@open-mercato/core 0.8.1-develop.7452.1.5e211edd51 → 0.8.1-develop.7455.1.8f7e53badb

package/dist/modules/communication_channels/commands/deliver-outbound-message.js

@@ -36,6 +36,10 @@ const deliverInputSchema = z.object({
   forceCredentialRefresh: z.boolean().optional()
 });
 const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID = "communication_channels.message.deliver_outbound";
+function omitRawMessage(metadata) {
+  if (!metadata) return {};
+  return Object.fromEntries(Object.entries(metadata).filter(([key]) => key !== "rawMessage"));
+}
 const deliverOutboundMessageCommand = {
   id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,
   async execute(rawInput, ctx) {
@@ -311,7 +315,7 @@ const deliverOutboundMessageCommand = {
       link.externalMessageId = externalMessageRowId;
       link.channelMetadata = {
         ...link.channelMetadata ?? {},
-        ...converted.metadata ?? {},
+        ...omitRawMessage(converted.metadata),
         externalMessageId: sendResult.externalMessageId,
         // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ
         // strategy in lib/thread-matcher) and sent-folder dedup can resolve this

package/dist/modules/communication_channels/commands/deliver-outbound-message.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/commands/deliver-outbound-message.ts"],
-  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport { resolveOutboundReplyExternalId, stripCallerReplyTargeting } from '../lib/outbound-reply-ref'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst moduleLogger = createLogger('communication_channels').child({ component: 'deliver-outbound-message' })\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    //\n    // Key the org on the CHANNEL's own org, not the message's org. Tenant-wide\n    // channels store `organization_id = NULL` and their credentials live at\n    // `organization_id = tenantId` (see connect-credential-channel.ts), so\n    // `channel.organizationId ?? tenantId` matches the write key for both\n    // org-scoped and tenant-wide channels. Keying on the message org would\n    // resolve `{}` the moment a tenant-wide provider delivers from a message\n    // that carries a non-null org.\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: channel.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => moduleLogger.warn('credential refresh diagnostic', { details: args }),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      moduleLogger.warn('thread token unavailable, proceeding without it', { err: tokenErr })\n    }\n\n    // (4c) Chat-provider reply threading \u2014 resolve the provider-native id of the\n    // message this one answers so a threading adapter can attach it (Discord's\n    // `message_reference`). Email adapters ignore this and keep threading on the\n    // `inReplyTo` / `references` headers built above. Best-effort like the thread\n    // token: an unresolvable parent sends an unthreaded reply rather than failing\n    // a delivery.\n    let replyToExternalId: string | null = null\n    try {\n      replyToExternalId = await resolveOutboundReplyExternalId(em, {\n        parentMessageId: message.parentMessageId ?? null,\n        externalConversationId: mapping.externalConversationId,\n        capabilities: adapter.capabilities,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n      })\n    } catch (replyRefErr) {\n      moduleLogger.warn('outbound reply reference unavailable, sending unthreaded', {\n        err: replyRefErr,\n      })\n    }\n    if (!replyToExternalId && message.parentMessageId && adapter.capabilities?.threading === true) {\n      // The provider threads and the caller asked for a reply, yet nothing\n      // resolved \u2014 the parent never reached this channel, or it belongs to\n      // another conversation. Delivery is unaffected, but say so: an unthreaded\n      // reply is otherwise indistinguishable from a non-reply, which is exactly\n      // the silent-unreachability shape #5541 was filed about.\n      moduleLogger.debug('reply parent has no external id on this channel, sending unthreaded', {\n        messageId: message.id,\n        parentMessageId: message.parentMessageId,\n        conversationId: mapping.externalConversationId,\n      })\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          // Reply targeting is hub-resolved only. `send-as-user` merges\n          // caller-supplied metadata onto the link, so every reply-targeting key\n          // is stripped off the stored metadata here rather than merely\n          // out-ranked below: merge order settles the contest only when the hub\n          // resolved a parent, and the uncontested case \u2014 no `parentMessageId`,\n          // or a parent that does not resolve \u2014 is exactly the one a caller\n          // controls.\n          ...stripCallerReplyTargeting(baseMetadata),\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n          ...(replyToExternalId ? { replyToExternalId } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: channel.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...(converted.metadata ?? {}),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          // #6095: same contract as the inbound path \u2014 the send time travels on\n          // the event so consumers (the customers timeline) date their rows\n          // from it instead of reading the ExternalMessage row across the\n          // module boundary. ISO string because this event is persistent.\n          providerTimestamp:\n            externalMessage.providerTimestamp instanceof Date\n              ? externalMessage.providerTimestamp.toISOString()\n              : null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,gCAAgC,iCAAiC;AAE1E,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,eAAe,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,2BAA2B,CAAC;AAM3G,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAyCF,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAYA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,MACtD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,aAAa,KAAK,iCAAiC,EAAE,SAAS,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,mBAAa,KAAK,mDAAmD,EAAE,KAAK,SAAS,CAAC;AAAA,IACxF;AAQA,QAAI,oBAAmC;AACvC,QAAI;AACF,0BAAoB,MAAM,+BAA+B,IAAI;AAAA,QAC3D,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,wBAAwB,QAAQ;AAAA,QAChC,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,aAAa;AACpB,mBAAa,KAAK,4DAA4D;AAAA,QAC5E,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB,QAAQ,mBAAmB,QAAQ,cAAc,cAAc,MAAM;AAM7F,mBAAa,MAAM,uEAAuE;AAAA,QACxF,WAAW,QAAQ;AAAA,QACnB,iBAAiB,QAAQ;AAAA,QACzB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQnB,GAAG,0BAA0B,YAAY;AAAA,UACzC,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,UACpD,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACnD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,QACxD;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAI,UAAU,YAAY,CAAC;AAAA,QAC3B,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,UAKX,mBACE,gBAAgB,6BAA6B,OACzC,gBAAgB,kBAAkB,YAAY,IAC9C;AAAA,UACN,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
+  "sourcesContent": ["import { randomUUID } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandHandler } from '@open-mercato/shared/lib/commands'\nimport { registerCommand } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { emitCommunicationChannelsEvent } from '../events'\nimport { refreshCredentialsIfNeeded } from '../lib/credential-refresh'\nimport { classifyOutboundError, isReauthError } from '../lib/error-classification'\nimport {\n  buildBodyFooter,\n  buildReferencesId,\n  getOrCreateThreadToken,\n} from '../lib/thread-token'\nimport { stringOrUndefined, stripBrackets } from '../lib/email-mime'\nimport { resolveOutboundReplyExternalId, stripCallerReplyTargeting } from '../lib/outbound-reply-ref'\nimport type { ChannelAdapterRegistry } from '../lib/registry'\nimport { isUniqueViolation } from '../lib/pg-errors'\nimport { Message } from '../../messages/data/entities'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalMessage,\n  MessageChannelLink,\n} from '../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst moduleLogger = createLogger('communication_channels').child({ component: 'deliver-outbound-message' })\n\n/**\n * Sentinel \u2014 `Message.threadId` of an internal-only (no channel link) message\n * has no matching `ChannelThreadMapping`. In that case outbound delivery is a no-op.\n */\nconst NO_THREAD_MAPPING_RESULT = { status: 'no_channel_link' as const }\n\nconst deliverInputSchema = z.object({\n  messageId: z.string().uuid(),\n  scope: z.object({\n    tenantId: z.string().uuid(),\n    organizationId: z.string().uuid().nullable(),\n  }),\n  /**\n   * If true, force a credential refresh before sending \u2014 used by retry attempts\n   * after a 401 from the provider.\n   */\n  forceCredentialRefresh: z.boolean().optional(),\n})\n\nexport type DeliverOutboundMessageInput = z.infer<typeof deliverInputSchema>\n\nexport type DeliverOutboundMessageResult =\n  | { status: 'no_channel_link' }\n  | { status: 'already_delivered'; messageId: string; channelLinkId: string }\n  | {\n      status: 'delivered'\n      messageId: string\n      channelLinkId: string\n      externalMessageId: string\n      providerKey: string\n    }\n  | {\n      status: 'failed'\n      messageId: string\n      channelLinkId: string\n      providerKey: string\n      error: string\n      transient: boolean\n      /**\n       * True when the failure was a 401 / invalid_grant \u2014 the channel was\n       * flipped to `requires_reauth`. The worker uses this to attempt one\n       * forced credential refresh before giving up.\n       */\n      requiresReauth: boolean\n    }\n\nexport const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =\n  'communication_channels.message.deliver_outbound'\n\nfunction omitRawMessage(metadata: Record<string, unknown> | undefined): Record<string, unknown> {\n  if (!metadata) return {}\n  return Object.fromEntries(Object.entries(metadata).filter(([key]) => key !== 'rawMessage'))\n}\n\ntype CredentialsServiceLike = {\n  resolve: (\n    integrationId: string,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<Record<string, unknown> | null>\n  save?: (\n    integrationId: string,\n    credentials: Record<string, unknown>,\n    scope: { organizationId: string; tenantId: string; userId?: string | null },\n  ) => Promise<void>\n}\n\ntype IntegrationLogLike = {\n  log?: (entry: Record<string, unknown>) => Promise<void> | void\n  warn?: (entry: Record<string, unknown>) => Promise<void> | void\n  error?: (entry: Record<string, unknown>) => Promise<void> | void\n}\n\n/**\n * Outbound delivery command. Called from the outbound worker.\n *\n * Steps (SPEC-045d \u00A77):\n *   1. Re-fetch the Message by ID. Bail if internal-only (no ChannelThreadMapping).\n *   2. Resolve channel + adapter + credentials.\n *   3. Idempotently upsert a 'pending' MessageChannelLink (unique on `messageId`).\n *      Skip if a 'sent'/'delivered' link already exists.\n *   4. Refresh credentials when OAuth + near expiry (or when caller forces it).\n *   5. Call `adapter.convertOutbound(...)` \u2192 channel-native content.\n *   6. Call `adapter.sendMessage(...)`.\n *   7. On success: persist ExternalMessage + flip link to 'sent', emit `.message.sent`.\n *   8. On failure: flip link to 'failed' + classify error, log to integrationLog,\n *      emit `.delivery_failed`. The worker decides whether to retry based on\n *      `result.transient`.\n *\n * Idempotency: the unique constraint on `message_channel_links.message_id`\n * prevents the same Message being sent twice through the channel even if the\n * subscriber fires repeatedly. Combined with the link's lifecycle state\n * (pending \u2192 sent | failed), we get safe retries.\n */\nconst deliverOutboundMessageCommand: CommandHandler<\n  DeliverOutboundMessageInput,\n  DeliverOutboundMessageResult\n> = {\n  id: COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID,\n  async execute(rawInput, ctx) {\n    const input = deliverInputSchema.parse(rawInput) as DeliverOutboundMessageInput\n    const em = (ctx.container.resolve('em') as EntityManager).fork()\n    const dscope = {\n      tenantId: input.scope.tenantId,\n      organizationId: input.scope.organizationId ?? null,\n    }\n\n    // (1) Re-fetch Message by ID \u2014 never trust the event payload shape.\n    const message = await findOneWithDecryption(\n      em,\n      Message,\n      {\n        id: input.messageId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!message) {\n      // Message was deleted before we got to deliver. Treat as no-op.\n      return NO_THREAD_MAPPING_RESULT\n    }\n    if (!message.threadId) {\n      // Message has no thread \u2192 no channel routing.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (1 cont.) Look up the channel link via ChannelThreadMapping.threadId.\n    const mapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        messageThreadId: message.threadId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!mapping) {\n      // Internal-only message \u2014 no channel delivery needed.\n      return NO_THREAD_MAPPING_RESULT\n    }\n\n    // (2) Channel + adapter.\n    const channel = await findOneWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        id: mapping.channelId,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        deletedAt: null,\n      },\n      undefined,\n      dscope,\n    )\n    if (!channel) {\n      throw new Error(\n        `[internal] Channel ${mapping.channelId} not found for tenant ${input.scope.tenantId} (or has been deleted)`,\n      )\n    }\n    if (!channel.isActive) {\n      throw new Error(`[internal] Channel ${mapping.channelId} is inactive; refusing to deliver outbound`)\n    }\n\n    const adapterRegistry = ctx.container.resolve('channelAdapterRegistry') as ChannelAdapterRegistry\n    const adapter = adapterRegistry.get(channel.providerKey)\n    if (!adapter) {\n      throw new Error(\n        `[internal] No ChannelAdapter registered for providerKey '${channel.providerKey}'. ` +\n          'Check that the provider package is enabled in modules.ts.',\n      )\n    }\n\n    // (3) Idempotently upsert a 'pending' MessageChannelLink.\n    let link = await findOneWithDecryption(\n      em,\n      MessageChannelLink,\n      {\n        messageId: message.id,\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      },\n      undefined,\n      dscope,\n    )\n    if (\n      link &&\n      (link.deliveryStatus === 'queued' ||\n        link.deliveryStatus === 'sent' ||\n        link.deliveryStatus === 'delivered' ||\n        link.deliveryStatus === 'read')\n    ) {\n      // Already sent (or accepted by the provider as 'queued') \u2014 short-circuit\n      // so a retried job does not re-invoke the adapter and double-send.\n      return {\n        status: 'already_delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n      }\n    }\n    if (!link) {\n      link = em.create(MessageChannelLink, {\n        messageId: message.id,\n        externalConversationId: mapping.externalConversationId,\n        providerKey: channel.providerKey,\n        channelType: channel.channelType,\n        direction: 'outbound',\n        deliveryStatus: 'pending',\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(link)\n      try {\n        await em.flush()\n      } catch (flushErr) {\n        // Concurrency guard: the link lookup above is not atomic with this\n        // insert, so two deliveries of the same message (a replayed\n        // `messages.message.sent`, or an overlapping worker retry) can both\n        // reach here. The `message_channel_links_message_uq` index rejects the\n        // loser with a 23505. Defer to the winning job \u2014 re-read its link on a\n        // fresh fork and report `already_delivered` \u2014 instead of re-invoking the\n        // adapter (double send) or letting the raw error dead-letter the job.\n        if (isUniqueViolation(flushErr)) {\n          const winner = await findOneWithDecryption(\n            em.fork(),\n            MessageChannelLink,\n            {\n              messageId: message.id,\n              tenantId: input.scope.tenantId,\n              organizationId: input.scope.organizationId ?? null,\n            },\n            undefined,\n            dscope,\n          )\n          if (winner) {\n            return {\n              status: 'already_delivered',\n              messageId: message.id,\n              channelLinkId: winner.id,\n            }\n          }\n        }\n        throw flushErr\n      }\n    }\n\n    // (2 cont.) Decrypted credentials via the integrations module (if available).\n    let credentialsService: CredentialsServiceLike | null = null\n    try {\n      credentialsService = ctx.container.resolve(\n        'integrationCredentialsService',\n      ) as CredentialsServiceLike\n    } catch {\n      credentialsService = null\n    }\n    // Per-user credentials scope: pass `channel.userId` so the credentials\n    // service returns this user's row, not whoever connected last. See\n    // review R2-C1 / N1 (2026-05-26).\n    //\n    // Key the org on the CHANNEL's own org, not the message's org. Tenant-wide\n    // channels store `organization_id = NULL` and their credentials live at\n    // `organization_id = tenantId` (see connect-credential-channel.ts), so\n    // `channel.organizationId ?? tenantId` matches the write key for both\n    // org-scoped and tenant-wide channels. Keying on the message org would\n    // resolve `{}` the moment a tenant-wide provider delivers from a message\n    // that carries a non-null org.\n    const credentialsScope = {\n      tenantId: input.scope.tenantId,\n      organizationId: channel.organizationId ?? input.scope.tenantId,\n      userId: channel.userId ?? null,\n    }\n    let credentials: Record<string, unknown> = {}\n    if (channel.credentialsRef && credentialsService) {\n      try {\n        credentials =\n          (await credentialsService.resolve(`channel_${channel.providerKey}`, credentialsScope)) ?? {}\n      } catch {\n        credentials = {}\n      }\n    }\n\n    // (4) Credential refresh if OAuth + near expiry, or forced by retry.\n    let integrationLog: IntegrationLogLike | null = null\n    try {\n      integrationLog = ctx.container.resolve('integrationLogService') as IntegrationLogLike\n    } catch {\n      integrationLog = null\n    }\n    const refreshResult = await refreshCredentialsIfNeeded(\n      {\n        adapter,\n        channelId: channel.id,\n        credentials,\n        scope: credentialsScope,\n        force: Boolean(input.forceCredentialRefresh),\n      },\n      {\n        credentialsService,\n        logger: (...args) => moduleLogger.warn('credential refresh diagnostic', { details: args }),\n      },\n    )\n    credentials = refreshResult.credentials\n\n    // (4b) Spec B \u2014 get-or-create the per-thread crypto token and inject it\n    // into the outbound payload BEFORE the adapter converts it. The token\n    // travels as both a `References` header (via channelMetadata.references)\n    // and a hidden body marker so inbound replies can be threaded back to\n    // this conversation even when the recipient's MUA strips RFC 5322\n    // headers. Idempotent on retry \u2014 same token reused per thread.\n    let threadToken: string | null = null\n    try {\n      const { token } = await getOrCreateThreadToken(em, {\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n        messageThreadId: mapping.messageThreadId,\n      })\n      threadToken = token\n    } catch (tokenErr) {\n      // Token creation should never block a send \u2014 if it fails, the message\n      // still goes out, just without our thread-token attachment point.\n      // Threading falls back to the JWZ strategy via Message-Id headers.\n      moduleLogger.warn('thread token unavailable, proceeding without it', { err: tokenErr })\n    }\n\n    // (4c) Chat-provider reply threading \u2014 resolve the provider-native id of the\n    // message this one answers so a threading adapter can attach it (Discord's\n    // `message_reference`). Email adapters ignore this and keep threading on the\n    // `inReplyTo` / `references` headers built above. Best-effort like the thread\n    // token: an unresolvable parent sends an unthreaded reply rather than failing\n    // a delivery.\n    let replyToExternalId: string | null = null\n    try {\n      replyToExternalId = await resolveOutboundReplyExternalId(em, {\n        parentMessageId: message.parentMessageId ?? null,\n        externalConversationId: mapping.externalConversationId,\n        capabilities: adapter.capabilities,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n      })\n    } catch (replyRefErr) {\n      moduleLogger.warn('outbound reply reference unavailable, sending unthreaded', {\n        err: replyRefErr,\n      })\n    }\n    if (!replyToExternalId && message.parentMessageId && adapter.capabilities?.threading === true) {\n      // The provider threads and the caller asked for a reply, yet nothing\n      // resolved \u2014 the parent never reached this channel, or it belongs to\n      // another conversation. Delivery is unaffected, but say so: an unthreaded\n      // reply is otherwise indistinguishable from a non-reply, which is exactly\n      // the silent-unreachability shape #5541 was filed about.\n      moduleLogger.debug('reply parent has no external id on this channel, sending unthreaded', {\n        messageId: message.id,\n        parentMessageId: message.parentMessageId,\n        conversationId: mapping.externalConversationId,\n      })\n    }\n\n    // (5) + (6) Convert + send.\n    try {\n      const outboundPayload = (link.channelPayload as Record<string, unknown> | null) ?? {}\n      const outboundHtml = typeof outboundPayload.html === 'string' ? outboundPayload.html : null\n      const outboundText = typeof outboundPayload.text === 'string' ? outboundPayload.text : null\n      let outboundBody = outboundHtml ?? outboundText ?? message.body ?? ''\n      const outboundBodyFormat = outboundHtml\n        ? 'html'\n        : ((message.bodyFormat as 'text' | 'markdown' | 'html') ?? 'text')\n\n      // Pre-existing channelMetadata.references (string[]) so we can extend\n      // it with the synthetic thread-token id without disturbing other refs\n      // (e.g. the recipient's own reply chain).\n      const baseMetadata = (link.channelMetadata as Record<string, unknown> | undefined) ?? {}\n      const existingRefs = Array.isArray(baseMetadata.references)\n        ? (baseMetadata.references as unknown[]).filter(\n            (value): value is string => typeof value === 'string',\n          )\n        : []\n      let mergedReferences = existingRefs\n      if (threadToken && !outboundBody.includes(`[OM:${threadToken}]`)) {\n        // Append the body footer for the corresponding format. The hidden\n        // HTML span is `display:none`; the plain-text trailer is a small\n        // bracketed marker on its own line. Both survive most reply clients.\n        const footer = buildBodyFooter(threadToken)\n        if (outboundBodyFormat === 'html') {\n          const closingBody = outboundBody.lastIndexOf('</body>')\n          outboundBody =\n            closingBody >= 0\n              ? `${outboundBody.slice(0, closingBody)}${footer.html}${outboundBody.slice(closingBody)}`\n              : `${outboundBody}${footer.html}`\n        } else {\n          outboundBody = `${outboundBody}${footer.plain}`\n        }\n        const refId = buildReferencesId(threadToken)\n        if (!mergedReferences.includes(refId)) {\n          mergedReferences = [...mergedReferences, refId]\n        }\n      }\n      const converted = await adapter.convertOutbound({\n        body: outboundBody,\n        bodyFormat: outboundBodyFormat,\n        channelMetadata: {\n          thread_id: mapping.externalThreadRef,\n          // Reply targeting is hub-resolved only. `send-as-user` merges\n          // caller-supplied metadata onto the link, so every reply-targeting key\n          // is stripped off the stored metadata here rather than merely\n          // out-ranked below: merge order settles the contest only when the hub\n          // resolved a parent, and the uncontested case \u2014 no `parentMessageId`,\n          // or a parent that does not resolve \u2014 is exactly the one a caller\n          // controls.\n          ...stripCallerReplyTargeting(baseMetadata),\n          references: mergedReferences,\n          ...(threadToken ? { omThreadToken: threadToken } : {}),\n          ...(replyToExternalId ? { replyToExternalId } : {}),\n        },\n      })\n\n      // NOTE \u2014 at-least-once delivery (accepted v1 semantics). This provider\n      // send is a non-transactional external side effect. The terminal-status\n      // short-circuit above and the `message_channel_links_message_uq` index\n      // prevent duplicate link records and re-sends after a *completed*\n      // delivery, but if the process crashes in the narrow window between this\n      // call returning and the success flush below, the link stays `pending`\n      // and a worker retry re-invokes the adapter \u2014 the recipient may receive a\n      // duplicate. This is deliberate: email providers (Gmail/SMTP) expose no\n      // idempotent-send key nor a reliable \"did message X send?\" query, so\n      // re-sending is preferred over risking a dropped message.\n      const sendResult = await adapter.sendMessage({\n        conversationId: mapping.externalThreadRef,\n        content: converted.content,\n        credentials,\n        scope: {\n          tenantId: input.scope.tenantId,\n          organizationId: channel.organizationId ?? input.scope.tenantId,\n        },\n        metadata: converted.metadata,\n      })\n\n      if (sendResult.status === 'failed') {\n        throw new Error(sendResult.error ?? `Adapter '${adapter.providerKey}' reported send failure`)\n      }\n\n      // (7) Persist success records.\n      //\n      // Pre-generate the ExternalMessage PK client-side. The PK uses\n      // `defaultRaw: 'gen_random_uuid()'`, so `externalMessage.id` is undefined\n      // until after the INSERT returns \u2014 writing `link.externalMessageId =\n      // externalMessage.id` before the flush would silently persist NULL on the\n      // link's FK. Mirrors the inbound ingest path (ingest-inbound-message.ts).\n      const externalMessageRowId = randomUUID()\n      const externalMessage = em.create(ExternalMessage, {\n        id: externalMessageRowId,\n        channelId: channel.id,\n        conversationId: mapping.externalConversationId,\n        externalMessageId: sendResult.externalMessageId,\n        direction: 'outbound',\n        senderIdentifier: null,\n        senderDisplayName: null,\n        providerTimestamp: new Date(),\n        tenantId: input.scope.tenantId,\n        organizationId: input.scope.organizationId ?? null,\n      })\n      em.persist(externalMessage)\n\n      // A successful send proves the credentials are valid \u2014 clear any prior\n      // `requires_reauth` / `error` state so a recovered channel doesn't keep\n      // showing a stale reconnect banner (e.g. after a forced-refresh retry).\n      if (channel.status === 'requires_reauth' || channel.status === 'error') {\n        channel.status = 'connected'\n      }\n\n      link.deliveryStatus = sendResult.status === 'sent' ? 'sent' : 'queued'\n      link.externalMessageId = externalMessageRowId\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        ...omitRawMessage(converted.metadata),\n        externalMessageId: sendResult.externalMessageId,\n        // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ\n        // strategy in lib/thread-matcher) and sent-folder dedup can resolve this\n        // outbound message. Adapters that build the message themselves (Gmail)\n        // return it in `converted.metadata.messageId`; IMAP/SMTP lets\n        // the transport mint it, surfacing it only as `sendResult.externalMessageId`\n        // (the RFC2822 id the recipient replies to) \u2014 fall back to that.\n        // Store it bracket-stripped to match the inbound convention\n        // (`normalizeMimeInbound` strips), so the JWZ matcher and sent-folder dedup \u2014\n        // which compare against stripped ids \u2014 resolve it. `assembleRfc2822`\n        // re-applies brackets when this id is later used to build reply headers.\n        messageId: stripBrackets(\n          stringOrUndefined((converted.metadata as Record<string, unknown> | undefined)?.messageId) ??\n            sendResult.externalMessageId,\n        ),\n      }\n      await em.flush()\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.sent',\n        {\n          messageId: message.id,\n          externalMessageId: externalMessage.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          direction: 'outbound',\n          // #6095: same contract as the inbound path \u2014 the send time travels on\n          // the event so consumers (the customers timeline) date their rows\n          // from it instead of reading the ExternalMessage row across the\n          // module boundary. ISO string because this event is persistent.\n          providerTimestamp:\n            externalMessage.providerTimestamp instanceof Date\n              ? externalMessage.providerTimestamp.toISOString()\n              : null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'delivered',\n        messageId: message.id,\n        channelLinkId: link.id,\n        externalMessageId: externalMessage.id,\n        providerKey: channel.providerKey,\n      }\n    } catch (sendErr) {\n      // (8) Failure path \u2014 classify, persist, emit, return.\n      const classification = classifyOutboundError(sendErr)\n      const requiresReauth = isReauthError(classification)\n      link.deliveryStatus = 'failed'\n      link.channelMetadata = {\n        ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),\n        lastError: classification.message,\n        lastErrorAt: new Date().toISOString(),\n        transient: classification.transient,\n        requiresReauth,\n      }\n      // A 401 / invalid_grant means the stored credentials are dead and no\n      // retry will help \u2014 flip the channel to `requires_reauth` (mirrors the\n      // inbound poll path) so the operator gets a reconnect signal instead of\n      // silently-failing sends. A later successful send self-heals back to\n      // `connected` (see the success path above).\n      if (requiresReauth) {\n        channel.status = 'requires_reauth'\n      }\n      await em.flush()\n\n      try {\n        await integrationLog?.error?.({\n          integrationId: `channel_${channel.providerKey}`,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n          channelId: channel.id,\n          messageId: message.id,\n          status: classification.status ?? null,\n          transient: classification.transient,\n          message: classification.message,\n        })\n      } catch {\n        // best-effort logging\n      }\n\n      if (requiresReauth) {\n        await emitCommunicationChannelsEvent(\n          'communication_channels.channel.requires_reauth',\n          {\n            channelId: channel.id,\n            providerKey: channel.providerKey,\n            channelType: channel.channelType,\n            reason: classification.message,\n            tenantId: input.scope.tenantId,\n            organizationId: input.scope.organizationId ?? null,\n          },\n          { persistent: true },\n        )\n      }\n\n      await emitCommunicationChannelsEvent(\n        'communication_channels.message.delivery_failed',\n        {\n          messageId: message.id,\n          channelLinkId: link.id,\n          conversationId: mapping.externalConversationId,\n          channelId: channel.id,\n          providerKey: channel.providerKey,\n          channelType: channel.channelType,\n          transient: classification.transient,\n          error: classification.message,\n          status: classification.status ?? null,\n          tenantId: input.scope.tenantId,\n          organizationId: input.scope.organizationId ?? null,\n        },\n        { persistent: true },\n      )\n\n      return {\n        status: 'failed',\n        messageId: message.id,\n        channelLinkId: link.id,\n        providerKey: channel.providerKey,\n        error: classification.message,\n        transient: classification.transient,\n        requiresReauth,\n      }\n    }\n  },\n}\n\nregisterCommand(deliverOutboundMessageCommand)\n\nexport default deliverOutboundMessageCommand\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAGlB,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sCAAsC;AAC/C,SAAS,kCAAkC;AAC3C,SAAS,uBAAuB,qBAAqB;AACrD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,gCAAgC,iCAAiC;AAE1E,SAAS,yBAAyB;AAClC,SAAS,eAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,eAAe,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,2BAA2B,CAAC;AAM3G,MAAM,2BAA2B,EAAE,QAAQ,kBAA2B;AAEtE,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA,EAC3B,OAAO,EAAE,OAAO;AAAA,IACd,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,IAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,EAKD,wBAAwB,EAAE,QAAQ,EAAE,SAAS;AAC/C,CAAC;AA6BM,MAAM,qDACX;AAEF,SAAS,eAAe,UAAwE;AAC9F,MAAI,CAAC,SAAU,QAAO,CAAC;AACvB,SAAO,OAAO,YAAY,OAAO,QAAQ,QAAQ,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,QAAQ,YAAY,CAAC;AAC5F;AAyCA,MAAM,gCAGF;AAAA,EACF,IAAI;AAAA,EACJ,MAAM,QAAQ,UAAU,KAAK;AAC3B,UAAM,QAAQ,mBAAmB,MAAM,QAAQ;AAC/C,UAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,UAAM,SAAS;AAAA,MACb,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,IAChD;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,MAAM;AAAA,QACV,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AACA,QAAI,CAAC,QAAQ,UAAU;AAErB,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,iBAAiB,QAAQ;AAAA,QACzB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AAEZ,aAAO;AAAA,IACT;AAGA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,QAAQ;AAAA,QACZ,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,sBAAsB,QAAQ,SAAS,yBAAyB,MAAM,MAAM,QAAQ;AAAA,MACtF;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,UAAU;AACrB,YAAM,IAAI,MAAM,sBAAsB,QAAQ,SAAS,4CAA4C;AAAA,IACrG;AAEA,UAAM,kBAAkB,IAAI,UAAU,QAAQ,wBAAwB;AACtE,UAAM,UAAU,gBAAgB,IAAI,QAAQ,WAAW;AACvD,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI;AAAA,QACR,4DAA4D,QAAQ,WAAW;AAAA,MAEjF;AAAA,IACF;AAGA,QAAI,OAAO,MAAM;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QACE,SACC,KAAK,mBAAmB,YACvB,KAAK,mBAAmB,UACxB,KAAK,mBAAmB,eACxB,KAAK,mBAAmB,SAC1B;AAGA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,MACtB;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,aAAO,GAAG,OAAO,oBAAoB;AAAA,QACnC,WAAW,QAAQ;AAAA,QACnB,wBAAwB,QAAQ;AAAA,QAChC,aAAa,QAAQ;AAAA,QACrB,aAAa,QAAQ;AAAA,QACrB,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,IAAI;AACf,UAAI;AACF,cAAM,GAAG,MAAM;AAAA,MACjB,SAAS,UAAU;AAQjB,YAAI,kBAAkB,QAAQ,GAAG;AAC/B,gBAAM,SAAS,MAAM;AAAA,YACnB,GAAG,KAAK;AAAA,YACR;AAAA,YACA;AAAA,cACE,WAAW,QAAQ;AAAA,cACnB,UAAU,MAAM,MAAM;AAAA,cACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,YAChD;AAAA,YACA;AAAA,YACA;AAAA,UACF;AACA,cAAI,QAAQ;AACV,mBAAO;AAAA,cACL,QAAQ;AAAA,cACR,WAAW,QAAQ;AAAA,cACnB,eAAe,OAAO;AAAA,YACxB;AAAA,UACF;AAAA,QACF;AACA,cAAM;AAAA,MACR;AAAA,IACF;AAGA,QAAI,qBAAoD;AACxD,QAAI;AACF,2BAAqB,IAAI,UAAU;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AACN,2BAAqB;AAAA,IACvB;AAYA,UAAM,mBAAmB;AAAA,MACvB,UAAU,MAAM,MAAM;AAAA,MACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,MACtD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AACA,QAAI,cAAuC,CAAC;AAC5C,QAAI,QAAQ,kBAAkB,oBAAoB;AAChD,UAAI;AACF,sBACG,MAAM,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI,gBAAgB,KAAM,CAAC;AAAA,MAC/F,QAAQ;AACN,sBAAc,CAAC;AAAA,MACjB;AAAA,IACF;AAGA,QAAI,iBAA4C;AAChD,QAAI;AACF,uBAAiB,IAAI,UAAU,QAAQ,uBAAuB;AAAA,IAChE,QAAQ;AACN,uBAAiB;AAAA,IACnB;AACA,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,QACE;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,QACP,OAAO,QAAQ,MAAM,sBAAsB;AAAA,MAC7C;AAAA,MACA;AAAA,QACE;AAAA,QACA,QAAQ,IAAI,SAAS,aAAa,KAAK,iCAAiC,EAAE,SAAS,KAAK,CAAC;AAAA,MAC3F;AAAA,IACF;AACA,kBAAc,cAAc;AAQ5B,QAAI,cAA6B;AACjC,QAAI;AACF,YAAM,EAAE,MAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,QACjD,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAC9C,iBAAiB,QAAQ;AAAA,MAC3B,CAAC;AACD,oBAAc;AAAA,IAChB,SAAS,UAAU;AAIjB,mBAAa,KAAK,mDAAmD,EAAE,KAAK,SAAS,CAAC;AAAA,IACxF;AAQA,QAAI,oBAAmC;AACvC,QAAI;AACF,0BAAoB,MAAM,+BAA+B,IAAI;AAAA,QAC3D,iBAAiB,QAAQ,mBAAmB;AAAA,QAC5C,wBAAwB,QAAQ;AAAA,QAChC,cAAc,QAAQ;AAAA,QACtB,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,MACF,CAAC;AAAA,IACH,SAAS,aAAa;AACpB,mBAAa,KAAK,4DAA4D;AAAA,QAC5E,KAAK;AAAA,MACP,CAAC;AAAA,IACH;AACA,QAAI,CAAC,qBAAqB,QAAQ,mBAAmB,QAAQ,cAAc,cAAc,MAAM;AAM7F,mBAAa,MAAM,uEAAuE;AAAA,QACxF,WAAW,QAAQ;AAAA,QACnB,iBAAiB,QAAQ;AAAA,QACzB,gBAAgB,QAAQ;AAAA,MAC1B,CAAC;AAAA,IACH;AAGA,QAAI;AACF,YAAM,kBAAmB,KAAK,kBAAqD,CAAC;AACpF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,YAAM,eAAe,OAAO,gBAAgB,SAAS,WAAW,gBAAgB,OAAO;AACvF,UAAI,eAAe,gBAAgB,gBAAgB,QAAQ,QAAQ;AACnE,YAAM,qBAAqB,eACvB,SACE,QAAQ,cAA+C;AAK7D,YAAM,eAAgB,KAAK,mBAA2D,CAAC;AACvF,YAAM,eAAe,MAAM,QAAQ,aAAa,UAAU,IACrD,aAAa,WAAyB;AAAA,QACrC,CAAC,UAA2B,OAAO,UAAU;AAAA,MAC/C,IACA,CAAC;AACL,UAAI,mBAAmB;AACvB,UAAI,eAAe,CAAC,aAAa,SAAS,OAAO,WAAW,GAAG,GAAG;AAIhE,cAAM,SAAS,gBAAgB,WAAW;AAC1C,YAAI,uBAAuB,QAAQ;AACjC,gBAAM,cAAc,aAAa,YAAY,SAAS;AACtD,yBACE,eAAe,IACX,GAAG,aAAa,MAAM,GAAG,WAAW,CAAC,GAAG,OAAO,IAAI,GAAG,aAAa,MAAM,WAAW,CAAC,KACrF,GAAG,YAAY,GAAG,OAAO,IAAI;AAAA,QACrC,OAAO;AACL,yBAAe,GAAG,YAAY,GAAG,OAAO,KAAK;AAAA,QAC/C;AACA,cAAM,QAAQ,kBAAkB,WAAW;AAC3C,YAAI,CAAC,iBAAiB,SAAS,KAAK,GAAG;AACrC,6BAAmB,CAAC,GAAG,kBAAkB,KAAK;AAAA,QAChD;AAAA,MACF;AACA,YAAM,YAAY,MAAM,QAAQ,gBAAgB;AAAA,QAC9C,MAAM;AAAA,QACN,YAAY;AAAA,QACZ,iBAAiB;AAAA,UACf,WAAW,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,UAQnB,GAAG,0BAA0B,YAAY;AAAA,UACzC,YAAY;AAAA,UACZ,GAAI,cAAc,EAAE,eAAe,YAAY,IAAI,CAAC;AAAA,UACpD,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,QACnD;AAAA,MACF,CAAC;AAYD,YAAM,aAAa,MAAM,QAAQ,YAAY;AAAA,QAC3C,gBAAgB,QAAQ;AAAA,QACxB,SAAS,UAAU;AAAA,QACnB;AAAA,QACA,OAAO;AAAA,UACL,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,QAAQ,kBAAkB,MAAM,MAAM;AAAA,QACxD;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAED,UAAI,WAAW,WAAW,UAAU;AAClC,cAAM,IAAI,MAAM,WAAW,SAAS,YAAY,QAAQ,WAAW,yBAAyB;AAAA,MAC9F;AASA,YAAM,uBAAuB,WAAW;AACxC,YAAM,kBAAkB,GAAG,OAAO,iBAAiB;AAAA,QACjD,IAAI;AAAA,QACJ,WAAW,QAAQ;AAAA,QACnB,gBAAgB,QAAQ;AAAA,QACxB,mBAAmB,WAAW;AAAA,QAC9B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,mBAAmB;AAAA,QACnB,mBAAmB,oBAAI,KAAK;AAAA,QAC5B,UAAU,MAAM,MAAM;AAAA,QACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,MAChD,CAAC;AACD,SAAG,QAAQ,eAAe;AAK1B,UAAI,QAAQ,WAAW,qBAAqB,QAAQ,WAAW,SAAS;AACtE,gBAAQ,SAAS;AAAA,MACnB;AAEA,WAAK,iBAAiB,WAAW,WAAW,SAAS,SAAS;AAC9D,WAAK,oBAAoB;AACzB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,GAAG,eAAe,UAAU,QAAQ;AAAA,QACpC,mBAAmB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAW9B,WAAW;AAAA,UACT,kBAAmB,UAAU,UAAkD,SAAS,KACtF,WAAW;AAAA,QACf;AAAA,MACF;AACA,YAAM,GAAG,MAAM;AAEf,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,mBAAmB,gBAAgB;AAAA,UACnC,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,UAKX,mBACE,gBAAgB,6BAA6B,OACzC,gBAAgB,kBAAkB,YAAY,IAC9C;AAAA,UACN,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,mBAAmB,gBAAgB;AAAA,QACnC,aAAa,QAAQ;AAAA,MACvB;AAAA,IACF,SAAS,SAAS;AAEhB,YAAM,iBAAiB,sBAAsB,OAAO;AACpD,YAAM,iBAAiB,cAAc,cAAc;AACnD,WAAK,iBAAiB;AACtB,WAAK,kBAAkB;AAAA,QACrB,GAAK,KAAK,mBAA2D,CAAC;AAAA,QACtE,WAAW,eAAe;AAAA,QAC1B,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,QACpC,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAMA,UAAI,gBAAgB;AAClB,gBAAQ,SAAS;AAAA,MACnB;AACA,YAAM,GAAG,MAAM;AAEf,UAAI;AACF,cAAM,gBAAgB,QAAQ;AAAA,UAC5B,eAAe,WAAW,QAAQ,WAAW;AAAA,UAC7C,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAC9C,WAAW,QAAQ;AAAA,UACnB,WAAW,QAAQ;AAAA,UACnB,QAAQ,eAAe,UAAU;AAAA,UACjC,WAAW,eAAe;AAAA,UAC1B,SAAS,eAAe;AAAA,QAC1B,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAEA,UAAI,gBAAgB;AAClB,cAAM;AAAA,UACJ;AAAA,UACA;AAAA,YACE,WAAW,QAAQ;AAAA,YACnB,aAAa,QAAQ;AAAA,YACrB,aAAa,QAAQ;AAAA,YACrB,QAAQ,eAAe;AAAA,YACvB,UAAU,MAAM,MAAM;AAAA,YACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,UAChD;AAAA,UACA,EAAE,YAAY,KAAK;AAAA,QACrB;AAAA,MACF;AAEA,YAAM;AAAA,QACJ;AAAA,QACA;AAAA,UACE,WAAW,QAAQ;AAAA,UACnB,eAAe,KAAK;AAAA,UACpB,gBAAgB,QAAQ;AAAA,UACxB,WAAW,QAAQ;AAAA,UACnB,aAAa,QAAQ;AAAA,UACrB,aAAa,QAAQ;AAAA,UACrB,WAAW,eAAe;AAAA,UAC1B,OAAO,eAAe;AAAA,UACtB,QAAQ,eAAe,UAAU;AAAA,UACjC,UAAU,MAAM,MAAM;AAAA,UACtB,gBAAgB,MAAM,MAAM,kBAAkB;AAAA,QAChD;AAAA,QACA,EAAE,YAAY,KAAK;AAAA,MACrB;AAEA,aAAO;AAAA,QACL,QAAQ;AAAA,QACR,WAAW,QAAQ;AAAA,QACnB,eAAe,KAAK;AAAA,QACpB,aAAa,QAAQ;AAAA,QACrB,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,QAC1B;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;AAEA,gBAAgB,6BAA6B;AAE7C,IAAO,mCAAQ;",
   "names": []
 }

package/dist/modules/customers/api/activity-types/route.js

@@ -0,0 +1,151 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveDictionaryRouteContext } from "../dictionaries/context.js";
+import { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from "../dictionaries/cache.js";
+import { getInjectionRegistryVersion } from "@open-mercato/shared/modules/widgets/injection-loader";
+import {
+  resolveScopedCalendarEventTypes
+} from "../../lib/calendar/eventTypeResolver.js";
+import { calendarEventTypeBehaviorSchema } from "../../calendar-event-types.js";
+import { getCalendarEventTypeRegistryVersion } from "../../calendar-event-types.js";
+const logger = createLogger("customers");
+function reportActivityTypeError(error, code, attributes) {
+  try {
+    getTelemetryRuntime()?.reportError(error, { module: "customers", code, attributes });
+  } catch {
+  }
+}
+const querySchema = z.object({ organizationId: z.string().uuid().optional() });
+const responseSchema = z.object({
+  fallbackKey: z.literal("meeting"),
+  items: z.array(z.object({
+    key: z.string(),
+    label: z.string(),
+    labelKey: z.string().optional(),
+    icon: z.string().nullable().optional(),
+    color: z.string().nullable().optional(),
+    behavior: calendarEventTypeBehaviorSchema,
+    selectable: z.boolean(),
+    panelKey: z.string().optional(),
+    source: z.string(),
+    provenance: z.record(z.string(), z.unknown()),
+    historical: z.boolean(),
+    fallbackReason: z.enum(["tombstoned", "module-unavailable", "unknown"]).optional(),
+    adminConfigurable: z.boolean(),
+    isInherited: z.boolean(),
+    isLocalOverride: z.boolean(),
+    updatedAt: z.string().nullable(),
+    missingCustomFieldsetIds: z.array(z.string()),
+    inactiveDictionaryOverride: z.boolean().optional()
+  }))
+});
+const metadata = {
+  GET: { requireAuth: true }
+};
+async function GET(req) {
+  try {
+    const url = new URL(req.url);
+    const query = querySchema.parse({ organizationId: url.searchParams.get("organizationId") ?? void 0 });
+    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId });
+    if (!context.organizationId) {
+      return NextResponse.json({ error: context.translate("customers.errors.organization_required", "Organization context is required") }, { status: 400 });
+    }
+    const organizationId = context.organizationId;
+    const rbac = context.container.resolve("rbacService");
+    const actorId = context.auth?.sub;
+    if (!rbac || !actorId) {
+      throw new CrudHttpError(403, { error: context.translate("customers.calendar.activityTypes.errors.forbidden", "You do not have permission to view activity types.") });
+    }
+    const permissionScope = { tenantId: context.tenantId, organizationId };
+    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ["customers.interactions.view"], permissionScope);
+    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ["customers.settings.manage"], permissionScope);
+    if (!canManageSettings) {
+      throw new CrudHttpError(403, { error: context.translate("customers.calendar.activityTypes.errors.forbidden", "You do not have permission to view activity types.") });
+    }
+    const hierarchy = context.container.resolve("organizationHierarchyService");
+    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId });
+    if (ancestors === null) {
+      throw new CrudHttpError(403, { error: context.translate("customers.errors.organization_forbidden", "Organization not accessible") });
+    }
+    const scopeIds = Array.from(/* @__PURE__ */ new Set([organizationId, ...ancestors.slice().reverse()]));
+    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join("|")}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`;
+    const cached = await context.cache?.get(cacheKey);
+    if (cached) return NextResponse.json(cached);
+    let catalog;
+    try {
+      catalog = await resolveScopedCalendarEventTypes({
+        em: context.em,
+        tenantId: context.tenantId,
+        organizationId,
+        readableOrganizationIds: scopeIds
+      });
+    } catch (err) {
+      logger.error("customers.activity_types.resolve failed", {
+        err,
+        tenantId: context.tenantId,
+        organizationId
+      });
+      reportActivityTypeError(err, "customers.activity_type_catalog_resolution_failed", {
+        tenantId: context.tenantId,
+        organizationId
+      });
+      return NextResponse.json({
+        error: context.translate("customers.calendar.activityTypes.errors.loadFailed", "Failed to load activity types"),
+        code: "activity_type_catalog_unavailable"
+      }, { status: 503 });
+    }
+    if (context.cache) {
+      await context.cache.set(cacheKey, catalog, {
+        ttl: DICTIONARY_CACHE_TTL_MS,
+        tags: createDictionaryCacheTags({
+          tenantId: context.tenantId,
+          mappedKind: "activity_type",
+          organizationIds: scopeIds
+        })
+      }).catch((err) => {
+        logger.warn("customers.activity_types cache write failed", { err });
+        reportActivityTypeError(err, "customers.activity_type_catalog_cache_write_failed", {
+          tenantId: context.tenantId,
+          organizationId
+        });
+      });
+    }
+    return NextResponse.json(catalog);
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    logger.error("customers.activity_types request failed", { err });
+    reportActivityTypeError(err, "customers.activity_type_catalog_request_failed");
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({
+      error: translate("customers.calendar.activityTypes.errors.loadFailed", "Failed to load activity types")
+    }, { status: err instanceof z.ZodError ? 400 : 500 });
+  }
+}
+const openApi = {
+  tag: "Customers",
+  summary: "Effective calendar activity types",
+  methods: {
+    GET: {
+      summary: "List effective calendar activity types",
+      description: "Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.",
+      responses: [{ status: 200, description: "Effective activity-type catalog", schema: responseSchema }],
+      errors: [
+        { status: 400, description: "Organization scope is required", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Forbidden", schema: z.object({ error: z.string() }) },
+        { status: 500, description: "Unexpected server error", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/customers/api/activity-types/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/api/activity-types/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveDictionaryRouteContext } from '../dictionaries/context'\nimport { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from '../dictionaries/cache'\nimport { getInjectionRegistryVersion } from '@open-mercato/shared/modules/widgets/injection-loader'\nimport {\n  resolveScopedCalendarEventTypes,\n} from '../../lib/calendar/eventTypeResolver'\nimport { calendarEventTypeBehaviorSchema } from '../../calendar-event-types'\nimport { getCalendarEventTypeRegistryVersion } from '../../calendar-event-types'\n\nconst logger = createLogger('customers')\n\nfunction reportActivityTypeError(error: unknown, code: string, attributes?: Record<string, string>): void {\n  try {\n    getTelemetryRuntime()?.reportError(error, { module: 'customers', code, attributes })\n  } catch {}\n}\n\nconst querySchema = z.object({ organizationId: z.string().uuid().optional() })\nconst responseSchema = z.object({\n  fallbackKey: z.literal('meeting'),\n  items: z.array(z.object({\n    key: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    icon: z.string().nullable().optional(),\n    color: z.string().nullable().optional(),\n    behavior: calendarEventTypeBehaviorSchema,\n    selectable: z.boolean(),\n    panelKey: z.string().optional(),\n    source: z.string(),\n    provenance: z.record(z.string(), z.unknown()),\n    historical: z.boolean(),\n    fallbackReason: z.enum(['tombstoned', 'module-unavailable', 'unknown']).optional(),\n    adminConfigurable: z.boolean(),\n    isInherited: z.boolean(),\n    isLocalOverride: z.boolean(),\n    updatedAt: z.string().nullable(),\n    missingCustomFieldsetIds: z.array(z.string()),\n    inactiveDictionaryOverride: z.boolean().optional(),\n  })),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse({ organizationId: url.searchParams.get('organizationId') ?? undefined })\n    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId })\n    if (!context.organizationId) {\n      return NextResponse.json({ error: context.translate('customers.errors.organization_required', 'Organization context is required') }, { status: 400 })\n    }\n    const organizationId = context.organizationId\n    const rbac = context.container.resolve('rbacService') as RbacService | undefined\n    const actorId = context.auth?.sub\n    if (!rbac || !actorId) {\n      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })\n    }\n    const permissionScope = { tenantId: context.tenantId, organizationId }\n    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ['customers.interactions.view'], permissionScope)\n    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ['customers.settings.manage'], permissionScope)\n    if (!canManageSettings) {\n      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })\n    }\n    const hierarchy = context.container.resolve('organizationHierarchyService') as OrganizationHierarchyService\n    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId })\n    if (ancestors === null) {\n      throw new CrudHttpError(403, { error: context.translate('customers.errors.organization_forbidden', 'Organization not accessible') })\n    }\n    const scopeIds = Array.from(new Set([organizationId, ...ancestors.slice().reverse()]))\n    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join('|')}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`\n    const cached = await context.cache?.get(cacheKey)\n    if (cached) return NextResponse.json(cached)\n\n    let catalog\n    try {\n      catalog = await resolveScopedCalendarEventTypes({\n        em: context.em,\n        tenantId: context.tenantId,\n        organizationId,\n        readableOrganizationIds: scopeIds,\n      })\n    } catch (err) {\n      logger.error('customers.activity_types.resolve failed', {\n        err,\n        tenantId: context.tenantId,\n        organizationId,\n      })\n      reportActivityTypeError(err, 'customers.activity_type_catalog_resolution_failed', {\n        tenantId: context.tenantId,\n        organizationId,\n      })\n      return NextResponse.json({\n        error: context.translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),\n        code: 'activity_type_catalog_unavailable',\n      }, { status: 503 })\n    }\n    if (context.cache) {\n      await context.cache.set(cacheKey, catalog, {\n        ttl: DICTIONARY_CACHE_TTL_MS,\n        tags: createDictionaryCacheTags({\n          tenantId: context.tenantId,\n          mappedKind: 'activity_type',\n          organizationIds: scopeIds,\n        }),\n      }).catch((err) => {\n        logger.warn('customers.activity_types cache write failed', { err })\n        reportActivityTypeError(err, 'customers.activity_type_catalog_cache_write_failed', {\n          tenantId: context.tenantId,\n          organizationId,\n        })\n      })\n    }\n    return NextResponse.json(catalog)\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('customers.activity_types request failed', { err })\n    reportActivityTypeError(err, 'customers.activity_type_catalog_request_failed')\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),\n    }, { status: err instanceof z.ZodError ? 400 : 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Effective calendar activity types',\n  methods: {\n    GET: {\n      summary: 'List effective calendar activity types',\n      description: 'Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.',\n      responses: [{ status: 200, description: 'Effective activity-type catalog', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Organization scope is required', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Unexpected server error', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,qBAAqB;AAG9B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,+BAA+B;AACnE,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,WAAW;AAEvC,SAAS,wBAAwB,OAAgB,MAAc,YAA2C;AACxG,MAAI;AACF,wBAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,aAAa,MAAM,WAAW,CAAC;AAAA,EACrF,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC7E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,QAAQ,SAAS;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,IACtB,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACrC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACtC,UAAU;AAAA,IACV,YAAY,EAAE,QAAQ;AAAA,IACtB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,IAC5C,YAAY,EAAE,QAAQ;AAAA,IACtB,gBAAgB,EAAE,KAAK,CAAC,cAAc,sBAAsB,SAAS,CAAC,EAAE,SAAS;AAAA,IACjF,mBAAmB,EAAE,QAAQ;AAAA,IAC7B,aAAa,EAAE,QAAQ;AAAA,IACvB,iBAAiB,EAAE,QAAQ;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,0BAA0B,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC5C,4BAA4B,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnD,CAAC,CAAC;AACJ,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,EAAE,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,KAAK,OAAU,CAAC;AACvG,UAAM,UAAU,MAAM,8BAA8B,KAAK,EAAE,YAAY,MAAM,eAAe,CAAC;AAC7F,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtJ;AACA,UAAM,iBAAiB,QAAQ;AAC/B,UAAM,OAAO,QAAQ,UAAU,QAAQ,aAAa;AACpD,UAAM,UAAU,QAAQ,MAAM;AAC9B,QAAI,CAAC,QAAQ,CAAC,SAAS;AACrB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,qDAAqD,oDAAoD,EAAE,CAAC;AAAA,IACtK;AACA,UAAM,kBAAkB,EAAE,UAAU,QAAQ,UAAU,eAAe;AACrE,UAAM,sBAAsB,MAAM,KAAK,mBAAmB,SAAS,CAAC,6BAA6B,GAAG,eAAe;AACnH,UAAM,oBAAoB,uBAAuB,MAAM,KAAK,mBAAmB,SAAS,CAAC,2BAA2B,GAAG,eAAe;AACtI,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,qDAAqD,oDAAoD,EAAE,CAAC;AAAA,IACtK;AACA,UAAM,YAAY,QAAQ,UAAU,QAAQ,8BAA8B;AAC1E,UAAM,YAAY,MAAM,UAAU,mBAAmB,EAAE,UAAU,QAAQ,UAAU,eAAe,CAAC;AACnG,QAAI,cAAc,MAAM;AACtB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,6BAA6B,EAAE,CAAC;AAAA,IACrI;AACA,UAAM,WAAW,MAAM,KAAK,oBAAI,IAAI,CAAC,gBAAgB,GAAG,UAAU,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrF,UAAM,WAAW,4BAA4B,QAAQ,QAAQ,QAAQ,cAAc,UAAU,SAAS,KAAK,GAAG,CAAC,YAAY,4BAA4B,CAAC,aAAa,oCAAoC,CAAC;AAC1M,UAAM,SAAS,MAAM,QAAQ,OAAO,IAAI,QAAQ;AAChD,QAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAE3C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,gCAAgC;AAAA,QAC9C,IAAI,QAAQ;AAAA,QACZ,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA,yBAAyB;AAAA,MAC3B,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,MAAM,2CAA2C;AAAA,QACtD;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB;AAAA,MACF,CAAC;AACD,8BAAwB,KAAK,qDAAqD;AAAA,QAChF,UAAU,QAAQ;AAAA,QAClB;AAAA,MACF,CAAC;AACD,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,QAAQ,UAAU,sDAAsD,+BAA+B;AAAA,QAC9G,MAAM;AAAA,MACR,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AACA,QAAI,QAAQ,OAAO;AACjB,YAAM,QAAQ,MAAM,IAAI,UAAU,SAAS;AAAA,QACzC,KAAK;AAAA,QACL,MAAM,0BAA0B;AAAA,UAC9B,UAAU,QAAQ;AAAA,UAClB,YAAY;AAAA,UACZ,iBAAiB;AAAA,QACnB,CAAC;AAAA,MACH,CAAC,EAAE,MAAM,CAAC,QAAQ;AAChB,eAAO,KAAK,+CAA+C,EAAE,IAAI,CAAC;AAClE,gCAAwB,KAAK,sDAAsD;AAAA,UACjF,UAAU,QAAQ;AAAA,UAClB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,4BAAwB,KAAK,gDAAgD;AAC7E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,UAAU,sDAAsD,+BAA+B;AAAA,IACxG,GAAG,EAAE,QAAQ,eAAe,EAAE,WAAW,MAAM,IAAI,CAAC;AAAA,EACtD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,eAAe,CAAC;AAAA,MACnG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customers/api/dictionaries/[kind]/[id]/route.js

@@ -14,6 +14,7 @@ import {
 } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { calendarEventTypeBehaviorSchema } from "../../../../calendar-event-types.js";
 const logger = createLogger("customers");
 const paramsSchema = z.object({
   id: z.string().uuid()
@@ -22,8 +23,9 @@ const patchSchema = z.object({
   value: z.string().trim().min(1).max(150).optional(),
   label: z.string().trim().max(150).optional(),
   color: z.union([z.string().trim(), z.null()]).optional(),
-  icon: z.union([z.string().trim(), z.null()]).optional()
-}).refine((input) => input.value !== void 0 || input.label !== void 0 || input.color !== void 0 || input.icon !== void 0, {
+  icon: z.union([z.string().trim(), z.null()]).optional(),
+  behavior: calendarEventTypeBehaviorSchema.nullable().optional()
+}).refine((input) => input.value !== void 0 || input.label !== void 0 || input.color !== void 0 || input.icon !== void 0 || input.behavior !== void 0, {
   message: "No changes provided"
 });
 const metadata = {
@@ -69,7 +71,8 @@ async function PATCH(req, ctx) {
           value: payload.value,
           label: payload.label,
           color: payload.color,
-          icon: payload.icon
+          icon: payload.icon,
+          behavior: payload.behavior
         },
         ctx: routeContext.ctx
       });
@@ -92,6 +95,7 @@ async function PATCH(req, ctx) {
               )
             });
           }
+          if (typeof err.body.code === "string") throw err;
           throw new CrudHttpError(409, { error: routeContext.translate("customers.config.dictionaries.errors.duplicate", "An entry with this value already exists") });
         }
         if (err.status === 400) {
@@ -127,8 +131,10 @@ async function PATCH(req, ctx) {
       label: entry.label,
       color: entry.color,
       icon: entry.icon,
+      ...mappedKind === "activity_type" ? { behavior: entry.activityTypeBehavior ?? null } : {},
       organizationId: entry.organizationId,
-      isInherited: false
+      isInherited: false,
+      updatedAt: entry.updatedAt
     });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -279,8 +285,10 @@ const dictionaryEntrySchema = z.object({
   label: z.string().nullable().optional(),
   color: z.string().nullable().optional(),
   icon: z.string().nullable().optional(),
+  behavior: calendarEventTypeBehaviorSchema.nullable().optional(),
   organizationId: z.string().uuid().nullable().optional(),
-  isInherited: z.boolean().optional()
+  isInherited: z.boolean().optional(),
+  updatedAt: z.date().or(z.string()).optional()
 });
 const dictionaryDeleteResponseSchema = z.object({
   success: z.literal(true)

package/dist/modules/customers/api/dictionaries/[kind]/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/dictionaries/%5Bkind%5D/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandExecuteResult } from '@open-mercato/shared/lib/commands/types'\nimport { CustomerDictionaryEntry } from '../../../../data/entities'\nimport { mapDictionaryKind, resolveDictionaryActorId, resolveDictionaryRouteContext } from '../../context'\nimport { invalidateDictionaryCache } from '../../cache'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst patchSchema = z\n  .object({\n    value: z.string().trim().min(1).max(150).optional(),\n    label: z.string().trim().max(150).optional(),\n    color: z.union([z.string().trim(), z.null()]).optional(),\n    icon: z.union([z.string().trim(), z.null()]).optional(),\n  })\n  .refine((input) => input.value !== undefined || input.label !== undefined || input.color !== undefined || input.icon !== undefined, {\n    message: 'No changes provided',\n  })\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n}\n\nfunction formatCountMessage(template: string, count: number) {\n  return template.replace('{{count}}', String(count))\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { kind?: string; id?: string } }) {\n  try {\n    const routeContext = await resolveDictionaryRouteContext(req)\n    if (!routeContext.organizationId) {\n      throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n    const { mappedKind } = mapDictionaryKind(ctx.params?.kind)\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const payload = patchSchema.parse(await readJsonSafe(req, {}))\n    const guardUserId = resolveDictionaryActorId(routeContext.auth)\n    const guardResult = await validateCrudMutationGuard(routeContext.container, {\n      tenantId: routeContext.tenantId,\n      organizationId: routeContext.organizationId,\n      userId: guardUserId,\n      resourceKind: 'customers.dictionary_entry',\n      resourceId: id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)\n    let commandResult: CommandExecuteResult<{ entryId: string; changed: boolean }>\n    try {\n      commandResult = (await commandBus.execute('customers.dictionaryEntries.update', {\n        input: {\n          id,\n          tenantId: routeContext.tenantId,\n          organizationId: routeContext.organizationId,\n          kind: mappedKind,\n          value: payload.value,\n          label: payload.label,\n          color: payload.color,\n          icon: payload.icon,\n        },\n        ctx: routeContext.ctx,\n      })) as CommandExecuteResult<{ entryId: string; changed: boolean }>\n    } catch (err) {\n      if (isCrudHttpError(err)) {\n        if (err.status === 404) {\n          throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n        }\n        if (err.status === 409) {\n          if ((err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {\n            const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)\n            throw new CrudHttpError(409, {\n              ...(err.body as Record<string, unknown> | undefined),\n              error: formatCountMessage(\n                routeContext.translate(\n                  'customers.config.dictionaries.errors.roleTypeValueInUse',\n                  'This role type is assigned to {{count}} records. Remove or replace those assignments before changing its value.',\n                ),\n                usageCount,\n              ),\n            })\n          }\n          throw new CrudHttpError(409, { error: routeContext.translate('customers.config.dictionaries.errors.duplicate', 'An entry with this value already exists') })\n        }\n        if (err.status === 400) {\n          throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') })\n        }\n      }\n      throw err\n    }\n    const { result, logEntry } = commandResult\n\n    const entry = await findOneWithDecryption(\n      routeContext.em.fork(),\n      CustomerDictionaryEntry,\n      { id },\n      {},\n      {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n      },\n    )\n    if (!entry) {\n      throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n    }\n\n    if (result.changed) {\n      await invalidateDictionaryCache(routeContext.cache, {\n        tenantId: routeContext.tenantId,\n        mappedKind,\n        organizationIds: [routeContext.organizationId],\n      })\n    }\n\n    const response = NextResponse.json({\n      id: entry.id,\n      value: entry.value,\n      label: entry.label,\n      color: entry.color,\n      icon: entry.icon,\n      organizationId: entry.organizationId,\n      isInherited: false,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.dictionary_entry',\n          resourceId: entry.id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(routeContext.container, {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n        userId: guardUserId,\n        resourceKind: 'customers.dictionary_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('customers.dictionaries.update failed', { err })\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') }, { status: 400 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { kind?: string; id?: string } }) {\n  try {\n    const routeContext = await resolveDictionaryRouteContext(req)\n    if (!routeContext.organizationId) {\n      throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n    const { mappedKind } = mapDictionaryKind(ctx.params?.kind)\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const guardUserId = resolveDictionaryActorId(routeContext.auth)\n    const guardResult = await validateCrudMutationGuard(routeContext.container, {\n      tenantId: routeContext.tenantId,\n      organizationId: routeContext.organizationId,\n      userId: guardUserId,\n      resourceKind: 'customers.dictionary_entry',\n      resourceId: id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)\n    let deleteResult: CommandExecuteResult<{ entryId: string }>\n    try {\n      deleteResult = (await commandBus.execute('customers.dictionaryEntries.delete', {\n        input: {\n          id,\n          tenantId: routeContext.tenantId,\n          organizationId: routeContext.organizationId,\n          kind: mappedKind,\n        },\n        ctx: routeContext.ctx,\n      })) as CommandExecuteResult<{ entryId: string }>\n    } catch (err) {\n      if (isCrudHttpError(err) && err.status === 404) {\n        throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n      }\n      if (isCrudHttpError(err) && err.status === 409 && (err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {\n        const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)\n        throw new CrudHttpError(409, {\n          ...(err.body as Record<string, unknown> | undefined),\n          error: formatCountMessage(\n            routeContext.translate(\n              'customers.config.dictionaries.errors.roleTypeDeleteInUse',\n              'This role type is assigned to {{count}} records. Remove or replace those assignments before deleting it.',\n            ),\n            usageCount,\n          ),\n        })\n      }\n      throw err\n    }\n    const { logEntry } = deleteResult\n\n    await invalidateDictionaryCache(routeContext.cache, {\n      tenantId: routeContext.tenantId,\n      mappedKind,\n      organizationIds: [routeContext.organizationId],\n    })\n\n    const response = NextResponse.json({ success: true })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.dictionary_entry',\n          resourceId: id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(routeContext.container, {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n        userId: guardUserId,\n        resourceKind: 'customers.dictionary_entry',\n        resourceId: id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('customers.dictionaries.delete failed', { err })\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to delete dictionary entry') }, { status: 400 })\n  }\n}\n\nconst dictionaryEntrySchema = z.object({\n  id: z.string().uuid(),\n  value: z.string(),\n  label: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  icon: z.string().nullable().optional(),\n  organizationId: z.string().uuid().nullable().optional(),\n  isInherited: z.boolean().optional(),\n})\n\nconst dictionaryDeleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst dictionaryErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Customer dictionary entry',\n  methods: {\n    PATCH: {\n      summary: 'Update dictionary entry',\n      description: 'Updates value, label, color, or icon for an existing customer dictionary entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: patchSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated dictionary entry', schema: dictionaryEntrySchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: dictionaryErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },\n        { status: 404, description: 'Entry not found', schema: dictionaryErrorSchema },\n        { status: 409, description: 'Duplicate value conflict', schema: dictionaryErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete dictionary entry',\n      description: 'Removes a customer dictionary entry by identifier.',\n      responses: [\n        { status: 200, description: 'Entry deleted', schema: dictionaryDeleteResponseSchema },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },\n        { status: 404, description: 'Entry not found', schema: dictionaryErrorSchema },\n        { status: 409, description: 'Entry is in use and cannot be deleted', schema: dictionaryErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,gBAAgB;AAEzD,SAAS,kCAAkC;AAE3C,SAAS,+BAA+B;AACxC,SAAS,mBAAmB,0BAA0B,qCAAqC;AAC3F,SAAS,iCAAiC;AAE1C,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EACjB,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AACxD,CAAC,EACA,OAAO,CAAC,UAAU,MAAM,UAAU,UAAa,MAAM,UAAU,UAAa,MAAM,UAAU,UAAa,MAAM,SAAS,QAAW;AAAA,EAClI,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC9E;AAEA,SAAS,mBAAmB,UAAkB,OAAe;AAC3D,SAAO,SAAS,QAAQ,aAAa,OAAO,KAAK,CAAC;AACpD;AAEA,eAAsB,MAAM,KAAc,KAAkD;AAC1F,MAAI;AACF,UAAM,eAAe,MAAM,8BAA8B,GAAG;AAC5D,QAAI,CAAC,aAAa,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IAC9I;AACA,UAAM,EAAE,WAAW,IAAI,kBAAkB,IAAI,QAAQ,IAAI;AACzD,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,UAAU,YAAY,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC7D,UAAM,cAAc,yBAAyB,aAAa,IAAI;AAC9D,UAAM,cAAc,MAAM,0BAA0B,aAAa,WAAW;AAAA,MAC1E,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa;AAAA,MAC7B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAc,aAAa,UAAU,QAAQ,YAAY;AAC/D,QAAI;AACJ,QAAI;AACF,sBAAiB,MAAM,WAAW,QAAQ,sCAAsC;AAAA,QAC9E,OAAO;AAAA,UACL;AAAA,UACA,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa;AAAA,UAC7B,MAAM;AAAA,UACN,OAAO,QAAQ;AAAA,UACf,OAAO,QAAQ;AAAA,UACf,OAAO,QAAQ;AAAA,UACf,MAAM,QAAQ;AAAA,QAChB;AAAA,QACA,KAAK,aAAa;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,GAAG;AACxB,YAAI,IAAI,WAAW,KAAK;AACtB,gBAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,QACvG;AACA,YAAI,IAAI,WAAW,KAAK;AACtB,cAAK,IAAI,MAA8C,SAAS,oBAAoB;AAClF,kBAAM,aAAa,OAAQ,IAAI,MAA8C,cAAc,CAAC;AAC5F,kBAAM,IAAI,cAAc,KAAK;AAAA,cAC3B,GAAI,IAAI;AAAA,cACR,OAAO;AAAA,gBACL,aAAa;AAAA,kBACX;AAAA,kBACA;AAAA,gBACF;AAAA,gBACA;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AACA,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,kDAAkD,yCAAyC,EAAE,CAAC;AAAA,QAC7J;AACA,YAAI,IAAI,WAAW,KAAK;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,kCAAkC,iCAAiC,EAAE,CAAC;AAAA,QACrI;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI;AAE7B,UAAM,QAAQ,MAAM;AAAA,MAClB,aAAa,GAAG,KAAK;AAAA,MACrB;AAAA,MACA,EAAE,GAAG;AAAA,MACL,CAAC;AAAA,MACD;AAAA,QACE,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,MAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,IACvG;AAEA,QAAI,OAAO,SAAS;AAClB,YAAM,0BAA0B,aAAa,OAAO;AAAA,QAClD,UAAU,aAAa;AAAA,QACvB;AAAA,QACA,iBAAiB,CAAC,aAAa,cAAc;AAAA,MAC/C,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,gBAAgB,MAAM;AAAA,MACtB,aAAa;AAAA,IACf,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,MAAM;AAAA,UAClB,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,aAAa,WAAW;AAAA,QAC7D,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrI;AACF;AAEA,eAAsB,OAAO,KAAc,KAAkD;AAC3F,MAAI;AACF,UAAM,eAAe,MAAM,8BAA8B,GAAG;AAC5D,QAAI,CAAC,aAAa,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IAC9I;AACA,UAAM,EAAE,WAAW,IAAI,kBAAkB,IAAI,QAAQ,IAAI;AACzD,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,cAAc,yBAAyB,aAAa,IAAI;AAC9D,UAAM,cAAc,MAAM,0BAA0B,aAAa,WAAW;AAAA,MAC1E,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa;AAAA,MAC7B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAc,aAAa,UAAU,QAAQ,YAAY;AAC/D,QAAI;AACJ,QAAI;AACF,qBAAgB,MAAM,WAAW,QAAQ,sCAAsC;AAAA,QAC7E,OAAO;AAAA,UACL;AAAA,UACA,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa;AAAA,UAC7B,MAAM;AAAA,QACR;AAAA,QACA,KAAK,aAAa;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,KAAK;AAC9C,cAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,MACvG;AACA,UAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,OAAQ,IAAI,MAA8C,SAAS,oBAAoB;AAChI,cAAM,aAAa,OAAQ,IAAI,MAA8C,cAAc,CAAC;AAC5F,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,GAAI,IAAI;AAAA,UACR,OAAO;AAAA,YACL,aAAa;AAAA,cACX;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AACA,UAAM,EAAE,SAAS,IAAI;AAErB,UAAM,0BAA0B,aAAa,OAAO;AAAA,MAClD,UAAU,aAAa;AAAA,MACvB;AAAA,MACA,iBAAiB,CAAC,aAAa,cAAc;AAAA,IAC/C,CAAC;AAED,UAAM,WAAW,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AACpD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,aAAa,WAAW;AAAA,QAC7D,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,mCAAmC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,aAAa,EAAE,QAAQ,EAAE,SAAS;AACpC,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,+BAA+B;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,sBAAsB;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { CommandExecuteResult } from '@open-mercato/shared/lib/commands/types'\nimport { CustomerDictionaryEntry } from '../../../../data/entities'\nimport { mapDictionaryKind, resolveDictionaryActorId, resolveDictionaryRouteContext } from '../../context'\nimport { invalidateDictionaryCache } from '../../cache'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { calendarEventTypeBehaviorSchema } from '../../../../calendar-event-types'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst patchSchema = z\n  .object({\n    value: z.string().trim().min(1).max(150).optional(),\n    label: z.string().trim().max(150).optional(),\n    color: z.union([z.string().trim(), z.null()]).optional(),\n    icon: z.union([z.string().trim(), z.null()]).optional(),\n    behavior: calendarEventTypeBehaviorSchema.nullable().optional(),\n  })\n  .refine((input) => input.value !== undefined || input.label !== undefined || input.color !== undefined || input.icon !== undefined || input.behavior !== undefined, {\n    message: 'No changes provided',\n  })\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n  DELETE: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },\n}\n\nfunction formatCountMessage(template: string, count: number) {\n  return template.replace('{{count}}', String(count))\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { kind?: string; id?: string } }) {\n  try {\n    const routeContext = await resolveDictionaryRouteContext(req)\n    if (!routeContext.organizationId) {\n      throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n    const { mappedKind } = mapDictionaryKind(ctx.params?.kind)\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const payload = patchSchema.parse(await readJsonSafe(req, {}))\n    const guardUserId = resolveDictionaryActorId(routeContext.auth)\n    const guardResult = await validateCrudMutationGuard(routeContext.container, {\n      tenantId: routeContext.tenantId,\n      organizationId: routeContext.organizationId,\n      userId: guardUserId,\n      resourceKind: 'customers.dictionary_entry',\n      resourceId: id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: payload,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)\n    let commandResult: CommandExecuteResult<{ entryId: string; changed: boolean }>\n    try {\n      commandResult = (await commandBus.execute('customers.dictionaryEntries.update', {\n        input: {\n          id,\n          tenantId: routeContext.tenantId,\n          organizationId: routeContext.organizationId,\n          kind: mappedKind,\n          value: payload.value,\n          label: payload.label,\n          color: payload.color,\n          icon: payload.icon,\n          behavior: payload.behavior,\n        },\n        ctx: routeContext.ctx,\n      })) as CommandExecuteResult<{ entryId: string; changed: boolean }>\n    } catch (err) {\n      if (isCrudHttpError(err)) {\n        if (err.status === 404) {\n          throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n        }\n        if (err.status === 409) {\n          if ((err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {\n            const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)\n            throw new CrudHttpError(409, {\n              ...(err.body as Record<string, unknown> | undefined),\n              error: formatCountMessage(\n                routeContext.translate(\n                  'customers.config.dictionaries.errors.roleTypeValueInUse',\n                  'This role type is assigned to {{count}} records. Remove or replace those assignments before changing its value.',\n                ),\n                usageCount,\n              ),\n            })\n          }\n          if (typeof err.body.code === 'string') throw err\n          throw new CrudHttpError(409, { error: routeContext.translate('customers.config.dictionaries.errors.duplicate', 'An entry with this value already exists') })\n        }\n        if (err.status === 400) {\n          throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') })\n        }\n      }\n      throw err\n    }\n    const { result, logEntry } = commandResult\n\n    const entry = await findOneWithDecryption(\n      routeContext.em.fork(),\n      CustomerDictionaryEntry,\n      { id },\n      {},\n      {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n      },\n    )\n    if (!entry) {\n      throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n    }\n\n    if (result.changed) {\n      await invalidateDictionaryCache(routeContext.cache, {\n        tenantId: routeContext.tenantId,\n        mappedKind,\n        organizationIds: [routeContext.organizationId],\n      })\n    }\n\n    const response = NextResponse.json({\n      id: entry.id,\n      value: entry.value,\n      label: entry.label,\n      color: entry.color,\n      icon: entry.icon,\n      ...(mappedKind === 'activity_type' ? { behavior: entry.activityTypeBehavior ?? null } : {}),\n      organizationId: entry.organizationId,\n      isInherited: false,\n      updatedAt: entry.updatedAt,\n    })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.dictionary_entry',\n          resourceId: entry.id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(routeContext.container, {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n        userId: guardUserId,\n        resourceKind: 'customers.dictionary_entry',\n        resourceId: entry.id,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('customers.dictionaries.update failed', { err })\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to save dictionary entry') }, { status: 400 })\n  }\n}\n\nexport async function DELETE(req: Request, ctx: { params?: { kind?: string; id?: string } }) {\n  try {\n    const routeContext = await resolveDictionaryRouteContext(req)\n    if (!routeContext.organizationId) {\n      throw new CrudHttpError(400, { error: routeContext.translate('customers.errors.organization_required', 'Organization context is required') })\n    }\n    const { mappedKind } = mapDictionaryKind(ctx.params?.kind)\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const guardUserId = resolveDictionaryActorId(routeContext.auth)\n    const guardResult = await validateCrudMutationGuard(routeContext.container, {\n      tenantId: routeContext.tenantId,\n      organizationId: routeContext.organizationId,\n      userId: guardUserId,\n      resourceKind: 'customers.dictionary_entry',\n      resourceId: id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n    const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)\n    let deleteResult: CommandExecuteResult<{ entryId: string }>\n    try {\n      deleteResult = (await commandBus.execute('customers.dictionaryEntries.delete', {\n        input: {\n          id,\n          tenantId: routeContext.tenantId,\n          organizationId: routeContext.organizationId,\n          kind: mappedKind,\n        },\n        ctx: routeContext.ctx,\n      })) as CommandExecuteResult<{ entryId: string }>\n    } catch (err) {\n      if (isCrudHttpError(err) && err.status === 404) {\n        throw notFound(routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found'))\n      }\n      if (isCrudHttpError(err) && err.status === 409 && (err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {\n        const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)\n        throw new CrudHttpError(409, {\n          ...(err.body as Record<string, unknown> | undefined),\n          error: formatCountMessage(\n            routeContext.translate(\n              'customers.config.dictionaries.errors.roleTypeDeleteInUse',\n              'This role type is assigned to {{count}} records. Remove or replace those assignments before deleting it.',\n            ),\n            usageCount,\n          ),\n        })\n      }\n      throw err\n    }\n    const { logEntry } = deleteResult\n\n    await invalidateDictionaryCache(routeContext.cache, {\n      tenantId: routeContext.tenantId,\n      mappedKind,\n      organizationIds: [routeContext.organizationId],\n    })\n\n    const response = NextResponse.json({ success: true })\n    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {\n      response.headers.set(\n        'x-om-operation',\n        serializeOperationMetadata({\n          id: logEntry.id,\n          undoToken: logEntry.undoToken,\n          commandId: logEntry.commandId,\n          actionLabel: logEntry.actionLabel ?? null,\n          resourceKind: logEntry.resourceKind ?? 'customers.dictionary_entry',\n          resourceId: id,\n          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,\n        })\n      )\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(routeContext.container, {\n        tenantId: routeContext.tenantId,\n        organizationId: routeContext.organizationId,\n        userId: guardUserId,\n        resourceKind: 'customers.dictionary_entry',\n        resourceId: id,\n        operation: 'delete',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return response\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    const { translate } = await resolveTranslations()\n    logger.error('customers.dictionaries.delete failed', { err })\n    return NextResponse.json({ error: translate('customers.errors.lookup_failed', 'Failed to delete dictionary entry') }, { status: 400 })\n  }\n}\n\nconst dictionaryEntrySchema = z.object({\n  id: z.string().uuid(),\n  value: z.string(),\n  label: z.string().nullable().optional(),\n  color: z.string().nullable().optional(),\n  icon: z.string().nullable().optional(),\n  behavior: calendarEventTypeBehaviorSchema.nullable().optional(),\n  organizationId: z.string().uuid().nullable().optional(),\n  isInherited: z.boolean().optional(),\n  updatedAt: z.date().or(z.string()).optional(),\n})\n\nconst dictionaryDeleteResponseSchema = z.object({\n  success: z.literal(true),\n})\n\nconst dictionaryErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Customer dictionary entry',\n  methods: {\n    PATCH: {\n      summary: 'Update dictionary entry',\n      description: 'Updates value, label, color, or icon for an existing customer dictionary entry.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: patchSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated dictionary entry', schema: dictionaryEntrySchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid payload', schema: dictionaryErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },\n        { status: 404, description: 'Entry not found', schema: dictionaryErrorSchema },\n        { status: 409, description: 'Duplicate value conflict', schema: dictionaryErrorSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete dictionary entry',\n      description: 'Removes a customer dictionary entry by identifier.',\n      responses: [\n        { status: 200, description: 'Entry deleted', schema: dictionaryDeleteResponseSchema },\n      ],\n      errors: [\n        { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },\n        { status: 404, description: 'Entry not found', schema: dictionaryErrorSchema },\n        { status: 409, description: 'Entry is in use and cannot be deleted', schema: dictionaryErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,gBAAgB;AAEzD,SAAS,kCAAkC;AAE3C,SAAS,+BAA+B;AACxC,SAAS,mBAAmB,0BAA0B,qCAAqC;AAC3F,SAAS,iCAAiC;AAE1C,SAAS,oBAAoB;AAC7B,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,uCAAuC;AAEhD,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EACjB,OAAO;AAAA,EACN,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAClD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EAC3C,OAAO,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EACvD,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,KAAK,GAAG,EAAE,KAAK,CAAC,CAAC,EAAE,SAAS;AAAA,EACtD,UAAU,gCAAgC,SAAS,EAAE,SAAS;AAChE,CAAC,EACA,OAAO,CAAC,UAAU,MAAM,UAAU,UAAa,MAAM,UAAU,UAAa,MAAM,UAAU,UAAa,MAAM,SAAS,UAAa,MAAM,aAAa,QAAW;AAAA,EAClK,SAAS;AACX,CAAC;AAEI,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAAA,EAC3E,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,2BAA2B,EAAE;AAC9E;AAEA,SAAS,mBAAmB,UAAkB,OAAe;AAC3D,SAAO,SAAS,QAAQ,aAAa,OAAO,KAAK,CAAC;AACpD;AAEA,eAAsB,MAAM,KAAc,KAAkD;AAC1F,MAAI;AACF,UAAM,eAAe,MAAM,8BAA8B,GAAG;AAC5D,QAAI,CAAC,aAAa,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IAC9I;AACA,UAAM,EAAE,WAAW,IAAI,kBAAkB,IAAI,QAAQ,IAAI;AACzD,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,UAAU,YAAY,MAAM,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AAC7D,UAAM,cAAc,yBAAyB,aAAa,IAAI;AAC9D,UAAM,cAAc,MAAM,0BAA0B,aAAa,WAAW;AAAA,MAC1E,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa;AAAA,MAC7B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAc,aAAa,UAAU,QAAQ,YAAY;AAC/D,QAAI;AACJ,QAAI;AACF,sBAAiB,MAAM,WAAW,QAAQ,sCAAsC;AAAA,QAC9E,OAAO;AAAA,UACL;AAAA,UACA,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa;AAAA,UAC7B,MAAM;AAAA,UACN,OAAO,QAAQ;AAAA,UACf,OAAO,QAAQ;AAAA,UACf,OAAO,QAAQ;AAAA,UACf,MAAM,QAAQ;AAAA,UACd,UAAU,QAAQ;AAAA,QACpB;AAAA,QACA,KAAK,aAAa;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,GAAG;AACxB,YAAI,IAAI,WAAW,KAAK;AACtB,gBAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,QACvG;AACA,YAAI,IAAI,WAAW,KAAK;AACtB,cAAK,IAAI,MAA8C,SAAS,oBAAoB;AAClF,kBAAM,aAAa,OAAQ,IAAI,MAA8C,cAAc,CAAC;AAC5F,kBAAM,IAAI,cAAc,KAAK;AAAA,cAC3B,GAAI,IAAI;AAAA,cACR,OAAO;AAAA,gBACL,aAAa;AAAA,kBACX;AAAA,kBACA;AAAA,gBACF;AAAA,gBACA;AAAA,cACF;AAAA,YACF,CAAC;AAAA,UACH;AACA,cAAI,OAAO,IAAI,KAAK,SAAS,SAAU,OAAM;AAC7C,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,kDAAkD,yCAAyC,EAAE,CAAC;AAAA,QAC7J;AACA,YAAI,IAAI,WAAW,KAAK;AACtB,gBAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,kCAAkC,iCAAiC,EAAE,CAAC;AAAA,QACrI;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI;AAE7B,UAAM,QAAQ,MAAM;AAAA,MAClB,aAAa,GAAG,KAAK;AAAA,MACrB;AAAA,MACA,EAAE,GAAG;AAAA,MACL,CAAC;AAAA,MACD;AAAA,QACE,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,MAC/B;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,IACvG;AAEA,QAAI,OAAO,SAAS;AAClB,YAAM,0BAA0B,aAAa,OAAO;AAAA,QAClD,UAAU,aAAa;AAAA,QACvB;AAAA,QACA,iBAAiB,CAAC,aAAa,cAAc;AAAA,MAC/C,CAAC;AAAA,IACH;AAEA,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI,MAAM;AAAA,MACV,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,GAAI,eAAe,kBAAkB,EAAE,UAAU,MAAM,wBAAwB,KAAK,IAAI,CAAC;AAAA,MACzF,gBAAgB,MAAM;AAAA,MACtB,aAAa;AAAA,MACb,WAAW,MAAM;AAAA,IACnB,CAAC;AACD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY,MAAM;AAAA,UAClB,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,aAAa,WAAW;AAAA,QAC7D,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY,MAAM;AAAA,QAClB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrI;AACF;AAEA,eAAsB,OAAO,KAAc,KAAkD;AAC3F,MAAI;AACF,UAAM,eAAe,MAAM,8BAA8B,GAAG;AAC5D,QAAI,CAAC,aAAa,gBAAgB;AAChC,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,aAAa,UAAU,0CAA0C,kCAAkC,EAAE,CAAC;AAAA,IAC9I;AACA,UAAM,EAAE,WAAW,IAAI,kBAAkB,IAAI,QAAQ,IAAI;AACzD,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,cAAc,yBAAyB,aAAa,IAAI;AAC9D,UAAM,cAAc,MAAM,0BAA0B,aAAa,WAAW;AAAA,MAC1E,UAAU,aAAa;AAAA,MACvB,gBAAgB,aAAa;AAAA,MAC7B,QAAQ;AAAA,MACR,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AACA,UAAM,aAAc,aAAa,UAAU,QAAQ,YAAY;AAC/D,QAAI;AACJ,QAAI;AACF,qBAAgB,MAAM,WAAW,QAAQ,sCAAsC;AAAA,QAC7E,OAAO;AAAA,UACL;AAAA,UACA,UAAU,aAAa;AAAA,UACvB,gBAAgB,aAAa;AAAA,UAC7B,MAAM;AAAA,QACR;AAAA,QACA,KAAK,aAAa;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,KAAK;AAC9C,cAAM,SAAS,aAAa,UAAU,kCAAkC,4BAA4B,CAAC;AAAA,MACvG;AACA,UAAI,gBAAgB,GAAG,KAAK,IAAI,WAAW,OAAQ,IAAI,MAA8C,SAAS,oBAAoB;AAChI,cAAM,aAAa,OAAQ,IAAI,MAA8C,cAAc,CAAC;AAC5F,cAAM,IAAI,cAAc,KAAK;AAAA,UAC3B,GAAI,IAAI;AAAA,UACR,OAAO;AAAA,YACL,aAAa;AAAA,cACX;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AACA,UAAM,EAAE,SAAS,IAAI;AAErB,UAAM,0BAA0B,aAAa,OAAO;AAAA,MAClD,UAAU,aAAa;AAAA,MACvB;AAAA,MACA,iBAAiB,CAAC,aAAa,cAAc;AAAA,IAC/C,CAAC;AAED,UAAM,WAAW,aAAa,KAAK,EAAE,SAAS,KAAK,CAAC;AACpD,QAAI,UAAU,aAAa,UAAU,MAAM,UAAU,WAAW;AAC9D,eAAS,QAAQ;AAAA,QACf;AAAA,QACA,2BAA2B;AAAA,UACzB,IAAI,SAAS;AAAA,UACb,WAAW,SAAS;AAAA,UACpB,WAAW,SAAS;AAAA,UACpB,aAAa,SAAS,eAAe;AAAA,UACrC,cAAc,SAAS,gBAAgB;AAAA,UACvC,YAAY;AAAA,UACZ,YAAY,SAAS,qBAAqB,OAAO,SAAS,UAAU,YAAY,IAAI;AAAA,QACtF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,aAAa,WAAW;AAAA,QAC7D,UAAU,aAAa;AAAA,QACvB,gBAAgB,aAAa;AAAA,QAC7B,QAAQ;AAAA,QACR,cAAc;AAAA,QACd,YAAY;AAAA,QACZ,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,MAAM,wCAAwC,EAAE,IAAI,CAAC;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,kCAAkC,mCAAmC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,UAAU,gCAAgC,SAAS,EAAE,SAAS;AAAA,EAC9D,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS;AAAA,EACtD,aAAa,EAAE,QAAQ,EAAE,SAAS;AAAA,EAClC,WAAW,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,EAAE,SAAS;AAC9C,CAAC;AAED,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,SAAS,EAAE,QAAQ,IAAI;AACzB,CAAC;AAED,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,MACxF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,+BAA+B;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,sBAAsB;AAAA,MACrG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }