@open-mercato/core 0.9.0 → 0.9.1-develop.7459.1.99e3accd30

package/dist/modules/communication_channels/lib/oauth-state.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/oauth-state.ts"],
-  "sourcesContent": ["import crypto from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst oauthStateLogger = createLogger('communication_channels').child({ component: 'oauth-state' })\n\n/**\n * OAuth state-cookie helper for the communication_channels hub.\n *\n * **Ported (re-implemented locally), NOT imported, from `packages/enterprise/src/modules/sso/lib/state-cookie.ts`.**\n * Root `AGENTS.md` rule: `@open-mercato/core` MUST NOT import from `@open-mercato/enterprise`.\n *\n * Design (per email integration spec \u00A7 OSS Independence + \u00A7 Hub Deltas \u2192 Delta 7):\n *   - AES-256-GCM payload encryption.\n *   - HKDF (SHA-256) key derivation from `OM_HUB_OAUTH_STATE_KEY` (falling back to\n *     `KMS_MASTER_KEY`). In production those dedicated keys are required; only in\n *     dev/test do we fall back to `JWT_SECRET` so envs that configure one secret\n *     still work. Production refuses the `JWT_SECRET` fallback so a session-secret\n *     leak cannot also forge OAuth-state cookies.\n *   - 5-minute TTL \u2014 short window to bound replay surface.\n *   - Payload binds the initiating `userId` so the callback rejects state cookies\n *     used by a different session.\n *   - Single-use consume-on-read via a short-TTL cache marker keyed by\n *     `tenantId:state` (see {@link consumeOAuthStateOnce}) so a captured cookie\n *     cannot re-drive the callback within the TTL. **This guarantee only holds\n *     across all replicas when `CACHE_STRATEGY=redis`.** With\n *     `CACHE_STRATEGY=memory` (the default) the marker is process-local \u2014 a\n *     replayed callback that reaches a different replica succeeds within the TTL.\n *     Multi-replica deployments MUST use a shared cache (`CACHE_STRATEGY=redis`).\n *\n * The output is a base64url string that we set on an HttpOnly + SameSite=Lax cookie.\n * Forgery requires the encryption key (KMS-managed in production).\n */\n\nconst ALGORITHM = 'aes-256-gcm'\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 16\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS = 5 * 60 * 1000\nconst HKDF_SALT = Buffer.from('open-mercato-channels-oauth-state-v1')\nconst HKDF_INFO = Buffer.from('communication_channels-oauth-state-cookie')\n\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME =\n  'om_cc_oauth_state'\n\nexport const DEFAULT_OAUTH_RETURN_URL = '/backend/profile/communication-channels'\n\n/** Cache tag for OAuth-state consume markers (invalidation / diagnostics). */\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG =\n  'communication_channels:oauth-state'\n\n/** Errors thrown by the helpers. Stable for tests + route mapping. */\nexport class OAuthStateError extends Error {\n  override name = 'OAuthStateError'\n  constructor(\n    message: string,\n    readonly code:\n      | 'missing_secret'\n      | 'invalid_cookie'\n      | 'expired'\n      | 'user_mismatch'\n      | 'decrypt_failed'\n      | 'replay',\n  ) {\n    super(message)\n  }\n}\n\n/**\n * Canonical state-cookie payload \u2014 provider-agnostic. Each OAuth provider\n * adapter (Gmail, \u2026) packs its own per-flow nonce / verifier into\n * the `extra` field rather than extending this shape.\n */\nexport interface OAuthStatePayload {\n  /** Nonce-like opaque value mirrored into the OAuth `state` query parameter. */\n  state: string\n  /** Per-flow CSRF nonce, returned alongside the OAuth response. */\n  nonce: string\n  /** Tenant-scoped user that initiated the flow. Validated on callback. */\n  userId: string\n  /** Tenant scope so the callback can pin the channel to the same tenant. */\n  tenantId: string\n  /** Optional organization id for multi-org tenants. */\n  organizationId?: string | null\n  /** Provider key (e.g. `gmail`) \u2014 routes the callback. */\n  providerKey: string\n  /** Where to redirect on success. Defaults to the profile page in the route. */\n  returnUrl?: string\n  /** Wall-clock expiry (ms since epoch). */\n  expiresAt: number\n  /** Provider-specific extras (PKCE code_verifier, scopes, login_hint, \u2026). */\n  extra?: Record<string, unknown>\n}\n\n/**\n * Minimal cache surface used by {@link consumeOAuthStateOnce}. Matches the\n * `has` / `set` subset of `@open-mercato/cache`'s `CacheStrategy` so callers\n * can pass `container.resolve('cache')` directly.\n */\nexport type OAuthStateConsumeStore = {\n  has(key: string): Promise<boolean>\n  set(\n    key: string,\n    value: unknown,\n    options?: { ttl?: number; tags?: string[] },\n  ): Promise<void>\n}\n\nexport function isSafeOAuthReturnUrl(value: string | null | undefined): value is string {\n  if (typeof value !== 'string') return false\n  if (value.length === 0 || value.length > 2048) return false\n  if (!value.startsWith('/') || value.startsWith('//')) return false\n  if (value.includes('\\\\')) return false\n  try {\n    const base = new URL('https://open-mercato.local')\n    const parsed = new URL(value, base)\n    return parsed.origin === base.origin && parsed.pathname.startsWith('/')\n  } catch {\n    return false\n  }\n}\n\nexport function normalizeOAuthReturnUrl(\n  value: string | null | undefined,\n  fallback: string = DEFAULT_OAUTH_RETURN_URL,\n): string {\n  return isSafeOAuthReturnUrl(value) ? value : fallback\n}\n\nfunction deriveKey(secret: string): Buffer {\n  return Buffer.from(crypto.hkdfSync('sha256', secret, HKDF_SALT, HKDF_INFO, 32))\n}\n\nfunction getSecret(): string {\n  const dedicated = process.env.OM_HUB_OAUTH_STATE_KEY ?? process.env.KMS_MASTER_KEY\n  if (dedicated) return dedicated\n  // No dedicated key configured. Fail closed in production rather than deriving\n  // the state-cookie key from JWT_SECRET (the platform session-signing secret) \u2014\n  // sharing that key means a JWT_SECRET leak also lets an attacker forge OAuth\n  // state cookies, bypassing the userId/tenant binding. In non-production we fall\n  // back to JWT_SECRET so dev/test envs that only configure one secret still work.\n  if (process.env.NODE_ENV === 'production') {\n    throw new Error('[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production')\n  }\n  const fallback = process.env.JWT_SECRET\n  if (!fallback) {\n    throw new OAuthStateError(\n      'OM_HUB_OAUTH_STATE_KEY (or fallback KMS_MASTER_KEY / JWT_SECRET) must be set',\n      'missing_secret',\n    )\n  }\n  return fallback\n}\n\n/** Cache key for a consumed OAuth `state` nonce. Exported for tests. */\nexport function oauthStateConsumedCacheKey(tenantId: string, state: string): string {\n  return `communication_channels:oauth-state:used:${tenantId}:${state}`\n}\n\n/** Encrypt + sign a state payload. Output is a base64url string suitable for a cookie. */\nexport function encryptOAuthState(payload: OAuthStatePayload): string {\n  const key = deriveKey(getSecret())\n  const iv = crypto.randomBytes(IV_LENGTH)\n  const json = JSON.stringify(payload)\n\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])\n  const tag = cipher.getAuthTag()\n\n  return Buffer.concat([iv, tag, ciphertext]).toString('base64url')\n}\n\n/**\n * Decrypt + verify a state cookie. Returns the payload or `null` if the cookie\n * is malformed / tampered. Returns the payload (NOT null) when the cookie has\n * expired \u2014 callers should check `expiresAt` themselves with the verification\n * helper below for stable status codes.\n */\nexport function decryptOAuthState(cookie: string): OAuthStatePayload | null {\n  try {\n    const key = deriveKey(getSecret())\n    const combined = Buffer.from(cookie, 'base64url')\n    if (combined.length < IV_LENGTH + TAG_LENGTH) return null\n\n    const iv = combined.subarray(0, IV_LENGTH)\n    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH)\n    const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH)\n\n    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)\n    decipher.setAuthTag(tag)\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')\n\n    return JSON.parse(decrypted) as OAuthStatePayload\n  } catch {\n    return null\n  }\n}\n\n/**\n * Verify a state cookie against the current session.\n *\n * Throws an {@link OAuthStateError} with a stable `code` field on any check\n * failure so route handlers can map to consistent HTTP responses + redirect\n * flash codes.\n *\n * Crypto + binding checks only \u2014 callers MUST also call\n * {@link consumeOAuthStateOnce} so the state cannot be replayed within the TTL.\n */\nexport function verifyOAuthState(input: {\n  cookie: string | null | undefined\n  expectedUserId: string\n  expectedProviderKey?: string\n  expectedState?: string\n  now?: number\n}): OAuthStatePayload {\n  if (!input.cookie) {\n    throw new OAuthStateError('Missing state cookie', 'invalid_cookie')\n  }\n  const payload = decryptOAuthState(input.cookie)\n  if (!payload) {\n    throw new OAuthStateError('Invalid state cookie', 'decrypt_failed')\n  }\n  const now = input.now ?? Date.now()\n  if (payload.expiresAt < now) {\n    throw new OAuthStateError('State cookie expired', 'expired')\n  }\n  if (payload.userId !== input.expectedUserId) {\n    throw new OAuthStateError('State cookie userId mismatch', 'user_mismatch')\n  }\n  if (input.expectedProviderKey && payload.providerKey !== input.expectedProviderKey) {\n    throw new OAuthStateError('State cookie providerKey mismatch', 'invalid_cookie')\n  }\n  if (input.expectedState && payload.state !== input.expectedState) {\n    throw new OAuthStateError('State cookie state nonce mismatch', 'invalid_cookie')\n  }\n  return payload\n}\n\n/**\n * Mark a verified OAuth `state` as consumed in a short-TTL store.\n *\n * First successful call records a used-marker until `expiresAt` (or 1s minimum).\n * A second call with the same `state` throws {@link OAuthStateError} `replay`.\n *\n * Call immediately after {@link verifyOAuthState} on the callback path so a\n * captured valid cookie cannot re-drive the flow within the cookie TTL.\n *\n * Note: the `has`\u2192`set` pattern is not atomic. Two concurrent callbacks racing\n * on the same `state` both pass the `has` check and both proceed \u2014 the\n * single-use guarantee requires an atomic `setNx` which `CacheStrategy` does\n * not currently expose. The race window is milliseconds; document it rather\n * than silently claiming it is closed.\n */\nexport async function consumeOAuthStateOnce(\n  store: OAuthStateConsumeStore,\n  payload: Pick<OAuthStatePayload, 'state' | 'expiresAt' | 'tenantId'>,\n  now: number = Date.now(),\n): Promise<void> {\n  const key = oauthStateConsumedCacheKey(payload.tenantId, payload.state)\n  if (await store.has(key)) {\n    throw new OAuthStateError('State cookie already used', 'replay')\n  }\n  const ttl = Math.max(payload.expiresAt - now, 1_000)\n  await store.set(key, 1, {\n    ttl,\n    tags: [`${COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG}:${payload.tenantId}`],\n  })\n}\n\n/**\n * Create a fresh state payload + matching `state` query parameter. PKCE\n * verifiers are NOT generated here \u2014 the provider adapter decides whether it\n * needs PKCE and packs the verifier into `extra` itself.\n */\nexport function createOAuthState(params: {\n  userId: string\n  tenantId: string\n  organizationId?: string | null\n  providerKey: string\n  returnUrl?: string\n  extra?: Record<string, unknown>\n}): { payload: OAuthStatePayload; cookie: string; stateParam: string } {\n  const state = crypto.randomBytes(32).toString('base64url')\n  const nonce = crypto.randomBytes(16).toString('base64url')\n  const payload: OAuthStatePayload = {\n    state,\n    nonce,\n    userId: params.userId,\n    tenantId: params.tenantId,\n    organizationId: params.organizationId ?? null,\n    providerKey: params.providerKey,\n    returnUrl: params.returnUrl,\n    extra: params.extra,\n    expiresAt: Date.now() + COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,\n  }\n  const cookie = encryptOAuthState(payload)\n  return { payload, cookie, stateParam: state }\n}\n\nlet memoryCacheStartupWarningEmitted = false\n\n/**\n * Emit a one-time startup warning unless the cache strategy is redis. Every other\n * strategy (memory, sqlite, jsonfile) keeps replay markers per process or per node,\n * so the single-use guarantee only holds across replicas on redis.\n */\nexport function emitOAuthStateMemoryCacheStartupWarningIfNeeded(\n  env: NodeJS.ProcessEnv = process.env,\n): void {\n  if (memoryCacheStartupWarningEmitted) return\n  const strategy = (env.CACHE_STRATEGY ?? 'memory').trim().toLowerCase()\n  if (strategy === 'redis') return\n  memoryCacheStartupWarningEmitted = true\n  oauthStateLogger.warn(\n    `OAuth state single-use protection needs a store shared across replicas. CACHE_STRATEGY=${strategy} is per-process or per-node; multi-replica deployments MUST set CACHE_STRATEGY=redis.`,\n    { context: 'startup', startup: true, cacheStrategy: strategy },\n  )\n}\n\n/** Test helper \u2014 reset the one-time startup warning latch. */\nexport function resetOAuthStateMemoryCacheStartupWarningForTests(): void {\n  memoryCacheStartupWarningEmitted = false\n}\n\nemitOAuthStateMemoryCacheStartupWarningIfNeeded()\n"],
-  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,oBAAoB;AAE7B,MAAM,mBAAmB,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AA8BlG,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,aAAa;AACZ,MAAM,4CAA4C,IAAI,KAAK;AAClE,MAAM,YAAY,OAAO,KAAK,sCAAsC;AACpE,MAAM,YAAY,OAAO,KAAK,2CAA2C;AAElE,MAAM,iDACX;AAEK,MAAM,2BAA2B;AAGjC,MAAM,+CACX;AAGK,MAAM,wBAAwB,MAAM;AAAA,EAEzC,YACE,SACS,MAOT;AACA,UAAM,OAAO;AARJ;AAHX,SAAS,OAAO;AAAA,EAYhB;AACF;AA0CO,SAAS,qBAAqB,OAAmD;AACtF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,KAAM,QAAO;AACtD,MAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AAC7D,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,4BAA4B;AACjD,UAAM,SAAS,IAAI,IAAI,OAAO,IAAI;AAClC,WAAO,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS,WAAW,GAAG;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBACd,OACA,WAAmB,0BACX;AACR,SAAO,qBAAqB,KAAK,IAAI,QAAQ;AAC/C;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,OAAO,KAAK,OAAO,SAAS,UAAU,QAAQ,WAAW,WAAW,EAAE,CAAC;AAChF;AAEA,SAAS,YAAoB;AAC3B,QAAM,YAAY,QAAQ,IAAI,0BAA0B,QAAQ,IAAI;AACpE,MAAI,UAAW,QAAO;AAMtB,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI,MAAM,4EAA4E;AAAA,EAC9F;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,2BAA2B,UAAkB,OAAuB;AAClF,SAAO,2CAA2C,QAAQ,IAAI,KAAK;AACrE;AAGO,SAAS,kBAAkB,SAAoC;AACpE,QAAM,MAAM,UAAU,UAAU,CAAC;AACjC,QAAM,KAAK,OAAO,YAAY,SAAS;AACvC,QAAM,OAAO,KAAK,UAAU,OAAO;AAEnC,QAAM,SAAS,OAAO,eAAe,WAAW,KAAK,EAAE;AACvD,QAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;AAC9E,QAAM,MAAM,OAAO,WAAW;AAE9B,SAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,SAAS,WAAW;AAClE;AAQO,SAAS,kBAAkB,QAA0C;AAC1E,MAAI;AACF,UAAM,MAAM,UAAU,UAAU,CAAC;AACjC,UAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAChD,QAAI,SAAS,SAAS,YAAY,WAAY,QAAO;AAErD,UAAM,KAAK,SAAS,SAAS,GAAG,SAAS;AACzC,UAAM,MAAM,SAAS,SAAS,WAAW,YAAY,UAAU;AAC/D,UAAM,aAAa,SAAS,SAAS,YAAY,UAAU;AAE3D,UAAM,WAAW,OAAO,iBAAiB,WAAW,KAAK,EAAE;AAC3D,aAAS,WAAW,GAAG;AACvB,UAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM;AAEhG,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,iBAAiB,OAMX;AACpB,MAAI,CAAC,MAAM,QAAQ;AACjB,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,UAAU,kBAAkB,MAAM,MAAM;AAC9C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,MAAI,QAAQ,YAAY,KAAK;AAC3B,UAAM,IAAI,gBAAgB,wBAAwB,SAAS;AAAA,EAC7D;AACA,MAAI,QAAQ,WAAW,MAAM,gBAAgB;AAC3C,UAAM,IAAI,gBAAgB,gCAAgC,eAAe;AAAA,EAC3E;AACA,MAAI,MAAM,uBAAuB,QAAQ,gBAAgB,MAAM,qBAAqB;AAClF,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,MAAI,MAAM,iBAAiB,QAAQ,UAAU,MAAM,eAAe;AAChE,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,SAAO;AACT;AAiBA,eAAsB,sBACpB,OACA,SACA,MAAc,KAAK,IAAI,GACR;AACf,QAAM,MAAM,2BAA2B,QAAQ,UAAU,QAAQ,KAAK;AACtE,MAAI,MAAM,MAAM,IAAI,GAAG,GAAG;AACxB,UAAM,IAAI,gBAAgB,6BAA6B,QAAQ;AAAA,EACjE;AACA,QAAM,MAAM,KAAK,IAAI,QAAQ,YAAY,KAAK,GAAK;AACnD,QAAM,MAAM,IAAI,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,GAAG,4CAA4C,IAAI,QAAQ,QAAQ,EAAE;AAAA,EAC9E,CAAC;AACH;AAOO,SAAS,iBAAiB,QAOsC;AACrE,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,UAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,WAAW,KAAK,IAAI,IAAI;AAAA,EAC1B;AACA,QAAM,SAAS,kBAAkB,OAAO;AACxC,SAAO,EAAE,SAAS,QAAQ,YAAY,MAAM;AAC9C;AAEA,IAAI,mCAAmC;AAOhC,SAAS,gDACd,MAAyB,QAAQ,KAC3B;AACN,MAAI,iCAAkC;AACtC,QAAM,YAAY,IAAI,kBAAkB,UAAU,KAAK,EAAE,YAAY;AACrE,MAAI,aAAa,QAAS;AAC1B,qCAAmC;AACnC,mBAAiB;AAAA,IACf,0FAA0F,QAAQ;AAAA,IAClG,EAAE,SAAS,WAAW,SAAS,MAAM,eAAe,SAAS;AAAA,EAC/D;AACF;AAGO,SAAS,mDAAyD;AACvE,qCAAmC;AACrC;AAEA,gDAAgD;",
+  "sourcesContent": ["import crypto from 'node:crypto'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst oauthStateLogger = createLogger('communication_channels').child({ component: 'oauth-state' })\n\n/**\n * OAuth state-cookie helper for the communication_channels hub.\n *\n * **Ported (re-implemented locally), NOT imported, from `packages/enterprise/src/modules/sso/lib/state-cookie.ts`.**\n * Root `AGENTS.md` rule: `@open-mercato/core` MUST NOT import from `@open-mercato/enterprise`.\n *\n * Design (per email integration spec \u00A7 OSS Independence + \u00A7 Hub Deltas \u2192 Delta 7):\n *   - AES-256-GCM payload encryption.\n *   - HKDF (SHA-256) key derivation from `OM_HUB_OAUTH_STATE_KEY` (falling back to\n *     `KMS_MASTER_KEY`). In production those dedicated keys are required; only in\n *     dev/test do we fall back to `JWT_SECRET` so envs that configure one secret\n *     still work. Production refuses the `JWT_SECRET` fallback so a session-secret\n *     leak cannot also forge OAuth-state cookies.\n *   - 5-minute TTL \u2014 short window to bound replay surface.\n *   - Payload binds the initiating `userId` so the callback rejects state cookies\n *     used by a different session.\n *   - Single-use consume-on-read via a short-TTL cache marker keyed by\n *     `tenantId:state` (see {@link consumeOAuthStateOnce}) so a captured cookie\n *     cannot re-drive the callback within the TTL. **This guarantee only holds\n *     across all replicas when `CACHE_STRATEGY=redis`.** With\n *     `CACHE_STRATEGY=memory` (the default) the marker is process-local \u2014 a\n *     replayed callback that reaches a different replica succeeds within the TTL.\n *     Multi-replica deployments MUST use a shared cache (`CACHE_STRATEGY=redis`).\n *\n * The output is a base64url string that we set on an HttpOnly + SameSite=Lax cookie.\n * Forgery requires the encryption key (KMS-managed in production).\n */\n\nconst ALGORITHM = 'aes-256-gcm'\nconst IV_LENGTH = 12\nconst TAG_LENGTH = 16\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS = 5 * 60 * 1000\nconst HKDF_SALT = Buffer.from('open-mercato-channels-oauth-state-v1')\nconst HKDF_INFO = Buffer.from('communication_channels-oauth-state-cookie')\n\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME =\n  'om_cc_oauth_state'\n\nexport const DEFAULT_OAUTH_RETURN_URL = '/backend/profile/communication-channels'\n\n/** Cache tag for OAuth-state consume markers (invalidation / diagnostics). */\nexport const COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG =\n  'communication_channels:oauth-state'\n\n/** Errors thrown by the helpers. Stable for tests + route mapping. */\nexport class OAuthStateError extends Error {\n  override name = 'OAuthStateError'\n  constructor(\n    message: string,\n    readonly code:\n      | 'missing_secret'\n      | 'invalid_cookie'\n      | 'expired'\n      | 'user_mismatch'\n      | 'decrypt_failed'\n      | 'replay',\n  ) {\n    super(message)\n  }\n}\n\n/**\n * Canonical state-cookie payload \u2014 provider-agnostic. Each OAuth provider\n * adapter (Gmail, \u2026) packs its own per-flow nonce / verifier into\n * the `extra` field rather than extending this shape.\n */\nexport interface OAuthStatePayload {\n  /** Nonce-like opaque value mirrored into the OAuth `state` query parameter. */\n  state: string\n  /** Per-flow CSRF nonce, returned alongside the OAuth response. */\n  nonce: string\n  /** Tenant-scoped user that initiated the flow. Validated on callback. */\n  userId: string\n  /** Tenant scope so the callback can pin the channel to the same tenant. */\n  tenantId: string\n  /** Optional organization id for multi-org tenants. */\n  organizationId?: string | null\n  /** Provider key (e.g. `gmail`) \u2014 routes the callback. */\n  providerKey: string\n  /** Where to redirect on success. Defaults to the profile page in the route. */\n  returnUrl?: string\n  /** Wall-clock expiry (ms since epoch). */\n  expiresAt: number\n  /** Provider-specific extras (PKCE code_verifier, scopes, login_hint, \u2026). */\n  extra?: Record<string, unknown>\n}\n\n/**\n * Minimal cache surface used by {@link consumeOAuthStateOnce}. Matches the\n * `has` / `set` subset of `@open-mercato/cache`'s `CacheStrategy` so callers\n * can pass `container.resolve('cache')` directly.\n */\nexport type OAuthStateConsumeStore = {\n  has(key: string): Promise<boolean>\n  set(\n    key: string,\n    value: unknown,\n    options?: { ttl?: number; tags?: string[] },\n  ): Promise<void>\n}\n\nexport function isSafeOAuthReturnUrl(value: string | null | undefined): value is string {\n  if (typeof value !== 'string') return false\n  if (value.length === 0 || value.length > 2048) return false\n  if (!value.startsWith('/') || value.startsWith('//')) return false\n  if (value.includes('\\\\')) return false\n  try {\n    const base = new URL('https://open-mercato.local')\n    const parsed = new URL(value, base)\n    return parsed.origin === base.origin && parsed.pathname.startsWith('/')\n  } catch {\n    return false\n  }\n}\n\nexport function normalizeOAuthReturnUrl(\n  value: string | null | undefined,\n  fallback: string = DEFAULT_OAUTH_RETURN_URL,\n): string {\n  return isSafeOAuthReturnUrl(value) ? value : fallback\n}\n\nfunction deriveKey(secret: string): Buffer {\n  return Buffer.from(crypto.hkdfSync('sha256', secret, HKDF_SALT, HKDF_INFO, 32))\n}\n\nfunction getSecret(): string {\n  const dedicated = process.env.OM_HUB_OAUTH_STATE_KEY ?? process.env.KMS_MASTER_KEY\n  if (dedicated) return dedicated\n  // No dedicated key configured. Fail closed in production rather than deriving\n  // the state-cookie key from JWT_SECRET (the platform session-signing secret) \u2014\n  // sharing that key means a JWT_SECRET leak also lets an attacker forge OAuth\n  // state cookies, bypassing the userId/tenant binding. In non-production we fall\n  // back to JWT_SECRET so dev/test envs that only configure one secret still work.\n  if (process.env.NODE_ENV === 'production') {\n    throw new OAuthStateError(\n      '[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production',\n      'missing_secret',\n    )\n  }\n  const fallback = process.env.JWT_SECRET\n  if (!fallback) {\n    throw new OAuthStateError(\n      'OM_HUB_OAUTH_STATE_KEY (or fallback KMS_MASTER_KEY / JWT_SECRET) must be set',\n      'missing_secret',\n    )\n  }\n  return fallback\n}\n\n/** Cache key for a consumed OAuth `state` nonce. Exported for tests. */\nexport function oauthStateConsumedCacheKey(tenantId: string, state: string): string {\n  return `communication_channels:oauth-state:used:${tenantId}:${state}`\n}\n\n/** Encrypt + sign a state payload. Output is a base64url string suitable for a cookie. */\nexport function encryptOAuthState(payload: OAuthStatePayload): string {\n  const key = deriveKey(getSecret())\n  const iv = crypto.randomBytes(IV_LENGTH)\n  const json = JSON.stringify(payload)\n\n  const cipher = crypto.createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])\n  const tag = cipher.getAuthTag()\n\n  return Buffer.concat([iv, tag, ciphertext]).toString('base64url')\n}\n\n/**\n * Decrypt + verify a state cookie. Returns the payload or `null` if the cookie\n * is malformed / tampered. Returns the payload (NOT null) when the cookie has\n * expired \u2014 callers should check `expiresAt` themselves with the verification\n * helper below for stable status codes.\n */\nexport function decryptOAuthState(cookie: string): OAuthStatePayload | null {\n  try {\n    const key = deriveKey(getSecret())\n    const combined = Buffer.from(cookie, 'base64url')\n    if (combined.length < IV_LENGTH + TAG_LENGTH) return null\n\n    const iv = combined.subarray(0, IV_LENGTH)\n    const tag = combined.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH)\n    const ciphertext = combined.subarray(IV_LENGTH + TAG_LENGTH)\n\n    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)\n    decipher.setAuthTag(tag)\n    const decrypted = Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8')\n\n    return JSON.parse(decrypted) as OAuthStatePayload\n  } catch {\n    return null\n  }\n}\n\n/**\n * Verify a state cookie against the current session.\n *\n * Throws an {@link OAuthStateError} with a stable `code` field on any check\n * failure so route handlers can map to consistent HTTP responses + redirect\n * flash codes.\n *\n * Crypto + binding checks only \u2014 callers MUST also call\n * {@link consumeOAuthStateOnce} so the state cannot be replayed within the TTL.\n */\nexport function verifyOAuthState(input: {\n  cookie: string | null | undefined\n  expectedUserId: string\n  expectedProviderKey?: string\n  expectedState?: string\n  now?: number\n}): OAuthStatePayload {\n  if (!input.cookie) {\n    throw new OAuthStateError('Missing state cookie', 'invalid_cookie')\n  }\n  const payload = decryptOAuthState(input.cookie)\n  if (!payload) {\n    throw new OAuthStateError('Invalid state cookie', 'decrypt_failed')\n  }\n  const now = input.now ?? Date.now()\n  if (payload.expiresAt < now) {\n    throw new OAuthStateError('State cookie expired', 'expired')\n  }\n  if (payload.userId !== input.expectedUserId) {\n    throw new OAuthStateError('State cookie userId mismatch', 'user_mismatch')\n  }\n  if (input.expectedProviderKey && payload.providerKey !== input.expectedProviderKey) {\n    throw new OAuthStateError('State cookie providerKey mismatch', 'invalid_cookie')\n  }\n  if (input.expectedState && payload.state !== input.expectedState) {\n    throw new OAuthStateError('State cookie state nonce mismatch', 'invalid_cookie')\n  }\n  return payload\n}\n\n/**\n * Mark a verified OAuth `state` as consumed in a short-TTL store.\n *\n * First successful call records a used-marker until `expiresAt` (or 1s minimum).\n * A second call with the same `state` throws {@link OAuthStateError} `replay`.\n *\n * Call immediately after {@link verifyOAuthState} on the callback path so a\n * captured valid cookie cannot re-drive the flow within the cookie TTL.\n *\n * Note: the `has`\u2192`set` pattern is not atomic. Two concurrent callbacks racing\n * on the same `state` both pass the `has` check and both proceed \u2014 the\n * single-use guarantee requires an atomic `setNx` which `CacheStrategy` does\n * not currently expose. The race window is milliseconds; document it rather\n * than silently claiming it is closed.\n */\nexport async function consumeOAuthStateOnce(\n  store: OAuthStateConsumeStore,\n  payload: Pick<OAuthStatePayload, 'state' | 'expiresAt' | 'tenantId'>,\n  now: number = Date.now(),\n): Promise<void> {\n  const key = oauthStateConsumedCacheKey(payload.tenantId, payload.state)\n  if (await store.has(key)) {\n    throw new OAuthStateError('State cookie already used', 'replay')\n  }\n  const ttl = Math.max(payload.expiresAt - now, 1_000)\n  await store.set(key, 1, {\n    ttl,\n    tags: [`${COMMUNICATION_CHANNELS_OAUTH_STATE_CACHE_TAG}:${payload.tenantId}`],\n  })\n}\n\n/**\n * Create a fresh state payload + matching `state` query parameter. PKCE\n * verifiers are NOT generated here \u2014 the provider adapter decides whether it\n * needs PKCE and packs the verifier into `extra` itself.\n */\nexport function createOAuthState(params: {\n  userId: string\n  tenantId: string\n  organizationId?: string | null\n  providerKey: string\n  returnUrl?: string\n  extra?: Record<string, unknown>\n}): { payload: OAuthStatePayload; cookie: string; stateParam: string } {\n  const state = crypto.randomBytes(32).toString('base64url')\n  const nonce = crypto.randomBytes(16).toString('base64url')\n  const payload: OAuthStatePayload = {\n    state,\n    nonce,\n    userId: params.userId,\n    tenantId: params.tenantId,\n    organizationId: params.organizationId ?? null,\n    providerKey: params.providerKey,\n    returnUrl: params.returnUrl,\n    extra: params.extra,\n    expiresAt: Date.now() + COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,\n  }\n  const cookie = encryptOAuthState(payload)\n  return { payload, cookie, stateParam: state }\n}\n\nlet memoryCacheStartupWarningEmitted = false\n\n/**\n * Emit a one-time startup warning unless the cache strategy is redis. Every other\n * strategy (memory, sqlite, jsonfile) keeps replay markers per process or per node,\n * so the single-use guarantee only holds across replicas on redis.\n */\nexport function emitOAuthStateMemoryCacheStartupWarningIfNeeded(\n  env: NodeJS.ProcessEnv = process.env,\n): void {\n  if (memoryCacheStartupWarningEmitted) return\n  const strategy = (env.CACHE_STRATEGY ?? 'memory').trim().toLowerCase()\n  if (strategy === 'redis') return\n  memoryCacheStartupWarningEmitted = true\n  oauthStateLogger.warn(\n    `OAuth state single-use protection needs a store shared across replicas. CACHE_STRATEGY=${strategy} is per-process or per-node; multi-replica deployments MUST set CACHE_STRATEGY=redis.`,\n    { context: 'startup', startup: true, cacheStrategy: strategy },\n  )\n}\n\n/** Test helper \u2014 reset the one-time startup warning latch. */\nexport function resetOAuthStateMemoryCacheStartupWarningForTests(): void {\n  memoryCacheStartupWarningEmitted = false\n}\n\nemitOAuthStateMemoryCacheStartupWarningIfNeeded()\n"],
+  "mappings": "AAAA,OAAO,YAAY;AACnB,SAAS,oBAAoB;AAE7B,MAAM,mBAAmB,aAAa,wBAAwB,EAAE,MAAM,EAAE,WAAW,cAAc,CAAC;AA8BlG,MAAM,YAAY;AAClB,MAAM,YAAY;AAClB,MAAM,aAAa;AACZ,MAAM,4CAA4C,IAAI,KAAK;AAClE,MAAM,YAAY,OAAO,KAAK,sCAAsC;AACpE,MAAM,YAAY,OAAO,KAAK,2CAA2C;AAElE,MAAM,iDACX;AAEK,MAAM,2BAA2B;AAGjC,MAAM,+CACX;AAGK,MAAM,wBAAwB,MAAM;AAAA,EAEzC,YACE,SACS,MAOT;AACA,UAAM,OAAO;AARJ;AAHX,SAAS,OAAO;AAAA,EAYhB;AACF;AA0CO,SAAS,qBAAqB,OAAmD;AACtF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,KAAM,QAAO;AACtD,MAAI,CAAC,MAAM,WAAW,GAAG,KAAK,MAAM,WAAW,IAAI,EAAG,QAAO;AAC7D,MAAI,MAAM,SAAS,IAAI,EAAG,QAAO;AACjC,MAAI;AACF,UAAM,OAAO,IAAI,IAAI,4BAA4B;AACjD,UAAM,SAAS,IAAI,IAAI,OAAO,IAAI;AAClC,WAAO,OAAO,WAAW,KAAK,UAAU,OAAO,SAAS,WAAW,GAAG;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,wBACd,OACA,WAAmB,0BACX;AACR,SAAO,qBAAqB,KAAK,IAAI,QAAQ;AAC/C;AAEA,SAAS,UAAU,QAAwB;AACzC,SAAO,OAAO,KAAK,OAAO,SAAS,UAAU,QAAQ,WAAW,WAAW,EAAE,CAAC;AAChF;AAEA,SAAS,YAAoB;AAC3B,QAAM,YAAY,QAAQ,IAAI,0BAA0B,QAAQ,IAAI;AACpE,MAAI,UAAW,QAAO;AAMtB,MAAI,QAAQ,IAAI,aAAa,cAAc;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AACb,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,2BAA2B,UAAkB,OAAuB;AAClF,SAAO,2CAA2C,QAAQ,IAAI,KAAK;AACrE;AAGO,SAAS,kBAAkB,SAAoC;AACpE,QAAM,MAAM,UAAU,UAAU,CAAC;AACjC,QAAM,KAAK,OAAO,YAAY,SAAS;AACvC,QAAM,OAAO,KAAK,UAAU,OAAO;AAEnC,QAAM,SAAS,OAAO,eAAe,WAAW,KAAK,EAAE;AACvD,QAAM,aAAa,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;AAC9E,QAAM,MAAM,OAAO,WAAW;AAE9B,SAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,SAAS,WAAW;AAClE;AAQO,SAAS,kBAAkB,QAA0C;AAC1E,MAAI;AACF,UAAM,MAAM,UAAU,UAAU,CAAC;AACjC,UAAM,WAAW,OAAO,KAAK,QAAQ,WAAW;AAChD,QAAI,SAAS,SAAS,YAAY,WAAY,QAAO;AAErD,UAAM,KAAK,SAAS,SAAS,GAAG,SAAS;AACzC,UAAM,MAAM,SAAS,SAAS,WAAW,YAAY,UAAU;AAC/D,UAAM,aAAa,SAAS,SAAS,YAAY,UAAU;AAE3D,UAAM,WAAW,OAAO,iBAAiB,WAAW,KAAK,EAAE;AAC3D,aAAS,WAAW,GAAG;AACvB,UAAM,YAAY,OAAO,OAAO,CAAC,SAAS,OAAO,UAAU,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE,SAAS,MAAM;AAEhG,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,iBAAiB,OAMX;AACpB,MAAI,CAAC,MAAM,QAAQ;AACjB,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,UAAU,kBAAkB,MAAM,MAAM;AAC9C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,gBAAgB,wBAAwB,gBAAgB;AAAA,EACpE;AACA,QAAM,MAAM,MAAM,OAAO,KAAK,IAAI;AAClC,MAAI,QAAQ,YAAY,KAAK;AAC3B,UAAM,IAAI,gBAAgB,wBAAwB,SAAS;AAAA,EAC7D;AACA,MAAI,QAAQ,WAAW,MAAM,gBAAgB;AAC3C,UAAM,IAAI,gBAAgB,gCAAgC,eAAe;AAAA,EAC3E;AACA,MAAI,MAAM,uBAAuB,QAAQ,gBAAgB,MAAM,qBAAqB;AAClF,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,MAAI,MAAM,iBAAiB,QAAQ,UAAU,MAAM,eAAe;AAChE,UAAM,IAAI,gBAAgB,qCAAqC,gBAAgB;AAAA,EACjF;AACA,SAAO;AACT;AAiBA,eAAsB,sBACpB,OACA,SACA,MAAc,KAAK,IAAI,GACR;AACf,QAAM,MAAM,2BAA2B,QAAQ,UAAU,QAAQ,KAAK;AACtE,MAAI,MAAM,MAAM,IAAI,GAAG,GAAG;AACxB,UAAM,IAAI,gBAAgB,6BAA6B,QAAQ;AAAA,EACjE;AACA,QAAM,MAAM,KAAK,IAAI,QAAQ,YAAY,KAAK,GAAK;AACnD,QAAM,MAAM,IAAI,KAAK,GAAG;AAAA,IACtB;AAAA,IACA,MAAM,CAAC,GAAG,4CAA4C,IAAI,QAAQ,QAAQ,EAAE;AAAA,EAC9E,CAAC;AACH;AAOO,SAAS,iBAAiB,QAOsC;AACrE,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,QAAQ,OAAO,YAAY,EAAE,EAAE,SAAS,WAAW;AACzD,QAAM,UAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,QAAQ,OAAO;AAAA,IACf,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO,kBAAkB;AAAA,IACzC,aAAa,OAAO;AAAA,IACpB,WAAW,OAAO;AAAA,IAClB,OAAO,OAAO;AAAA,IACd,WAAW,KAAK,IAAI,IAAI;AAAA,EAC1B;AACA,QAAM,SAAS,kBAAkB,OAAO;AACxC,SAAO,EAAE,SAAS,QAAQ,YAAY,MAAM;AAC9C;AAEA,IAAI,mCAAmC;AAOhC,SAAS,gDACd,MAAyB,QAAQ,KAC3B;AACN,MAAI,iCAAkC;AACtC,QAAM,YAAY,IAAI,kBAAkB,UAAU,KAAK,EAAE,YAAY;AACrE,MAAI,aAAa,QAAS;AAC1B,qCAAmC;AACnC,mBAAiB;AAAA,IACf,0FAA0F,QAAQ;AAAA,IAClG,EAAE,SAAS,WAAW,SAAS,MAAM,eAAe,SAAS;AAAA,EAC/D;AACF;AAGO,SAAS,mDAAyD;AACvE,qCAAmC;AACrC;AAEA,gDAAgD;",
   "names": []
 }

package/dist/modules/communication_channels/lib/use-connect-channel.js

@@ -32,6 +32,16 @@ function useConnectChannel(options) {
       });
       const body = response.result;
       if (!response.ok || !body?.authorizeUrl) {
+        if (body?.code === "missing_secret") {
+          flash(
+            t(
+              "communication_channels.profile.connect.notAvailable",
+              "Mailbox connection is not available. Ask an administrator to configure the OAuth state key."
+            ),
+            "error"
+          );
+          return;
+        }
         if (body?.code === "oauth_client_not_configured") {
           flash(
             t(

package/dist/modules/communication_channels/lib/use-connect-channel.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/use-connect-channel.ts"],
-  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\n\ntype InitiateResponse = { authorizeUrl?: string; error?: string; code?: string }\n\n/**\n * Shared OAuth \"connect\" flow for email channel provider widgets (Gmail and\n * other OAuth providers). Wraps the guarded-mutation contract + `/oauth/<provider>/initiate`\n * call + redirect, so each provider widget only supplies its own button chrome.\n */\nexport function useConnectChannel(options: {\n  providerKey: string\n  returnUrl?: string\n}): { connect: () => Promise<void>; pending: boolean } {\n  const { providerKey } = options\n  const returnUrl = options.returnUrl ?? '/backend/profile/communication-channels'\n  const t = useT()\n  const [pending, setPending] = React.useState(false)\n  const { runMutation, retryLastMutation } = useGuardedMutation({\n    contextId: `channel-${providerKey}-connect`,\n    blockedMessage: t('communication_channels.profile.connect.blocked', 'Connection blocked by validation'),\n  })\n  const mutationContext = React.useMemo(\n    () => ({ providerKey, retryLastMutation }),\n    [providerKey, retryLastMutation],\n  )\n\n  const connect = React.useCallback(async () => {\n    if (pending) return\n    setPending(true)\n    try {\n      const response = await runMutation({\n        context: mutationContext,\n        mutationPayload: { providerKey },\n        operation: () =>\n          apiCall<InitiateResponse>(`/api/communication_channels/oauth/${providerKey}/initiate`, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ returnUrl }),\n          }),\n      })\n      const body = response.result as InitiateResponse | undefined\n      if (!response.ok || !body?.authorizeUrl) {\n        if (body?.code === 'oauth_client_not_configured') {\n          flash(\n            t(\n              'communication_channels.profile.connect.notConfigured',\n              'This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.',\n            ),\n            'error',\n          )\n          return\n        }\n        flash(\n          body?.error ??\n            t('communication_channels.profile.connect.oauthFailed', 'Could not start OAuth connection.'),\n          'error',\n        )\n        return\n      }\n      window.location.assign(body.authorizeUrl)\n    } finally {\n      setPending(false)\n    }\n  }, [mutationContext, pending, providerKey, returnUrl, runMutation, t])\n\n  return { connect, pending }\n}\n"],
-  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,0BAA0B;AACnC,SAAS,eAAe;AASjB,SAAS,kBAAkB,SAGqB;AACrD,QAAM,EAAE,YAAY,IAAI;AACxB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAAmB;AAAA,IAC5D,WAAW,WAAW,WAAW;AAAA,IACjC,gBAAgB,EAAE,kDAAkD,kCAAkC;AAAA,EACxG,CAAC;AACD,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,EAAE,aAAa,kBAAkB;AAAA,IACxC,CAAC,aAAa,iBAAiB;AAAA,EACjC;AAEA,QAAM,UAAU,MAAM,YAAY,YAAY;AAC5C,QAAI,QAAS;AACb,eAAW,IAAI;AACf,QAAI;AACF,YAAM,WAAW,MAAM,YAAY;AAAA,QACjC,SAAS;AAAA,QACT,iBAAiB,EAAE,YAAY;AAAA,QAC/B,WAAW,MACT,QAA0B,qCAAqC,WAAW,aAAa;AAAA,UACrF,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,QACpC,CAAC;AAAA,MACL,CAAC;AACD,YAAM,OAAO,SAAS;AACtB,UAAI,CAAC,SAAS,MAAM,CAAC,MAAM,cAAc;AACvC,YAAI,MAAM,SAAS,+BAA+B;AAChD;AAAA,YACE;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AACA;AAAA,QACF;AACA;AAAA,UACE,MAAM,SACJ,EAAE,sDAAsD,mCAAmC;AAAA,UAC7F;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,SAAS,OAAO,KAAK,YAAY;AAAA,IAC1C,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,aAAa,WAAW,aAAa,CAAC,CAAC;AAErE,SAAO,EAAE,SAAS,QAAQ;AAC5B;",
+  "sourcesContent": ["'use client'\n\nimport * as React from 'react'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\n\ntype InitiateResponse = { authorizeUrl?: string; error?: string; code?: string }\n\n/**\n * Shared OAuth \"connect\" flow for email channel provider widgets (Gmail and\n * other OAuth providers). Wraps the guarded-mutation contract + `/oauth/<provider>/initiate`\n * call + redirect, so each provider widget only supplies its own button chrome.\n */\nexport function useConnectChannel(options: {\n  providerKey: string\n  returnUrl?: string\n}): { connect: () => Promise<void>; pending: boolean } {\n  const { providerKey } = options\n  const returnUrl = options.returnUrl ?? '/backend/profile/communication-channels'\n  const t = useT()\n  const [pending, setPending] = React.useState(false)\n  const { runMutation, retryLastMutation } = useGuardedMutation({\n    contextId: `channel-${providerKey}-connect`,\n    blockedMessage: t('communication_channels.profile.connect.blocked', 'Connection blocked by validation'),\n  })\n  const mutationContext = React.useMemo(\n    () => ({ providerKey, retryLastMutation }),\n    [providerKey, retryLastMutation],\n  )\n\n  const connect = React.useCallback(async () => {\n    if (pending) return\n    setPending(true)\n    try {\n      const response = await runMutation({\n        context: mutationContext,\n        mutationPayload: { providerKey },\n        operation: () =>\n          apiCall<InitiateResponse>(`/api/communication_channels/oauth/${providerKey}/initiate`, {\n            method: 'POST',\n            headers: { 'content-type': 'application/json' },\n            body: JSON.stringify({ returnUrl }),\n          }),\n      })\n      const body = response.result as InitiateResponse | undefined\n      if (!response.ok || !body?.authorizeUrl) {\n        if (body?.code === 'missing_secret') {\n          flash(\n            t(\n              'communication_channels.profile.connect.notAvailable',\n              'Mailbox connection is not available. Ask an administrator to configure the OAuth state key.',\n            ),\n            'error',\n          )\n          return\n        }\n        if (body?.code === 'oauth_client_not_configured') {\n          flash(\n            t(\n              'communication_channels.profile.connect.notConfigured',\n              'This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.',\n            ),\n            'error',\n          )\n          return\n        }\n        flash(\n          body?.error ??\n            t('communication_channels.profile.connect.oauthFailed', 'Could not start OAuth connection.'),\n          'error',\n        )\n        return\n      }\n      window.location.assign(body.authorizeUrl)\n    } finally {\n      setPending(false)\n    }\n  }, [mutationContext, pending, providerKey, returnUrl, runMutation, t])\n\n  return { connect, pending }\n}\n"],
+  "mappings": ";AAEA,YAAY,WAAW;AACvB,SAAS,YAAY;AACrB,SAAS,aAAa;AACtB,SAAS,0BAA0B;AACnC,SAAS,eAAe;AASjB,SAAS,kBAAkB,SAGqB;AACrD,QAAM,EAAE,YAAY,IAAI;AACxB,QAAM,YAAY,QAAQ,aAAa;AACvC,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,MAAM,SAAS,KAAK;AAClD,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAAmB;AAAA,IAC5D,WAAW,WAAW,WAAW;AAAA,IACjC,gBAAgB,EAAE,kDAAkD,kCAAkC;AAAA,EACxG,CAAC;AACD,QAAM,kBAAkB,MAAM;AAAA,IAC5B,OAAO,EAAE,aAAa,kBAAkB;AAAA,IACxC,CAAC,aAAa,iBAAiB;AAAA,EACjC;AAEA,QAAM,UAAU,MAAM,YAAY,YAAY;AAC5C,QAAI,QAAS;AACb,eAAW,IAAI;AACf,QAAI;AACF,YAAM,WAAW,MAAM,YAAY;AAAA,QACjC,SAAS;AAAA,QACT,iBAAiB,EAAE,YAAY;AAAA,QAC/B,WAAW,MACT,QAA0B,qCAAqC,WAAW,aAAa;AAAA,UACrF,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,CAAC;AAAA,QACpC,CAAC;AAAA,MACL,CAAC;AACD,YAAM,OAAO,SAAS;AACtB,UAAI,CAAC,SAAS,MAAM,CAAC,MAAM,cAAc;AACvC,YAAI,MAAM,SAAS,kBAAkB;AACnC;AAAA,YACE;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AACA;AAAA,QACF;AACA,YAAI,MAAM,SAAS,+BAA+B;AAChD;AAAA,YACE;AAAA,cACE;AAAA,cACA;AAAA,YACF;AAAA,YACA;AAAA,UACF;AACA;AAAA,QACF;AACA;AAAA,UACE,MAAM,SACJ,EAAE,sDAAsD,mCAAmC;AAAA,UAC7F;AAAA,QACF;AACA;AAAA,MACF;AACA,aAAO,SAAS,OAAO,KAAK,YAAY;AAAA,IAC1C,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,iBAAiB,SAAS,aAAa,WAAW,aAAa,CAAC,CAAC;AAErE,SAAO,EAAE,SAAS,QAAQ;AAC5B;",
   "names": []
 }

package/dist/modules/customers/api/activity-types/route.js

@@ -0,0 +1,151 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveDictionaryRouteContext } from "../dictionaries/context.js";
+import { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from "../dictionaries/cache.js";
+import { getInjectionRegistryVersion } from "@open-mercato/shared/modules/widgets/injection-loader";
+import {
+  resolveScopedCalendarEventTypes
+} from "../../lib/calendar/eventTypeResolver.js";
+import { calendarEventTypeBehaviorSchema } from "../../calendar-event-types.js";
+import { getCalendarEventTypeRegistryVersion } from "../../calendar-event-types.js";
+const logger = createLogger("customers");
+function reportActivityTypeError(error, code, attributes) {
+  try {
+    getTelemetryRuntime()?.reportError(error, { module: "customers", code, attributes });
+  } catch {
+  }
+}
+const querySchema = z.object({ organizationId: z.string().uuid().optional() });
+const responseSchema = z.object({
+  fallbackKey: z.literal("meeting"),
+  items: z.array(z.object({
+    key: z.string(),
+    label: z.string(),
+    labelKey: z.string().optional(),
+    icon: z.string().nullable().optional(),
+    color: z.string().nullable().optional(),
+    behavior: calendarEventTypeBehaviorSchema,
+    selectable: z.boolean(),
+    panelKey: z.string().optional(),
+    source: z.string(),
+    provenance: z.record(z.string(), z.unknown()),
+    historical: z.boolean(),
+    fallbackReason: z.enum(["tombstoned", "module-unavailable", "unknown"]).optional(),
+    adminConfigurable: z.boolean(),
+    isInherited: z.boolean(),
+    isLocalOverride: z.boolean(),
+    updatedAt: z.string().nullable(),
+    missingCustomFieldsetIds: z.array(z.string()),
+    inactiveDictionaryOverride: z.boolean().optional()
+  }))
+});
+const metadata = {
+  GET: { requireAuth: true }
+};
+async function GET(req) {
+  try {
+    const url = new URL(req.url);
+    const query = querySchema.parse({ organizationId: url.searchParams.get("organizationId") ?? void 0 });
+    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId });
+    if (!context.organizationId) {
+      return NextResponse.json({ error: context.translate("customers.errors.organization_required", "Organization context is required") }, { status: 400 });
+    }
+    const organizationId = context.organizationId;
+    const rbac = context.container.resolve("rbacService");
+    const actorId = context.auth?.sub;
+    if (!rbac || !actorId) {
+      throw new CrudHttpError(403, { error: context.translate("customers.calendar.activityTypes.errors.forbidden", "You do not have permission to view activity types.") });
+    }
+    const permissionScope = { tenantId: context.tenantId, organizationId };
+    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ["customers.interactions.view"], permissionScope);
+    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ["customers.settings.manage"], permissionScope);
+    if (!canManageSettings) {
+      throw new CrudHttpError(403, { error: context.translate("customers.calendar.activityTypes.errors.forbidden", "You do not have permission to view activity types.") });
+    }
+    const hierarchy = context.container.resolve("organizationHierarchyService");
+    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId });
+    if (ancestors === null) {
+      throw new CrudHttpError(403, { error: context.translate("customers.errors.organization_forbidden", "Organization not accessible") });
+    }
+    const scopeIds = Array.from(/* @__PURE__ */ new Set([organizationId, ...ancestors.slice().reverse()]));
+    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join("|")}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`;
+    const cached = await context.cache?.get(cacheKey);
+    if (cached) return NextResponse.json(cached);
+    let catalog;
+    try {
+      catalog = await resolveScopedCalendarEventTypes({
+        em: context.em,
+        tenantId: context.tenantId,
+        organizationId,
+        readableOrganizationIds: scopeIds
+      });
+    } catch (err) {
+      logger.error("customers.activity_types.resolve failed", {
+        err,
+        tenantId: context.tenantId,
+        organizationId
+      });
+      reportActivityTypeError(err, "customers.activity_type_catalog_resolution_failed", {
+        tenantId: context.tenantId,
+        organizationId
+      });
+      return NextResponse.json({
+        error: context.translate("customers.calendar.activityTypes.errors.loadFailed", "Failed to load activity types"),
+        code: "activity_type_catalog_unavailable"
+      }, { status: 503 });
+    }
+    if (context.cache) {
+      await context.cache.set(cacheKey, catalog, {
+        ttl: DICTIONARY_CACHE_TTL_MS,
+        tags: createDictionaryCacheTags({
+          tenantId: context.tenantId,
+          mappedKind: "activity_type",
+          organizationIds: scopeIds
+        })
+      }).catch((err) => {
+        logger.warn("customers.activity_types cache write failed", { err });
+        reportActivityTypeError(err, "customers.activity_type_catalog_cache_write_failed", {
+          tenantId: context.tenantId,
+          organizationId
+        });
+      });
+    }
+    return NextResponse.json(catalog);
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    logger.error("customers.activity_types request failed", { err });
+    reportActivityTypeError(err, "customers.activity_type_catalog_request_failed");
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({
+      error: translate("customers.calendar.activityTypes.errors.loadFailed", "Failed to load activity types")
+    }, { status: err instanceof z.ZodError ? 400 : 500 });
+  }
+}
+const openApi = {
+  tag: "Customers",
+  summary: "Effective calendar activity types",
+  methods: {
+    GET: {
+      summary: "List effective calendar activity types",
+      description: "Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.",
+      responses: [{ status: 200, description: "Effective activity-type catalog", schema: responseSchema }],
+      errors: [
+        { status: 400, description: "Organization scope is required", schema: z.object({ error: z.string() }) },
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Forbidden", schema: z.object({ error: z.string() }) },
+        { status: 500, description: "Unexpected server error", schema: z.object({ error: z.string() }) }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/customers/api/activity-types/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customers/api/activity-types/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveDictionaryRouteContext } from '../dictionaries/context'\nimport { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from '../dictionaries/cache'\nimport { getInjectionRegistryVersion } from '@open-mercato/shared/modules/widgets/injection-loader'\nimport {\n  resolveScopedCalendarEventTypes,\n} from '../../lib/calendar/eventTypeResolver'\nimport { calendarEventTypeBehaviorSchema } from '../../calendar-event-types'\nimport { getCalendarEventTypeRegistryVersion } from '../../calendar-event-types'\n\nconst logger = createLogger('customers')\n\nfunction reportActivityTypeError(error: unknown, code: string, attributes?: Record<string, string>): void {\n  try {\n    getTelemetryRuntime()?.reportError(error, { module: 'customers', code, attributes })\n  } catch {}\n}\n\nconst querySchema = z.object({ organizationId: z.string().uuid().optional() })\nconst responseSchema = z.object({\n  fallbackKey: z.literal('meeting'),\n  items: z.array(z.object({\n    key: z.string(),\n    label: z.string(),\n    labelKey: z.string().optional(),\n    icon: z.string().nullable().optional(),\n    color: z.string().nullable().optional(),\n    behavior: calendarEventTypeBehaviorSchema,\n    selectable: z.boolean(),\n    panelKey: z.string().optional(),\n    source: z.string(),\n    provenance: z.record(z.string(), z.unknown()),\n    historical: z.boolean(),\n    fallbackReason: z.enum(['tombstoned', 'module-unavailable', 'unknown']).optional(),\n    adminConfigurable: z.boolean(),\n    isInherited: z.boolean(),\n    isLocalOverride: z.boolean(),\n    updatedAt: z.string().nullable(),\n    missingCustomFieldsetIds: z.array(z.string()),\n    inactiveDictionaryOverride: z.boolean().optional(),\n  })),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const query = querySchema.parse({ organizationId: url.searchParams.get('organizationId') ?? undefined })\n    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId })\n    if (!context.organizationId) {\n      return NextResponse.json({ error: context.translate('customers.errors.organization_required', 'Organization context is required') }, { status: 400 })\n    }\n    const organizationId = context.organizationId\n    const rbac = context.container.resolve('rbacService') as RbacService | undefined\n    const actorId = context.auth?.sub\n    if (!rbac || !actorId) {\n      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })\n    }\n    const permissionScope = { tenantId: context.tenantId, organizationId }\n    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ['customers.interactions.view'], permissionScope)\n    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ['customers.settings.manage'], permissionScope)\n    if (!canManageSettings) {\n      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })\n    }\n    const hierarchy = context.container.resolve('organizationHierarchyService') as OrganizationHierarchyService\n    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId })\n    if (ancestors === null) {\n      throw new CrudHttpError(403, { error: context.translate('customers.errors.organization_forbidden', 'Organization not accessible') })\n    }\n    const scopeIds = Array.from(new Set([organizationId, ...ancestors.slice().reverse()]))\n    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join('|')}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`\n    const cached = await context.cache?.get(cacheKey)\n    if (cached) return NextResponse.json(cached)\n\n    let catalog\n    try {\n      catalog = await resolveScopedCalendarEventTypes({\n        em: context.em,\n        tenantId: context.tenantId,\n        organizationId,\n        readableOrganizationIds: scopeIds,\n      })\n    } catch (err) {\n      logger.error('customers.activity_types.resolve failed', {\n        err,\n        tenantId: context.tenantId,\n        organizationId,\n      })\n      reportActivityTypeError(err, 'customers.activity_type_catalog_resolution_failed', {\n        tenantId: context.tenantId,\n        organizationId,\n      })\n      return NextResponse.json({\n        error: context.translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),\n        code: 'activity_type_catalog_unavailable',\n      }, { status: 503 })\n    }\n    if (context.cache) {\n      await context.cache.set(cacheKey, catalog, {\n        ttl: DICTIONARY_CACHE_TTL_MS,\n        tags: createDictionaryCacheTags({\n          tenantId: context.tenantId,\n          mappedKind: 'activity_type',\n          organizationIds: scopeIds,\n        }),\n      }).catch((err) => {\n        logger.warn('customers.activity_types cache write failed', { err })\n        reportActivityTypeError(err, 'customers.activity_type_catalog_cache_write_failed', {\n          tenantId: context.tenantId,\n          organizationId,\n        })\n      })\n    }\n    return NextResponse.json(catalog)\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    logger.error('customers.activity_types request failed', { err })\n    reportActivityTypeError(err, 'customers.activity_type_catalog_request_failed')\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({\n      error: translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),\n    }, { status: err instanceof z.ZodError ? 400 : 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  summary: 'Effective calendar activity types',\n  methods: {\n    GET: {\n      summary: 'List effective calendar activity types',\n      description: 'Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.',\n      responses: [{ status: 200, description: 'Effective activity-type catalog', schema: responseSchema }],\n      errors: [\n        { status: 400, description: 'Organization scope is required', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },\n        { status: 500, description: 'Unexpected server error', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,qBAAqB;AAG9B,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,2BAA2B;AACpC,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,+BAA+B;AACnE,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,OACK;AACP,SAAS,uCAAuC;AAChD,SAAS,2CAA2C;AAEpD,MAAM,SAAS,aAAa,WAAW;AAEvC,SAAS,wBAAwB,OAAgB,MAAc,YAA2C;AACxG,MAAI;AACF,wBAAoB,GAAG,YAAY,OAAO,EAAE,QAAQ,aAAa,MAAM,WAAW,CAAC;AAAA,EACrF,QAAQ;AAAA,EAAC;AACX;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AAC7E,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,aAAa,EAAE,QAAQ,SAAS;AAAA,EAChC,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,IACtB,KAAK,EAAE,OAAO;AAAA,IACd,OAAO,EAAE,OAAO;AAAA,IAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACrC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,IACtC,UAAU;AAAA,IACV,YAAY,EAAE,QAAQ;AAAA,IACtB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,QAAQ,EAAE,OAAO;AAAA,IACjB,YAAY,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC;AAAA,IAC5C,YAAY,EAAE,QAAQ;AAAA,IACtB,gBAAgB,EAAE,KAAK,CAAC,cAAc,sBAAsB,SAAS,CAAC,EAAE,SAAS;AAAA,IACjF,mBAAmB,EAAE,QAAQ;AAAA,IAC7B,aAAa,EAAE,QAAQ;AAAA,IACvB,iBAAiB,EAAE,QAAQ;AAAA,IAC3B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,IAC/B,0BAA0B,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,IAC5C,4BAA4B,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnD,CAAC,CAAC;AACJ,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,EAAE,gBAAgB,IAAI,aAAa,IAAI,gBAAgB,KAAK,OAAU,CAAC;AACvG,UAAM,UAAU,MAAM,8BAA8B,KAAK,EAAE,YAAY,MAAM,eAAe,CAAC;AAC7F,QAAI,CAAC,QAAQ,gBAAgB;AAC3B,aAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,UAAU,0CAA0C,kCAAkC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtJ;AACA,UAAM,iBAAiB,QAAQ;AAC/B,UAAM,OAAO,QAAQ,UAAU,QAAQ,aAAa;AACpD,UAAM,UAAU,QAAQ,MAAM;AAC9B,QAAI,CAAC,QAAQ,CAAC,SAAS;AACrB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,qDAAqD,oDAAoD,EAAE,CAAC;AAAA,IACtK;AACA,UAAM,kBAAkB,EAAE,UAAU,QAAQ,UAAU,eAAe;AACrE,UAAM,sBAAsB,MAAM,KAAK,mBAAmB,SAAS,CAAC,6BAA6B,GAAG,eAAe;AACnH,UAAM,oBAAoB,uBAAuB,MAAM,KAAK,mBAAmB,SAAS,CAAC,2BAA2B,GAAG,eAAe;AACtI,QAAI,CAAC,mBAAmB;AACtB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,qDAAqD,oDAAoD,EAAE,CAAC;AAAA,IACtK;AACA,UAAM,YAAY,QAAQ,UAAU,QAAQ,8BAA8B;AAC1E,UAAM,YAAY,MAAM,UAAU,mBAAmB,EAAE,UAAU,QAAQ,UAAU,eAAe,CAAC;AACnG,QAAI,cAAc,MAAM;AACtB,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,2CAA2C,6BAA6B,EAAE,CAAC;AAAA,IACrI;AACA,UAAM,WAAW,MAAM,KAAK,oBAAI,IAAI,CAAC,gBAAgB,GAAG,UAAU,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACrF,UAAM,WAAW,4BAA4B,QAAQ,QAAQ,QAAQ,cAAc,UAAU,SAAS,KAAK,GAAG,CAAC,YAAY,4BAA4B,CAAC,aAAa,oCAAoC,CAAC;AAC1M,UAAM,SAAS,MAAM,QAAQ,OAAO,IAAI,QAAQ;AAChD,QAAI,OAAQ,QAAO,aAAa,KAAK,MAAM;AAE3C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,gCAAgC;AAAA,QAC9C,IAAI,QAAQ;AAAA,QACZ,UAAU,QAAQ;AAAA,QAClB;AAAA,QACA,yBAAyB;AAAA,MAC3B,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,aAAO,MAAM,2CAA2C;AAAA,QACtD;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB;AAAA,MACF,CAAC;AACD,8BAAwB,KAAK,qDAAqD;AAAA,QAChF,UAAU,QAAQ;AAAA,QAClB;AAAA,MACF,CAAC;AACD,aAAO,aAAa,KAAK;AAAA,QACvB,OAAO,QAAQ,UAAU,sDAAsD,+BAA+B;AAAA,QAC9G,MAAM;AAAA,MACR,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpB;AACA,QAAI,QAAQ,OAAO;AACjB,YAAM,QAAQ,MAAM,IAAI,UAAU,SAAS;AAAA,QACzC,KAAK;AAAA,QACL,MAAM,0BAA0B;AAAA,UAC9B,UAAU,QAAQ;AAAA,UAClB,YAAY;AAAA,UACZ,iBAAiB;AAAA,QACnB,CAAC;AAAA,MACH,CAAC,EAAE,MAAM,CAAC,QAAQ;AAChB,eAAO,KAAK,+CAA+C,EAAE,IAAI,CAAC;AAClE,gCAAwB,KAAK,sDAAsD;AAAA,UACjF,UAAU,QAAQ;AAAA,UAClB;AAAA,QACF,CAAC;AAAA,MACH,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,OAAO;AAAA,EAClC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,WAAO,MAAM,2CAA2C,EAAE,IAAI,CAAC;AAC/D,4BAAwB,KAAK,gDAAgD;AAC7E,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,UAAU,sDAAsD,+BAA+B;AAAA,IACxG,GAAG,EAAE,QAAQ,eAAe,EAAE,WAAW,MAAM,IAAI,CAAC;AAAA,EACtD;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,mCAAmC,QAAQ,eAAe,CAAC;AAAA,MACnG,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,kCAAkC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customers/api/deals/[id]/people/route.js

@@ -8,7 +8,11 @@ import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/di
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
-import { CustomerDeal, CustomerDealPersonLink } from "../../../../data/entities.js";
+import {
+  CustomerDeal,
+  CustomerDealPersonLink,
+  CustomerPersonProfile
+} from "../../../../data/entities.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customers");
 const paramsSchema = z.object({
@@ -28,7 +32,17 @@ function normalizeSort(sort) {
 function matchesSearch(item, query) {
   const normalized = query.trim().toLowerCase();
   if (!normalized.length) return true;
-  return [item.label, item.subtitle].filter((value) => typeof value === "string" && value.length > 0).some((value) => value.toLowerCase().includes(normalized));
+  return [
+    item.label,
+    item.subtitle,
+    item.primaryEmail,
+    item.primaryPhone,
+    item.jobTitle,
+    item.department,
+    item.status,
+    item.lifecycleStage,
+    item.source
+  ].filter((value) => typeof value === "string" && value.length > 0).some((value) => value.toLowerCase().includes(normalized));
 }
 function sortItems(items, sort) {
   if (sort === "recent") {
@@ -87,16 +101,44 @@ async function GET(req, ctx) {
       { populate: ["person"] },
       entityScope
     );
+    const personIds = links.map((link) => link.person?.id).filter((personId) => typeof personId === "string" && personId.length > 0);
+    const profiles = personIds.length > 0 ? await findWithDecryption(
+      em,
+      CustomerPersonProfile,
+      {
+        entity: { $in: personIds },
+        tenantId: deal.tenantId,
+        organizationId: deal.organizationId
+      },
+      {},
+      entityScope
+    ) : [];
+    const profileByPersonId = new Map(
+      profiles.map((profile) => [profile.entity.id, profile])
+    );
     const items = links.map((link) => {
       const person = link.person;
       if (!person?.id) return null;
+      const profile = profileByPersonId.get(person.id) ?? null;
+      const displayName = person.displayName ?? person.primaryEmail ?? person.id;
       return {
         id: person.id,
-        label: person.displayName ?? person.primaryEmail ?? person.id,
+        label: displayName,
         subtitle: person.primaryEmail ?? person.primaryPhone ?? null,
         kind: "person",
         linkedAt: link.createdAt.toISOString(),
-        isPrimary: link.isPrimary === true
+        isPrimary: link.isPrimary === true,
+        displayName,
+        primaryEmail: person.primaryEmail ?? null,
+        primaryPhone: person.primaryPhone ?? null,
+        status: person.status ?? null,
+        lifecycleStage: person.lifecycleStage ?? null,
+        jobTitle: profile?.jobTitle ?? null,
+        department: profile?.department ?? null,
+        createdAt: person.createdAt.toISOString(),
+        organizationId: person.organizationId,
+        temperature: person.temperature ?? null,
+        source: person.source ?? null
       };
     }).filter((item) => item !== null);
     const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? "")) : items;
@@ -138,7 +180,18 @@ const openApi = {
                 subtitle: z.string().nullable(),
                 kind: z.literal("person"),
                 linkedAt: z.string(),
-                isPrimary: z.boolean()
+                isPrimary: z.boolean(),
+                displayName: z.string(),
+                primaryEmail: z.string().nullable(),
+                primaryPhone: z.string().nullable(),
+                status: z.string().nullable(),
+                lifecycleStage: z.string().nullable(),
+                jobTitle: z.string().nullable(),
+                department: z.string().nullable(),
+                createdAt: z.string(),
+                organizationId: z.string().uuid().nullable(),
+                temperature: z.string().nullable(),
+                source: z.string().nullable()
               })
             ),
             total: z.number().int().nonnegative(),

package/dist/modules/customers/api/deals/[id]/people/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/deals/%5Bid%5D/people/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst querySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(20),\n  search: z.string().optional(),\n  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),\n})\n\ntype DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'\n\nfunction normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {\n  if (sort === 'name-asc') return 'label-asc'\n  if (sort === 'name-desc') return 'label-desc'\n  return sort\n}\n\ntype DealPersonItem = {\n  id: string\n  label: string\n  subtitle: string | null\n  kind: 'person'\n  linkedAt: string\n  isPrimary: boolean\n}\n\nfunction matchesSearch(item: DealPersonItem, query: string): boolean {\n  const normalized = query.trim().toLowerCase()\n  if (!normalized.length) return true\n  return [item.label, item.subtitle]\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n    .some((value) => value.toLowerCase().includes(normalized))\n}\n\nfunction sortItems(items: DealPersonItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealPersonItem[] {\n  if (sort === 'recent') {\n    return [...items].sort((left, right) => {\n      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()\n      if (compare !== 0) return compare\n      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    })\n  }\n  return [...items].sort((left, right) => {\n    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    return sort === 'label-asc' ? compare : -compare\n  })\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { id?: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })\n\n    const url = new URL(req.url)\n    const query = querySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sort: url.searchParams.get('sort') ?? undefined,\n    })\n\n    const container = await createRequestContainer()\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const em = (container.resolve('em') as EntityManager).fork()\n    const decryptionScope = {\n      tenantId: auth.tenantId,\n      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    }\n\n    const deal = await findOneWithDecryption(\n      em,\n      CustomerDeal,\n      { id, tenantId: auth.tenantId, deletedAt: null },\n      {},\n      decryptionScope,\n    )\n    if (!deal) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n    // the parent-not-found above \u2014 so it cannot reveal that a deal exists in an\n    // organization the caller cannot see.\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }\n    const links = await findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { deal: deal.id },\n      { populate: ['person'] },\n      entityScope,\n    )\n\n    const items = links\n      .map((link) => {\n        const person = link.person as CustomerEntity | null\n        if (!person?.id) return null\n        return {\n          id: person.id,\n          label: person.displayName ?? person.primaryEmail ?? person.id,\n          subtitle: person.primaryEmail ?? person.primaryPhone ?? null,\n          kind: 'person',\n          linkedAt: link.createdAt.toISOString(),\n          isPrimary: link.isPrimary === true,\n        } satisfies DealPersonItem\n      })\n      .filter((item): item is DealPersonItem => item !== null)\n\n    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items\n    const sorted = sortItems(filtered, normalizeSort(query.sort))\n    const total = sorted.length\n    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))\n    const page = Math.min(query.page, totalPages)\n    const start = (page - 1) * query.pageSize\n\n    return NextResponse.json({\n      items: sorted.slice(start, start + query.pageSize),\n      total,\n      page,\n      pageSize: query.pageSize,\n      totalPages,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    logger.error('customers.deals.people.GET', { err: error })\n    return NextResponse.json({ error: translate('customers.errors.deal_people_load_failed', 'Failed to load linked people') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'List linked people for a deal',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated linked people',\n          schema: z.object({\n            items: z.array(\n              z.object({\n                id: z.string().uuid(),\n                label: z.string(),\n                subtitle: z.string().nullable(),\n                kind: z.literal('person'),\n                linkedAt: z.string(),\n                isPrimary: z.boolean(),\n              }),\n            ),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD,SAAS,cAAc,8BAA8C;AACrE,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,KAAK,CAAC,aAAa,cAAc,YAAY,aAAa,QAAQ,CAAC,EAAE,QAAQ,WAAW;AAClG,CAAC;AAID,SAAS,cAAc,MAAiE;AACtF,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAWA,SAAS,cAAc,MAAsB,OAAwB;AACnE,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO,CAAC,KAAK,OAAO,KAAK,QAAQ,EAC9B,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,CAAC,UAAU,MAAM,YAAY,EAAE,SAAS,UAAU,CAAC;AAC7D;AAEA,SAAS,UAAU,OAAyB,MAA+D;AACzG,MAAI,SAAS,UAAU;AACrB,WAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,YAAM,UAAU,IAAI,KAAK,MAAM,QAAQ,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACrF,UAAI,YAAY,EAAG,QAAO;AAC1B,aAAO,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AAAA,IACjF,CAAC;AAAA,EACH;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,UAAM,UAAU,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AACxF,WAAO,SAAS,cAAc,UAAU,CAAC;AAAA,EAC3C,CAAC;AACH;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAAmC;AACzE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAE3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACxC,CAAC;AAED,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,gBAAgB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IACpE;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAKA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,KAAK,eAAe,CAAC,GAAG;AAC1F,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AACnF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK,GAAG;AAAA,MAChB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAEA,UAAM,QAAQ,MACX,IAAI,CAAC,SAAS;AACb,YAAM,SAAS,KAAK;AACpB,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,OAAO,OAAO,eAAe,OAAO,gBAAgB,OAAO;AAAA,QAC3D,UAAU,OAAO,gBAAgB,OAAO,gBAAgB;AAAA,QACxD,MAAM;AAAA,QACN,UAAU,KAAK,UAAU,YAAY;AAAA,QACrC,WAAW,KAAK,cAAc;AAAA,MAChC;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAiC,SAAS,IAAI;AAEzD,UAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,SAAS,MAAM,OAAO,CAAC,SAAS,cAAc,MAAM,MAAM,UAAU,EAAE,CAAC,IAAI;AACjH,UAAM,SAAS,UAAU,UAAU,cAAc,MAAM,IAAI,CAAC;AAC5D,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAChE,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,KAAK,MAAM;AAEjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MACjD;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4CAA4C,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE;AAAA,cACP,EAAE,OAAO;AAAA,gBACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,gBACpB,OAAO,EAAE,OAAO;AAAA,gBAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC9B,MAAM,EAAE,QAAQ,QAAQ;AAAA,gBACxB,UAAU,EAAE,OAAO;AAAA,gBACnB,WAAW,EAAE,QAAQ;AAAA,cACvB,CAAC;AAAA,YACH;AAAA,YACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport {\n  CustomerDeal,\n  CustomerDealPersonLink,\n  CustomerEntity,\n  CustomerPersonProfile,\n} from '../../../../data/entities'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customers')\n\nconst paramsSchema = z.object({\n  id: z.string().uuid(),\n})\n\nconst querySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(20),\n  search: z.string().optional(),\n  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),\n})\n\ntype DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'\n\nfunction normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {\n  if (sort === 'name-asc') return 'label-asc'\n  if (sort === 'name-desc') return 'label-desc'\n  return sort\n}\n\ntype DealPersonItem = {\n  id: string\n  label: string\n  subtitle: string | null\n  kind: 'person'\n  linkedAt: string\n  isPrimary: boolean\n  // Added for the shared linked-people card, which renders the same shape the company\n  // endpoint already returns. Purely additive: every key above keeps its meaning, so\n  // `DealLinkedEntitiesTab` and any third-party consumer are unaffected.\n  displayName: string\n  primaryEmail: string | null\n  primaryPhone: string | null\n  status: string | null\n  lifecycleStage: string | null\n  jobTitle: string | null\n  department: string | null\n  createdAt: string\n  organizationId: string\n  temperature: string | null\n  source: string | null\n}\n\nfunction matchesSearch(item: DealPersonItem, query: string): boolean {\n  const normalized = query.trim().toLowerCase()\n  if (!normalized.length) return true\n  return [\n    item.label,\n    item.subtitle,\n    item.primaryEmail,\n    item.primaryPhone,\n    item.jobTitle,\n    item.department,\n    item.status,\n    item.lifecycleStage,\n    item.source,\n  ]\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n    .some((value) => value.toLowerCase().includes(normalized))\n}\n\nfunction sortItems(items: DealPersonItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealPersonItem[] {\n  if (sort === 'recent') {\n    return [...items].sort((left, right) => {\n      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()\n      if (compare !== 0) return compare\n      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    })\n  }\n  return [...items].sort((left, right) => {\n    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })\n    return sort === 'label-asc' ? compare : -compare\n  })\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },\n}\n\nexport async function GET(req: Request, ctx: { params?: { id?: string } }) {\n  const { translate } = await resolveTranslations()\n  try {\n    const { id } = paramsSchema.parse({ id: ctx.params?.id })\n    const auth = await getAuthFromRequest(req)\n    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })\n\n    const url = new URL(req.url)\n    const query = querySchema.parse({\n      page: url.searchParams.get('page') ?? undefined,\n      pageSize: url.searchParams.get('pageSize') ?? undefined,\n      search: url.searchParams.get('search') ?? undefined,\n      sort: url.searchParams.get('sort') ?? undefined,\n    })\n\n    const container = await createRequestContainer()\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const em = (container.resolve('em') as EntityManager).fork()\n    const decryptionScope = {\n      tenantId: auth.tenantId,\n      organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null,\n    }\n\n    const deal = await findOneWithDecryption(\n      em,\n      CustomerDeal,\n      { id, tenantId: auth.tenantId, deletedAt: null },\n      {},\n      decryptionScope,\n    )\n    if (!deal) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    // Existence oracle (#5504): deny a cross-org read as not-found \u2014 identical to\n    // the parent-not-found above \u2014 so it cannot reveal that a deal exists in an\n    // organization the caller cannot see.\n    if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId: deal.organizationId })) {\n      throw notFound(translate('customers.errors.deal_not_found', 'Deal not found'))\n    }\n\n    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }\n    const links = await findWithDecryption(\n      em,\n      CustomerDealPersonLink,\n      { deal: deal.id },\n      { populate: ['person'] },\n      entityScope,\n    )\n\n    // One batched read for the profile-only columns, keyed by every linked person \u2014 not one\n    // query per row. The handler filters, sorts and paginates in memory below, so the batch\n    // covers the whole link set rather than the page; that is fine at the expected scale of\n    // tens of contacts per deal, and the in-memory pipeline is what to revisit first if it\n    // ever is not.\n    const personIds = links\n      .map((link) => (link.person as CustomerEntity | null)?.id)\n      .filter((personId): personId is string => typeof personId === 'string' && personId.length > 0)\n\n    const profiles = personIds.length > 0\n      ? await findWithDecryption(\n          em,\n          CustomerPersonProfile,\n          {\n            entity: { $in: personIds },\n            tenantId: deal.tenantId,\n            organizationId: deal.organizationId,\n          },\n          {},\n          entityScope,\n        )\n      : []\n    const profileByPersonId = new Map(\n      profiles.map((profile) => [(profile.entity as { id: string }).id, profile]),\n    )\n\n    const items = links\n      .map((link) => {\n        const person = link.person as CustomerEntity | null\n        if (!person?.id) return null\n        const profile = profileByPersonId.get(person.id) ?? null\n        const displayName = person.displayName ?? person.primaryEmail ?? person.id\n        return {\n          id: person.id,\n          label: displayName,\n          subtitle: person.primaryEmail ?? person.primaryPhone ?? null,\n          kind: 'person',\n          linkedAt: link.createdAt.toISOString(),\n          isPrimary: link.isPrimary === true,\n          displayName,\n          primaryEmail: person.primaryEmail ?? null,\n          primaryPhone: person.primaryPhone ?? null,\n          status: person.status ?? null,\n          lifecycleStage: person.lifecycleStage ?? null,\n          jobTitle: profile?.jobTitle ?? null,\n          department: profile?.department ?? null,\n          createdAt: person.createdAt.toISOString(),\n          organizationId: person.organizationId,\n          temperature: person.temperature ?? null,\n          source: person.source ?? null,\n        } satisfies DealPersonItem\n      })\n      .filter((item): item is DealPersonItem => item !== null)\n\n    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items\n    const sorted = sortItems(filtered, normalizeSort(query.sort))\n    const total = sorted.length\n    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))\n    const page = Math.min(query.page, totalPages)\n    const start = (page - 1) * query.pageSize\n\n    return NextResponse.json({\n      items: sorted.slice(start, start + query.pageSize),\n      total,\n      page,\n      pageSize: query.pageSize,\n      totalPages,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    logger.error('customers.deals.people.GET', { err: error })\n    return NextResponse.json({ error: translate('customers.errors.deal_people_load_failed', 'Failed to load linked people') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Customers',\n  methods: {\n    GET: {\n      summary: 'List linked people for a deal',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Paginated linked people',\n          schema: z.object({\n            items: z.array(\n              z.object({\n                id: z.string().uuid(),\n                label: z.string(),\n                subtitle: z.string().nullable(),\n                kind: z.literal('person'),\n                linkedAt: z.string(),\n                isPrimary: z.boolean(),\n                displayName: z.string(),\n                primaryEmail: z.string().nullable(),\n                primaryPhone: z.string().nullable(),\n                status: z.string().nullable(),\n                lifecycleStage: z.string().nullable(),\n                jobTitle: z.string().nullable(),\n                department: z.string().nullable(),\n                createdAt: z.string(),\n                organizationId: z.string().uuid().nullable(),\n                temperature: z.string().nullable(),\n                source: z.string().nullable(),\n              }),\n            ),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,iBAAiB,gBAAgB;AACzD,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,2BAA2B;AAEpC,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,uCAAuC;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EAEA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW;AAEvC,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,MAAM,EAAE,KAAK,CAAC,aAAa,cAAc,YAAY,aAAa,QAAQ,CAAC,EAAE,QAAQ,WAAW;AAClG,CAAC;AAID,SAAS,cAAc,MAAiE;AACtF,MAAI,SAAS,WAAY,QAAO;AAChC,MAAI,SAAS,YAAa,QAAO;AACjC,SAAO;AACT;AAyBA,SAAS,cAAc,MAAsB,OAAwB;AACnE,QAAM,aAAa,MAAM,KAAK,EAAE,YAAY;AAC5C,MAAI,CAAC,WAAW,OAAQ,QAAO;AAC/B,SAAO;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,EACP,EACG,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,CAAC,UAAU,MAAM,YAAY,EAAE,SAAS,UAAU,CAAC;AAC7D;AAEA,SAAS,UAAU,OAAyB,MAA+D;AACzG,MAAI,SAAS,UAAU;AACrB,WAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,YAAM,UAAU,IAAI,KAAK,MAAM,QAAQ,EAAE,QAAQ,IAAI,IAAI,KAAK,KAAK,QAAQ,EAAE,QAAQ;AACrF,UAAI,YAAY,EAAG,QAAO;AAC1B,aAAO,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AAAA,IACjF,CAAC;AAAA,EACH;AACA,SAAO,CAAC,GAAG,KAAK,EAAE,KAAK,CAAC,MAAM,UAAU;AACtC,UAAM,UAAU,KAAK,MAAM,cAAc,MAAM,OAAO,QAAW,EAAE,aAAa,OAAO,CAAC;AACxF,WAAO,SAAS,cAAc,UAAU,CAAC;AAAA,EAC3C,CAAC;AACH;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAsB,IAAI,KAAc,KAAmC;AACzE,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,aAAa,MAAM,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC;AACxD,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,MAAM,SAAU,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,eAAe,CAAC;AAE3E,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM;AAAA,MAC9B,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,MACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,MAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,MAC1C,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACxC,CAAC;AAED,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,UAAM,kBAAkB;AAAA,MACtB,UAAU,KAAK;AAAA,MACf,gBAAgB,kCAAkC,OAAO,IAAI,KAAK;AAAA,IACpE;AAEA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,MAC/C,CAAC;AAAA,MACD;AAAA,IACF;AACA,QAAI,CAAC,MAAM;AACT,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAKA,QAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,gBAAgB,KAAK,eAAe,CAAC,GAAG;AAC1F,YAAM,SAAS,UAAU,mCAAmC,gBAAgB,CAAC;AAAA,IAC/E;AAEA,UAAM,cAAc,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,eAAe;AACnF,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,KAAK,GAAG;AAAA,MAChB,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,MACvB;AAAA,IACF;AAOA,UAAM,YAAY,MACf,IAAI,CAAC,SAAU,KAAK,QAAkC,EAAE,EACxD,OAAO,CAAC,aAAiC,OAAO,aAAa,YAAY,SAAS,SAAS,CAAC;AAE/F,UAAM,WAAW,UAAU,SAAS,IAChC,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,QACE,QAAQ,EAAE,KAAK,UAAU;AAAA,QACzB,UAAU,KAAK;AAAA,QACf,gBAAgB,KAAK;AAAA,MACvB;AAAA,MACA,CAAC;AAAA,MACD;AAAA,IACF,IACA,CAAC;AACL,UAAM,oBAAoB,IAAI;AAAA,MAC5B,SAAS,IAAI,CAAC,YAAY,CAAE,QAAQ,OAA0B,IAAI,OAAO,CAAC;AAAA,IAC5E;AAEA,UAAM,QAAQ,MACX,IAAI,CAAC,SAAS;AACb,YAAM,SAAS,KAAK;AACpB,UAAI,CAAC,QAAQ,GAAI,QAAO;AACxB,YAAM,UAAU,kBAAkB,IAAI,OAAO,EAAE,KAAK;AACpD,YAAM,cAAc,OAAO,eAAe,OAAO,gBAAgB,OAAO;AACxE,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,OAAO;AAAA,QACP,UAAU,OAAO,gBAAgB,OAAO,gBAAgB;AAAA,QACxD,MAAM;AAAA,QACN,UAAU,KAAK,UAAU,YAAY;AAAA,QACrC,WAAW,KAAK,cAAc;AAAA,QAC9B;AAAA,QACA,cAAc,OAAO,gBAAgB;AAAA,QACrC,cAAc,OAAO,gBAAgB;AAAA,QACrC,QAAQ,OAAO,UAAU;AAAA,QACzB,gBAAgB,OAAO,kBAAkB;AAAA,QACzC,UAAU,SAAS,YAAY;AAAA,QAC/B,YAAY,SAAS,cAAc;AAAA,QACnC,WAAW,OAAO,UAAU,YAAY;AAAA,QACxC,gBAAgB,OAAO;AAAA,QACvB,aAAa,OAAO,eAAe;AAAA,QACnC,QAAQ,OAAO,UAAU;AAAA,MAC3B;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAiC,SAAS,IAAI;AAEzD,UAAM,WAAW,MAAM,QAAQ,KAAK,EAAE,SAAS,MAAM,OAAO,CAAC,SAAS,cAAc,MAAM,MAAM,UAAU,EAAE,CAAC,IAAI;AACjH,UAAM,SAAS,UAAU,UAAU,cAAc,MAAM,IAAI,CAAC;AAC5D,UAAM,QAAQ,OAAO;AACrB,UAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,MAAM,QAAQ,CAAC;AAChE,UAAM,OAAO,KAAK,IAAI,MAAM,MAAM,UAAU;AAC5C,UAAM,SAAS,OAAO,KAAK,MAAM;AAEjC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MACjD;AAAA,MACA;AAAA,MACA,UAAU,MAAM;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,WAAO,MAAM,8BAA8B,EAAE,KAAK,MAAM,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,4CAA4C,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE;AAAA,cACP,EAAE,OAAO;AAAA,gBACP,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,gBACpB,OAAO,EAAE,OAAO;AAAA,gBAChB,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC9B,MAAM,EAAE,QAAQ,QAAQ;AAAA,gBACxB,UAAU,EAAE,OAAO;AAAA,gBACnB,WAAW,EAAE,QAAQ;AAAA,gBACrB,aAAa,EAAE,OAAO;AAAA,gBACtB,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,gBAClC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,gBAClC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC5B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,gBACpC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC9B,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,gBAChC,WAAW,EAAE,OAAO;AAAA,gBACpB,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,gBAC3C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,gBACjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,cAC9B,CAAC;AAAA,YACH;AAAA,YACA,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/dictionaries/[kind]/[id]/route.js

@@ -14,6 +14,7 @@ import {
 } from "@open-mercato/shared/lib/crud/mutation-guard";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { calendarEventTypeBehaviorSchema } from "../../../../calendar-event-types.js";
 const logger = createLogger("customers");
 const paramsSchema = z.object({
   id: z.string().uuid()
@@ -22,8 +23,9 @@ const patchSchema = z.object({
   value: z.string().trim().min(1).max(150).optional(),
   label: z.string().trim().max(150).optional(),
   color: z.union([z.string().trim(), z.null()]).optional(),
-  icon: z.union([z.string().trim(), z.null()]).optional()
-}).refine((input) => input.value !== void 0 || input.label !== void 0 || input.color !== void 0 || input.icon !== void 0, {
+  icon: z.union([z.string().trim(), z.null()]).optional(),
+  behavior: calendarEventTypeBehaviorSchema.nullable().optional()
+}).refine((input) => input.value !== void 0 || input.label !== void 0 || input.color !== void 0 || input.icon !== void 0 || input.behavior !== void 0, {
   message: "No changes provided"
 });
 const metadata = {
@@ -69,7 +71,8 @@ async function PATCH(req, ctx) {
           value: payload.value,
           label: payload.label,
           color: payload.color,
-          icon: payload.icon
+          icon: payload.icon,
+          behavior: payload.behavior
         },
         ctx: routeContext.ctx
       });
@@ -92,6 +95,7 @@ async function PATCH(req, ctx) {
               )
             });
           }
+          if (typeof err.body.code === "string") throw err;
           throw new CrudHttpError(409, { error: routeContext.translate("customers.config.dictionaries.errors.duplicate", "An entry with this value already exists") });
         }
         if (err.status === 400) {
@@ -127,8 +131,10 @@ async function PATCH(req, ctx) {
       label: entry.label,
       color: entry.color,
       icon: entry.icon,
+      ...mappedKind === "activity_type" ? { behavior: entry.activityTypeBehavior ?? null } : {},
       organizationId: entry.organizationId,
-      isInherited: false
+      isInherited: false,
+      updatedAt: entry.updatedAt
     });
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(
@@ -279,8 +285,10 @@ const dictionaryEntrySchema = z.object({
   label: z.string().nullable().optional(),
   color: z.string().nullable().optional(),
   icon: z.string().nullable().optional(),
+  behavior: calendarEventTypeBehaviorSchema.nullable().optional(),
   organizationId: z.string().uuid().nullable().optional(),
-  isInherited: z.boolean().optional()
+  isInherited: z.boolean().optional(),
+  updatedAt: z.date().or(z.string()).optional()
 });
 const dictionaryDeleteResponseSchema = z.object({
   success: z.literal(true)