistInteractions(\n    em,\n    inheritedPersonIdSet,\n    {\n      linkId,\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      title: subject,\n      body: null,\n      authorUserId: channelUserId,\n      occurredAt,\n      visibility,\n      channelProviderKey: providerKey,\n    },\n  )\n}\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * When the linked email happened, for `CustomerInteraction.occurredAt` (#6095).\n *\n * Preference order:\n *   1. `payload.providerTimestamp` \u2014 the provider's own receive/send time, put\n *      on the hub event by ingest / delivery;\n *   2. `MessageChannelLink.createdAt` \u2014 the ingest time, the only date this\n *      handler knew before #6095, and the compatibility path for events that\n *      were enqueued before the field existed;\n *   3. now, for a link row with no usable `createdAt` (test stubs).\n */\nfunction resolveOccurredAt(\n  payload: LinkChannelMessagePayload,\n  link: Record<string, unknown>,\n): Date {\n  const ingestedAt = link.createdAt instanceof Date ? link.createdAt : new Date()\n  const carried = payload.providerTimestamp\n  if (carried instanceof Date) {\n    return Number.isNaN(carried.getTime()) ? ingestedAt : carried\n  }\n  if (typeof carried === 'string' && carried) {\n    const parsed = new Date(carried)\n    if (!Number.isNaN(parsed.getTime())) return parsed\n  }\n  return ingestedAt\n}\n\ninterface InteractionData {\n  linkId: string\n  tenantId: string\n  organizationId: string | null\n  interactionType: string\n  title: string | null\n  body: string | null\n  authorUserId: string | null\n  occurredAt: Date\n  visibility: 'private' | 'shared'\n  channelProviderKey: string | null\n}\n\nasync function persistInteractions(\n  em: EntityManager,\n  personIdSet: Set<string>,\n  data: InteractionData,\n): Promise<void> {\n  for (const personId of personIdSet) {\n    // Fork per row so a unique-violation on one row doesn't poison the identity\n    // map for subsequent rows. The parent em's connection pool is reused.\n    const rowEm = em.fork()\n    // Use em.getReference so we satisfy the ManyToOne relation without a\n    // redundant SELECT \u2014 MikroORM will flush the FK column directly.\n    const entityRef = rowEm.getReference(CustomerEntity, personId)\n    const interaction = rowEm.create(CustomerInteraction, {\n      tenantId: data.tenantId,\n      organizationId: data.organizationId,\n      entity: entityRef,\n      interactionType: data.interactionType,\n      title: data.title,\n      body: data.body,\n      authorUserId: data.authorUserId,\n      occurredAt: data.occurredAt,\n      // Emails are logged AFTER they're sent/received \u2014 they are not\n      // scheduled work. Without an explicit status the entity default\n      // ('planned') combined with a past `occurredAt` makes the activity\n      // timeline render the email as \"overdue\", which is the wrong UX.\n      // The canonical terminal-success value is `INTERACTION_STATUS_COMPLETED`\n      // ('done'); see `lib/interactionStatus.ts` for the open/terminal semantics.\n      status: INTERACTION_STATUS_COMPLETED,\n      externalMessageId: data.linkId,\n      visibility: data.visibility,\n      channelProviderKey: data.channelProviderKey,\n    } as any)\n    try {\n      await rowEm.flush()\n    } catch (err) {\n      // Idempotency: swallow unique-violation on (entity_id, external_message_id).\n      // The partial unique index `customer_interactions_email_dedupe_uq` guarantees\n      // at-most-once semantics across retries.\n      const code = (err as { code?: string }).code\n      if (code !== POSTGRES_UNIQUE_VIOLATION) throw err\n      // Duplicate (retried delivery) \u2014 already linked, skip the refresh signal.\n      continue\n    }\n    // Live-refresh signal for the CRM Person page (clientBroadcast \u2192 SSE). The\n    // interaction is already persisted, so a failed emit must not abort linking\n    // or fail this persistent (retried) subscriber.\n    try {\n      await emitCustomersEvent('customers.email.linked', {\n        personId,\n        interactionId: interaction.id,\n        tenantId: data.tenantId,\n        organizationId: data.organizationId,\n      })\n    } catch {\n      /* swallow \u2014 UI refresh signal is non-critical */\n    }\n  }\n}\n\nfunction resolveVisibility(\n  metaJson: Record<string, unknown> | null,\n  channelUserId: string | null,\n  direction: 'inbound' | 'outbound' | null,\n): 'private' | 'shared' {\n  // The explicit `crmVisibility` override is written ONLY by the outbound compose\n  // route. Inbound `channelMetadata` is provider-derived (and therefore attacker-\n  // influenceable), so it MUST NOT be able to downgrade a user-owned channel's\n  // inbound mail from private \u2192 shared. Honor the override on outbound only.\n  if (direction === 'outbound') {\n    if (metaJson?.crmVisibility === 'shared') return 'shared'\n    if (metaJson?.crmVisibility === 'private') return 'private'\n  }\n  // Tenant-scoped channels (no userId) \u2192 shared; user-scoped \u2192 private.\n  return channelUserId ? 'private' : 'shared'\n}\n\n/**\n * Collect email address strings from a field that may be:\n *   - a plain string: 'alice@example.com'\n *   - an array of strings: ['alice@example.com', 'bob@example.com']\n *   - an object with an `address` property: { address: 'alice@example.com', name: 'Alice' }\n *   - an array of such objects\n */\nfunction collectAddressField(out: unknown[], value: unknown): void {\n  if (!value) return\n  if (typeof value === 'string') {\n    out.push(value)\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      if (typeof item === 'string') {\n        out.push(item)\n      } else if (item && typeof item === 'object' && typeof (item as Record<string, unknown>).address === 'string') {\n        out.push((item as Record<string, unknown>).address as string)\n      }\n    }\n    return\n  }\n  if (typeof value === 'object' && typeof (value as Record<string, unknown>).address === 'string') {\n    out.push((value as Record<string, unknown>).address as string)\n  }\n}\n\nfunction stripBrackets(value: string): string {\n  const trimmed = value.trim()\n  if (trimmed.startsWith('<') && trimmed.endsWith('>')) {\n    return trimmed.slice(1, -1)\n  }\n  return trimmed\n}\n"],
-  "mappings": "AACA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,gBAAgB,2BAA2B;AACpD,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,0BAA0B;AACnC,SAAS,oCAAoC;AA8C7C,MAAM,4BAA4B;AAIlC,eAAO,QACL,SACA,KACe;AAEf,QAAM,SAAS,SAAS,iBAAiB,SAAS;AAClD,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ;AAG3C,MAAI,OAAO,QAAQ,aAAa,YAAY,CAAC,QAAQ,SAAU;AAE/D,QAAM,WAAW,QAAQ;AACzB,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS,EAAE,UAAU,eAAe;AAG1C,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AAUrD,QAAM,OAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,UAAU,eAAe;AAAA,IACvC;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,KAAM;AAEX,QAAM,WAAY,KAAK,mBAAmB;AAC1C,QAAM,cAAe,KAAK,kBAAkB;AAW5C,QAAM,aAAa,kBAAkB,SAAS,IAAI;AASlD,MAAI,gBAA+B;AACnC,MAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,WAAW;AAC9D,UAAM,UAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,UAAU,eAAe;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AACA,oBAAgB,SAAS,UAAU;AAAA,EACrC;AAYA,QAAM,eAA0B,CAAC;AAYjC,MAAI,aAAa;AACf,wBAAoB,cAAc,YAAY,IAAI;AAClD,wBAAoB,cAAc,YAAY,EAAE;AAChD,wBAAoB,cAAc,YAAY,EAAE;AAChD,wBAAoB,cAAc,YAAY,GAAG;AAAA,EACnD;AAEA,MAAI,aAAa,WAAW,KAAK,UAAU;AACzC,wBAAoB,cAAc,SAAS,IAAI;AAC/C,wBAAoB,cAAc,SAAS,EAAE;AAC7C,wBAAoB,cAAc,SAAS,EAAE;AAC7C,wBAAoB,cAAc,SAAS,GAAG;AAAA,EAChD;AAEA,QAAM,aAAa,mBAAmB,YAAwB;AAO9D,QAAM,kBACJ,OAAO,UAAU,gBAAgB,WAAY,SAAU,cAAyB;AAMlF,MAAI,cAA6B;AACjC,MAAI,iBAAiB;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,iBAAiB,MAAM,UAAU,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACjF;AAAA,MACA;AAAA,IACF;AACA,QAAI,aAAc,eAAc;AAAA,EAClC;AAGA,MAAI,WAAW,WAAW,KAAK,CAAC,aAAa;AAE3C,UAAM,2BAA2B,IAAI,MAAM,QAAQ,UAAU,gBAAgB,eAAe,UAAU,aAAa,UAAU;AAC7H;AAAA,EACF;AAGA,QAAM,UAAU,MAAM,sBAAsB,IAAI,YAAY,UAAU,cAAc;AACpF,QAAM,cAAc,IAAI,IAAY,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAC5D,MAAI,YAAa,aAAY,IAAI,WAAW;AAE5C,MAAI,YAAY,SAAS,GAAG;AAE1B,UAAM,2BAA2B,IAAI,MAAM,QAAQ,UAAU,gBAAgB,eAAe,UAAU,aAAa,UAAU;AAC7H;AAAA,EACF;AAOA,QAAM,gBACJ,KAAK,cAAc,aAAa,KAAK,cAAc,aAAa,KAAK,YAAY;AACnF,QAAM,aAAmC,kBAAkB,UAAU,eAAe,aAAa;AAGjG,QAAM,UACJ,OAAO,UAAU,YAAY,WACxB,SAAU,UACX,OAAO,aAAa,YAAY,WAC7B,YAAa,UACd;AAER,QAAM,WACJ,OAAO,UAAU,aAAa,WACzB,SAAU,WACX,OAAO,aAAa,SAAS,WAC1B,YAAa,OACd;AAER,QAAM,cACJ,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAGxE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;AAgBA,eAAe,2BACb,IACA,OACA,QACA,UACA,gBACA,eACA,UACA,aACA,YACe;AAgBf,QAAM,mBAAmB,OAAO,MAAM,cAAc,WAAW,MAAM,YAAY;AACjF,MAAI,oBAAoB,gBAAgB;AACtC,UAAM,mBAAoB,MAAM,GAAG,cAAc,EAAE;AAAA,MACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAqBA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,kBAAkB,IAAI;AAAA,MAC1B,iBAAiB,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,OAAO,CAAC,OAAqB,CAAC,CAAC,EAAE;AAAA,IAChF;AACA,QAAI,gBAAgB,OAAO,GAAG;AAC5B,YAAMA,WACJ,OAAO,UAAU,YAAY,WACxB,SAAS,UACV,OAAO,aAAa,YAAY,WAC7B,YAAY,UACb;AACR,YAAM,WACJ,OAAO,aAAa,SAAS,WACxB,YAAY,OACb,OAAO,UAAU,aAAa,WAC3B,SAAS,WACV;AACR,YAAMC,eAAc,OAAO,MAAM,gBAAgB,WAAY,MAAM,cAAyB;AAC5F,YAAM,oBAAoB,IAAI,iBAAiB;AAAA,QAC7C;AAAA,QACA;AAAA,QACA;AAAA,QACA,iBAAiB;AAAA,QACjB,OAAOD;AAAA,QACP,MAAM;AAAA,QACN,cAAc;AAAA,QACd;AAAA,QACA,YAAY,gBAAgB,YAAY;AAAA,QACxC,oBAAoBC;AAAA,MACtB,CAAC;AACD;AAAA,IACF;AAAA,EACF;AAIA,QAAM,SAAmB,CAAC;AAC1B,QAAM,YACJ,OAAO,UAAU,cAAc,WAC3B,cAAc,SAAU,SAAmB,IAC3C,OAAO,aAAa,cAAc,WAChC,cAAc,YAAa,SAAmB,IAC9C;AACR,MAAI,UAAW,QAAO,KAAK,SAAS;AAEpC,QAAM,OACJ,MAAM,QAAQ,UAAU,UAAU,IAC7B,SAAU,aACX,MAAM,QAAQ,aAAa,UAAU,IAClC,YAAa,aACd,CAAC;AACT,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,WAAW,cAAc,CAAC;AAChC,UAAI,YAAY,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO,KAAK,QAAQ;AAAA,IAClE;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,EAAG;AASzB,QAAM,SAAS,EAAE,UAAU,eAAe;AAC1C,QAAM,sBAAsB,MAAM;AAAA,IAChC,IAAI,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,CAAC;AAAA,EACpD;AACA,QAAM,eAAe,oBAAoB,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACjE,QAAM,iBAAkB,MAAM,GAAG,cAAc,EAAE;AAAA,IAC/C;AAAA;AAAA;AAAA,gDAG4C,YAAY;AAAA;AAAA,IAExD,CAAC,UAAU,gBAAgB,GAAG,mBAAmB;AAAA,EACnD;AAEA,QAAM,mBAAmB,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE;AAEzE,MAAI,iBAAiB,WAAW,EAAG;AAGnC,QAAM,qBAAsB,MAAM;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,MACE,mBAAmB,EAAE,KAAK,iBAAiB;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,IAAI;AAAA,IAC/B,mBAAmB,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,OAAO,OAAO;AAAA,EAC9D;AAEA,MAAI,qBAAqB,SAAS,EAAG;AAErC,QAAM,aAAmC,gBAAgB,YAAY;AACrE,QAAM,OAAO;AACb,QAAM,gBAAiB,KAAK,mBAAmB;AAC/C,QAAM,UACJ,OAAO,eAAe,YAAY,WAAY,cAAc,UAAqB;AACnF,QAAM,cACJ,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAExE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,IACtB;AAAA,EACF;AACF;AAeA,SAAS,kBACP,SACA,MACM;AACN,QAAM,aAAa,KAAK,qBAAqB,OAAO,KAAK,YAAY,oBAAI,KAAK;AAC9E,QAAM,UAAU,QAAQ;AACxB,MAAI,mBAAmB,MAAM;AAC3B,WAAO,OAAO,MAAM,QAAQ,QAAQ,CAAC,IAAI,aAAa;AAAA,EACxD;AACA,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,UAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,QAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,EAC9C;AACA,SAAO;AACT;AAeA,eAAe,oBACb,IACA,aACA,MACe;AACf,aAAW,YAAY,aAAa;AAGlC,UAAM,QAAQ,GAAG,KAAK;AAGtB,UAAM,YAAY,MAAM,aAAa,gBAAgB,QAAQ;AAC7D,UAAM,cAAc,MAAM,OAAO,qBAAqB;AAAA,MACpD,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ;AAAA,MACR,iBAAiB,KAAK;AAAA,MACtB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOjB,QAAQ;AAAA,MACR,mBAAmB,KAAK;AAAA,MACxB,YAAY,KAAK;AAAA,MACjB,oBAAoB,KAAK;AAAA,IAC3B,CAAQ;AACR,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,IACpB,SAAS,KAAK;AAIZ,YAAM,OAAQ,IAA0B;AACxC,UAAI,SAAS,0BAA2B,OAAM;AAE9C;AAAA,IACF;AAIA,QAAI;AACF,YAAM,mBAAmB,0BAA0B;AAAA,QACjD;AAAA,QACA,eAAe,YAAY;AAAA,QAC3B,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,kBACP,UACA,eACA,WACsB;AAKtB,MAAI,cAAc,YAAY;AAC5B,QAAI,UAAU,kBAAkB,SAAU,QAAO;AACjD,QAAI,UAAU,kBAAkB,UAAW,QAAO;AAAA,EACpD;AAEA,SAAO,gBAAgB,YAAY;AACrC;AASA,SAAS,oBAAoB,KAAgB,OAAsB;AACjE,MAAI,CAAC,MAAO;AACZ,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,KAAK;AACd;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,OAAO,SAAS,UAAU;AAC5B,YAAI,KAAK,IAAI;AAAA,MACf,WAAW,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,YAAY,UAAU;AAC5G,YAAI,KAAM,KAAiC,OAAiB;AAAA,MAC9D;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,OAAQ,MAAkC,YAAY,UAAU;AAC/F,QAAI,KAAM,MAAkC,OAAiB;AAAA,EAC/D;AACF;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,WAAO,QAAQ,MAAM,GAAG,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerEntity, CustomerInteraction } from '../data/entities'\nimport { findPeopleByAddresses, normalizeAddresses } from './findPeopleByAddresses'\nimport { emitCustomersEvent } from '../events'\nimport { INTERACTION_STATUS_COMPLETED } from './interactionStatus'\n\n/**\n * Shared implementation for the link-channel-message subscribers.\n *\n * The auto-discovery scanner requires a single string `event` value on each\n * subscriber file. Because we must handle both `communication_channels.message.received`\n * AND `.sent`, we use TWO thin subscriber files (link-channel-message-received.ts\n * and link-channel-message-sent.ts) that both delegate here.\n */\n\n// \u2500\u2500 Types \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Payload emitted by `communication_channels.message.received` and\n * `communication_channels.message.sent`.\n *\n * The canonical field is `channelLinkId` (as emitted by the hub). The alias\n * `messageChannelLinkId` is kept for test stubs and legacy compatibility.\n */\ntype LinkChannelMessagePayload = {\n  eventType?: string\n  /** UUID of the MessageChannelLink row (canonical hub field name). */\n  channelLinkId?: string\n  /** Alias used in some older stubs / test payloads. Prefer channelLinkId. */\n  messageChannelLinkId?: string\n  channelId?: string | null\n  tenantId?: string\n  organizationId?: string | null\n  providerKey?: string | null\n  direction?: 'inbound' | 'outbound' | null\n  /**\n   * The provider's own receive/send time, carried by the hub on the event\n   * (#6095). An ISO string when the event rode the queue, a Date for an\n   * in-process emit. Absent on events enqueued before the field existed and on\n   * adapters that supply no timestamp.\n   */\n  providerTimestamp?: string | Date | null\n}\n\ntype SubscriberContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\n// \u2500\u2500 Constants \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nconst POSTGRES_UNIQUE_VIOLATION = '23505'\n\n// \u2500\u2500 Main handler \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport default async function handler(\n  payload: LinkChannelMessagePayload,\n  ctx: SubscriberContext,\n): Promise<void> {\n  // Resolve the link ID from either field name.\n  const linkId = payload?.channelLinkId ?? payload?.messageChannelLinkId\n  if (typeof linkId !== 'string' || !linkId) return\n\n  // Fail-closed when tenantId is missing \u2014 unscoped queries are unsafe.\n  if (typeof payload.tenantId !== 'string' || !payload.tenantId) return\n\n  const tenantId = payload.tenantId\n  const organizationId = payload.organizationId ?? null\n  // CustomerEntity and CustomerInteraction are organization-scoped. Without an\n  // organization id, fail closed instead of linking tenant-wide by email/thread.\n  if (!organizationId) return\n  const dscope = { tenantId, organizationId }\n\n  // em.fork() gives us an isolated identity map for this event.\n  const em = (ctx.resolve('em') as EntityManager).fork()\n\n  // \u2500\u2500 (1) Load the MessageChannelLink row \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The customers module MUST NOT import MessageChannelLink from the\n  // communication_channels module (cross-module ORM boundary rule in AGENTS.md).\n  // We use the entity class name as a string so MikroORM's identity map resolves\n  // it at runtime \u2014 the generated entity registry includes the hub's entities.\n  // Read through findOneWithDecryption so any encrypted columns on the hub\n  // entity are transparently decrypted (per the Encryption section in AGENTS.md).\n  const link = (await findOneWithDecryption(\n    em,\n    'MessageChannelLink' as any,\n    { id: linkId, tenantId, organizationId } as any,\n    undefined,\n    dscope,\n  )) as Record<string, unknown> | null\n\n  if (!link) return\n\n  const metaJson = (link.channelMetadata ?? null) as Record<string, unknown> | null\n  const payloadJson = (link.channelPayload ?? null) as Record<string, unknown> | null\n\n  // \u2500\u2500 (1b) Resolve when the email actually happened \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // `link.createdAt` is when the hub ingested the message, which for a history\n  // import is the import minute, not the day the mail arrived (#6095). The hub\n  // carries the provider's own timestamp on the event payload, so take it from\n  // there: reading the communication_channels ExternalMessage row here would\n  // cross the storage boundary (Cross-Module Coupling in AGENTS.md) and add a\n  // peer-table query per event. Resolved once and threaded through every branch\n  // below so the address-match and threading-inheritance paths agree.\n  const occurredAt = resolveOccurredAt(payload, link)\n\n  // \u2500\u2500 (2) Resolve the channel to get its owner userId \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The channel.userId is needed for two purposes:\n  //   - authorUserId on the CustomerInteraction row\n  //   - default visibility ('private' for user-scoped, 'shared' for tenant-scoped)\n  //\n  // We look up the channel only when channelId is provided in the event payload.\n  let channelUserId: string | null = null\n  // Denormalized onto each interaction so a read path can ask \"is this row's\n  // channel shared?\" without a three-join hop. NULL when the event carried no\n  // channelId \u2014 every predicate treats that as not shared (fail closed).\n  const resolvedChannelId: string | null =\n    typeof payload.channelId === 'string' && payload.channelId ? payload.channelId : null\n  if (typeof payload.channelId === 'string' && payload.channelId) {\n    const channel = (await findOneWithDecryption(\n      em,\n      'CommunicationChannel' as any,\n      { id: payload.channelId, tenantId, organizationId } as any,\n      undefined,\n      dscope,\n    )) as { userId?: string | null } | null\n    channelUserId = channel?.userId ?? null\n  }\n\n  // \u2500\u2500 (3) Collect recipient addresses \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The channel metadata shape differs by provider and direction:\n  //   - Outbound (Gmail): subject/to/cc/bcc/from are in channelMetadata\n  //     (merged from GmailEmailNativeMetadata by deliver-outbound-message.ts)\n  //   - Inbound (Gmail): from/to/cc/bcc/subject are in channelPayload\n  //     (from NormalizedInboundMessage.channelPayload)\n  //\n  // We check channelMetadata first (works for outbound + any provider that\n  // writes addresses there), then fall back to channelPayload for inbound.\n  const rawAddresses: unknown[] = []\n\n  // For inbound IMAP messages we ALWAYS read addresses from `channelPayload`,\n  // not `channelMetadata`. The IMAP adapter stores raw provider headers in\n  // `channelMetadata` (where `from` is a JSON-stringified string that's\n  // useless for address matching), and the structured normalized addresses\n  // in `channelPayload.from` / `.to` / `.cc` / `.bcc`. Reading metadata\n  // first poisoned `rawAddresses` with stringified-JSON garbage so the\n  // payload-fallback never ran.\n  //\n  // Priority: payloadJson (canonical normalized shape) \u2192 metaJson fallback\n  // (for legacy/outbound providers that still write addresses there).\n  if (payloadJson) {\n    collectAddressField(rawAddresses, payloadJson.from)\n    collectAddressField(rawAddresses, payloadJson.to)\n    collectAddressField(rawAddresses, payloadJson.cc)\n    collectAddressField(rawAddresses, payloadJson.bcc)\n  }\n\n  if (rawAddresses.length === 0 && metaJson) {\n    collectAddressField(rawAddresses, metaJson.from)\n    collectAddressField(rawAddresses, metaJson.to)\n    collectAddressField(rawAddresses, metaJson.cc)\n    collectAddressField(rawAddresses, metaJson.bcc)\n  }\n\n  const normalized = normalizeAddresses(rawAddresses as string[])\n\n  // \u2500\u2500 (4) Optional explicit crmPersonId hint \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The outbound compose route stores `crmPersonId` in channelMetadata so the\n  // subscriber can link to the intended Person even if their address isn't in\n  // the recipient list (e.g. typo in To: field).\n  const crmPersonIdHint =\n    typeof metaJson?.crmPersonId === 'string' ? (metaJson!.crmPersonId as string) : null\n\n  // Defense-in-depth: the crmPersonId hint is written by the compose route\n  // (which already verifies tenant ownership), but the subscriber MUST re-verify\n  // the hinted Person belongs to THIS tenant before linking. Otherwise a stale or\n  // forged hint could attach an interaction to a Person in another tenant.\n  let crmPersonId: string | null = null\n  if (crmPersonIdHint) {\n    const hintedPerson = await findOneWithDecryption(\n      em,\n      CustomerEntity,\n      { id: crmPersonIdHint, kind: 'person', tenantId, organizationId, deletedAt: null } as any,\n      undefined,\n      dscope,\n    )\n    if (hintedPerson) crmPersonId = crmPersonIdHint\n  }\n\n  // Early exit: no addresses AND no hint \u2192 nothing to link.\n  if (normalized.length === 0 && !crmPersonId) {\n    // Before giving up, try threading-inheritance (TC-CRM-EMAIL-005).\n    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, resolvedChannelId, metaJson, payloadJson, occurredAt)\n    return\n  }\n\n  // \u2500\u2500 (5) Resolve People by address \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const matched = await findPeopleByAddresses(em, normalized, tenantId, organizationId)\n  const personIdSet = new Set<string>(matched.map((m) => m.id))\n  if (crmPersonId) personIdSet.add(crmPersonId)\n\n  if (personIdSet.size === 0) {\n    // Try threading-inheritance before giving up.\n    await handleThreadingInheritance(em, link, linkId, tenantId, organizationId, channelUserId, resolvedChannelId, metaJson, payloadJson, occurredAt)\n    return\n  }\n\n  // \u2500\u2500 (6) Determine visibility \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // Priority order:\n  //   1. Explicit `crmVisibility` in channelMetadata (set by compose route)\n  //   2. Channel owner: 'private' if user-scoped, 'shared' if tenant-scoped\n  const linkDirection =\n    link.direction === 'inbound' || link.direction === 'outbound' ? link.direction : null\n  const visibility: 'private' | 'shared' = resolveVisibility(metaJson, channelUserId, linkDirection)\n\n  // \u2500\u2500 (7) Extract subject / body / timestamps \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const subject =\n    typeof metaJson?.subject === 'string'\n      ? (metaJson!.subject as string)\n      : typeof payloadJson?.subject === 'string'\n        ? (payloadJson!.subject as string)\n        : null\n\n  const bodyText =\n    typeof metaJson?.bodyText === 'string'\n      ? (metaJson!.bodyText as string)\n      : typeof payloadJson?.text === 'string'\n        ? (payloadJson!.text as string)\n        : null\n\n  const providerKey =\n    typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n\n  // \u2500\u2500 (8) INSERT one CustomerInteraction per matched Person \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  await persistInteractions(\n    em,\n    personIdSet,\n    {\n      linkId,\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      title: subject,\n      body: bodyText,\n      authorUserId: channelUserId,\n      occurredAt,\n      visibility,\n      channelProviderKey: providerKey,\n      channelId: resolvedChannelId,\n    },\n  )\n}\n\n// \u2500\u2500 Threading-inheritance fallback \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * When direct address matching finds 0 people AND crmPersonId is absent, look\n * up parent message references from channelMetadata (`inReplyTo` + `references`).\n *\n * For each reference (an RFC2822 Message-ID), find a prior MessageChannelLink\n * in this tenant whose `channelMetadata.messageId` matches. For each such\n * parent link, find any existing email CustomerInteraction rows where\n * `externalMessageId = parent.id` \u2014 and link THIS message to the same Persons.\n *\n * This enables TC-CRM-EMAIL-005: a reply from an unknown address is still\n * attached to alice's timeline because the original thread was.\n */\nasync function handleThreadingInheritance(\n  em: EntityManager,\n  _link: Record<string, unknown>,\n  linkId: string,\n  tenantId: string,\n  organizationId: string | null,\n  channelUserId: string | null,\n  channelId: string | null,\n  metaJson: Record<string, unknown> | null,\n  payloadJson: Record<string, unknown> | null,\n  occurredAt: Date,\n): Promise<void> {\n  // \u2500\u2500 Primary: inherit Person(s) from the hub's authoritative thread \u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // The hub threads an inbound reply into the same `messages.message.thread_id`\n  // as the outbound that started the conversation (via the thread token /\n  // subject+participants matcher). That outbound is already linked to the CRM\n  // Person (through the `crmPersonId` hint set by the compose route). So a reply\n  // inherits the Person of any existing email interaction in the same thread.\n  //\n  // This is the dependable join where the alternatives are not:\n  //   - Address matching (`findPeopleByAddresses`) filters the *encrypted*\n  //     `primary_email` column by a plaintext value, which never matches when\n  //     tenant data encryption is on (ciphertext != plaintext).\n  //   - RFC Message-IDs are rewritten by some providers (e.g. Gmail) on send,\n  //     so the legacy In-Reply-To/References inheritance below also misses.\n  // The hub thread id survives both, so we resolve by it first.\n  const inboundMessageId = typeof _link.messageId === 'string' ? _link.messageId : null\n  if (inboundMessageId && organizationId) {\n    const threadPersonRows = (await em.getConnection().execute(\n      `SELECT DISTINCT ci.entity_id AS entity_id\n       FROM messages inbound_m\n       JOIN messages thread_m ON thread_m.thread_id = inbound_m.thread_id\n       JOIN message_channel_links mcl ON mcl.message_id = thread_m.id\n       JOIN customer_interactions ci ON ci.external_message_id = mcl.id\n       WHERE inbound_m.id = ?\n         AND inbound_m.tenant_id = ?\n         AND inbound_m.organization_id = ?\n         AND inbound_m.deleted_at IS NULL\n         AND inbound_m.thread_id IS NOT NULL\n         AND thread_m.tenant_id = ?\n         AND thread_m.organization_id = ?\n         AND thread_m.deleted_at IS NULL\n         AND mcl.tenant_id = ?\n         AND mcl.organization_id = ?\n         AND ci.tenant_id = ?\n         AND ci.organization_id = ?\n         AND ci.interaction_type = 'email'\n         AND ci.deleted_at IS NULL\n         AND ci.entity_id IS NOT NULL\n       LIMIT 200`,\n      [\n        inboundMessageId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n        tenantId,\n        organizationId,\n      ],\n    )) as Array<{ entity_id: string }>\n    const threadPersonIds = new Set<string>(\n      threadPersonRows.map((row) => row.entity_id).filter((id): id is string => !!id),\n    )\n    if (threadPersonIds.size > 0) {\n      const subject =\n        typeof metaJson?.subject === 'string'\n          ? (metaJson.subject as string)\n          : typeof payloadJson?.subject === 'string'\n            ? (payloadJson.subject as string)\n            : null\n      const bodyText =\n        typeof payloadJson?.text === 'string'\n          ? (payloadJson.text as string)\n          : typeof metaJson?.bodyText === 'string'\n            ? (metaJson.bodyText as string)\n            : null\n      const providerKey = typeof _link.providerKey === 'string' ? (_link.providerKey as string) : null\n      await persistInteractions(em, threadPersonIds, {\n        linkId,\n        tenantId,\n        organizationId,\n        interactionType: 'email',\n        title: subject,\n        body: bodyText,\n        authorUserId: channelUserId,\n        occurredAt,\n        // Single source of truth for the ingestion default (see resolveVisibility).\n        // The threading-inheritance path deliberately passes no metadata and no\n        // direction: a reply is matched by parent-thread lookup and its metadata is\n        // provider-derived, so it must never be able to downgrade privacy via the\n        // `crmVisibility` override.\n        visibility: resolveVisibility(null, channelUserId, null),\n        channelProviderKey: providerKey,\n        channelId,\n      })\n      return\n    }\n  }\n\n  // \u2500\u2500 Fallback: legacy In-Reply-To / References Message-ID inheritance \u2500\u2500\u2500\u2500\u2500\n  // Collect reference message-ids from inReplyTo + references\n  const refIds: string[] = []\n  const inReplyTo =\n    typeof metaJson?.inReplyTo === 'string'\n      ? stripBrackets(metaJson!.inReplyTo as string)\n      : typeof payloadJson?.inReplyTo === 'string'\n        ? stripBrackets(payloadJson!.inReplyTo as string)\n        : null\n  if (inReplyTo) refIds.push(inReplyTo)\n\n  const refs =\n    Array.isArray(metaJson?.references)\n      ? (metaJson!.references as unknown[])\n      : Array.isArray(payloadJson?.references)\n        ? (payloadJson!.references as unknown[])\n        : []\n  for (const r of refs) {\n    if (typeof r === 'string') {\n      const stripped = stripBrackets(r)\n      if (stripped && !refIds.includes(stripped)) refIds.push(stripped)\n    }\n  }\n\n  if (refIds.length === 0) return\n\n  // Find parent MessageChannelLinks whose channelMetadata.messageId is in refIds.\n  // Bounded lookup: narrow to the candidate Message-IDs directly in SQL instead\n  // of loading every link in the tenant and filtering in JS (which does not scale\n  // on a busy mailbox \u2014 this path runs for every inbound reply that didn't match a\n  // Person by address). channel_metadata is NOT an encrypted column, so a\n  // parameterized raw query is safe; we match both bracketed (`<id>`) and\n  // unbracketed (`id`) Message-ID storage forms, capped to a sane page.\n  const dscope = { tenantId, organizationId }\n  const messageIdCandidates = Array.from(\n    new Set(refIds.flatMap((ref) => [ref, `<${ref}>`])),\n  )\n  const placeholders = messageIdCandidates.map(() => '?').join(', ')\n  const parentLinkRows = (await em.getConnection().execute(\n    `SELECT id FROM message_channel_links\n     WHERE tenant_id = ?\n       AND organization_id = ?\n       AND channel_metadata->>'messageId' IN (${placeholders})\n     LIMIT 200`,\n    [tenantId, organizationId, ...messageIdCandidates],\n  )) as Array<{ id: string }>\n\n  const matchedParentIds = parentLinkRows.map((parentLink) => parentLink.id)\n\n  if (matchedParentIds.length === 0) return\n\n  // Find existing email CustomerInteraction rows for those parent links.\n  const parentInteractions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    {\n      externalMessageId: { $in: matchedParentIds },\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      deletedAt: null,\n    } as any,\n    undefined,\n    dscope,\n  )) as Array<{ entity: { id: string } }>\n\n  const inheritedPersonIdSet = new Set<string>(\n    parentInteractions.map((pi) => pi.entity?.id).filter(Boolean) as string[],\n  )\n\n  if (inheritedPersonIdSet.size === 0) return\n\n  // Same single source of truth as the primary ingestion path; no metadata and no\n  // direction on the inheritance path (see the sibling call above).\n  const visibility: 'private' | 'shared' = resolveVisibility(null, channelUserId, null)\n  const link = _link\n  const inheritedMeta = (link.channelMetadata ?? null) as Record<string, unknown> | null\n  const subject =\n    typeof inheritedMeta?.subject === 'string' ? (inheritedMeta.subject as string) : null\n  const providerKey =\n    typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n\n  await persistInteractions(\n    em,\n    inheritedPersonIdSet,\n    {\n      linkId,\n      tenantId,\n      organizationId,\n      interactionType: 'email',\n      title: subject,\n      body: null,\n      authorUserId: channelUserId,\n      occurredAt,\n      visibility,\n      channelProviderKey: providerKey,\n      channelId,\n    },\n  )\n}\n\n// \u2500\u2500 Helpers \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * When the linked email happened, for `CustomerInteraction.occurredAt` (#6095).\n *\n * Preference order:\n *   1. `payload.providerTimestamp` \u2014 the provider's own receive/send time, put\n *      on the hub event by ingest / delivery;\n *   2. `MessageChannelLink.createdAt` \u2014 the ingest time, the only date this\n *      handler knew before #6095, and the compatibility path for events that\n *      were enqueued before the field existed;\n *   3. now, for a link row with no usable `createdAt` (test stubs).\n */\nfunction resolveOccurredAt(\n  payload: LinkChannelMessagePayload,\n  link: Record<string, unknown>,\n): Date {\n  const ingestedAt = link.createdAt instanceof Date ? link.createdAt : new Date()\n  const carried = payload.providerTimestamp\n  if (carried instanceof Date) {\n    return Number.isNaN(carried.getTime()) ? ingestedAt : carried\n  }\n  if (typeof carried === 'string' && carried) {\n    const parsed = new Date(carried)\n    if (!Number.isNaN(parsed.getTime())) return parsed\n  }\n  return ingestedAt\n}\n\ninterface InteractionData {\n  linkId: string\n  tenantId: string\n  organizationId: string | null\n  interactionType: string\n  title: string | null\n  body: string | null\n  authorUserId: string | null\n  occurredAt: Date\n  visibility: 'private' | 'shared'\n  channelProviderKey: string | null\n  /**\n   * Denormalized channel id, so a read path can ask \"is this row's channel\n   * shared?\" without a three-join hop. NULL when the event carried no channelId\n   * (the predicate then treats the row as not shared \u2014 fail closed).\n   */\n  channelId: string | null\n}\n\nasync function persistInteractions(\n  em: EntityManager,\n  personIdSet: Set<string>,\n  data: InteractionData,\n): Promise<void> {\n  for (const personId of personIdSet) {\n    // Fork per row so a unique-violation on one row doesn't poison the identity\n    // map for subsequent rows. The parent em's connection pool is reused.\n    const rowEm = em.fork()\n    // Use em.getReference so we satisfy the ManyToOne relation without a\n    // redundant SELECT \u2014 MikroORM will flush the FK column directly.\n    const entityRef = rowEm.getReference(CustomerEntity, personId)\n    const interaction = rowEm.create(CustomerInteraction, {\n      tenantId: data.tenantId,\n      organizationId: data.organizationId,\n      entity: entityRef,\n      interactionType: data.interactionType,\n      title: data.title,\n      body: data.body,\n      authorUserId: data.authorUserId,\n      occurredAt: data.occurredAt,\n      // Emails are logged AFTER they're sent/received \u2014 they are not\n      // scheduled work. Without an explicit status the entity default\n      // ('planned') combined with a past `occurredAt` makes the activity\n      // timeline render the email as \"overdue\", which is the wrong UX.\n      // The canonical terminal-success value is `INTERACTION_STATUS_COMPLETED`\n      // ('done'); see `lib/interactionStatus.ts` for the open/terminal semantics.\n      status: INTERACTION_STATUS_COMPLETED,\n      externalMessageId: data.linkId,\n      visibility: data.visibility,\n      channelProviderKey: data.channelProviderKey,\n      channelId: data.channelId,\n    } as any)\n    try {\n      await rowEm.flush()\n    } catch (err) {\n      // Idempotency: swallow unique-violation on (entity_id, external_message_id).\n      // The partial unique index `customer_interactions_email_dedupe_uq` guarantees\n      // at-most-once semantics across retries.\n      const code = (err as { code?: string }).code\n      if (code !== POSTGRES_UNIQUE_VIOLATION) throw err\n      // Duplicate (retried delivery) \u2014 already linked, skip the refresh signal.\n      continue\n    }\n    // Live-refresh signal for the CRM Person page (clientBroadcast \u2192 SSE). The\n    // interaction is already persisted, so a failed emit must not abort linking\n    // or fail this persistent (retried) subscriber.\n    try {\n      await emitCustomersEvent('customers.email.linked', {\n        personId,\n        interactionId: interaction.id,\n        tenantId: data.tenantId,\n        organizationId: data.organizationId,\n      })\n    } catch {\n      /* swallow \u2014 UI refresh signal is non-critical */\n    }\n  }\n}\n\nfunction resolveVisibility(\n  metaJson: Record<string, unknown> | null,\n  channelUserId: string | null,\n  direction: 'inbound' | 'outbound' | null,\n): 'private' | 'shared' {\n  // The explicit `crmVisibility` override is written ONLY by the outbound compose\n  // route. Inbound `channelMetadata` is provider-derived (and therefore attacker-\n  // influenceable), so it MUST NOT be able to downgrade a user-owned channel's\n  // inbound mail from private \u2192 shared. Honor the override on outbound only.\n  if (direction === 'outbound') {\n    if (metaJson?.crmVisibility === 'shared') return 'shared'\n    if (metaJson?.crmVisibility === 'private') return 'private'\n  }\n  // Tenant-scoped channels (no userId) \u2192 shared; user-scoped \u2192 private.\n  return channelUserId ? 'private' : 'shared'\n}\n\n/**\n * Collect email address strings from a field that may be:\n *   - a plain string: 'alice@example.com'\n *   - an array of strings: ['alice@example.com', 'bob@example.com']\n *   - an object with an `address` property: { address: 'alice@example.com', name: 'Alice' }\n *   - an array of such objects\n */\nfunction collectAddressField(out: unknown[], value: unknown): void {\n  if (!value) return\n  if (typeof value === 'string') {\n    out.push(value)\n    return\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) {\n      if (typeof item === 'string') {\n        out.push(item)\n      } else if (item && typeof item === 'object' && typeof (item as Record<string, unknown>).address === 'string') {\n        out.push((item as Record<string, unknown>).address as string)\n      }\n    }\n    return\n  }\n  if (typeof value === 'object' && typeof (value as Record<string, unknown>).address === 'string') {\n    out.push((value as Record<string, unknown>).address as string)\n  }\n}\n\nfunction stripBrackets(value: string): string {\n  const trimmed = value.trim()\n  if (trimmed.startsWith('<') && trimmed.endsWith('>')) {\n    return trimmed.slice(1, -1)\n  }\n  return trimmed\n}\n"],
+  "mappings": "AACA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,gBAAgB,2BAA2B;AACpD,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,0BAA0B;AACnC,SAAS,oCAAoC;AA8C7C,MAAM,4BAA4B;AAIlC,eAAO,QACL,SACA,KACe;AAEf,QAAM,SAAS,SAAS,iBAAiB,SAAS;AAClD,MAAI,OAAO,WAAW,YAAY,CAAC,OAAQ;AAG3C,MAAI,OAAO,QAAQ,aAAa,YAAY,CAAC,QAAQ,SAAU;AAE/D,QAAM,WAAW,QAAQ;AACzB,QAAM,iBAAiB,QAAQ,kBAAkB;AAGjD,MAAI,CAAC,eAAgB;AACrB,QAAM,SAAS,EAAE,UAAU,eAAe;AAG1C,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AAUrD,QAAM,OAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,UAAU,eAAe;AAAA,IACvC;AAAA,IACA;AAAA,EACF;AAEA,MAAI,CAAC,KAAM;AAEX,QAAM,WAAY,KAAK,mBAAmB;AAC1C,QAAM,cAAe,KAAK,kBAAkB;AAW5C,QAAM,aAAa,kBAAkB,SAAS,IAAI;AASlD,MAAI,gBAA+B;AAInC,QAAM,oBACJ,OAAO,QAAQ,cAAc,YAAY,QAAQ,YAAY,QAAQ,YAAY;AACnF,MAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,WAAW;AAC9D,UAAM,UAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,QAAQ,WAAW,UAAU,eAAe;AAAA,MAClD;AAAA,MACA;AAAA,IACF;AACA,oBAAgB,SAAS,UAAU;AAAA,EACrC;AAYA,QAAM,eAA0B,CAAC;AAYjC,MAAI,aAAa;AACf,wBAAoB,cAAc,YAAY,IAAI;AAClD,wBAAoB,cAAc,YAAY,EAAE;AAChD,wBAAoB,cAAc,YAAY,EAAE;AAChD,wBAAoB,cAAc,YAAY,GAAG;AAAA,EACnD;AAEA,MAAI,aAAa,WAAW,KAAK,UAAU;AACzC,wBAAoB,cAAc,SAAS,IAAI;AAC/C,wBAAoB,cAAc,SAAS,EAAE;AAC7C,wBAAoB,cAAc,SAAS,EAAE;AAC7C,wBAAoB,cAAc,SAAS,GAAG;AAAA,EAChD;AAEA,QAAM,aAAa,mBAAmB,YAAwB;AAO9D,QAAM,kBACJ,OAAO,UAAU,gBAAgB,WAAY,SAAU,cAAyB;AAMlF,MAAI,cAA6B;AACjC,MAAI,iBAAiB;AACnB,UAAM,eAAe,MAAM;AAAA,MACzB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,iBAAiB,MAAM,UAAU,UAAU,gBAAgB,WAAW,KAAK;AAAA,MACjF;AAAA,MACA;AAAA,IACF;AACA,QAAI,aAAc,eAAc;AAAA,EAClC;AAGA,MAAI,WAAW,WAAW,KAAK,CAAC,aAAa;AAE3C,UAAM,2BAA2B,IAAI,MAAM,QAAQ,UAAU,gBAAgB,eAAe,mBAAmB,UAAU,aAAa,UAAU;AAChJ;AAAA,EACF;AAGA,QAAM,UAAU,MAAM,sBAAsB,IAAI,YAAY,UAAU,cAAc;AACpF,QAAM,cAAc,IAAI,IAAY,QAAQ,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAC5D,MAAI,YAAa,aAAY,IAAI,WAAW;AAE5C,MAAI,YAAY,SAAS,GAAG;AAE1B,UAAM,2BAA2B,IAAI,MAAM,QAAQ,UAAU,gBAAgB,eAAe,mBAAmB,UAAU,aAAa,UAAU;AAChJ;AAAA,EACF;AAOA,QAAM,gBACJ,KAAK,cAAc,aAAa,KAAK,cAAc,aAAa,KAAK,YAAY;AACnF,QAAM,aAAmC,kBAAkB,UAAU,eAAe,aAAa;AAGjG,QAAM,UACJ,OAAO,UAAU,YAAY,WACxB,SAAU,UACX,OAAO,aAAa,YAAY,WAC7B,YAAa,UACd;AAER,QAAM,WACJ,OAAO,UAAU,aAAa,WACzB,SAAU,WACX,OAAO,aAAa,SAAS,WAC1B,YAAa,OACd;AAER,QAAM,cACJ,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAGxE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB,WAAW;AAAA,IACb;AAAA,EACF;AACF;AAgBA,eAAe,2BACb,IACA,OACA,QACA,UACA,gBACA,eACA,WACA,UACA,aACA,YACe;AAgBf,QAAM,mBAAmB,OAAO,MAAM,cAAc,WAAW,MAAM,YAAY;AACjF,MAAI,oBAAoB,gBAAgB;AACtC,UAAM,mBAAoB,MAAM,GAAG,cAAc,EAAE;AAAA,MACjD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAqBA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,kBAAkB,IAAI;AAAA,MAC1B,iBAAiB,IAAI,CAAC,QAAQ,IAAI,SAAS,EAAE,OAAO,CAAC,OAAqB,CAAC,CAAC,EAAE;AAAA,IAChF;AACA,QAAI,gBAAgB,OAAO,GAAG;AAC5B,YAAMA,WACJ,OAAO,UAAU,YAAY,WACxB,SAAS,UACV,OAAO,aAAa,YAAY,WAC7B,YAAY,UACb;AACR,YAAM,WACJ,OAAO,aAAa,SAAS,WACxB,YAAY,OACb,OAAO,UAAU,aAAa,WAC3B,SAAS,WACV;AACR,YAAMC,eAAc,OAAO,MAAM,gBAAgB,WAAY,MAAM,cAAyB;AAC5F,YAAM,oBAAoB,IAAI,iBAAiB;AAAA,QAC7C;AAAA,QACA;AAAA,QACA;AAAA,QACA,iBAAiB;AAAA,QACjB,OAAOD;AAAA,QACP,MAAM;AAAA,QACN,cAAc;AAAA,QACd;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAMA,YAAY,kBAAkB,MAAM,eAAe,IAAI;AAAA,QACvD,oBAAoBC;AAAA,QACpB;AAAA,MACF,CAAC;AACD;AAAA,IACF;AAAA,EACF;AAIA,QAAM,SAAmB,CAAC;AAC1B,QAAM,YACJ,OAAO,UAAU,cAAc,WAC3B,cAAc,SAAU,SAAmB,IAC3C,OAAO,aAAa,cAAc,WAChC,cAAc,YAAa,SAAmB,IAC9C;AACR,MAAI,UAAW,QAAO,KAAK,SAAS;AAEpC,QAAM,OACJ,MAAM,QAAQ,UAAU,UAAU,IAC7B,SAAU,aACX,MAAM,QAAQ,aAAa,UAAU,IAClC,YAAa,aACd,CAAC;AACT,aAAW,KAAK,MAAM;AACpB,QAAI,OAAO,MAAM,UAAU;AACzB,YAAM,WAAW,cAAc,CAAC;AAChC,UAAI,YAAY,CAAC,OAAO,SAAS,QAAQ,EAAG,QAAO,KAAK,QAAQ;AAAA,IAClE;AAAA,EACF;AAEA,MAAI,OAAO,WAAW,EAAG;AASzB,QAAM,SAAS,EAAE,UAAU,eAAe;AAC1C,QAAM,sBAAsB,MAAM;AAAA,IAChC,IAAI,IAAI,OAAO,QAAQ,CAAC,QAAQ,CAAC,KAAK,IAAI,GAAG,GAAG,CAAC,CAAC;AAAA,EACpD;AACA,QAAM,eAAe,oBAAoB,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI;AACjE,QAAM,iBAAkB,MAAM,GAAG,cAAc,EAAE;AAAA,IAC/C;AAAA;AAAA;AAAA,gDAG4C,YAAY;AAAA;AAAA,IAExD,CAAC,UAAU,gBAAgB,GAAG,mBAAmB;AAAA,EACnD;AAEA,QAAM,mBAAmB,eAAe,IAAI,CAAC,eAAe,WAAW,EAAE;AAEzE,MAAI,iBAAiB,WAAW,EAAG;AAGnC,QAAM,qBAAsB,MAAM;AAAA,IAChC;AAAA,IACA;AAAA,IACA;AAAA,MACE,mBAAmB,EAAE,KAAK,iBAAiB;AAAA,MAC3C;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,uBAAuB,IAAI;AAAA,IAC/B,mBAAmB,IAAI,CAAC,OAAO,GAAG,QAAQ,EAAE,EAAE,OAAO,OAAO;AAAA,EAC9D;AAEA,MAAI,qBAAqB,SAAS,EAAG;AAIrC,QAAM,aAAmC,kBAAkB,MAAM,eAAe,IAAI;AACpF,QAAM,OAAO;AACb,QAAM,gBAAiB,KAAK,mBAAmB;AAC/C,QAAM,UACJ,OAAO,eAAe,YAAY,WAAY,cAAc,UAAqB;AACnF,QAAM,cACJ,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAExE,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,iBAAiB;AAAA,MACjB,OAAO;AAAA,MACP,MAAM;AAAA,MACN,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,oBAAoB;AAAA,MACpB;AAAA,IACF;AAAA,EACF;AACF;AAeA,SAAS,kBACP,SACA,MACM;AACN,QAAM,aAAa,KAAK,qBAAqB,OAAO,KAAK,YAAY,oBAAI,KAAK;AAC9E,QAAM,UAAU,QAAQ;AACxB,MAAI,mBAAmB,MAAM;AAC3B,WAAO,OAAO,MAAM,QAAQ,QAAQ,CAAC,IAAI,aAAa;AAAA,EACxD;AACA,MAAI,OAAO,YAAY,YAAY,SAAS;AAC1C,UAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,QAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,EAC9C;AACA,SAAO;AACT;AAqBA,eAAe,oBACb,IACA,aACA,MACe;AACf,aAAW,YAAY,aAAa;AAGlC,UAAM,QAAQ,GAAG,KAAK;AAGtB,UAAM,YAAY,MAAM,aAAa,gBAAgB,QAAQ;AAC7D,UAAM,cAAc,MAAM,OAAO,qBAAqB;AAAA,MACpD,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,QAAQ;AAAA,MACR,iBAAiB,KAAK;AAAA,MACtB,OAAO,KAAK;AAAA,MACZ,MAAM,KAAK;AAAA,MACX,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAOjB,QAAQ;AAAA,MACR,mBAAmB,KAAK;AAAA,MACxB,YAAY,KAAK;AAAA,MACjB,oBAAoB,KAAK;AAAA,MACzB,WAAW,KAAK;AAAA,IAClB,CAAQ;AACR,QAAI;AACF,YAAM,MAAM,MAAM;AAAA,IACpB,SAAS,KAAK;AAIZ,YAAM,OAAQ,IAA0B;AACxC,UAAI,SAAS,0BAA2B,OAAM;AAE9C;AAAA,IACF;AAIA,QAAI;AACF,YAAM,mBAAmB,0BAA0B;AAAA,QACjD;AAAA,QACA,eAAe,YAAY;AAAA,QAC3B,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AACF;AAEA,SAAS,kBACP,UACA,eACA,WACsB;AAKtB,MAAI,cAAc,YAAY;AAC5B,QAAI,UAAU,kBAAkB,SAAU,QAAO;AACjD,QAAI,UAAU,kBAAkB,UAAW,QAAO;AAAA,EACpD;AAEA,SAAO,gBAAgB,YAAY;AACrC;AASA,SAAS,oBAAoB,KAAgB,OAAsB;AACjE,MAAI,CAAC,MAAO;AACZ,MAAI,OAAO,UAAU,UAAU;AAC7B,QAAI,KAAK,KAAK;AACd;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,OAAO;AACxB,UAAI,OAAO,SAAS,UAAU;AAC5B,YAAI,KAAK,IAAI;AAAA,MACf,WAAW,QAAQ,OAAO,SAAS,YAAY,OAAQ,KAAiC,YAAY,UAAU;AAC5G,YAAI,KAAM,KAAiC,OAAiB;AAAA,MAC9D;AAAA,IACF;AACA;AAAA,EACF;AACA,MAAI,OAAO,UAAU,YAAY,OAAQ,MAAkC,YAAY,UAAU;AAC/F,QAAI,KAAM,MAAkC,OAAiB;AAAA,EAC/D;AACF;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,WAAO,QAAQ,MAAM,GAAG,EAAE;AAAA,EAC5B;AACA,SAAO;AACT;",
   "names": ["subject", "providerKey"]
 }

package/dist/modules/customers/lib/personDetailCacheTags.js

@@ -0,0 +1,32 @@
+import { buildCollectionTags, canonicalizeResourceTag } from "@open-mercato/shared/lib/crud/cache";
+const PERSON_DETAIL_TAG_RESOURCES = [
+  "customers.person",
+  "customers.address",
+  "customers.tagAssignment",
+  "customers.labelAssignment",
+  "customers.personCompanyLink",
+  "customers.interaction",
+  "customers.activity"
+];
+function buildPersonDetailCacheTags(tenantId, organizationId) {
+  const tags = [];
+  for (const resource of PERSON_DETAIL_TAG_RESOURCES) {
+    const canonical = canonicalizeResourceTag(resource) ?? resource;
+    tags.push(...buildCollectionTags(canonical, tenantId, [organizationId]));
+  }
+  return tags;
+}
+async function invalidatePersonDetailCache(container, tenantId, organizationId) {
+  try {
+    const cache = container.resolve("cache");
+    if (!cache?.invalidateTags) return;
+    await cache.invalidateTags(buildPersonDetailCacheTags(tenantId, organizationId));
+  } catch {
+  }
+}
+export {
+  PERSON_DETAIL_TAG_RESOURCES,
+  buildPersonDetailCacheTags,
+  invalidatePersonDetailCache
+};
+//# sourceMappingURL=personDetailCacheTags.js.map

package/dist/modules/customers/lib/personDetailCacheTags.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/lib/personDetailCacheTags.ts"],
+  "sourcesContent": ["import { buildCollectionTags, canonicalizeResourceTag } from '@open-mercato/shared/lib/crud/cache'\n\n/**\n * Resources whose collection tags the cached person-detail payload depends on.\n *\n * Single source of truth, shared by the READ side (`api/people/[id]/route.ts`,\n * which stores under these tags) and every WRITE side that must invalidate them.\n * Hand-formatting the tag strings at a write site is how they silently stop\n * matching: the canonical shape is `crud:<resource>:tenant:<t>:org:<o>:collection`\n * and it is produced only by `buildCollectionTags`.\n */\nexport const PERSON_DETAIL_TAG_RESOURCES = [\n  'customers.person',\n  'customers.address',\n  'customers.tagAssignment',\n  'customers.labelAssignment',\n  'customers.personCompanyLink',\n  'customers.interaction',\n  'customers.activity',\n] as const\n\n/**\n * Collection tags the cached person-detail payload is stored under.\n *\n * The resource ids are canonicalized with `canonicalizeResourceTag` (they are\n * already canonical today, but going through the helper keeps this aligned if the\n * canonical form ever changes).\n */\nexport function buildPersonDetailCacheTags(\n  tenantId: string | null,\n  organizationId: string | null,\n): string[] {\n  const tags: string[] = []\n  for (const resource of PERSON_DETAIL_TAG_RESOURCES) {\n    const canonical = canonicalizeResourceTag(resource) ?? resource\n    tags.push(...buildCollectionTags(canonical, tenantId, [organizationId]))\n  }\n  return tags\n}\n\ntype CacheLike = { invalidateTags?: (tags: string[]) => Promise<void> }\n\n/**\n * Invalidate the person-detail collection tags after a write that widens or\n * narrows email visibility.\n *\n * Both email-sharing write paths (per-Person conversation share, whole-channel\n * flag) change which rows the read filter admits without writing any resource the\n * person-detail cache tags observe, so neither would otherwise invalidate. The\n * revoke direction is the one that matters: without this a teammate keeps reading\n * now-private email from their own warm cache entry until the TTL expires.\n *\n * Best effort \u2014 a stale cached page is a TTL-bounded annoyance, and the write is\n * already committed by the time this runs.\n */\nexport async function invalidatePersonDetailCache(\n  container: { resolve: (name: string) => unknown },\n  tenantId: string | null,\n  organizationId: string | null,\n): Promise<void> {\n  try {\n    const cache = container.resolve('cache') as CacheLike | undefined\n    if (!cache?.invalidateTags) return\n    await cache.invalidateTags(buildPersonDetailCacheTags(tenantId, organizationId))\n  } catch {\n    /* best effort \u2014 never fail a committed write over cache invalidation */\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB,+BAA+B;AAWtD,MAAM,8BAA8B;AAAA,EACzC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AASO,SAAS,2BACd,UACA,gBACU;AACV,QAAM,OAAiB,CAAC;AACxB,aAAW,YAAY,6BAA6B;AAClD,UAAM,YAAY,wBAAwB,QAAQ,KAAK;AACvD,SAAK,KAAK,GAAG,oBAAoB,WAAW,UAAU,CAAC,cAAc,CAAC,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAiBA,eAAsB,4BACpB,WACA,UACA,gBACe;AACf,MAAI;AACF,UAAM,QAAQ,UAAU,QAAQ,OAAO;AACvC,QAAI,CAAC,OAAO,eAAgB;AAC5B,UAAM,MAAM,eAAe,2BAA2B,UAAU,cAAc,CAAC;AAAA,EACjF,QAAQ;AAAA,EAER;AACF;",
+  "names": []
+}

package/dist/modules/customers/lib/personEmailThreads.js

@@ -1,5 +1,6 @@
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { CustomerInteraction } from "../data/entities.js";
+import { resolveUserNames } from "./userNames.js";
 import { buildEmailVisibilityMikroFilter } from "./visibilityFilter.js";
 const DEFAULT_MAX_THREADS = 50;
 const DEFAULT_MAX_MESSAGES_PER_THREAD = 200;
@@ -54,6 +55,8 @@ async function buildPersonEmailThreads(em, opts) {
     organizationId,
     viewerUserId,
     userFeatures,
+    sharedConversations,
+    sharedChannelIds,
     maxThreads = DEFAULT_MAX_THREADS,
     maxMessagesPerThread = DEFAULT_MAX_MESSAGES_PER_THREAD
   } = opts;
@@ -64,10 +67,15 @@ async function buildPersonEmailThreads(em, opts) {
     tenantId
   };
   if (organizationId) interactionWhere.organizationId = organizationId;
-  interactionWhere.$or = buildEmailVisibilityMikroFilter({
-    currentUserId: viewerUserId,
-    userFeatures
-  }).$or;
+  Object.assign(
+    interactionWhere,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: viewerUserId,
+      userFeatures,
+      sharedConversations,
+      sharedChannelIds
+    })
+  );
   const dscope = { tenantId, organizationId: organizationId ?? null };
   const interactions = await findWithDecryption(
     em,
@@ -81,7 +89,10 @@ async function buildPersonEmailThreads(em, opts) {
   for (const interaction of interactions) {
     const linkId = interaction.externalMessageId;
     if (!linkId || linkIdByInteraction.has(linkId)) continue;
-    linkIdByInteraction.set(linkId, { occurredAt: interaction.occurredAt ?? interaction.createdAt });
+    linkIdByInteraction.set(linkId, {
+      occurredAt: interaction.occurredAt ?? interaction.createdAt,
+      authorUserId: interaction.authorUserId ?? null
+    });
     linkIds.push(linkId);
   }
   if (linkIds.length === 0) return [];
@@ -114,11 +125,19 @@ async function buildPersonEmailThreads(em, opts) {
       if (typeof message.id === "string") messageById.set(message.id, message);
     }
   }
+  const foreignAuthorIds = Array.from(
+    new Set(
+      Array.from(linkIdByInteraction.values()).map((entry) => entry.authorUserId).filter((id) => !!id && id !== viewerUserId)
+    )
+  );
+  const authorNames = foreignAuthorIds.length ? await resolveUserNames(em, tenantId, organizationId, foreignAuthorIds) : /* @__PURE__ */ new Map();
   const threadsByKey = /* @__PURE__ */ new Map();
   for (const link of links) {
     const linkId = typeof link.id === "string" ? link.id : null;
     if (!linkId) continue;
     const direction = link.direction === "outbound" ? "outbound" : "inbound";
+    const authorUserId = direction === "outbound" ? linkIdByInteraction.get(linkId)?.authorUserId ?? null : null;
+    const authoredByViewer = !!viewerUserId && !!authorUserId && authorUserId === viewerUserId;
     const providerKey = typeof link.providerKey === "string" ? link.providerKey : null;
     const payload = link.channelPayload ?? null;
     const meta = link.channelMetadata ?? null;
@@ -150,6 +169,8 @@ async function buildPersonEmailThreads(em, opts) {
       direction,
       fromName: fromList[0]?.name ?? null,
       fromEmail: fromList[0]?.email ?? null,
+      authoredByViewer,
+      authorName: authoredByViewer ? null : authorUserId ? authorNames.get(authorUserId) ?? null : null,
       to: toList.map((a) => a.email),
       cc: ccList.map((a) => a.email),
       subject,

package/dist/modules/customers/lib/personEmailThreads.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/lib/personEmailThreads.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerInteraction } from '../data/entities'\nimport { buildEmailVisibilityMikroFilter } from './visibilityFilter'\n\n/**\n * Read model that turns a Person's email `CustomerInteraction` rows into\n * Gmail-style threads for the CRM Person page.\n *\n * The Person\u2194email anchor lives only on `CustomerInteraction`\n * (`interactionType='email'`, `externalMessageId` \u2192 `MessageChannelLink.id`).\n * The thread grouping key and the rich per-message content (From/To/Cc, body,\n * direction) live in the communication_channels hub. We read the hub entities\n * by their string class names \u2014 the same cross-module pattern used by\n * `link-channel-message-handler.ts` \u2014 so the customers module never imports the\n * hub's entity classes (root AGENTS.md: no direct ORM relationships between\n * modules).\n */\n\nexport type EmailThreadDirection = 'inbound' | 'outbound'\n\nexport type PersonEmailMessage = {\n  id: string\n  /** Open Mercato `messages.message` id \u2014 used as `parentMessageId` when replying so the reply joins this thread. */\n  messageId: string | null\n  /** RFC2822 Message-ID of this email \u2014 used as `In-Reply-To` on a reply. */\n  rfcMessageId: string | null\n  /** RFC2822 References chain for this email. */\n  references: string[]\n  direction: EmailThreadDirection\n  fromName: string | null\n  fromEmail: string | null\n  to: string[]\n  cc: string[]\n  subject: string | null\n  bodyText: string | null\n  sentAt: string\n  providerKey: string | null\n}\n\nexport type PersonEmailThread = {\n  threadKey: string\n  subject: string | null\n  preview: string | null\n  participants: string[]\n  lastMessageAt: string\n  messageCount: number\n  providerKey: string | null\n  lastDirection: EmailThreadDirection\n  messages: PersonEmailMessage[]\n}\n\nexport type BuildPersonEmailThreadsOptions = {\n  personId: string\n  tenantId: string\n  organizationId: string | null\n  viewerUserId: string | null\n  userFeatures: string[] | null | undefined\n  maxThreads?: number\n  maxMessagesPerThread?: number\n}\n\nconst DEFAULT_MAX_THREADS = 50\nconst DEFAULT_MAX_MESSAGES_PER_THREAD = 200\nconst PREVIEW_LENGTH = 140\n\ntype JsonRecord = Record<string, unknown>\n\n/** Extracts `{ email, name }[]` from the many shapes a channel address field can take. */\nfunction extractAddresses(value: unknown): Array<{ email: string; name: string | null }> {\n  const out: Array<{ email: string; name: string | null }> = []\n  const pushOne = (item: unknown): void => {\n    if (typeof item === 'string') {\n      const trimmed = item.trim()\n      if (trimmed) out.push({ email: trimmed, name: null })\n      return\n    }\n    if (item && typeof item === 'object') {\n      const rec = item as JsonRecord\n      const address = typeof rec.address === 'string' ? rec.address.trim() : null\n      const name = typeof rec.name === 'string' && rec.name.trim() ? rec.name.trim() : null\n      if (address) out.push({ email: address, name })\n    }\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) pushOne(item)\n  } else {\n    pushOne(value)\n  }\n  return out\n}\n\nfunction firstString(...values: unknown[]): string | null {\n  for (const value of values) {\n    if (typeof value === 'string' && value.trim().length > 0) return value\n  }\n  return null\n}\n\nfunction toStringArray(...values: unknown[]): string[] {\n  for (const value of values) {\n    if (Array.isArray(value)) {\n      const strings = value.filter((item): item is string => typeof item === 'string' && item.trim().length > 0)\n      if (strings.length > 0) return strings\n    }\n  }\n  return []\n}\n\nfunction truncate(value: string | null): string | null {\n  if (!value) return value\n  const collapsed = value.replace(/\\s+/g, ' ').trim()\n  if (collapsed.length <= PREVIEW_LENGTH) return collapsed\n  return `${collapsed.slice(0, PREVIEW_LENGTH - 1)}\u2026`\n}\n\n/**\n * Builds the per-Person email-thread read model. Pure data assembly \u2014 callers\n * are responsible for auth and scoping (tenantId/organizationId required).\n */\nexport async function buildPersonEmailThreads(\n  em: EntityManager,\n  opts: BuildPersonEmailThreadsOptions,\n): Promise<PersonEmailThread[]> {\n  const {\n    personId,\n    tenantId,\n    organizationId,\n    viewerUserId,\n    userFeatures,\n    maxThreads = DEFAULT_MAX_THREADS,\n    maxMessagesPerThread = DEFAULT_MAX_MESSAGES_PER_THREAD,\n  } = opts\n\n  // \u2500\u2500 (1) Load the Person's email interactions (the Person\u2194email anchor) \u2500\u2500\n  const interactionWhere: JsonRecord = {\n    entity: personId,\n    interactionType: 'email',\n    deletedAt: null,\n    tenantId,\n  }\n  if (organizationId) interactionWhere.organizationId = organizationId\n\n  // Per-email visibility (v1: strict owner-only, no admin bypass) \u2014 the CRM\n  // Person page applies the SAME rule as every other interactions read path via\n  // `buildEmailVisibilityMikroFilter`, so the Emails tab and the `/interactions`\n  // timeline can never disagree about who sees an email:\n  //   - `visibility = 'shared'` is visible to every user with CRM access to this\n  //     Person (lets a teammate pick up a handed-off thread),\n  //   - `visibility = 'private'` is visible ONLY to its author (the mailbox\n  //     owner) \u2014 never to teammates, not even an admin/superadmin (team\n  //     oversight is a deliberate v2 follow-up),\n  //   - legacy/unset rows (`visibility IS NULL`) stay visible so pre-existing\n  //     CRM history is never silently hidden.\n  // Fail-closed: a null viewer (API-key caller) never matches the author arm, so\n  // it only ever sees shared/legacy rows \u2014 never anyone's private email.\n  interactionWhere.$or = buildEmailVisibilityMikroFilter({\n    currentUserId: viewerUserId,\n    userFeatures,\n  }).$or\n\n  // `customer_interaction.title`/`body` are encrypted at rest, so reads go\n  // through `findWithDecryption` even though we only consume non-encrypted\n  // columns here \u2014 this keeps the encrypted-entity contract intact.\n  const dscope = { tenantId, organizationId: organizationId ?? null }\n  const interactions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    interactionWhere as never,\n    { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: maxThreads * 20 },\n    dscope,\n  )) as CustomerInteraction[]\n\n  const linkIdByInteraction = new Map<string, { occurredAt: Date }>()\n  const linkIds: string[] = []\n  for (const interaction of interactions) {\n    const linkId = interaction.externalMessageId\n    if (!linkId || linkIdByInteraction.has(linkId)) continue\n    linkIdByInteraction.set(linkId, { occurredAt: interaction.occurredAt ?? interaction.createdAt })\n    linkIds.push(linkId)\n  }\n  if (linkIds.length === 0) return []\n\n  // \u2500\u2500 (2) Resolve MessageChannelLink rows (rich content + direction) \u2500\u2500\u2500\u2500\u2500\u2500\n  const linkWhere: JsonRecord = { id: { $in: linkIds }, tenantId }\n  if (organizationId) linkWhere.organizationId = organizationId\n  const links = (await findWithDecryption(\n    em,\n    'MessageChannelLink' as never,\n    linkWhere as never,\n    undefined,\n    dscope,\n  )) as JsonRecord[]\n\n  // \u2500\u2500 (3) Resolve hub Message rows (the authoritative thread grouping) \u2500\u2500\u2500\u2500\n  const messageIds = Array.from(\n    new Set(\n      links\n        .map((link) => (typeof link.messageId === 'string' ? (link.messageId as string) : null))\n        .filter((value): value is string => !!value),\n    ),\n  )\n  const messageById = new Map<string, JsonRecord>()\n  if (messageIds.length > 0) {\n    const messageWhere: JsonRecord = { id: { $in: messageIds }, tenantId }\n    if (organizationId) messageWhere.organizationId = organizationId\n    const messages = (await findWithDecryption(\n      em,\n      'Message' as never,\n      messageWhere as never,\n      undefined,\n      dscope,\n    )) as JsonRecord[]\n    for (const message of messages) {\n      if (typeof message.id === 'string') messageById.set(message.id, message)\n    }\n  }\n\n  // \u2500\u2500 (4) Build per-message DTOs grouped by thread \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threadsByKey = new Map<string, PersonEmailThread>()\n\n  for (const link of links) {\n    const linkId = typeof link.id === 'string' ? (link.id as string) : null\n    if (!linkId) continue\n    const direction: EmailThreadDirection = link.direction === 'outbound' ? 'outbound' : 'inbound'\n    const providerKey = typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n    const payload = (link.channelPayload ?? null) as JsonRecord | null\n    const meta = (link.channelMetadata ?? null) as JsonRecord | null\n    const messageId = typeof link.messageId === 'string' ? (link.messageId as string) : null\n    const message = messageId ? messageById.get(messageId) ?? null : null\n\n    // Outbound addresses live in channelMetadata; inbound in channelPayload.\n    // Prefer the direction-appropriate source, fall back to the other.\n    const primary = direction === 'outbound' ? meta : payload\n    const secondary = direction === 'outbound' ? payload : meta\n    const fromList = extractAddresses(primary?.from ?? secondary?.from)\n    const toList = extractAddresses(primary?.to ?? secondary?.to)\n    const ccList = extractAddresses(primary?.cc ?? secondary?.cc)\n\n    const subject = firstString(\n      primary?.subject,\n      secondary?.subject,\n      typeof message?.subject === 'string' ? message.subject : null,\n    )\n    const bodyText = firstString(\n      direction === 'outbound' ? meta?.bodyText : payload?.text,\n      direction === 'outbound' ? payload?.text : meta?.bodyText,\n      typeof message?.body === 'string' ? message.body : null,\n    )\n\n    const sentAtRaw =\n      (typeof message?.sentAt === 'string' || message?.sentAt instanceof Date\n        ? message.sentAt\n        : null) ??\n      (link.createdAt instanceof Date || typeof link.createdAt === 'string' ? link.createdAt : null) ??\n      linkIdByInteraction.get(linkId)?.occurredAt ??\n      new Date()\n    const sentAt = (sentAtRaw instanceof Date ? sentAtRaw : new Date(sentAtRaw)).toISOString()\n\n    const threadKey =\n      (typeof message?.threadId === 'string' && message.threadId ? message.threadId : null) ??\n      (messageId ? `message:${messageId}` : `link:${linkId}`)\n\n    const dto: PersonEmailMessage = {\n      id: linkId,\n      messageId,\n      rfcMessageId: firstString(primary?.messageId, secondary?.messageId),\n      references: toStringArray(primary?.references, secondary?.references),\n      direction,\n      fromName: fromList[0]?.name ?? null,\n      fromEmail: fromList[0]?.email ?? null,\n      to: toList.map((a) => a.email),\n      cc: ccList.map((a) => a.email),\n      subject,\n      bodyText,\n      sentAt,\n      providerKey,\n    }\n\n    const existing = threadsByKey.get(threadKey)\n    if (existing) {\n      existing.messages.push(dto)\n    } else {\n      threadsByKey.set(threadKey, {\n        threadKey,\n        subject,\n        preview: null,\n        participants: [],\n        lastMessageAt: sentAt,\n        messageCount: 0,\n        providerKey,\n        lastDirection: direction,\n        messages: [dto],\n      })\n    }\n  }\n\n  // \u2500\u2500 (5) Finalize thread summaries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threads: PersonEmailThread[] = []\n  for (const thread of threadsByKey.values()) {\n    thread.messages.sort((a, b) => a.sentAt.localeCompare(b.sentAt))\n    if (thread.messages.length > maxMessagesPerThread) {\n      thread.messages = thread.messages.slice(thread.messages.length - maxMessagesPerThread)\n    }\n    const last = thread.messages[thread.messages.length - 1]\n    const firstWithSubject = thread.messages.find((m) => m.subject)\n    const participantSet = new Set<string>()\n    for (const message of thread.messages) {\n      // External counterpart = the \"from\" for inbound, the \"to\" for outbound.\n      if (message.direction === 'inbound' && message.fromEmail) participantSet.add(message.fromEmail)\n      if (message.direction === 'outbound') message.to.forEach((email) => participantSet.add(email))\n    }\n    thread.subject = firstWithSubject?.subject ?? thread.subject\n    thread.preview = truncate(last?.bodyText ?? null)\n    thread.participants = Array.from(participantSet)\n    thread.lastMessageAt = last?.sentAt ?? thread.lastMessageAt\n    thread.lastDirection = last?.direction ?? thread.lastDirection\n    thread.providerKey = last?.providerKey ?? thread.providerKey\n    thread.messageCount = thread.messages.length\n    threads.push(thread)\n  }\n\n  threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))\n  return threads.slice(0, maxThreads)\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,uCAAuC;AA2DhD,MAAM,sBAAsB;AAC5B,MAAM,kCAAkC;AACxC,MAAM,iBAAiB;AAKvB,SAAS,iBAAiB,OAA+D;AACvF,QAAM,MAAqD,CAAC;AAC5D,QAAM,UAAU,CAAC,SAAwB;AACvC,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,MAAM,KAAK,CAAC;AACpD;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,YAAM,MAAM;AACZ,YAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,IAAI;AACvE,YAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;AACjF,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,KAAK,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,SAAQ,IAAI;AAAA,EACxC,OAAO;AACL,YAAQ,KAAK;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA6B;AACrD,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,UAAU,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AACzG,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,SAAS,OAAqC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAClD,MAAI,UAAU,UAAU,eAAgB,QAAO;AAC/C,SAAO,GAAG,UAAU,MAAM,GAAG,iBAAiB,CAAC,CAAC;AAClD;AAMA,eAAsB,wBACpB,IACA,MAC8B;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,uBAAuB;AAAA,EACzB,IAAI;AAGJ,QAAM,mBAA+B;AAAA,IACnC,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,EACF;AACA,MAAI,eAAgB,kBAAiB,iBAAiB;AAetD,mBAAiB,MAAM,gCAAgC;AAAA,IACrD,eAAe;AAAA,IACf;AAAA,EACF,CAAC,EAAE;AAKH,QAAM,SAAS,EAAE,UAAU,gBAAgB,kBAAkB,KAAK;AAClE,QAAM,eAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,SAAS,EAAE,YAAY,QAAQ,WAAW,OAAO,GAAG,OAAO,aAAa,GAAG;AAAA,IAC7E;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAAkC;AAClE,QAAM,UAAoB,CAAC;AAC3B,aAAW,eAAe,cAAc;AACtC,UAAM,SAAS,YAAY;AAC3B,QAAI,CAAC,UAAU,oBAAoB,IAAI,MAAM,EAAG;AAChD,wBAAoB,IAAI,QAAQ,EAAE,YAAY,YAAY,cAAc,YAAY,UAAU,CAAC;AAC/F,YAAQ,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAwB,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,SAAS;AAC/D,MAAI,eAAgB,WAAU,iBAAiB;AAC/C,QAAM,QAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,QAAM,aAAa,MAAM;AAAA,IACvB,IAAI;AAAA,MACF,MACG,IAAI,CAAC,SAAU,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB,IAAK,EACtF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,eAA2B,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,SAAS;AACrE,QAAI,eAAgB,cAAa,iBAAiB;AAClD,UAAM,WAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,QAAQ,OAAO,SAAU,aAAY,IAAI,QAAQ,IAAI,OAAO;AAAA,IACzE;AAAA,EACF;AAGA,QAAM,eAAe,oBAAI,IAA+B;AAExD,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,OAAO,WAAY,KAAK,KAAgB;AACnE,QAAI,CAAC,OAAQ;AACb,UAAM,YAAkC,KAAK,cAAc,aAAa,aAAa;AACrF,UAAM,cAAc,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAC1F,UAAM,UAAW,KAAK,kBAAkB;AACxC,UAAM,OAAQ,KAAK,mBAAmB;AACtC,UAAM,YAAY,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB;AACpF,UAAM,UAAU,YAAY,YAAY,IAAI,SAAS,KAAK,OAAO;AAIjE,UAAM,UAAU,cAAc,aAAa,OAAO;AAClD,UAAM,YAAY,cAAc,aAAa,UAAU;AACvD,UAAM,WAAW,iBAAiB,SAAS,QAAQ,WAAW,IAAI;AAClE,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAC5D,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAE5D,UAAM,UAAU;AAAA,MACd,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,SAAS,YAAY,WAAW,QAAQ,UAAU;AAAA,IAC3D;AACA,UAAM,WAAW;AAAA,MACf,cAAc,aAAa,MAAM,WAAW,SAAS;AAAA,MACrD,cAAc,aAAa,SAAS,OAAO,MAAM;AAAA,MACjD,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,IACrD;AAEA,UAAM,aACH,OAAO,SAAS,WAAW,YAAY,SAAS,kBAAkB,OAC/D,QAAQ,SACR,UACH,KAAK,qBAAqB,QAAQ,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,SACzF,oBAAoB,IAAI,MAAM,GAAG,cACjC,oBAAI,KAAK;AACX,UAAM,UAAU,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS,GAAG,YAAY;AAEzF,UAAM,aACH,OAAO,SAAS,aAAa,YAAY,QAAQ,WAAW,QAAQ,WAAW,UAC/E,YAAY,WAAW,SAAS,KAAK,QAAQ,MAAM;AAEtD,UAAM,MAA0B;AAAA,MAC9B,IAAI;AAAA,MACJ;AAAA,MACA,cAAc,YAAY,SAAS,WAAW,WAAW,SAAS;AAAA,MAClE,YAAY,cAAc,SAAS,YAAY,WAAW,UAAU;AAAA,MACpE;AAAA,MACA,UAAU,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC/B,WAAW,SAAS,CAAC,GAAG,SAAS;AAAA,MACjC,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,IAAI,SAAS;AAC3C,QAAI,UAAU;AACZ,eAAS,SAAS,KAAK,GAAG;AAAA,IAC5B,OAAO;AACL,mBAAa,IAAI,WAAW;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,cAAc,CAAC;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd;AAAA,QACA,eAAe;AAAA,QACf,UAAU,CAAC,GAAG;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,UAA+B,CAAC;AACtC,aAAW,UAAU,aAAa,OAAO,GAAG;AAC1C,WAAO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAC/D,QAAI,OAAO,SAAS,SAAS,sBAAsB;AACjD,aAAO,WAAW,OAAO,SAAS,MAAM,OAAO,SAAS,SAAS,oBAAoB;AAAA,IACvF;AACA,UAAM,OAAO,OAAO,SAAS,OAAO,SAAS,SAAS,CAAC;AACvD,UAAM,mBAAmB,OAAO,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AAC9D,UAAM,iBAAiB,oBAAI,IAAY;AACvC,eAAW,WAAW,OAAO,UAAU;AAErC,UAAI,QAAQ,cAAc,aAAa,QAAQ,UAAW,gBAAe,IAAI,QAAQ,SAAS;AAC9F,UAAI,QAAQ,cAAc,WAAY,SAAQ,GAAG,QAAQ,CAAC,UAAU,eAAe,IAAI,KAAK,CAAC;AAAA,IAC/F;AACA,WAAO,UAAU,kBAAkB,WAAW,OAAO;AACrD,WAAO,UAAU,SAAS,MAAM,YAAY,IAAI;AAChD,WAAO,eAAe,MAAM,KAAK,cAAc;AAC/C,WAAO,gBAAgB,MAAM,UAAU,OAAO;AAC9C,WAAO,gBAAgB,MAAM,aAAa,OAAO;AACjD,WAAO,cAAc,MAAM,eAAe,OAAO;AACjD,WAAO,eAAe,OAAO,SAAS;AACtC,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,cAAc,EAAE,aAAa,CAAC;AACrE,SAAO,QAAQ,MAAM,GAAG,UAAU;AACpC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerInteraction } from '../data/entities'\nimport { resolveUserNames } from './userNames'\nimport { buildEmailVisibilityMikroFilter } from './visibilityFilter'\nimport type { ConversationShareGrant } from './conversationShares'\n\n/**\n * Read model that turns a Person's email `CustomerInteraction` rows into\n * Gmail-style threads for the CRM Person page.\n *\n * The Person\u2194email anchor lives only on `CustomerInteraction`\n * (`interactionType='email'`, `externalMessageId` \u2192 `MessageChannelLink.id`).\n * The thread grouping key and the rich per-message content (From/To/Cc, body,\n * direction) live in the communication_channels hub. We read the hub entities\n * by their string class names \u2014 the same cross-module pattern used by\n * `link-channel-message-handler.ts` \u2014 so the customers module never imports the\n * hub's entity classes (root AGENTS.md: no direct ORM relationships between\n * modules).\n */\n\nexport type EmailThreadDirection = 'inbound' | 'outbound'\n\nexport type PersonEmailMessage = {\n  id: string\n  /** Open Mercato `messages.message` id \u2014 used as `parentMessageId` when replying so the reply joins this thread. */\n  messageId: string | null\n  /** RFC2822 Message-ID of this email \u2014 used as `In-Reply-To` on a reply. */\n  rfcMessageId: string | null\n  /** RFC2822 References chain for this email. */\n  references: string[]\n  direction: EmailThreadDirection\n  fromName: string | null\n  fromEmail: string | null\n  /**\n   * True when the viewer is the author of this message. Outbound email carries\n   * no `from` header in `channelMetadata`, so the sender label cannot be derived\n   * from the addresses \u2014 and since conversation/channel sharing lets a teammate\n   * read someone else's outbound mail, direction alone is not the author either.\n   */\n  authoredByViewer: boolean\n  /** Display label of the sending colleague; null for the viewer's own mail and for inbound. */\n  authorName: string | null\n  to: string[]\n  cc: string[]\n  subject: string | null\n  bodyText: string | null\n  sentAt: string\n  providerKey: string | null\n}\n\nexport type PersonEmailThread = {\n  threadKey: string\n  subject: string | null\n  preview: string | null\n  participants: string[]\n  lastMessageAt: string\n  messageCount: number\n  providerKey: string | null\n  lastDirection: EmailThreadDirection\n  messages: PersonEmailMessage[]\n}\n\nexport type BuildPersonEmailThreadsOptions = {\n  personId: string\n  tenantId: string\n  organizationId: string | null\n  viewerUserId: string | null\n  userFeatures: string[] | null | undefined\n  /**\n   * Conversation shares that widen this viewer's access. Optional and fail-closed:\n   * omitting it yields the strict owner-only view.\n   */\n  sharedConversations?: ConversationShareGrant[]\n  /** Channels marked as shared team mailboxes; optional and fail-closed. */\n  sharedChannelIds?: string[]\n  maxThreads?: number\n  maxMessagesPerThread?: number\n}\n\nconst DEFAULT_MAX_THREADS = 50\nconst DEFAULT_MAX_MESSAGES_PER_THREAD = 200\nconst PREVIEW_LENGTH = 140\n\ntype JsonRecord = Record<string, unknown>\n\n/** Extracts `{ email, name }[]` from the many shapes a channel address field can take. */\nfunction extractAddresses(value: unknown): Array<{ email: string; name: string | null }> {\n  const out: Array<{ email: string; name: string | null }> = []\n  const pushOne = (item: unknown): void => {\n    if (typeof item === 'string') {\n      const trimmed = item.trim()\n      if (trimmed) out.push({ email: trimmed, name: null })\n      return\n    }\n    if (item && typeof item === 'object') {\n      const rec = item as JsonRecord\n      const address = typeof rec.address === 'string' ? rec.address.trim() : null\n      const name = typeof rec.name === 'string' && rec.name.trim() ? rec.name.trim() : null\n      if (address) out.push({ email: address, name })\n    }\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) pushOne(item)\n  } else {\n    pushOne(value)\n  }\n  return out\n}\n\nfunction firstString(...values: unknown[]): string | null {\n  for (const value of values) {\n    if (typeof value === 'string' && value.trim().length > 0) return value\n  }\n  return null\n}\n\nfunction toStringArray(...values: unknown[]): string[] {\n  for (const value of values) {\n    if (Array.isArray(value)) {\n      const strings = value.filter((item): item is string => typeof item === 'string' && item.trim().length > 0)\n      if (strings.length > 0) return strings\n    }\n  }\n  return []\n}\n\nfunction truncate(value: string | null): string | null {\n  if (!value) return value\n  const collapsed = value.replace(/\\s+/g, ' ').trim()\n  if (collapsed.length <= PREVIEW_LENGTH) return collapsed\n  return `${collapsed.slice(0, PREVIEW_LENGTH - 1)}\u2026`\n}\n\n/**\n * Builds the per-Person email-thread read model. Pure data assembly \u2014 callers\n * are responsible for auth and scoping (tenantId/organizationId required).\n */\nexport async function buildPersonEmailThreads(\n  em: EntityManager,\n  opts: BuildPersonEmailThreadsOptions,\n): Promise<PersonEmailThread[]> {\n  const {\n    personId,\n    tenantId,\n    organizationId,\n    viewerUserId,\n    userFeatures,\n    sharedConversations,\n    sharedChannelIds,\n    maxThreads = DEFAULT_MAX_THREADS,\n    maxMessagesPerThread = DEFAULT_MAX_MESSAGES_PER_THREAD,\n  } = opts\n\n  // \u2500\u2500 (1) Load the Person's email interactions (the Person\u2194email anchor) \u2500\u2500\n  const interactionWhere: JsonRecord = {\n    entity: personId,\n    interactionType: 'email',\n    deletedAt: null,\n    tenantId,\n  }\n  if (organizationId) interactionWhere.organizationId = organizationId\n\n  // Per-email visibility (v1: strict owner-only, no admin bypass) \u2014 the CRM\n  // Person page applies the SAME rule as every other interactions read path via\n  // `buildEmailVisibilityMikroFilter`, so the Emails tab and the `/interactions`\n  // timeline can never disagree about who sees an email:\n  //   - `visibility = 'shared'` is visible to every user with CRM access to this\n  //     Person (lets a teammate pick up a handed-off thread),\n  //   - `visibility = 'private'` is visible ONLY to its author (the mailbox\n  //     owner) \u2014 never to teammates, not even an admin/superadmin (team\n  //     oversight is a deliberate v2 follow-up),\n  //   - legacy/unset rows (`visibility IS NULL`) stay visible so pre-existing\n  //     CRM history is never silently hidden.\n  // Fail-closed: a null viewer (API-key caller) never matches the author arm, so\n  // it only ever sees shared/legacy rows \u2014 never anyone's private email.\n  // Merge the WHOLE fragment. Cherry-picking `.$or` here would silently discard\n  // any other arm the predicate grows, which fails OPEN at a compile-clean call\n  // site \u2014 the exact hazard the fragment contract now documents.\n  Object.assign(\n    interactionWhere,\n    buildEmailVisibilityMikroFilter({\n      currentUserId: viewerUserId,\n      userFeatures,\n      sharedConversations,\n      sharedChannelIds,\n    }),\n  )\n\n  // `customer_interaction.title`/`body` are encrypted at rest, so reads go\n  // through `findWithDecryption` even though we only consume non-encrypted\n  // columns here \u2014 this keeps the encrypted-entity contract intact.\n  const dscope = { tenantId, organizationId: organizationId ?? null }\n  const interactions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    interactionWhere as never,\n    { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: maxThreads * 20 },\n    dscope,\n  )) as CustomerInteraction[]\n\n  const linkIdByInteraction = new Map<string, { occurredAt: Date; authorUserId: string | null }>()\n  const linkIds: string[] = []\n  for (const interaction of interactions) {\n    const linkId = interaction.externalMessageId\n    if (!linkId || linkIdByInteraction.has(linkId)) continue\n    linkIdByInteraction.set(linkId, {\n      occurredAt: interaction.occurredAt ?? interaction.createdAt,\n      authorUserId: interaction.authorUserId ?? null,\n    })\n    linkIds.push(linkId)\n  }\n  if (linkIds.length === 0) return []\n\n  // \u2500\u2500 (2) Resolve MessageChannelLink rows (rich content + direction) \u2500\u2500\u2500\u2500\u2500\u2500\n  const linkWhere: JsonRecord = { id: { $in: linkIds }, tenantId }\n  if (organizationId) linkWhere.organizationId = organizationId\n  const links = (await findWithDecryption(\n    em,\n    'MessageChannelLink' as never,\n    linkWhere as never,\n    undefined,\n    dscope,\n  )) as JsonRecord[]\n\n  // \u2500\u2500 (3) Resolve hub Message rows (the authoritative thread grouping) \u2500\u2500\u2500\u2500\n  const messageIds = Array.from(\n    new Set(\n      links\n        .map((link) => (typeof link.messageId === 'string' ? (link.messageId as string) : null))\n        .filter((value): value is string => !!value),\n    ),\n  )\n  const messageById = new Map<string, JsonRecord>()\n  if (messageIds.length > 0) {\n    const messageWhere: JsonRecord = { id: { $in: messageIds }, tenantId }\n    if (organizationId) messageWhere.organizationId = organizationId\n    const messages = (await findWithDecryption(\n      em,\n      'Message' as never,\n      messageWhere as never,\n      undefined,\n      dscope,\n    )) as JsonRecord[]\n    for (const message of messages) {\n      if (typeof message.id === 'string') messageById.set(message.id, message)\n    }\n  }\n\n  // \u2500\u2500 (3b) Resolve sender labels for colleagues' messages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // Only for authors other than the viewer: their own mail renders as \"You\" and\n  // needs no lookup. A shared conversation is exactly the case where a message\n  // the viewer did not write shows up in their thread list, so without this the\n  // UI would have to fall back on direction and misattribute it to the reader.\n  const foreignAuthorIds = Array.from(\n    new Set(\n      Array.from(linkIdByInteraction.values())\n        .map((entry) => entry.authorUserId)\n        .filter((id): id is string => !!id && id !== viewerUserId),\n    ),\n  )\n  const authorNames = foreignAuthorIds.length\n    ? await resolveUserNames(em, tenantId, organizationId, foreignAuthorIds)\n    : new Map<string, string>()\n\n  // \u2500\u2500 (4) Build per-message DTOs grouped by thread \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threadsByKey = new Map<string, PersonEmailThread>()\n\n  for (const link of links) {\n    const linkId = typeof link.id === 'string' ? (link.id as string) : null\n    if (!linkId) continue\n    const direction: EmailThreadDirection = link.direction === 'outbound' ? 'outbound' : 'inbound'\n    // `authorUserId` on the interaction is the MAILBOX OWNER, which on an\n    // inbound message is the recipient, not the sender \u2014 so authorship is an\n    // outbound-only notion. Inbound senders are named by the `from` header.\n    const authorUserId = direction === 'outbound' ? linkIdByInteraction.get(linkId)?.authorUserId ?? null : null\n    const authoredByViewer = !!viewerUserId && !!authorUserId && authorUserId === viewerUserId\n    const providerKey = typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n    const payload = (link.channelPayload ?? null) as JsonRecord | null\n    const meta = (link.channelMetadata ?? null) as JsonRecord | null\n    const messageId = typeof link.messageId === 'string' ? (link.messageId as string) : null\n    const message = messageId ? messageById.get(messageId) ?? null : null\n\n    // Outbound addresses live in channelMetadata; inbound in channelPayload.\n    // Prefer the direction-appropriate source, fall back to the other.\n    const primary = direction === 'outbound' ? meta : payload\n    const secondary = direction === 'outbound' ? payload : meta\n    const fromList = extractAddresses(primary?.from ?? secondary?.from)\n    const toList = extractAddresses(primary?.to ?? secondary?.to)\n    const ccList = extractAddresses(primary?.cc ?? secondary?.cc)\n\n    const subject = firstString(\n      primary?.subject,\n      secondary?.subject,\n      typeof message?.subject === 'string' ? message.subject : null,\n    )\n    const bodyText = firstString(\n      direction === 'outbound' ? meta?.bodyText : payload?.text,\n      direction === 'outbound' ? payload?.text : meta?.bodyText,\n      typeof message?.body === 'string' ? message.body : null,\n    )\n\n    const sentAtRaw =\n      (typeof message?.sentAt === 'string' || message?.sentAt instanceof Date\n        ? message.sentAt\n        : null) ??\n      (link.createdAt instanceof Date || typeof link.createdAt === 'string' ? link.createdAt : null) ??\n      linkIdByInteraction.get(linkId)?.occurredAt ??\n      new Date()\n    const sentAt = (sentAtRaw instanceof Date ? sentAtRaw : new Date(sentAtRaw)).toISOString()\n\n    const threadKey =\n      (typeof message?.threadId === 'string' && message.threadId ? message.threadId : null) ??\n      (messageId ? `message:${messageId}` : `link:${linkId}`)\n\n    const dto: PersonEmailMessage = {\n      id: linkId,\n      messageId,\n      rfcMessageId: firstString(primary?.messageId, secondary?.messageId),\n      references: toStringArray(primary?.references, secondary?.references),\n      direction,\n      fromName: fromList[0]?.name ?? null,\n      fromEmail: fromList[0]?.email ?? null,\n      authoredByViewer,\n      authorName: authoredByViewer ? null : authorUserId ? authorNames.get(authorUserId) ?? null : null,\n      to: toList.map((a) => a.email),\n      cc: ccList.map((a) => a.email),\n      subject,\n      bodyText,\n      sentAt,\n      providerKey,\n    }\n\n    const existing = threadsByKey.get(threadKey)\n    if (existing) {\n      existing.messages.push(dto)\n    } else {\n      threadsByKey.set(threadKey, {\n        threadKey,\n        subject,\n        preview: null,\n        participants: [],\n        lastMessageAt: sentAt,\n        messageCount: 0,\n        providerKey,\n        lastDirection: direction,\n        messages: [dto],\n      })\n    }\n  }\n\n  // \u2500\u2500 (5) Finalize thread summaries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threads: PersonEmailThread[] = []\n  for (const thread of threadsByKey.values()) {\n    thread.messages.sort((a, b) => a.sentAt.localeCompare(b.sentAt))\n    if (thread.messages.length > maxMessagesPerThread) {\n      thread.messages = thread.messages.slice(thread.messages.length - maxMessagesPerThread)\n    }\n    const last = thread.messages[thread.messages.length - 1]\n    const firstWithSubject = thread.messages.find((m) => m.subject)\n    const participantSet = new Set<string>()\n    for (const message of thread.messages) {\n      // External counterpart = the \"from\" for inbound, the \"to\" for outbound.\n      if (message.direction === 'inbound' && message.fromEmail) participantSet.add(message.fromEmail)\n      if (message.direction === 'outbound') message.to.forEach((email) => participantSet.add(email))\n    }\n    thread.subject = firstWithSubject?.subject ?? thread.subject\n    thread.preview = truncate(last?.bodyText ?? null)\n    thread.participants = Array.from(participantSet)\n    thread.lastMessageAt = last?.sentAt ?? thread.lastMessageAt\n    thread.lastDirection = last?.direction ?? thread.lastDirection\n    thread.providerKey = last?.providerKey ?? thread.providerKey\n    thread.messageCount = thread.messages.length\n    threads.push(thread)\n  }\n\n  threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))\n  return threads.slice(0, maxThreads)\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AACjC,SAAS,uCAAuC;AA4EhD,MAAM,sBAAsB;AAC5B,MAAM,kCAAkC;AACxC,MAAM,iBAAiB;AAKvB,SAAS,iBAAiB,OAA+D;AACvF,QAAM,MAAqD,CAAC;AAC5D,QAAM,UAAU,CAAC,SAAwB;AACvC,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,MAAM,KAAK,CAAC;AACpD;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,YAAM,MAAM;AACZ,YAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,IAAI;AACvE,YAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;AACjF,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,KAAK,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,SAAQ,IAAI;AAAA,EACxC,OAAO;AACL,YAAQ,KAAK;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA6B;AACrD,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,UAAU,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AACzG,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,SAAS,OAAqC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAClD,MAAI,UAAU,UAAU,eAAgB,QAAO;AAC/C,SAAO,GAAG,UAAU,MAAM,GAAG,iBAAiB,CAAC,CAAC;AAClD;AAMA,eAAsB,wBACpB,IACA,MAC8B;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,uBAAuB;AAAA,EACzB,IAAI;AAGJ,QAAM,mBAA+B;AAAA,IACnC,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,EACF;AACA,MAAI,eAAgB,kBAAiB,iBAAiB;AAkBtD,SAAO;AAAA,IACL;AAAA,IACA,gCAAgC;AAAA,MAC9B,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,EAAE,UAAU,gBAAgB,kBAAkB,KAAK;AAClE,QAAM,eAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,SAAS,EAAE,YAAY,QAAQ,WAAW,OAAO,GAAG,OAAO,aAAa,GAAG;AAAA,IAC7E;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAA+D;AAC/F,QAAM,UAAoB,CAAC;AAC3B,aAAW,eAAe,cAAc;AACtC,UAAM,SAAS,YAAY;AAC3B,QAAI,CAAC,UAAU,oBAAoB,IAAI,MAAM,EAAG;AAChD,wBAAoB,IAAI,QAAQ;AAAA,MAC9B,YAAY,YAAY,cAAc,YAAY;AAAA,MAClD,cAAc,YAAY,gBAAgB;AAAA,IAC5C,CAAC;AACD,YAAQ,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAwB,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,SAAS;AAC/D,MAAI,eAAgB,WAAU,iBAAiB;AAC/C,QAAM,QAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,QAAM,aAAa,MAAM;AAAA,IACvB,IAAI;AAAA,MACF,MACG,IAAI,CAAC,SAAU,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB,IAAK,EACtF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,eAA2B,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,SAAS;AACrE,QAAI,eAAgB,cAAa,iBAAiB;AAClD,UAAM,WAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,QAAQ,OAAO,SAAU,aAAY,IAAI,QAAQ,IAAI,OAAO;AAAA,IACzE;AAAA,EACF;AAQA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,KAAK,oBAAoB,OAAO,CAAC,EACpC,IAAI,CAAC,UAAU,MAAM,YAAY,EACjC,OAAO,CAAC,OAAqB,CAAC,CAAC,MAAM,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,cAAc,iBAAiB,SACjC,MAAM,iBAAiB,IAAI,UAAU,gBAAgB,gBAAgB,IACrE,oBAAI,IAAoB;AAG5B,QAAM,eAAe,oBAAI,IAA+B;AAExD,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,OAAO,WAAY,KAAK,KAAgB;AACnE,QAAI,CAAC,OAAQ;AACb,UAAM,YAAkC,KAAK,cAAc,aAAa,aAAa;AAIrF,UAAM,eAAe,cAAc,aAAa,oBAAoB,IAAI,MAAM,GAAG,gBAAgB,OAAO;AACxG,UAAM,mBAAmB,CAAC,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,iBAAiB;AAC9E,UAAM,cAAc,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAC1F,UAAM,UAAW,KAAK,kBAAkB;AACxC,UAAM,OAAQ,KAAK,mBAAmB;AACtC,UAAM,YAAY,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB;AACpF,UAAM,UAAU,YAAY,YAAY,IAAI,SAAS,KAAK,OAAO;AAIjE,UAAM,UAAU,cAAc,aAAa,OAAO;AAClD,UAAM,YAAY,cAAc,aAAa,UAAU;AACvD,UAAM,WAAW,iBAAiB,SAAS,QAAQ,WAAW,IAAI;AAClE,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAC5D,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAE5D,UAAM,UAAU;AAAA,MACd,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,SAAS,YAAY,WAAW,QAAQ,UAAU;AAAA,IAC3D;AACA,UAAM,WAAW;AAAA,MACf,cAAc,aAAa,MAAM,WAAW,SAAS;AAAA,MACrD,cAAc,aAAa,SAAS,OAAO,MAAM;AAAA,MACjD,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,IACrD;AAEA,UAAM,aACH,OAAO,SAAS,WAAW,YAAY,SAAS,kBAAkB,OAC/D,QAAQ,SACR,UACH,KAAK,qBAAqB,QAAQ,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,SACzF,oBAAoB,IAAI,MAAM,GAAG,cACjC,oBAAI,KAAK;AACX,UAAM,UAAU,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS,GAAG,YAAY;AAEzF,UAAM,aACH,OAAO,SAAS,aAAa,YAAY,QAAQ,WAAW,QAAQ,WAAW,UAC/E,YAAY,WAAW,SAAS,KAAK,QAAQ,MAAM;AAEtD,UAAM,MAA0B;AAAA,MAC9B,IAAI;AAAA,MACJ;AAAA,MACA,cAAc,YAAY,SAAS,WAAW,WAAW,SAAS;AAAA,MAClE,YAAY,cAAc,SAAS,YAAY,WAAW,UAAU;AAAA,MACpE;AAAA,MACA,UAAU,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC/B,WAAW,SAAS,CAAC,GAAG,SAAS;AAAA,MACjC;AAAA,MACA,YAAY,mBAAmB,OAAO,eAAe,YAAY,IAAI,YAAY,KAAK,OAAO;AAAA,MAC7F,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,IAAI,SAAS;AAC3C,QAAI,UAAU;AACZ,eAAS,SAAS,KAAK,GAAG;AAAA,IAC5B,OAAO;AACL,mBAAa,IAAI,WAAW;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,cAAc,CAAC;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd;AAAA,QACA,eAAe;AAAA,QACf,UAAU,CAAC,GAAG;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,UAA+B,CAAC;AACtC,aAAW,UAAU,aAAa,OAAO,GAAG;AAC1C,WAAO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAC/D,QAAI,OAAO,SAAS,SAAS,sBAAsB;AACjD,aAAO,WAAW,OAAO,SAAS,MAAM,OAAO,SAAS,SAAS,oBAAoB;AAAA,IACvF;AACA,UAAM,OAAO,OAAO,SAAS,OAAO,SAAS,SAAS,CAAC;AACvD,UAAM,mBAAmB,OAAO,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AAC9D,UAAM,iBAAiB,oBAAI,IAAY;AACvC,eAAW,WAAW,OAAO,UAAU;AAErC,UAAI,QAAQ,cAAc,aAAa,QAAQ,UAAW,gBAAe,IAAI,QAAQ,SAAS;AAC9F,UAAI,QAAQ,cAAc,WAAY,SAAQ,GAAG,QAAQ,CAAC,UAAU,eAAe,IAAI,KAAK,CAAC;AAAA,IAC/F;AACA,WAAO,UAAU,kBAAkB,WAAW,OAAO;AACrD,WAAO,UAAU,SAAS,MAAM,YAAY,IAAI;AAChD,WAAO,eAAe,MAAM,KAAK,cAAc;AAC/C,WAAO,gBAAgB,MAAM,UAAU,OAAO;AAC9C,WAAO,gBAAgB,MAAM,aAAa,OAAO;AACjD,WAAO,cAAc,MAAM,eAAe,OAAO;AACjD,WAAO,eAAe,OAAO,SAAS;AACtC,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,cAAc,EAAE,aAAa,CAAC;AACrE,SAAO,QAAQ,MAAM,GAAG,UAAU;AACpC;",
   "names": []
 }

package/dist/modules/customers/lib/reassignDealOwner.js

@@ -0,0 +1,25 @@
+import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+const BULK_UPDATE_OWNER_ENDPOINT = "/api/customers/deals/bulk-update-owner";
+async function requestBulkOwnerReassignment(params) {
+  const call = await apiCall(BULK_UPDATE_OWNER_ENDPOINT, {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ ids: params.ids, ownerUserId: params.ownerUserId })
+  });
+  if (!call.ok) throw new Error(params.errorMessage);
+  return { progressJobId: call.result?.progressJobId ?? null };
+}
+function buildReassignOwnerSuccess(params) {
+  return {
+    ok: true,
+    progressJobId: params.progressJobId,
+    affectedCount: params.ids.length,
+    message: params.message
+  };
+}
+export {
+  BULK_UPDATE_OWNER_ENDPOINT,
+  buildReassignOwnerSuccess,
+  requestBulkOwnerReassignment
+};
+//# sourceMappingURL=reassignDealOwner.js.map

package/dist/modules/customers/lib/reassignDealOwner.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/lib/reassignDealOwner.ts"],
+  "sourcesContent": ["import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport type { BulkActionExecuteResult } from '@open-mercato/ui/backend/DataTable'\n\nexport const BULK_UPDATE_OWNER_ENDPOINT = '/api/customers/deals/bulk-update-owner'\n\ntype BulkUpdateOwnerResponse = {\n  ok: boolean\n  progressJobId: string | null\n  message: string\n}\n\n/**\n * Posts a bulk owner reassignment and returns the queued job id.\n *\n * Split out of the deals list page so the request shape and the progress-id passthrough are\n * testable without rendering the page. `errorMessage` is supplied by the caller because the\n * page owns translation; it is thrown as-is so the guarded-mutation wrapper surfaces the same\n * text it did before this was extracted.\n */\nexport async function requestBulkOwnerReassignment(params: {\n  ids: string[]\n  ownerUserId: string\n  errorMessage: string\n}): Promise<{ progressJobId: string | null }> {\n  const call = await apiCall<BulkUpdateOwnerResponse>(BULK_UPDATE_OWNER_ENDPOINT, {\n    method: 'POST',\n    headers: { 'content-type': 'application/json' },\n    body: JSON.stringify({ ids: params.ids, ownerUserId: params.ownerUserId }),\n  })\n  if (!call.ok) throw new Error(params.errorMessage)\n  return { progressJobId: call.result?.progressJobId ?? null }\n}\n\n/**\n * The success shape handed back to `DataTable`. Returning `ok: true` with a `progressJobId` is\n * what makes the table clear the row selection and track the job in the top bar \u2014 that side of\n * the contract is covered by `DataTable.propBulkActions.test.tsx`; this builder is what keeps\n * our half of it honest.\n */\nexport function buildReassignOwnerSuccess(params: {\n  ids: string[]\n  progressJobId: string | null\n  message: string\n}): BulkActionExecuteResult {\n  return {\n    ok: true,\n    progressJobId: params.progressJobId,\n    affectedCount: params.ids.length,\n    message: params.message,\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,eAAe;AAGjB,MAAM,6BAA6B;AAgB1C,eAAsB,6BAA6B,QAIL;AAC5C,QAAM,OAAO,MAAM,QAAiC,4BAA4B;AAAA,IAC9E,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,IAC9C,MAAM,KAAK,UAAU,EAAE,KAAK,OAAO,KAAK,aAAa,OAAO,YAAY,CAAC;AAAA,EAC3E,CAAC;AACD,MAAI,CAAC,KAAK,GAAI,OAAM,IAAI,MAAM,OAAO,YAAY;AACjD,SAAO,EAAE,eAAe,KAAK,QAAQ,iBAAiB,KAAK;AAC7D;AAQO,SAAS,0BAA0B,QAId;AAC1B,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,eAAe,OAAO;AAAA,IACtB,eAAe,OAAO,IAAI;AAAA,IAC1B,SAAS,OAAO;AAAA,EAClB;AACF;",
+  "names": []
+}

package/dist/modules/customers/lib/userNames.js

@@ -0,0 +1,26 @@
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { User } from "@open-mercato/core/modules/auth/data/entities";
+async function resolveUserNames(em, tenantId, organizationId, userIds) {
+  const names = /* @__PURE__ */ new Map();
+  const unique = Array.from(new Set(userIds.filter((id) => typeof id === "string" && !!id)));
+  if (unique.length === 0) return names;
+  try {
+    const users = await findWithDecryption(
+      em,
+      User,
+      { id: { $in: unique } },
+      void 0,
+      { tenantId, organizationId }
+    );
+    for (const user of Array.isArray(users) ? users : []) {
+      const label = user.name?.trim() || user.email?.trim() || null;
+      if (label) names.set(user.id, label);
+    }
+  } catch {
+  }
+  return names;
+}
+export {
+  resolveUserNames
+};
+//# sourceMappingURL=userNames.js.map

package/dist/modules/customers/lib/userNames.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customers/lib/userNames.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\n\n/**\n * Resolves display labels for a set of user ids, tenant/organization scoped.\n *\n * Used wherever the CRM attributes something to the colleague who did it \u2014 the\n * \"Shared by {name}\" badge on the Emails tab, and the per-message sender label\n * a teammate sees on a shared conversation. Best effort by design: a caller\n * renders a generic fallback for any id that resolves to no label, so a failed\n * lookup degrades the wording rather than the read.\n */\nexport async function resolveUserNames(\n  em: EntityManager,\n  tenantId: string,\n  organizationId: string | null,\n  userIds: Array<string | null | undefined>,\n): Promise<Map<string, string>> {\n  const names = new Map<string, string>()\n  const unique = Array.from(new Set(userIds.filter((id): id is string => typeof id === 'string' && !!id)))\n  if (unique.length === 0) return names\n  try {\n    const users = (await findWithDecryption(\n      em,\n      User,\n      { id: { $in: unique } } as never,\n      undefined,\n      { tenantId, organizationId },\n    )) as Array<{ id: string; name?: string | null; email?: string | null }>\n    for (const user of Array.isArray(users) ? users : []) {\n      const label = user.name?.trim() || user.email?.trim() || null\n      if (label) names.set(user.id, label)\n    }\n  } catch {\n    /* best effort \u2014 callers fall back to a generic label without a name */\n  }\n  return names\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,YAAY;AAWrB,eAAsB,iBACpB,IACA,UACA,gBACA,SAC8B;AAC9B,QAAM,QAAQ,oBAAI,IAAoB;AACtC,QAAM,SAAS,MAAM,KAAK,IAAI,IAAI,QAAQ,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,CAAC,CAAC,EAAE,CAAC,CAAC;AACvG,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,MAAI;AACF,UAAM,QAAS,MAAM;AAAA,MACnB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,OAAO,EAAE;AAAA,MACtB;AAAA,MACA,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,QAAQ,KAAK,MAAM,KAAK,KAAK,KAAK,OAAO,KAAK,KAAK;AACzD,UAAI,MAAO,OAAM,IAAI,KAAK,IAAI,KAAK;AAAA,IACrC;AAAA,EACF,QAAQ;AAAA,EAER;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/customers/lib/visibilityFilter.js

@@ -13,15 +13,70 @@ function canChangeEmailVisibility(opts) {
 }
 function applyEmailVisibilityFilter(query, opts) {
   const currentUserId = opts.currentUserId;
+  const grants = opts.sharedConversations ?? [];
+  const sharedChannelIds = opts.sharedChannelIds ?? [];
   return query.where(
     (eb) => eb.or([
       eb("interaction_type", "!=", "email"),
       eb("visibility", "is", null),
       eb("visibility", "!=", "private"),
-      currentUserId ? eb("author_user_id", "=", currentUserId) : eb.val(false)
+      currentUserId ? eb("author_user_id", "=", currentUserId) : eb.val(false),
+      // Conversation shares: the owner handed their history with this Person to
+      // the team. One arm per grant, each an AND of the two columns the covering
+      // index already leads with.
+      ...grants.map(
+        (grant) => eb.and([
+          eb("entity_id", "=", grant.personEntityId),
+          eb("author_user_id", "=", grant.ownerUserId)
+        ])
+      ),
+      // Shared team mailboxes: the whole channel was handed to the team. One arm
+      // for the whole set, matching the indexed `channel_id` column.
+      ...sharedChannelIds.length > 0 ? [eb("channel_id", "in", sharedChannelIds)] : []
     ])
   );
 }
+function isEmailHiddenFrom(opts) {
+  if (opts.interactionType !== "email") return false;
+  if (opts.visibility !== "private") return false;
+  if (opts.currentUserId && opts.authorUserId && opts.authorUserId === opts.currentUserId) {
+    return false;
+  }
+  const sharedChannelIds = opts.sharedChannelIds ?? [];
+  if (sharedChannelIds.length > 0 && opts.channelId && sharedChannelIds.includes(opts.channelId)) {
+    return false;
+  }
+  const grants = opts.sharedConversations ?? [];
+  if (grants.length > 0 && opts.personEntityId && opts.authorUserId) {
+    const shared = grants.some(
+      (grant) => grant.personEntityId === opts.personEntityId && grant.ownerUserId === opts.authorUserId
+    );
+    if (shared) return false;
+  }
+  return true;
+}
+function applyEmailHiddenFilter(query, opts) {
+  const currentUserId = opts.currentUserId;
+  const grants = opts.sharedConversations ?? [];
+  const sharedChannelIds = opts.sharedChannelIds ?? [];
+  return query.where("interaction_type", "=", "email").where("visibility", "=", "private").where(
+    (eb) => currentUserId ? eb("author_user_id", "!=", currentUserId) : eb.val(true)
+  ).where(
+    (eb) => sharedChannelIds.length === 0 ? eb.val(true) : eb.or([
+      eb("channel_id", "is", null),
+      eb("channel_id", "not in", sharedChannelIds)
+    ])
+  ).where(
+    (eb) => grants.length === 0 ? eb.val(true) : eb.and(
+      grants.map(
+        (grant) => eb.or([
+          eb("entity_id", "!=", grant.personEntityId),
+          eb("author_user_id", "!=", grant.ownerUserId)
+        ])
+      )
+    )
+  );
+}
 async function resolveCallerEmailFeatures(container, userId, tenantId, organizationId) {
   if (!userId) return void 0;
   try {
@@ -33,21 +88,34 @@ async function resolveCallerEmailFeatures(container, userId, tenantId, organizat
   }
 }
 function buildEmailVisibilityMikroFilter(opts) {
+  const grants = opts.sharedConversations ?? [];
+  const sharedChannelIds = opts.sharedChannelIds ?? [];
   return {
     $or: [
       { interactionType: { $ne: "email" } },
       { visibility: null },
       { visibility: { $ne: "private" } },
-      ...opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : []
+      ...opts.currentUserId ? [{ authorUserId: opts.currentUserId }] : [],
+      // Mirrors the kysely share arm: one AND-pair per grant, kept flat inside
+      // this single `$or` so the fragment stays a one-key object.
+      ...grants.map((grant) => ({
+        entity: grant.personEntityId,
+        authorUserId: grant.ownerUserId
+      })),
+      // Mirrors the kysely channel arm. Still flat inside this single `$or`, so
+      // the fragment stays a one-key object every caller can spread losslessly.
+      ...sharedChannelIds.length > 0 ? [{ channelId: { $in: sharedChannelIds } }] : []
     ]
   };
 }
 export {
   EMAIL_VIEW_PRIVATE_FEATURE,
+  applyEmailHiddenFilter,
   applyEmailVisibilityFilter,
   buildEmailVisibilityMikroFilter,
   callerHasEmailViewPrivate,
   canChangeEmailVisibility,
+  isEmailHiddenFrom,
   resolveCallerEmailFeatures
 };
 //# sourceMappingURL=visibilityFilter.js.map