@open-mercato/core 0.8.1-develop.7297.1.67605e74f9 → 0.9.0

package/dist/modules/communication_channels/api/put/channels/[id]/visibility/route.js

@@ -0,0 +1,137 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { readOptimisticLockExpected } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import {
+  CHANNEL_VISIBILITY_VALUES,
+  COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID
+} from "../../../../../commands/set-channel-visibility.js";
+import { validateRouteMutationGuard } from "../../../../../lib/route-mutation-guard.js";
+const metadata = {
+  path: "/communication_channels/channels/[id]/visibility",
+  PUT: {
+    // Owner self-service, exactly like set-primary: the command enforces strict
+    // ownership (`not_owner` → 404), so the dedicated share feature is the right
+    // gate. `communication_channels.admin` stays inert — there is deliberately no
+    // admin path to share someone else's mailbox.
+    requireAuth: true,
+    requireFeatures: ["communication_channels.share_own_channel"]
+  }
+};
+const bodySchema = z.object({ visibility: z.enum(CHANNEL_VISIBILITY_VALUES) }).strict();
+async function PUT(req, context) {
+  const { id } = await context.params;
+  if (!z.string().uuid().safeParse(id).success) {
+    return NextResponse.json({ error: "Invalid channel id" }, { status: 400 });
+  }
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  if (auth.isApiKey) {
+    return NextResponse.json({ error: "Channel not found" }, { status: 404 });
+  }
+  let body;
+  try {
+    body = bodySchema.parse(await readJsonSafe(req, null));
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Invalid request body" },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: "communication_channels.channel",
+      resourceId: id,
+      operation: "update",
+      mutationPayload: { visibility: body.visibility }
+    }
+  });
+  if ("response" in guard) return guard.response;
+  const organizationId = auth.orgId ?? null;
+  const commandBus = container.resolve("commandBus");
+  const input = {
+    channelId: id,
+    userId: auth.sub,
+    visibility: body.visibility,
+    // Absent header ⇒ no expectation; the shared assertion helper skips the check
+    // rather than blocking clients that never send it.
+    expectedUpdatedAt: readOptimisticLockExpected(req),
+    scope: { tenantId: auth.tenantId, organizationId }
+  };
+  let result;
+  try {
+    const executed = await commandBus.execute(COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID, {
+      input,
+      ctx: {
+        container,
+        auth,
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: organizationId ? [organizationId] : null
+      }
+    });
+    result = executed.result;
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status });
+    }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err);
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status });
+    }
+    throw err;
+  }
+  if (result.status === "not_owner") {
+    return NextResponse.json({ error: "Channel not found" }, { status: 404 });
+  }
+  if (result.status === "noop") {
+    return NextResponse.json(
+      { channelId: id, visibility: body.visibility, unchanged: true },
+      { status: 200 }
+    );
+  }
+  await guard.afterSuccess();
+  return NextResponse.json(
+    {
+      channelId: result.channelId,
+      visibility: body.visibility,
+      previousVisibility: result.previousVisibility
+    },
+    { status: 200 }
+  );
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    PUT: {
+      summary: "Mark your own personal channel as a shared team mailbox (or private again)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 200, description: "Visibility updated (or already at that value)" },
+        { status: 400, description: "Invalid channel id" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Channel not found or not owned by current user" },
+        { status: 409, description: "Optimistic lock conflict" },
+        { status: 422, description: "Invalid body" }
+      ]
+    }
+  }
+};
+var route_default = PUT;
+export {
+  PUT,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/put/channels/[id]/visibility/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/communication_channels/api/put/channels/%5Bid%5D/visibility/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport {\n  CHANNEL_VISIBILITY_VALUES,\n  COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID,\n  type SetChannelVisibilityInput,\n  type SetChannelVisibilityResult,\n} from '../../../../../commands/set-channel-visibility'\nimport { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'\n\nexport const metadata = {\n  path: '/communication_channels/channels/[id]/visibility',\n  PUT: {\n    // Owner self-service, exactly like set-primary: the command enforces strict\n    // ownership (`not_owner` \u2192 404), so the dedicated share feature is the right\n    // gate. `communication_channels.admin` stays inert \u2014 there is deliberately no\n    // admin path to share someone else's mailbox.\n    requireAuth: true,\n    requireFeatures: ['communication_channels.share_own_channel'],\n  },\n}\n\nconst bodySchema = z.object({ visibility: z.enum(CHANNEL_VISIBILITY_VALUES) }).strict()\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function PUT(req: Request, context: RouteContext): Promise<Response> {\n  const { id } = await context.params\n  if (!z.string().uuid().safeParse(id).success) {\n    return NextResponse.json({ error: 'Invalid channel id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  // An API-key principal owns no mailbox, so it has nothing to share.\n  if ((auth as { isApiKey?: boolean }).isApiKey) {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const guard = await validateRouteMutationGuard({\n    container,\n    req,\n    auth,\n    input: {\n      resourceKind: 'communication_channels.channel',\n      resourceId: id,\n      operation: 'update',\n      mutationPayload: { visibility: body.visibility },\n    },\n  })\n  if ('response' in guard) return guard.response\n\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const commandBus = container.resolve('commandBus') as CommandBus\n\n  const input: SetChannelVisibilityInput = {\n    channelId: id,\n    userId: auth.sub as string,\n    visibility: body.visibility,\n    // Absent header \u21D2 no expectation; the shared assertion helper skips the check\n    // rather than blocking clients that never send it.\n    expectedUpdatedAt: readOptimisticLockExpected(req),\n    scope: { tenantId: auth.tenantId as string, organizationId },\n  }\n\n  let result: SetChannelVisibilityResult\n  try {\n    const executed = await commandBus.execute<\n      SetChannelVisibilityInput,\n      SetChannelVisibilityResult\n    >(COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    result = executed.result\n  } catch (err) {\n    // Surfaces the 409 optimistic-lock conflict with its intended status rather\n    // than a generic 500.\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    throw err\n  }\n\n  // Non-ownership maps to 404 (existence masking), consistent with every other\n  // channel-scoped route.\n  if (result.status === 'not_owner') {\n    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })\n  }\n  if (result.status === 'noop') {\n    return NextResponse.json(\n      { channelId: id, visibility: body.visibility, unchanged: true },\n      { status: 200 },\n    )\n  }\n\n  // A channel flip is a strictly BROADER widening than a per-conversation share \u2014\n  // it exposes a whole mailbox \u2014 so the CRM's person-detail cache must drop the\n  // entries whose email rows this just changed. That invalidation belongs to the\n  // customers module and reaches it through the\n  // `communication_channels.channel.visibility_changed` event the command emits\n  // with the tenant/organization scope: this hub must not import customers to do\n  // its own write. See customers/subscribers/channel-visibility-changed.ts.\n  await guard.afterSuccess()\n  return NextResponse.json(\n    {\n      channelId: result.channelId,\n      visibility: body.visibility,\n      previousVisibility: result.previousVisibility,\n    },\n    { status: 200 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    PUT: {\n      summary: 'Mark your own personal channel as a shared team mailbox (or private again)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 200, description: 'Visibility updated (or already at that value)' },\n        { status: 400, description: 'Invalid channel id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Channel not found or not owned by current user' },\n        { status: 409, description: 'Optimistic lock conflict' },\n        { status: 422, description: 'Invalid body' },\n      ],\n    },\n  },\n}\n\nexport default PUT\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAC7B,SAAS,uBAAuB;AAChC,SAAS,0CAA0C;AACnD,SAAS,kCAAkC;AAE3C;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,IAKH,aAAa;AAAA,IACb,iBAAiB,CAAC,0CAA0C;AAAA,EAC9D;AACF;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,YAAY,EAAE,KAAK,yBAAyB,EAAE,CAAC,EAAE,OAAO;AAMtF,eAAsB,IAAI,KAAc,SAA0C;AAChF,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,SAAS;AAC5C,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAK,KAAgC,UAAU;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,2BAA2B;AAAA,IAC7C;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,YAAY,KAAK,WAAW;AAAA,IACjD;AAAA,EACF,CAAC;AACD,MAAI,cAAc,MAAO,QAAO,MAAM;AAEtC,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,aAAa,UAAU,QAAQ,YAAY;AAEjD,QAAM,QAAmC;AAAA,IACvC,WAAW;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,YAAY,KAAK;AAAA;AAAA;AAAA,IAGjB,mBAAmB,2BAA2B,GAAG;AAAA,IACjD,OAAO,EAAE,UAAU,KAAK,UAAoB,eAAe;AAAA,EAC7D;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,WAAW,QAGhC,kDAAkD;AAAA,MAClD;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,aAAS,SAAS;AAAA,EACpB,SAAS,KAAK;AAGZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM;AAAA,EACR;AAIA,MAAI,OAAO,WAAW,aAAa;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,MAAI,OAAO,WAAW,QAAQ;AAC5B,WAAO,aAAa;AAAA,MAClB,EAAE,WAAW,IAAI,YAAY,KAAK,YAAY,WAAW,KAAK;AAAA,MAC9D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AASA,QAAM,MAAM,aAAa;AACzB,SAAO,aAAa;AAAA,IAClB;AAAA,MACE,WAAW,OAAO;AAAA,MAClB,YAAY,KAAK;AAAA,MACjB,oBAAoB,OAAO;AAAA,IAC7B;AAAA,IACA,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,gDAAgD;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,qBAAqB;AAAA,QACjD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,iDAAiD;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,QACvD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,MAC7C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/backend/profile/communication-channels/page.js

@@ -21,7 +21,11 @@ import { Input } from "@open-mercato/ui/primitives/input";
 import { Label } from "@open-mercato/ui/primitives/label";
 import { Textarea } from "@open-mercato/ui/primitives/textarea";
 import { KbdShortcut } from "@open-mercato/ui/primitives/kbd";
-import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { RowActions } from "@open-mercato/ui/backend/RowActions";
+import { apiCall, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { surfaceRecordConflict } from "@open-mercato/ui/backend/conflicts";
+import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
 import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
@@ -46,6 +50,7 @@ function ProfileCommunicationChannelsPage() {
     contextId: PROFILE_CHANNELS_MUTATION_CONTEXT_ID,
     blockedMessage: t("ui.forms.flash.saveBlocked", "Save blocked by validation")
   });
+  const { confirm, ConfirmDialogElement } = useConfirmDialog();
   React.useEffect(() => {
     if (flashType === "connected") {
       flash(
@@ -62,6 +67,12 @@ function ProfileCommunicationChannelsPage() {
         ) : flashCode === "mailbox_already_connected" ? t(
           "communication_channels.profile.connect.mailboxAlreadyConnected",
           "This mailbox is already connected through another provider. Disconnect it first to reconnect it with a different one."
+        ) : flashCode === "replay" ? t(
+          "communication_channels.profile.flash.replayedState",
+          "This connection link was already used \u2014 please start the connection again."
+        ) : flashCode === "state_store_unavailable" ? t(
+          "communication_channels.profile.flash.stateStoreUnavailable",
+          "A server error prevented completing the connection. Please try again in a moment."
         ) : flashCode ? t("communication_channels.profile.flash.errorWithCode", "Failed to connect channel \u2014 {code}.", {
           code: flashCode
         }) : t("communication_channels.profile.flash.error", "Failed to connect channel."),
@@ -100,6 +111,74 @@ function ProfileCommunicationChannelsPage() {
   }, [reloadKey, t]);
   const reauthRows = rows.filter((r) => r.status === "requires_reauth");
   const reloadChannels = React.useCallback(() => setReloadKey((k) => k + 1), []);
+  const onSetVisibility = React.useCallback(
+    async (channel, nextShared) => {
+      if (nextShared) {
+        const confirmed = await confirm({
+          title: t(
+            "communication_channels.profile.share.confirm.title",
+            "Share this mailbox with your team?"
+          ),
+          text: t(
+            "communication_channels.profile.share.confirm.text",
+            "Colleagues will be able to read the CRM email this mailbox handles, including messages already received. You stay the only person who can manage the connection, and you can stop sharing at any time."
+          ),
+          confirmText: t("communication_channels.profile.share.confirm.cta", "Share with team")
+        });
+        if (!confirmed) return;
+      }
+      const nextVisibility = nextShared ? "shared" : "private";
+      let response;
+      try {
+        response = await runMutation({
+          operation: () => withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(channel.updatedAt),
+            () => apiCall(
+              `/api/communication_channels/channels/${encodeURIComponent(channel.id)}/visibility`,
+              {
+                method: "PUT",
+                headers: { "content-type": "application/json" },
+                body: JSON.stringify({ visibility: nextVisibility })
+              }
+            )
+          ),
+          context: {
+            formId: PROFILE_CHANNELS_MUTATION_CONTEXT_ID,
+            resourceKind: "communication_channels.channel",
+            resourceId: channel.id,
+            retryLastMutation
+          },
+          mutationPayload: { visibility: nextVisibility }
+        });
+      } catch (err) {
+        if (surfaceRecordConflict(err, t)) return;
+        flash(
+          err instanceof Error ? err.message : t("communication_channels.profile.share.failed", "Failed to update sharing"),
+          "error"
+        );
+        return;
+      }
+      if (!response.ok) {
+        if (surfaceRecordConflict(
+          { status: response.status, body: response.result },
+          t,
+          { onRefresh: () => setReloadKey((k) => k + 1) }
+        )) return;
+        const body = response.result;
+        flash(
+          body?.error ?? t("communication_channels.profile.share.failed", "Failed to update sharing"),
+          "error"
+        );
+        return;
+      }
+      flash(
+        nextShared ? t("communication_channels.profile.share.sharedSuccess", "Mailbox shared with your team.") : t("communication_channels.profile.share.privateSuccess", "Mailbox is private again."),
+        "success"
+      );
+      setReloadKey((k) => k + 1);
+    },
+    [runMutation, retryLastMutation, confirm, t]
+  );
   const onSetPrimary = React.useCallback(
     async (channelId) => {
       let response;
@@ -242,17 +321,18 @@ function ProfileCommunicationChannelsPage() {
       {
         header: t("communication_channels.profile.columns.primary", "Primary"),
         accessorKey: "isPrimary",
-        cell: ({ row }) => row.original.isPrimary ? /* @__PURE__ */ jsx(Tag, { variant: "success", dot: true, children: t("communication_channels.profile.primary", "Primary") }) : /* @__PURE__ */ jsx(
-          Button,
-          {
-            type: "button",
-            variant: "outline",
-            size: "sm",
-            onClick: () => void onSetPrimary(row.original.id),
-            "aria-label": t("communication_channels.profile.actions.setPrimary", "Set as primary"),
-            children: t("communication_channels.profile.actions.setPrimary", "Set as primary")
-          }
-        )
+        // Status only — "Set as primary" lives in the row actions menu.
+        cell: ({ row }) => row.original.isPrimary ? /* @__PURE__ */ jsx(Tag, { variant: "success", dot: true, children: t("communication_channels.profile.primary", "Primary") }) : /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: "\u2014" })
+      },
+      {
+        header: t("communication_channels.profile.columns.sharing", "Team access"),
+        accessorKey: "visibility",
+        // Status only — the share/unshare flip lives in the row actions menu.
+        //
+        // Only email ingestion writes customer_interactions, so on an SMS or push
+        // channel a share would flip the flag and flash success while changing
+        // nothing anyone can observe. The menu applies the same email-only rule.
+        cell: ({ row }) => row.original.channelType !== "email" ? /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: "\u2014" }) : row.original.visibility === "shared" ? /* @__PURE__ */ jsx(Tag, { variant: "info", dot: true, children: t("communication_channels.profile.share.shared", "Shared") }) : /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: t("communication_channels.profile.share.private", "Only you") })
       },
       {
         header: t("communication_channels.columns.status", "Status"),
@@ -274,115 +354,100 @@ function ProfileCommunicationChannelsPage() {
             if (ps === "failed") {
               return /* @__PURE__ */ jsx(Tag, { variant: "error", dot: true, title: errorTitle, children: t("communication_channels.push.status.pushDrivenFailed", "Push connection failed") });
             }
-            return /* @__PURE__ */ jsx(Tag, { variant: "success", dot: true, children: t("communication_channels.push.status.pushDriven", "Push-driven") });
+            return /* @__PURE__ */ jsx(
+              Tag,
+              {
+                variant: "success",
+                dot: true,
+                title: t(
+                  "communication_channels.profile.actions.pollNowPushDriven",
+                  "This channel is push-driven \u2014 inbound messages arrive over the provider connection, so polling does not apply."
+                ),
+                children: t("communication_channels.push.status.pushDriven", "Push-driven")
+              }
+            );
           }
           if (ps === "active") {
             return /* @__PURE__ */ jsx(Tag, { variant: "success", dot: true, children: t("communication_channels.push.status.active", "Push active") });
           }
           if (ps === "failed") {
-            return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
-              /* @__PURE__ */ jsx(Tag, { variant: "error", dot: true, children: t("communication_channels.push.status.failed", "Push failed \u2014 using polling") }),
-              /* @__PURE__ */ jsx(
-                Button,
-                {
-                  type: "button",
-                  variant: "outline",
-                  size: "sm",
-                  onClick: () => void onRegisterPush(row.original.id),
-                  "aria-label": t("communication_channels.push.button.reregister", "Re-register push"),
-                  title: errorTitle,
-                  children: t("communication_channels.push.button.reregister", "Re-register push")
-                }
-              )
-            ] });
+            return /* @__PURE__ */ jsx(Tag, { variant: "error", dot: true, title: errorTitle, children: t("communication_channels.push.status.failed", "Push failed \u2014 using polling") });
           }
-          return /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2", children: [
-            /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: row.original.supportsRealtimePush ? t("communication_channels.push.status.notRegistered", "Push not registered") : t("communication_channels.push.status.inactive", "Polling only") }),
-            /* @__PURE__ */ jsx(
-              Button,
-              {
-                type: "button",
-                variant: "outline",
-                size: "sm",
-                onClick: () => void onRegisterPush(row.original.id),
-                "aria-label": t("communication_channels.push.button.reregister", "Re-register push"),
-                children: t("communication_channels.push.button.reregister", "Re-register push")
-              }
-            )
-          ] });
+          return /* @__PURE__ */ jsx("span", { className: "text-xs text-muted-foreground", children: row.original.supportsRealtimePush ? t("communication_channels.push.status.notRegistered", "Push not registered") : t("communication_channels.push.status.inactive", "Polling only") });
         }
       },
       {
         header: t("communication_channels.profile.columns.lastPolled", "Last synced"),
         accessorKey: "lastPolledAt",
         cell: ({ row }) => row.original.lastPolledAt ? new Date(row.original.lastPolledAt).toLocaleString() : "\u2014"
-      },
-      {
-        id: "importHistory",
-        header: t("communication_channels.profile.columns.importHistory", "History"),
-        cell: ({ row }) => {
-          const eligible = row.original.isActive && row.original.status === "connected" && row.original.channelType === "email";
-          const label = t("communication_channels.profile.actions.importHistory", "Import history");
-          return /* @__PURE__ */ jsx(
-            Button,
-            {
-              type: "button",
-              variant: "outline",
-              size: "sm",
-              onClick: () => setImportChannel(row.original),
-              disabled: !eligible,
-              "aria-label": label,
-              children: label
-            }
-          );
-        }
-      },
-      {
-        id: "pollNow",
-        header: t("communication_channels.profile.columns.pollNow", "Sync"),
-        cell: ({ row }) => {
-          const pushDriven = row.original.supportsRealtimePush;
-          const pollable = row.original.isActive && !pushDriven && (row.original.status === "connected" || row.original.status === "error");
-          const label = row.original.status === "error" ? t("communication_channels.profile.actions.retryPoll", "Retry") : t("communication_channels.profile.actions.pollNow", "Poll now");
-          const disabledReason = pushDriven ? t(
-            "communication_channels.profile.actions.pollNowPushDriven",
-            "This channel is push-driven \u2014 inbound messages arrive over the provider connection, so polling does not apply."
-          ) : void 0;
-          const button = /* @__PURE__ */ jsx(
-            Button,
-            {
-              type: "button",
-              variant: row.original.status === "error" ? "default" : "outline",
-              size: "sm",
-              onClick: () => void onPollNow(row.original.id),
-              disabled: !pollable,
-              "aria-label": disabledReason ? `${label} \u2014 ${disabledReason}` : label,
-              children: label
+      }
+    ],
+    [t]
+  );
+  const rowActions = React.useCallback(
+    (channel) => {
+      const items = [];
+      if (!channel.isPrimary) {
+        items.push({
+          id: "set-primary",
+          label: t("communication_channels.profile.actions.setPrimary", "Set as primary"),
+          onSelect: () => {
+            void onSetPrimary(channel.id);
+          }
+        });
+      }
+      if (channel.channelType === "email") {
+        items.push(
+          channel.visibility === "shared" ? {
+            id: "make-private",
+            label: t("communication_channels.profile.share.makePrivate", "Make private"),
+            onSelect: () => {
+              void onSetVisibility(channel, false);
             }
-          );
-          return disabledReason ? /* @__PURE__ */ jsx("span", { title: disabledReason, children: button }) : button;
-        }
-      },
-      {
-        id: "disconnect",
-        header: t("communication_channels.profile.columns.disconnect", "Connection"),
-        cell: ({ row }) => {
-          const label = t("communication_channels.profile.actions.disconnect", "Disconnect");
-          return /* @__PURE__ */ jsx(
-            Button,
-            {
-              type: "button",
-              variant: "outline",
-              size: "sm",
-              onClick: () => setDisconnectChannel(row.original),
-              "aria-label": label,
-              children: label
+          } : {
+            id: "share-with-team",
+            label: t("communication_channels.profile.share.shareCta", "Share with team"),
+            onSelect: () => {
+              void onSetVisibility(channel, true);
             }
-          );
-        }
+          }
+        );
       }
-    ],
-    [onSetPrimary, onPollNow, onRegisterPush, t]
+      if (channel.supportsPushRegistration && channel.pushStatus !== "active") {
+        items.push({
+          id: "register-push",
+          label: t("communication_channels.push.button.reregister", "Re-register push"),
+          onSelect: () => {
+            void onRegisterPush(channel.id);
+          }
+        });
+      }
+      if (channel.isActive && channel.status === "connected" && channel.channelType === "email") {
+        items.push({
+          id: "import-history",
+          label: t("communication_channels.profile.actions.importHistory", "Import history"),
+          onSelect: () => setImportChannel(channel)
+        });
+      }
+      const pollable = channel.isActive && !channel.supportsRealtimePush && (channel.status === "connected" || channel.status === "error");
+      if (pollable) {
+        items.push({
+          id: "poll-now",
+          label: channel.status === "error" ? t("communication_channels.profile.actions.retryPoll", "Retry") : t("communication_channels.profile.actions.pollNow", "Poll now"),
+          onSelect: () => {
+            void onPollNow(channel.id);
+          }
+        });
+      }
+      items.push({
+        id: "disconnect",
+        label: t("communication_channels.profile.actions.disconnect", "Disconnect"),
+        destructive: true,
+        onSelect: () => setDisconnectChannel(channel)
+      });
+      return /* @__PURE__ */ jsx(RowActions, { items });
+    },
+    [onSetPrimary, onSetVisibility, onPollNow, onRegisterPush, t]
   );
   return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsxs(PageBody, { children: [
     /* @__PURE__ */ jsxs("header", { className: "mb-4 flex flex-col gap-3 sm:flex-row sm:items-start sm:justify-between sm:gap-4", children: [
@@ -407,6 +472,8 @@ function ProfileCommunicationChannelsPage() {
         titleHeadingLevel: 2,
         extensionTableId: extensionPoints.hosts.profileChannelsTable.tableId,
         columns,
+        rowActions,
+        stickyActionsColumn: true,
         data: rows,
         isLoading,
         error: errorMessage,
@@ -437,7 +504,8 @@ function ProfileCommunicationChannelsPage() {
           setReloadKey((k) => k + 1);
         }
       }
-    )
+    ),
+    ConfirmDialogElement
   ] }) });
 }
 function ImportHistoryDialog({ channel, onClose, onQueued }) {