@open-mercato/core 0.9.0 → 0.9.1-develop.7462.1.94c09f158f

package/src/modules/catalog/search.ts

@@ -131,10 +131,14 @@ function buildProductPresenter(
   ) ?? label
   const isActive = record.is_active ?? record.isActive
   const statusText = isActive === false ? translate('catalog.search.status.inactive', 'Inactive') : null
+  const productType = readRecordText(record, 'product_type', 'productType')
+  const productTypeLabel = productType
+    ? translate(`catalog.products.types.${productType}`, productType)
+    : null
   const subtitle = formatSubtitle(
     readRecordText(record, 'subtitle'),
     readRecordText(record, 'sku'),
-    readRecordText(record, 'product_type', 'productType'),
+    productTypeLabel,
     statusText,
   ) ?? snippet(readRecordText(record, 'description'))
   return { title, subtitle, icon: 'package', badge: label }

package/src/modules/communication_channels/api/get/oauth/[provider]/callback/route.ts

@@ -15,6 +15,7 @@ import {
   verifyOAuthState,
   type OAuthStateConsumeStore,
 } from '../../../../../lib/oauth-state'
+import { OAUTH_RESULT_QUERY_PARAM } from '../../../../../lib/oauth-result'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('communication_channels').child({ component: 'oauth-callback' })
@@ -51,7 +52,7 @@ function redirectWithFlash(
     normalizeOAuthReturnUrl(returnUrl, DEFAULT_OAUTH_RETURN_URL),
     getAppBaseUrl(req),
   )
-  base.searchParams.set('flash', flash.type)
+  base.searchParams.set(OAUTH_RESULT_QUERY_PARAM, flash.type)
   if (flash.code) base.searchParams.set('code', flash.code)
   if (flash.provider) base.searchParams.set('provider', flash.provider)
   if (flash.channelId) base.searchParams.set('channelId', flash.channelId)

package/src/modules/communication_channels/api/post/channels/connect/credentials/route.ts

@@ -33,16 +33,14 @@ export async function POST(req: Request): Promise<Response> {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  let body: z.infer<typeof bodySchema>
-  try {
-    const json = await readJsonSafe(req, null)
-    body = bodySchema.parse(json)
-  } catch (err) {
+  const parsed = bodySchema.safeParse(await readJsonSafe(req, null))
+  if (!parsed.success) {
     return NextResponse.json(
-      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { error: 'Invalid request body', details: parsed.error.issues },
       { status: 422 },
     )
   }
+  const body = parsed.data
 
   const container = await createRequestContainer()
 

package/src/modules/communication_channels/api/post/channels/connect/tenant-credentials/route.ts

@@ -33,16 +33,14 @@ export async function POST(req: Request): Promise<Response> {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 
-  let body: z.infer<typeof bodySchema>
-  try {
-    const json = await readJsonSafe(req, null)
-    body = bodySchema.parse(json)
-  } catch (err) {
+  const parsed = bodySchema.safeParse(await readJsonSafe(req, null))
+  if (!parsed.success) {
     return NextResponse.json(
-      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { error: 'Invalid request body', details: parsed.error.issues },
       { status: 422 },
     )
   }
+  const body = parsed.data
 
   const container = await createRequestContainer()
 

package/src/modules/communication_channels/api/post/oauth/[provider]/initiate/route.ts

@@ -4,6 +4,8 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { toAbsoluteUrl } from '@open-mercato/shared/lib/url'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { getChannelAdapter } from '../../../../../lib/adapter-registry-singleton'
 import { resolveOAuthClientCredentials } from '../../../../../lib/oauth-client-config'
 import {
@@ -16,6 +18,8 @@ import {
   OAuthStateError,
 } from '../../../../../lib/oauth-state'
 
+const logger = createLogger('communication_channels').child({ component: 'oauth-initiate' })
+
 export const metadata = {
   path: '/communication_channels/oauth/[provider]/initiate',
   POST: {
@@ -56,6 +60,21 @@ function defaultRedirectUri(req: Request, providerKey: string): string {
   return toAbsoluteUrl(req, `/api/communication_channels/oauth/${providerKey}/callback`)
 }
 
+function oauthStateErrorResponse(err: unknown): Response | null {
+  if (err instanceof OAuthStateError) {
+    if (err.code === 'missing_secret') {
+      logger.error('OAuth state secret is not configured', { err })
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'communication_channels',
+        code: 'communication_channels.missing_secret',
+      })
+      return NextResponse.json({ error: 'OAuth is not available', code: err.code }, { status: 500 })
+    }
+    return NextResponse.json({ error: err.message, code: err.code }, { status: 500 })
+  }
+  return null
+}
+
 export async function POST(req: Request, context: RouteContext): Promise<Response> {
   const { provider } = await context.params
   if (!/^[a-z0-9_-]+$/i.test(provider)) {
@@ -121,13 +140,20 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
   }
 
   const redirectUri = defaultRedirectUri(req, provider)
-  const stateEnvelope = createOAuthState({
-    userId: auth.sub as string,
-    tenantId: auth.tenantId as string,
-    organizationId: (auth as { orgId?: string | null }).orgId ?? null,
-    providerKey: provider,
-    returnUrl: normalizeOAuthReturnUrl(body.returnUrl, DEFAULT_OAUTH_RETURN_URL),
-  })
+  let stateEnvelope: ReturnType<typeof createOAuthState>
+  try {
+    stateEnvelope = createOAuthState({
+      userId: auth.sub as string,
+      tenantId: auth.tenantId as string,
+      organizationId: (auth as { orgId?: string | null }).orgId ?? null,
+      providerKey: provider,
+      returnUrl: normalizeOAuthReturnUrl(body.returnUrl, DEFAULT_OAUTH_RETURN_URL),
+    })
+  } catch (err) {
+    const response = oauthStateErrorResponse(err)
+    if (response) return response
+    throw err
+  }
 
   let result
   try {
@@ -153,12 +179,21 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
 
   // If the adapter packed extras (PKCE verifier, scopes), bake them into the
   // state cookie now so the callback handler can pass them to exchangeOAuthCode.
-  const finalCookie = result.extra
-    ? (await import('../../../../../lib/oauth-state')).encryptOAuthState({
+  let finalCookie: string
+  if (result.extra) {
+    try {
+      finalCookie = (await import('../../../../../lib/oauth-state')).encryptOAuthState({
         ...stateEnvelope.payload,
         extra: { ...(stateEnvelope.payload.extra ?? {}), ...result.extra },
       })
-    : stateEnvelope.cookie
+    } catch (err) {
+      const response = oauthStateErrorResponse(err)
+      if (response) return response
+      throw err
+    }
+  } else {
+    finalCookie = stateEnvelope.cookie
+  }
 
   const response = NextResponse.json({ authorizeUrl: result.authorizeUrl })
   response.cookies.set({
@@ -184,6 +219,7 @@ export const openApi = {
         { status: 400, description: 'Invalid provider or unsupported (no OAuth)' },
         { status: 401, description: 'Unauthorized' },
         { status: 422, description: 'Invalid request body' },
+        { status: 500, description: 'OAuth state secret missing or state encryption failed' },
         { status: 502, description: 'Adapter failed to build authorize URL' },
       ],
     },

package/src/modules/communication_channels/backend/profile/communication-channels/page.tsx

@@ -3,6 +3,7 @@
 import * as React from 'react'
 import { extensionPoints } from '@open-mercato/core/modules/communication_channels/extension-points'
 import { getImportHistoryLimits } from '@open-mercato/core/modules/communication_channels/lib/import-history-limits'
+import { OAUTH_RESULT_QUERY_PARAM, stripOAuthResultParams } from '@open-mercato/core/modules/communication_channels/lib/oauth-result'
 import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -76,7 +77,7 @@ export default function ProfileCommunicationChannelsPage() {
   const t = useT()
   const router = useRouter()
   const searchParams = useSearchParams()
-  const flashType = searchParams?.get('flash')
+  const flashType = searchParams?.get(OAUTH_RESULT_QUERY_PARAM)
   const flashCode = searchParams?.get('code')
   const flashProvider = searchParams?.get('provider')
 
@@ -96,10 +97,13 @@ export default function ProfileCommunicationChannelsPage() {
 
   React.useEffect(() => {
     if (flashType === 'connected') {
+      const providerLabel = flashProvider
+        ? t(`communication_channels.channel.providers.${flashProvider}`, '')
+        : ''
       flash(
-        flashProvider
+        providerLabel
           ? t('communication_channels.profile.flash.connectedWithProvider', 'Channel connected ({provider}).', {
-              provider: flashProvider,
+              provider: providerLabel,
             })
           : t('communication_channels.profile.flash.connected', 'Channel connected.'),
         'success',
@@ -126,15 +130,14 @@ export default function ProfileCommunicationChannelsPage() {
                     'communication_channels.profile.flash.stateStoreUnavailable',
                     'A server error prevented completing the connection. Please try again in a moment.',
                   )
-                : flashCode
-                  ? t('communication_channels.profile.flash.errorWithCode', 'Failed to connect channel — {code}.', {
-                      code: flashCode,
-                    })
-                  : t('communication_channels.profile.flash.error', 'Failed to connect channel.'),
+                : t('communication_channels.profile.flash.error', 'Failed to connect channel.'),
         'error',
       )
+    } else {
+      return
     }
-  }, [flashType, flashCode, flashProvider, t])
+    router.replace(stripOAuthResultParams(window.location.href), { scroll: false })
+  }, [flashType, flashCode, flashProvider, router, t])
 
   React.useEffect(() => {
     let cancelled = false

package/src/modules/communication_channels/commands/deliver-outbound-message.ts

@@ -76,6 +76,11 @@ export type DeliverOutboundMessageResult =
 export const COMMUNICATION_CHANNELS_DELIVER_OUTBOUND_COMMAND_ID =
   'communication_channels.message.deliver_outbound'
 
+function omitRawMessage(metadata: Record<string, unknown> | undefined): Record<string, unknown> {
+  if (!metadata) return {}
+  return Object.fromEntries(Object.entries(metadata).filter(([key]) => key !== 'rawMessage'))
+}
+
 type CredentialsServiceLike = {
   resolve: (
     integrationId: string,
@@ -500,7 +505,7 @@ const deliverOutboundMessageCommand: CommandHandler<
       link.externalMessageId = externalMessageRowId
       link.channelMetadata = {
         ...((link.channelMetadata as Record<string, unknown> | undefined) ?? {}),
-        ...(converted.metadata ?? {}),
+        ...omitRawMessage(converted.metadata),
         externalMessageId: sendResult.externalMessageId,
         // Always persist the RFC2822 Message-ID so inbound reply matching (JWZ
         // strategy in lib/thread-matcher) and sent-folder dedup can resolve this

package/src/modules/communication_channels/i18n/de.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Kanal verbunden.",
   "communication_channels.profile.connect.connecting": "Wird verbunden...",
   "communication_channels.profile.connect.credentialsFailed": "Postfach konnte nicht verbunden werden.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Geben Sie eine gültige E-Mail-Adresse ein.",
+  "communication_channels.profile.connect.errors.invalidPort": "Geben Sie einen Port zwischen 1 und 65535 ein.",
+  "communication_channels.profile.connect.errors.required": "Dieses Feld ist erforderlich.",
   "communication_channels.profile.connect.fields.displayName": "Anzeigename",
   "communication_channels.profile.connect.fields.fromAddress": "Absenderadresse",
   "communication_channels.profile.connect.fields.imapHost": "IMAP-Host",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "IMAP-Postfach verbinden",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Dieses Postfach ist bereits über einen anderen Anbieter verbunden. Trennen Sie es zuerst, um es mit einem anderen Anbieter erneut zu verbinden.",
   "communication_channels.profile.connect.menu": "Kanal verbinden",
+  "communication_channels.profile.connect.notAvailable": "Die Verbindung mit einem Postfach ist nicht verfügbar. Bitten Sie einen Administrator, den OAuth-Zustandsschlüssel zu konfigurieren.",
   "communication_channels.profile.connect.notConfigured": "Dieser Anbieter ist noch nicht konfiguriert. Bitten Sie einen Administrator, die OAuth-Client-ID und das Secret unter Integrationen zu hinterlegen, bevor ein Postfach verbunden wird.",
   "communication_channels.profile.connect.oauthFailed": "OAuth-Verbindung konnte nicht gestartet werden.",
   "communication_channels.profile.connect.save": "Verbinden",
@@ -103,7 +107,6 @@
   "communication_channels.profile.flash.connected": "Kanal verbunden.",
   "communication_channels.profile.flash.connectedWithProvider": "Kanal verbunden ({provider}).",
   "communication_channels.profile.flash.error": "Kanal konnte nicht verbunden werden.",
-  "communication_channels.profile.flash.errorWithCode": "Kanal konnte nicht verbunden werden — {code}.",
   "communication_channels.profile.flash.replayedState": "Dieser Verbindungslink wurde bereits verwendet — bitte starten Sie die Verbindung erneut.",
   "communication_channels.profile.flash.stateStoreUnavailable": "Ein Serverfehler hat die Verbindung verhindert. Bitte versuchen Sie es in Kürze erneut.",
   "communication_channels.profile.group": "Profil",

package/src/modules/communication_channels/i18n/en.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Channel connected.",
   "communication_channels.profile.connect.connecting": "Connecting...",
   "communication_channels.profile.connect.credentialsFailed": "Could not connect mailbox.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Enter a valid email address.",
+  "communication_channels.profile.connect.errors.invalidPort": "Enter a port between 1 and 65535.",
+  "communication_channels.profile.connect.errors.required": "This field is required.",
   "communication_channels.profile.connect.fields.displayName": "Display name",
   "communication_channels.profile.connect.fields.fromAddress": "From address",
   "communication_channels.profile.connect.fields.imapHost": "IMAP host",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Connect IMAP mailbox",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "This mailbox is already connected through another provider. Disconnect it first to reconnect it with a different one.",
   "communication_channels.profile.connect.menu": "Connect channel",
+  "communication_channels.profile.connect.notAvailable": "Mailbox connection is not available. Ask an administrator to configure the OAuth state key.",
   "communication_channels.profile.connect.notConfigured": "This provider is not configured yet. Ask an administrator to add the OAuth Client ID and Secret under Integrations before connecting a mailbox.",
   "communication_channels.profile.connect.oauthFailed": "Could not start OAuth connection.",
   "communication_channels.profile.connect.save": "Connect",
@@ -103,7 +107,6 @@
   "communication_channels.profile.flash.connected": "Channel connected.",
   "communication_channels.profile.flash.connectedWithProvider": "Channel connected ({provider}).",
   "communication_channels.profile.flash.error": "Failed to connect channel.",
-  "communication_channels.profile.flash.errorWithCode": "Failed to connect channel — {code}.",
   "communication_channels.profile.flash.replayedState": "This connection link was already used — please start the connection again.",
   "communication_channels.profile.flash.stateStoreUnavailable": "A server error prevented completing the connection. Please try again in a moment.",
   "communication_channels.profile.group": "Profile",

package/src/modules/communication_channels/i18n/es.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Canal conectado.",
   "communication_channels.profile.connect.connecting": "Conectando...",
   "communication_channels.profile.connect.credentialsFailed": "No se pudo conectar el buzón.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Introduce una dirección de correo electrónico válida.",
+  "communication_channels.profile.connect.errors.invalidPort": "Introduce un puerto entre 1 y 65535.",
+  "communication_channels.profile.connect.errors.required": "Este campo es obligatorio.",
   "communication_channels.profile.connect.fields.displayName": "Nombre visible",
   "communication_channels.profile.connect.fields.fromAddress": "Dirección de remitente",
   "communication_channels.profile.connect.fields.imapHost": "Host IMAP",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Conectar buzón IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Este buzón ya está conectado a través de otro proveedor. Desconéctalo primero para volver a conectarlo con uno diferente.",
   "communication_channels.profile.connect.menu": "Conectar canal",
+  "communication_channels.profile.connect.notAvailable": "La conexión del buzón no está disponible. Pide a un administrador que configure la clave de estado de OAuth.",
   "communication_channels.profile.connect.notConfigured": "Este proveedor aún no está configurado. Pide a un administrador que añada el ID de cliente y el secreto de OAuth en Integraciones antes de conectar un buzón.",
   "communication_channels.profile.connect.oauthFailed": "No se pudo iniciar la conexión OAuth.",
   "communication_channels.profile.connect.save": "Conectar",
@@ -103,7 +107,6 @@
   "communication_channels.profile.flash.connected": "Canal conectado.",
   "communication_channels.profile.flash.connectedWithProvider": "Canal conectado ({provider}).",
   "communication_channels.profile.flash.error": "No se pudo conectar el canal.",
-  "communication_channels.profile.flash.errorWithCode": "No se pudo conectar el canal — {code}.",
   "communication_channels.profile.flash.replayedState": "Este enlace de conexión ya se utilizó — inicia la conexión de nuevo.",
   "communication_channels.profile.flash.stateStoreUnavailable": "Un error del servidor impidió completar la conexión. Inténtalo de nuevo en un momento.",
   "communication_channels.profile.group": "Perfil",

package/src/modules/communication_channels/i18n/ko.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "채널이 연결되었습니다.",
   "communication_channels.profile.connect.connecting": "연결 중...",
   "communication_channels.profile.connect.credentialsFailed": "메일함에 연결할 수 없습니다.",
+  "communication_channels.profile.connect.errors.invalidEmail": "유효한 이메일 주소를 입력하세요.",
+  "communication_channels.profile.connect.errors.invalidPort": "1에서 65535 사이의 포트를 입력하세요.",
+  "communication_channels.profile.connect.errors.required": "필수 입력 항목입니다.",
   "communication_channels.profile.connect.fields.displayName": "표시 이름",
   "communication_channels.profile.connect.fields.fromAddress": "보내는 주소",
   "communication_channels.profile.connect.fields.imapHost": "IMAP 호스트",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "IMAP 메일함 연결",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "이 메일함은 이미 다른 제공업체를 통해 연결되어 있습니다. 다른 제공업체로 다시 연결하려면 먼저 연결을 해제하세요.",
   "communication_channels.profile.connect.menu": "채널 연결",
+  "communication_channels.profile.connect.notAvailable": "메일함 연결을 사용할 수 없습니다. 관리자에게 OAuth 상태 키를 구성하도록 요청하세요.",
   "communication_channels.profile.connect.notConfigured": "이 제공업체는 아직 구성되지 않았습니다. 메일함을 연결하기 전에 관리자에게 통합에서 OAuth 클라이언트 ID와 시크릿을 추가하도록 요청하세요.",
   "communication_channels.profile.connect.oauthFailed": "OAuth 연결을 시작할 수 없습니다.",
   "communication_channels.profile.connect.save": "연결",
@@ -103,7 +107,6 @@
   "communication_channels.profile.flash.connected": "채널이 연결되었습니다.",
   "communication_channels.profile.flash.connectedWithProvider": "채널이 연결되었습니다 ({provider}).",
   "communication_channels.profile.flash.error": "채널 연결에 실패했습니다.",
-  "communication_channels.profile.flash.errorWithCode": "채널 연결에 실패했습니다 — {code}.",
   "communication_channels.profile.flash.replayedState": "이 연결 링크는 이미 사용되었습니다. 연결을 다시 시작해 주세요.",
   "communication_channels.profile.flash.stateStoreUnavailable": "서버 오류로 연결을 완료할 수 없습니다. 잠시 후 다시 시도해 주세요.",
   "communication_channels.profile.group": "프로필",

package/src/modules/communication_channels/i18n/pl.json

@@ -71,6 +71,9 @@
   "communication_channels.profile.connect.connected": "Kanał połączony.",
   "communication_channels.profile.connect.connecting": "Łączenie...",
   "communication_channels.profile.connect.credentialsFailed": "Nie udało się połączyć skrzynki pocztowej.",
+  "communication_channels.profile.connect.errors.invalidEmail": "Wprowadź prawidłowy adres e-mail.",
+  "communication_channels.profile.connect.errors.invalidPort": "Wprowadź port z zakresu od 1 do 65535.",
+  "communication_channels.profile.connect.errors.required": "To pole jest wymagane.",
   "communication_channels.profile.connect.fields.displayName": "Nazwa wyświetlana",
   "communication_channels.profile.connect.fields.fromAddress": "Adres nadawcy",
   "communication_channels.profile.connect.fields.imapHost": "Host IMAP",
@@ -88,6 +91,7 @@
   "communication_channels.profile.connect.imapTitle": "Połącz skrzynkę IMAP",
   "communication_channels.profile.connect.mailboxAlreadyConnected": "Ta skrzynka jest już połączona przez innego dostawcę. Najpierw ją rozłącz, aby połączyć ją z innym dostawcą.",
   "communication_channels.profile.connect.menu": "Połącz kanał",
+  "communication_channels.profile.connect.notAvailable": "Połączenie skrzynki pocztowej jest niedostępne. Poproś administratora o skonfigurowanie klucza stanu OAuth.",
   "communication_channels.profile.connect.notConfigured": "Ten dostawca nie został jeszcze skonfigurowany. Poproś administratora o dodanie identyfikatora klienta i sekretu OAuth w sekcji Integracje przed połączeniem skrzynki.",
   "communication_channels.profile.connect.oauthFailed": "Nie udało się rozpocząć połączenia OAuth.",
   "communication_channels.profile.connect.save": "Połącz",
@@ -103,7 +107,6 @@
   "communication_channels.profile.flash.connected": "Kanał połączony.",
   "communication_channels.profile.flash.connectedWithProvider": "Kanał połączony ({provider}).",
   "communication_channels.profile.flash.error": "Nie udało się połączyć kanału.",
-  "communication_channels.profile.flash.errorWithCode": "Nie udało się połączyć kanału — {code}.",
   "communication_channels.profile.flash.replayedState": "Ten link połączenia został już użyty — rozpocznij połączenie ponownie.",
   "communication_channels.profile.flash.stateStoreUnavailable": "Błąd serwera uniemożliwił dokończenie połączenia. Spróbuj ponownie za chwilę.",
   "communication_channels.profile.group": "Profil",

package/src/modules/communication_channels/lib/inbound-message-origin.ts

@@ -1,12 +1,8 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveCommunicationChannelsSystemUserId } from './system-user'
+import { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE } from '../../messages/lib/messageSourceEntityTypes'
 
-/**
- * Entity type a channel-backed conversation is exposed under on a message's
- * `sourceEntityType`. Written by `commands/ingest-inbound-message.ts` and
- * inherited by every operator message composed on the same conversation.
- */
-export const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'
+export { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE }
 
 /**
  * Dedup key `ingest-inbound-message` stamps on the platform message it composes,

package/src/modules/communication_channels/lib/oauth-result.ts

@@ -0,0 +1,13 @@
+// The OAuth callback reports its outcome to the return page through this query
+// param. It must not be `flash`: the global <FlashMessages> host reads `?flash=`
+// as the message text and would render the raw outcome ("error"/"connected") as
+// a success toast (#6402).
+export const OAUTH_RESULT_QUERY_PARAM = 'oauth'
+
+const OAUTH_RESULT_QUERY_PARAMS = [OAUTH_RESULT_QUERY_PARAM, 'code', 'provider', 'channelId']
+
+export function stripOAuthResultParams(href: string): string {
+  const url = new URL(href)
+  for (const param of OAUTH_RESULT_QUERY_PARAMS) url.searchParams.delete(param)
+  return `${url.pathname}${url.search}${url.hash}`
+}

package/src/modules/communication_channels/lib/oauth-state.ts

@@ -138,7 +138,10 @@ function getSecret(): string {
   // state cookies, bypassing the userId/tenant binding. In non-production we fall
   // back to JWT_SECRET so dev/test envs that only configure one secret still work.
   if (process.env.NODE_ENV === 'production') {
-    throw new Error('[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production')
+    throw new OAuthStateError(
+      '[internal] OM_HUB_OAUTH_STATE_KEY or KMS_MASTER_KEY required in production',
+      'missing_secret',
+    )
   }
   const fallback = process.env.JWT_SECRET
   if (!fallback) {

package/src/modules/communication_channels/lib/use-connect-channel.ts

@@ -46,6 +46,16 @@ export function useConnectChannel(options: {
       })
       const body = response.result as InitiateResponse | undefined
       if (!response.ok || !body?.authorizeUrl) {
+        if (body?.code === 'missing_secret') {
+          flash(
+            t(
+              'communication_channels.profile.connect.notAvailable',
+              'Mailbox connection is not available. Ask an administrator to configure the OAuth state key.',
+            ),
+            'error',
+          )
+          return
+        }
         if (body?.code === 'oauth_client_not_configured') {
           flash(
             t(

package/src/modules/customers/api/activity-types/route.ts

@@ -0,0 +1,154 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveDictionaryRouteContext } from '../dictionaries/context'
+import { createDictionaryCacheTags, DICTIONARY_CACHE_TTL_MS } from '../dictionaries/cache'
+import { getInjectionRegistryVersion } from '@open-mercato/shared/modules/widgets/injection-loader'
+import {
+  resolveScopedCalendarEventTypes,
+} from '../../lib/calendar/eventTypeResolver'
+import { calendarEventTypeBehaviorSchema } from '../../calendar-event-types'
+import { getCalendarEventTypeRegistryVersion } from '../../calendar-event-types'
+
+const logger = createLogger('customers')
+
+function reportActivityTypeError(error: unknown, code: string, attributes?: Record<string, string>): void {
+  try {
+    getTelemetryRuntime()?.reportError(error, { module: 'customers', code, attributes })
+  } catch {}
+}
+
+const querySchema = z.object({ organizationId: z.string().uuid().optional() })
+const responseSchema = z.object({
+  fallbackKey: z.literal('meeting'),
+  items: z.array(z.object({
+    key: z.string(),
+    label: z.string(),
+    labelKey: z.string().optional(),
+    icon: z.string().nullable().optional(),
+    color: z.string().nullable().optional(),
+    behavior: calendarEventTypeBehaviorSchema,
+    selectable: z.boolean(),
+    panelKey: z.string().optional(),
+    source: z.string(),
+    provenance: z.record(z.string(), z.unknown()),
+    historical: z.boolean(),
+    fallbackReason: z.enum(['tombstoned', 'module-unavailable', 'unknown']).optional(),
+    adminConfigurable: z.boolean(),
+    isInherited: z.boolean(),
+    isLocalOverride: z.boolean(),
+    updatedAt: z.string().nullable(),
+    missingCustomFieldsetIds: z.array(z.string()),
+    inactiveDictionaryOverride: z.boolean().optional(),
+  })),
+})
+
+export const metadata = {
+  GET: { requireAuth: true },
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const query = querySchema.parse({ organizationId: url.searchParams.get('organizationId') ?? undefined })
+    const context = await resolveDictionaryRouteContext(req, { selectedId: query.organizationId })
+    if (!context.organizationId) {
+      return NextResponse.json({ error: context.translate('customers.errors.organization_required', 'Organization context is required') }, { status: 400 })
+    }
+    const organizationId = context.organizationId
+    const rbac = context.container.resolve('rbacService') as RbacService | undefined
+    const actorId = context.auth?.sub
+    if (!rbac || !actorId) {
+      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })
+    }
+    const permissionScope = { tenantId: context.tenantId, organizationId }
+    const canViewInteractions = await rbac.userHasAllFeatures(actorId, ['customers.interactions.view'], permissionScope)
+    const canManageSettings = canViewInteractions || await rbac.userHasAllFeatures(actorId, ['customers.settings.manage'], permissionScope)
+    if (!canManageSettings) {
+      throw new CrudHttpError(403, { error: context.translate('customers.calendar.activityTypes.errors.forbidden', 'You do not have permission to view activity types.') })
+    }
+    const hierarchy = context.container.resolve('organizationHierarchyService') as OrganizationHierarchyService
+    const ancestors = await hierarchy.resolveAncestorIds({ tenantId: context.tenantId, organizationId })
+    if (ancestors === null) {
+      throw new CrudHttpError(403, { error: context.translate('customers.errors.organization_forbidden', 'Organization not accessible') })
+    }
+    const scopeIds = Array.from(new Set([organizationId, ...ancestors.slice().reverse()]))
+    const cacheKey = `customers:activity-types:${context.tenantId}:org=${organizationId}:scope=${scopeIds.join('|')}:widgets=${getInjectionRegistryVersion()}:registry=${getCalendarEventTypeRegistryVersion()}`
+    const cached = await context.cache?.get(cacheKey)
+    if (cached) return NextResponse.json(cached)
+
+    let catalog
+    try {
+      catalog = await resolveScopedCalendarEventTypes({
+        em: context.em,
+        tenantId: context.tenantId,
+        organizationId,
+        readableOrganizationIds: scopeIds,
+      })
+    } catch (err) {
+      logger.error('customers.activity_types.resolve failed', {
+        err,
+        tenantId: context.tenantId,
+        organizationId,
+      })
+      reportActivityTypeError(err, 'customers.activity_type_catalog_resolution_failed', {
+        tenantId: context.tenantId,
+        organizationId,
+      })
+      return NextResponse.json({
+        error: context.translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),
+        code: 'activity_type_catalog_unavailable',
+      }, { status: 503 })
+    }
+    if (context.cache) {
+      await context.cache.set(cacheKey, catalog, {
+        ttl: DICTIONARY_CACHE_TTL_MS,
+        tags: createDictionaryCacheTags({
+          tenantId: context.tenantId,
+          mappedKind: 'activity_type',
+          organizationIds: scopeIds,
+        }),
+      }).catch((err) => {
+        logger.warn('customers.activity_types cache write failed', { err })
+        reportActivityTypeError(err, 'customers.activity_type_catalog_cache_write_failed', {
+          tenantId: context.tenantId,
+          organizationId,
+        })
+      })
+    }
+    return NextResponse.json(catalog)
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('customers.activity_types request failed', { err })
+    reportActivityTypeError(err, 'customers.activity_type_catalog_request_failed')
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({
+      error: translate('customers.calendar.activityTypes.errors.loadFailed', 'Failed to load activity types'),
+    }, { status: err instanceof z.ZodError ? 400 : 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Effective calendar activity types',
+  methods: {
+    GET: {
+      summary: 'List effective calendar activity types',
+      description: 'Returns the tenant and organization scoped calendar activity-type catalog. Requires customers.interactions.view or customers.settings.manage.',
+      responses: [{ status: 200, description: 'Effective activity-type catalog', schema: responseSchema }],
+      errors: [
+        { status: 400, description: 'Organization scope is required', schema: z.object({ error: z.string() }) },
+        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Forbidden', schema: z.object({ error: z.string() }) },
+        { status: 500, description: 'Unexpected server error', schema: z.object({ error: z.string() }) },
+      ],
+    },
+  },
+}