@open-mercato/core 0.9.1-develop.7513.1.ae2715553f → 0.9.1-develop.7516.1.176184247d

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 5729 entry points
+[build:core] found 5734 entry points
 [build:core] built successfully
 [build:core:generated] found 252 entry points
 [build:core:generated] built successfully

package/dist/modules/communication_channels/lib/send-as-user.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/communication_channels/lib/send-as-user.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../data/entities'\nimport { ChannelMutationBlockedError, guardOutboundCreate } from './mutation-guards'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from './queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\nimport { htmlToText } from './email-mime'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels')\n\nexport type SendAsUserActor = {\n  userId: string\n  tenantId: string\n  organizationId: string | null\n  /** Forwarded as the messages compose command `ctx.auth`. */\n  auth?: unknown\n}\n\nexport type SendAsUserInput = {\n  userChannelId: string\n  to: string[]\n  cc?: string[]\n  bcc?: string[]\n  subject: string\n  body: { plain?: string; html?: string; bodyFormat?: 'text' | 'markdown' }\n  inReplyTo?: string\n  references?: string[]\n  /**\n   * Open Mercato `messages.message` id of the message being replied to. When\n   * set, the composed message joins that message's thread (the messages module\n   * derives `threadId` from the parent), so a CRM reply continues the existing\n   * conversation instead of starting a new thread. Optional \u2014 omitted for new\n   * threads.\n   */\n  parentMessageId?: string\n  /**\n   * Free-form metadata persisted on the resulting MessageChannelLink. Used by\n   * downstream subscribers (e.g. the customers module's link-channel-message\n   * subscriber) to anchor the sent message back to a CRM Person or honor a\n   * caller-specified visibility flag. The hub does not interpret these keys.\n   */\n  channelMetadata?: Record<string, unknown>\n}\n\nexport type SendAsUserResult =\n  | {\n      ok: true\n      messageId: string\n      threadId: string\n      channelId: string\n      providerKey: string\n    }\n  | { ok: false; status: number; error: string; fieldErrors?: Record<string, string> }\n\n/**\n * In-process send-as-user facade.\n *\n * Validates the actor owns `userChannelId`, composes the Message via the\n * messages module command, persists the outbound MessageChannelLink + thread\n * mapping, and enqueues delivery. Returns a discriminated result instead of an\n * HTTP Response so it can be invoked both by the `/send-as-user` route and by\n * other modules via DI (`container.resolve('communicationChannelsSendAsUser')`)\n * \u2014 no HTTP self-call required.\n */\nexport async function sendAsUser(\n  container: AppContainer,\n  actor: SendAsUserActor,\n  input: SendAsUserInput,\n): Promise<SendAsUserResult> {\n  if (!input.body.plain && !input.body.html) {\n    return { ok: false, status: 422, error: 'Either body.plain or body.html is required' }\n  }\n  // Re-validate here (not only in the HTTP route's zod schema) because this\n  // facade is also reachable via DI; `input.to[0]` below would otherwise become\n  // `undefined` for an empty recipient list.\n  if (!Array.isArray(input.to) || input.to.length === 0) {\n    return { ok: false, status: 422, error: 'At least one recipient is required' }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const { tenantId } = actor\n  const organizationId = actor.organizationId\n  const dscope = { tenantId, organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id: input.userChannelId, tenantId, organizationId, deletedAt: null },\n    undefined,\n    dscope,\n  )\n  if (!channel) return { ok: false, status: 404, error: 'Channel not found' }\n  if (channel.userId !== actor.userId) {\n    return { ok: false, status: 403, error: 'You can only send through channels you own' }\n  }\n\n  // Hub mutation guard: map known non-deliverable states (`requires_reauth`,\n  // `disconnected`) to a 422 with field-level errors; other transitional states\n  // fall through to the 409 below.\n  try {\n    await guardOutboundCreate(em, { channelId: channel.id, scope: dscope })\n  } catch (err) {\n    if (err instanceof ChannelMutationBlockedError) {\n      return { ok: false, status: 422, error: err.message, fieldErrors: err.errors }\n    }\n    throw err\n  }\n  if (!channel.isActive || channel.status !== 'connected') {\n    return {\n      ok: false,\n      status: 409,\n      error: `Channel is in status '${channel.status}' (not connected)`,\n    }\n  }\n\n  // Create the Message via the messages module compose command. The outbound\n  // subscriber picks it up via `messages.message.sent` and routes through the\n  // adapter chain.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  const messageBody = input.body.plain ?? htmlToText(input.body.html ?? '')\n  const composeInput = {\n    type: `channel.${channel.providerKey}`,\n    visibility: 'public' as const,\n    sourceEntityType: 'communication_channels.send_as_user',\n    sourceEntityId: channel.id,\n    externalEmail: input.to[0],\n    externalName: input.subject,\n    recipients: [],\n    subject: input.subject,\n    body: messageBody,\n    bodyFormat: input.body.bodyFormat === 'markdown' ? ('markdown' as const) : ('text' as const),\n    priority: 'normal' as const,\n    sendViaEmail: false,\n    parentMessageId: input.parentMessageId,\n    isDraft: false,\n    tenantId,\n    organizationId,\n    userId: actor.userId,\n  }\n  let result\n  try {\n    result = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: {\n          container,\n          auth: actor.auth as never,\n          organizationScope: null,\n          selectedOrganizationId: organizationId,\n          organizationIds: organizationId ? [organizationId] : null,\n        },\n      },\n    )\n  } catch (err) {\n    logger.error('communication_channels send-as-user compose failed', { err })\n    return { ok: false, status: 500, error: '[internal] compose failed' }\n  }\n\n  const messageId = result.result.id\n  const messageThreadId = result.result.threadId ?? messageId\n  const externalThreadRef = `outbound:${messageThreadId}`\n\n  // Persist the conversation, thread mapping, and channel link as one unit. The\n  // conversation's id is DB-generated (`gen_random_uuid()`), so it must be\n  // flushed before the mapping/link can reference it \u2014 hence the eager flushes\n  // rather than `withAtomicFlush` (single trailing flush). `em.transactional`\n  // wraps the whole sequence so a mid-way failure rolls back all three writes\n  // instead of leaving an orphaned conversation row.\n  await em.transactional(async () => {\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        subject: input.subject,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n        lastMessageAt: new Date(),\n      })\n      em.persist(conversation)\n      await em.flush()\n    } else {\n      conversation.subject = conversation.subject ?? input.subject\n      conversation.assignedUserId = conversation.assignedUserId ?? actor.userId\n      conversation.lastMessageAt = new Date()\n      // Flush the scalar updates BEFORE the ChannelThreadMapping lookup below: a\n      // find/findOne on the same EntityManager between a scalar mutation and flush\n      // can silently drop the pending UPDATE (core AGENTS.md \u2192 Entity Update Safety).\n      await em.flush()\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!existingMapping) {\n      const mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId,\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        externalThreadRef,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n      })\n      em.persist(mapping)\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      messageId,\n      externalConversationId: conversation.id,\n      providerKey: channel.providerKey,\n      channelType: channel.channelType,\n      direction: 'outbound',\n      deliveryStatus: 'pending',\n      channelPayload: {\n        text: input.body.plain ?? messageBody,\n        ...(input.body.html ? { html: input.body.html } : {}),\n      },\n      channelContentType: input.body.html ? 'text/html' : 'text/plain',\n      channelMetadata: {\n        // Caller-supplied pass-through metadata merged FIRST so the validated\n        // routing fields below always win \u2014 a caller cannot override the\n        // recipients/subject/threading headers via `channelMetadata`.\n        ...(input.channelMetadata ?? {}),\n        to: input.to,\n        cc: input.cc ?? [],\n        bcc: input.bcc ?? [],\n        subject: input.subject,\n        inReplyTo: input.inReplyTo ?? null,\n        references: input.references ?? [],\n      },\n      tenantId,\n      organizationId,\n    })\n    em.persist(channelLink)\n    await em.flush()\n  })\n\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const deliveryJob: OutboundDeliveryPayload = {\n    messageId,\n    scope: dscope,\n    attempt: 1,\n  }\n  await queue.enqueue(deliveryJob as unknown as Record<string, unknown>)\n\n  return {\n    ok: true,\n    messageId,\n    threadId: messageThreadId,\n    channelId: channel.id,\n    providerKey: channel.providerKey,\n  }\n}\n\n/** DI service type for cross-module callers (resolve `communicationChannelsSendAsUser`). */\nexport type SendAsUserService = typeof sendAsUser\n"],
-  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B,2BAA2B;AACjE,SAAS,+BAA+B,qCAAqC;AAE7E,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB;AAwDpD,eAAsB,WACpB,WACA,OACA,OAC2B;AAC3B,MAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,KAAK,MAAM;AACzC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAIA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAE,KAAK,MAAM,GAAG,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,qCAAqC;AAAA,EAC/E;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,iBAAiB,MAAM;AAC7B,QAAM,SAAS,EAAE,UAAU,eAAe;AAE1C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,eAAe,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,oBAAoB;AAC1E,MAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAKA,MAAI;AACF,UAAM,oBAAoB,IAAI,EAAE,WAAW,QAAQ,IAAI,OAAO,OAAO,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,IAAI,SAAS,aAAa,IAAI,OAAO;AAAA,IAC/E;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,aAAa;AACvD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,OAAO,yBAAyB,QAAQ,MAAM;AAAA,IAChD;AAAA,EACF;AAKA,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,cAAc,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,QAAQ,EAAE;AACxE,QAAM,eAAe;AAAA,IACnB,MAAM,WAAW,QAAQ,WAAW;AAAA,IACpC,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,eAAe,MAAM,GAAG,CAAC;AAAA,IACzB,cAAc,MAAM;AAAA,IACpB,YAAY,CAAC;AAAA,IACb,SAAS,MAAM;AAAA,IACf,MAAM;AAAA,IACN,YAAY,MAAM,KAAK,eAAe,aAAc,aAAwB;AAAA,IAC5E,UAAU;AAAA,IACV,cAAc;AAAA,IACd,iBAAiB,MAAM;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,WAAW;AAAA,MACxB;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,4BAA4B;AAAA,EACtE;AAEA,QAAM,YAAY,OAAO,OAAO;AAChC,QAAM,kBAAkB,OAAO,OAAO,YAAY;AAClD,QAAM,oBAAoB,YAAY,eAAe;AAQrD,QAAM,GAAG,cAAc,YAAY;AACjC,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,eAAe,oBAAI,KAAK;AAAA,MAC1B,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,mBAAa,UAAU,aAAa,WAAW,MAAM;AACrD,mBAAa,iBAAiB,aAAa,kBAAkB,MAAM;AACnE,mBAAa,gBAAgB,oBAAI,KAAK;AAItC,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,YAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,QAC9C,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,MACF,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD;AAAA,MACA,wBAAwB,aAAa;AAAA,MACrC,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,QACd,MAAM,MAAM,KAAK,SAAS;AAAA,QAC1B,GAAI,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD;AAAA,MACA,oBAAoB,MAAM,KAAK,OAAO,cAAc;AAAA,MACpD,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIf,GAAI,MAAM,mBAAmB,CAAC;AAAA,QAC9B,IAAI,MAAM;AAAA,QACV,IAAI,MAAM,MAAM,CAAC;AAAA,QACjB,KAAK,MAAM,OAAO,CAAC;AAAA,QACnB,SAAS,MAAM;AAAA,QACf,WAAW,MAAM,aAAa;AAAA,QAC9B,YAAY,MAAM,cAAc,CAAC;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,WAAW;AACtB,UAAM,GAAG,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,cAAuC;AAAA,IAC3C;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,WAAiD;AAErE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,EACvB;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AppContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  ChannelThreadMapping,\n  CommunicationChannel,\n  ExternalConversation,\n  MessageChannelLink,\n} from '../data/entities'\nimport { ChannelMutationBlockedError, guardOutboundCreate } from './mutation-guards'\nimport { COMMUNICATION_CHANNELS_QUEUES, getCommunicationChannelsQueue } from './queue'\nimport type { OutboundDeliveryPayload } from '../workers/outbound-delivery'\nimport { htmlToText } from './email-mime'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('communication_channels')\n\nexport type SendAsUserActor = {\n  userId: string\n  tenantId: string\n  organizationId: string | null\n  /** Forwarded as the messages compose command `ctx.auth`. */\n  auth?: unknown\n}\n\nexport type SendAsUserInput = {\n  userChannelId: string\n  to: string[]\n  cc?: string[]\n  bcc?: string[]\n  subject: string\n  body: { plain?: string; html?: string; bodyFormat?: 'text' | 'markdown' }\n  inReplyTo?: string\n  references?: string[]\n  /**\n   * Open Mercato `messages.message` id of the message being replied to. When\n   * set, the composed message joins that message's thread (the messages module\n   * derives `threadId` from the parent), so a CRM reply continues the existing\n   * conversation instead of starting a new thread. Optional \u2014 omitted for new\n   * threads.\n   *\n   * Not authorized here: the facade serves more than one surface, and each owns\n   * what \"may reply to\" means. The caller MUST have established that the actor\n   * can read this message under its own read rule before passing it.\n   */\n  parentMessageId?: string\n  /**\n   * Free-form metadata persisted on the resulting MessageChannelLink. Used by\n   * downstream subscribers (e.g. the customers module's link-channel-message\n   * subscriber) to anchor the sent message back to a CRM Person or honor a\n   * caller-specified visibility flag. The hub does not interpret these keys.\n   */\n  channelMetadata?: Record<string, unknown>\n}\n\nexport type SendAsUserResult =\n  | {\n      ok: true\n      messageId: string\n      threadId: string\n      channelId: string\n      providerKey: string\n    }\n  | { ok: false; status: number; error: string; fieldErrors?: Record<string, string> }\n\n/**\n * In-process send-as-user facade.\n *\n * Validates the actor owns `userChannelId`, composes the Message via the\n * messages module command, persists the outbound MessageChannelLink + thread\n * mapping, and enqueues delivery. Returns a discriminated result instead of an\n * HTTP Response so it can be invoked both by the `/send-as-user` route and by\n * other modules via DI (`container.resolve('communicationChannelsSendAsUser')`)\n * \u2014 no HTTP self-call required.\n */\nexport async function sendAsUser(\n  container: AppContainer,\n  actor: SendAsUserActor,\n  input: SendAsUserInput,\n): Promise<SendAsUserResult> {\n  if (!input.body.plain && !input.body.html) {\n    return { ok: false, status: 422, error: 'Either body.plain or body.html is required' }\n  }\n  // Re-validate here (not only in the HTTP route's zod schema) because this\n  // facade is also reachable via DI; `input.to[0]` below would otherwise become\n  // `undefined` for an empty recipient list.\n  if (!Array.isArray(input.to) || input.to.length === 0) {\n    return { ok: false, status: 422, error: 'At least one recipient is required' }\n  }\n\n  const em = (container.resolve('em') as EntityManager).fork()\n  const { tenantId } = actor\n  const organizationId = actor.organizationId\n  const dscope = { tenantId, organizationId }\n\n  const channel = await findOneWithDecryption(\n    em,\n    CommunicationChannel,\n    { id: input.userChannelId, tenantId, organizationId, deletedAt: null },\n    undefined,\n    dscope,\n  )\n  if (!channel) return { ok: false, status: 404, error: 'Channel not found' }\n  if (channel.userId !== actor.userId) {\n    return { ok: false, status: 403, error: 'You can only send through channels you own' }\n  }\n\n  // Hub mutation guard: map known non-deliverable states (`requires_reauth`,\n  // `disconnected`) to a 422 with field-level errors; other transitional states\n  // fall through to the 409 below.\n  try {\n    await guardOutboundCreate(em, { channelId: channel.id, scope: dscope })\n  } catch (err) {\n    if (err instanceof ChannelMutationBlockedError) {\n      return { ok: false, status: 422, error: err.message, fieldErrors: err.errors }\n    }\n    throw err\n  }\n  if (!channel.isActive || channel.status !== 'connected') {\n    return {\n      ok: false,\n      status: 409,\n      error: `Channel is in status '${channel.status}' (not connected)`,\n    }\n  }\n\n  // Create the Message via the messages module compose command. The outbound\n  // subscriber picks it up via `messages.message.sent` and routes through the\n  // adapter chain.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  const messageBody = input.body.plain ?? htmlToText(input.body.html ?? '')\n  const composeInput = {\n    type: `channel.${channel.providerKey}`,\n    visibility: 'public' as const,\n    sourceEntityType: 'communication_channels.send_as_user',\n    sourceEntityId: channel.id,\n    externalEmail: input.to[0],\n    externalName: input.subject,\n    recipients: [],\n    subject: input.subject,\n    body: messageBody,\n    bodyFormat: input.body.bodyFormat === 'markdown' ? ('markdown' as const) : ('text' as const),\n    priority: 'normal' as const,\n    sendViaEmail: false,\n    parentMessageId: input.parentMessageId,\n    isDraft: false,\n    tenantId,\n    organizationId,\n    userId: actor.userId,\n  }\n  let result\n  try {\n    result = await commandBus.execute<typeof composeInput, { id: string; threadId: string | null }>(\n      'messages.messages.compose',\n      {\n        input: composeInput,\n        ctx: {\n          container,\n          auth: actor.auth as never,\n          organizationScope: null,\n          selectedOrganizationId: organizationId,\n          organizationIds: organizationId ? [organizationId] : null,\n        },\n      },\n    )\n  } catch (err) {\n    logger.error('communication_channels send-as-user compose failed', { err })\n    return { ok: false, status: 500, error: '[internal] compose failed' }\n  }\n\n  const messageId = result.result.id\n  const messageThreadId = result.result.threadId ?? messageId\n  const externalThreadRef = `outbound:${messageThreadId}`\n\n  // Persist the conversation, thread mapping, and channel link as one unit. The\n  // conversation's id is DB-generated (`gen_random_uuid()`), so it must be\n  // flushed before the mapping/link can reference it \u2014 hence the eager flushes\n  // rather than `withAtomicFlush` (single trailing flush). `em.transactional`\n  // wraps the whole sequence so a mid-way failure rolls back all three writes\n  // instead of leaving an orphaned conversation row.\n  await em.transactional(async () => {\n    let conversation = await findOneWithDecryption(\n      em,\n      ExternalConversation,\n      {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!conversation) {\n      conversation = em.create(ExternalConversation, {\n        channelId: channel.id,\n        externalConversationId: externalThreadRef,\n        subject: input.subject,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n        lastMessageAt: new Date(),\n      })\n      em.persist(conversation)\n      await em.flush()\n    } else {\n      conversation.subject = conversation.subject ?? input.subject\n      conversation.assignedUserId = conversation.assignedUserId ?? actor.userId\n      conversation.lastMessageAt = new Date()\n      // Flush the scalar updates BEFORE the ChannelThreadMapping lookup below: a\n      // find/findOne on the same EntityManager between a scalar mutation and flush\n      // can silently drop the pending UPDATE (core AGENTS.md \u2192 Entity Update Safety).\n      await em.flush()\n    }\n\n    const existingMapping = await findOneWithDecryption(\n      em,\n      ChannelThreadMapping,\n      {\n        externalConversationId: conversation.id,\n        tenantId,\n        organizationId,\n      },\n      undefined,\n      dscope,\n    )\n    if (!existingMapping) {\n      const mapping = em.create(ChannelThreadMapping, {\n        externalConversationId: conversation.id,\n        messageThreadId,\n        channelId: channel.id,\n        providerKey: channel.providerKey,\n        externalThreadRef,\n        assignedUserId: actor.userId,\n        tenantId,\n        organizationId,\n      })\n      em.persist(mapping)\n    }\n\n    const channelLink = em.create(MessageChannelLink, {\n      messageId,\n      externalConversationId: conversation.id,\n      providerKey: channel.providerKey,\n      channelType: channel.channelType,\n      direction: 'outbound',\n      deliveryStatus: 'pending',\n      channelPayload: {\n        text: input.body.plain ?? messageBody,\n        ...(input.body.html ? { html: input.body.html } : {}),\n      },\n      channelContentType: input.body.html ? 'text/html' : 'text/plain',\n      channelMetadata: {\n        // Caller-supplied pass-through metadata merged FIRST so the validated\n        // routing fields below always win \u2014 a caller cannot override the\n        // recipients/subject/threading headers via `channelMetadata`.\n        ...(input.channelMetadata ?? {}),\n        to: input.to,\n        cc: input.cc ?? [],\n        bcc: input.bcc ?? [],\n        subject: input.subject,\n        inReplyTo: input.inReplyTo ?? null,\n        references: input.references ?? [],\n      },\n      tenantId,\n      organizationId,\n    })\n    em.persist(channelLink)\n    await em.flush()\n  })\n\n  const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.outbound)\n  const deliveryJob: OutboundDeliveryPayload = {\n    messageId,\n    scope: dscope,\n    attempt: 1,\n  }\n  await queue.enqueue(deliveryJob as unknown as Record<string, unknown>)\n\n  return {\n    ok: true,\n    messageId,\n    threadId: messageThreadId,\n    channelId: channel.id,\n    providerKey: channel.providerKey,\n  }\n}\n\n/** DI service type for cross-module callers (resolve `communicationChannelsSendAsUser`). */\nexport type SendAsUserService = typeof sendAsUser\n"],
+  "mappings": "AAGA,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,6BAA6B,2BAA2B;AACjE,SAAS,+BAA+B,qCAAqC;AAE7E,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,wBAAwB;AA4DpD,eAAsB,WACpB,WACA,OACA,OAC2B;AAC3B,MAAI,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,KAAK,MAAM;AACzC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAIA,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAE,KAAK,MAAM,GAAG,WAAW,GAAG;AACrD,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,qCAAqC;AAAA,EAC/E;AAEA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,EAAE,SAAS,IAAI;AACrB,QAAM,iBAAiB,MAAM;AAC7B,QAAM,SAAS,EAAE,UAAU,eAAe;AAE1C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,eAAe,UAAU,gBAAgB,WAAW,KAAK;AAAA,IACrE;AAAA,IACA;AAAA,EACF;AACA,MAAI,CAAC,QAAS,QAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,oBAAoB;AAC1E,MAAI,QAAQ,WAAW,MAAM,QAAQ;AACnC,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,6CAA6C;AAAA,EACvF;AAKA,MAAI;AACF,UAAM,oBAAoB,IAAI,EAAE,WAAW,QAAQ,IAAI,OAAO,OAAO,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,QAAI,eAAe,6BAA6B;AAC9C,aAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,IAAI,SAAS,aAAa,IAAI,OAAO;AAAA,IAC/E;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,QAAQ,YAAY,QAAQ,WAAW,aAAa;AACvD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,QAAQ;AAAA,MACR,OAAO,yBAAyB,QAAQ,MAAM;AAAA,IAChD;AAAA,EACF;AAKA,QAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,QAAM,cAAc,MAAM,KAAK,SAAS,WAAW,MAAM,KAAK,QAAQ,EAAE;AACxE,QAAM,eAAe;AAAA,IACnB,MAAM,WAAW,QAAQ,WAAW;AAAA,IACpC,YAAY;AAAA,IACZ,kBAAkB;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,eAAe,MAAM,GAAG,CAAC;AAAA,IACzB,cAAc,MAAM;AAAA,IACpB,YAAY,CAAC;AAAA,IACb,SAAS,MAAM;AAAA,IACf,MAAM;AAAA,IACN,YAAY,MAAM,KAAK,eAAe,aAAc,aAAwB;AAAA,IAC5E,UAAU;AAAA,IACV,cAAc;AAAA,IACd,iBAAiB,MAAM;AAAA,IACvB,SAAS;AAAA,IACT;AAAA,IACA;AAAA,IACA,QAAQ,MAAM;AAAA,EAChB;AACA,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,WAAW;AAAA,MACxB;AAAA,MACA;AAAA,QACE,OAAO;AAAA,QACP,KAAK;AAAA,UACH;AAAA,UACA,MAAM,MAAM;AAAA,UACZ,mBAAmB;AAAA,UACnB,wBAAwB;AAAA,UACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,QACvD;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,WAAO,MAAM,sDAAsD,EAAE,IAAI,CAAC;AAC1E,WAAO,EAAE,IAAI,OAAO,QAAQ,KAAK,OAAO,4BAA4B;AAAA,EACtE;AAEA,QAAM,YAAY,OAAO,OAAO;AAChC,QAAM,kBAAkB,OAAO,OAAO,YAAY;AAClD,QAAM,oBAAoB,YAAY,eAAe;AAQrD,QAAM,GAAG,cAAc,YAAY;AACjC,QAAI,eAAe,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,cAAc;AACjB,qBAAe,GAAG,OAAO,sBAAsB;AAAA,QAC7C,WAAW,QAAQ;AAAA,QACnB,wBAAwB;AAAA,QACxB,SAAS,MAAM;AAAA,QACf,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,QACA,eAAe,oBAAI,KAAK;AAAA,MAC1B,CAAC;AACD,SAAG,QAAQ,YAAY;AACvB,YAAM,GAAG,MAAM;AAAA,IACjB,OAAO;AACL,mBAAa,UAAU,aAAa,WAAW,MAAM;AACrD,mBAAa,iBAAiB,aAAa,kBAAkB,MAAM;AACnE,mBAAa,gBAAgB,oBAAI,KAAK;AAItC,YAAM,GAAG,MAAM;AAAA,IACjB;AAEA,UAAM,kBAAkB,MAAM;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,QACE,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA;AAAA,MACF;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI,CAAC,iBAAiB;AACpB,YAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,QAC9C,wBAAwB,aAAa;AAAA,QACrC;AAAA,QACA,WAAW,QAAQ;AAAA,QACnB,aAAa,QAAQ;AAAA,QACrB;AAAA,QACA,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA;AAAA,MACF,CAAC;AACD,SAAG,QAAQ,OAAO;AAAA,IACpB;AAEA,UAAM,cAAc,GAAG,OAAO,oBAAoB;AAAA,MAChD;AAAA,MACA,wBAAwB,aAAa;AAAA,MACrC,aAAa,QAAQ;AAAA,MACrB,aAAa,QAAQ;AAAA,MACrB,WAAW;AAAA,MACX,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,QACd,MAAM,MAAM,KAAK,SAAS;AAAA,QAC1B,GAAI,MAAM,KAAK,OAAO,EAAE,MAAM,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD;AAAA,MACA,oBAAoB,MAAM,KAAK,OAAO,cAAc;AAAA,MACpD,iBAAiB;AAAA;AAAA;AAAA;AAAA,QAIf,GAAI,MAAM,mBAAmB,CAAC;AAAA,QAC9B,IAAI,MAAM;AAAA,QACV,IAAI,MAAM,MAAM,CAAC;AAAA,QACjB,KAAK,MAAM,OAAO,CAAC;AAAA,QACnB,SAAS,MAAM;AAAA,QACf,WAAW,MAAM,aAAa;AAAA,QAC9B,YAAY,MAAM,cAAc,CAAC;AAAA,MACnC;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,WAAW;AACtB,UAAM,GAAG,MAAM;AAAA,EACjB,CAAC;AAED,QAAM,QAAQ,8BAA8B,8BAA8B,QAAQ;AAClF,QAAM,cAAuC;AAAA,IAC3C;AAAA,IACA,OAAO;AAAA,IACP,SAAS;AAAA,EACX;AACA,QAAM,MAAM,QAAQ,WAAiD;AAErE,SAAO;AAAA,IACL,IAAI;AAAA,IACJ;AAAA,IACA,UAAU;AAAA,IACV,WAAW,QAAQ;AAAA,IACnB,aAAa,QAAQ;AAAA,EACvB;AACF;",
   "names": []
 }

package/dist/modules/customers/api/people/[id]/emails/route.js

@@ -11,8 +11,11 @@ import {
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { isOrganizationReadAccessAllowed } from "@open-mercato/core/modules/directory/utils/organizationScopeGuard";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveAuthActorId } from "../../../../lib/interactionRequestContext.js";
 import { CustomerEntity } from "../../../../data/entities.js";
+import { listGrantsForViewerOnPerson, listSharedChannelIds } from "../../../../lib/conversationShares.js";
+import { isMessageOnPersonEmailHistory } from "../../../../lib/personEmailThreads.js";
 const metadata = {
   path: "/customers/people/[id]/emails",
   POST: {
@@ -33,6 +36,15 @@ const composeSchema = z.object({
   references: z.array(z.string().max(500)).max(50).optional(),
   parentMessageId: z.string().uuid().optional()
 }).strict();
+async function callerHasFeature(container, userId, feature, scope) {
+  try {
+    const rbac = container.resolve("rbacService");
+    if (typeof rbac?.userHasAllFeatures !== "function") return false;
+    return await rbac.userHasAllFeatures(userId, [feature], scope);
+  } catch {
+    return false;
+  }
+}
 async function POST(req, context) {
   const { id: personId } = await context.params;
   if (!z.string().uuid().safeParse(personId).success) {
@@ -74,6 +86,37 @@ async function POST(req, context) {
   if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {
     return NextResponse.json({ error: "Person not found" }, { status: 404 });
   }
+  if (body.parentMessageId) {
+    const viewerUserId = auth.isApiKey ? null : auth.sub ?? null;
+    const shareScope = { tenantId: auth.tenantId, organizationId };
+    const canViewPeople = await callerHasFeature(container, userId, "customers.people.view", shareScope);
+    const [sharedConversations, sharedChannelIds] = canViewPeople ? await Promise.all([
+      listGrantsForViewerOnPerson(em, shareScope, viewerUserId, personId),
+      listSharedChannelIds(em, shareScope, viewerUserId)
+    ]) : [[], []];
+    const parentVisible = canViewPeople && await isMessageOnPersonEmailHistory(em, {
+      personId,
+      tenantId: auth.tenantId,
+      organizationId,
+      viewerUserId,
+      userFeatures: void 0,
+      sharedConversations,
+      sharedChannelIds,
+      messageId: body.parentMessageId
+    });
+    if (!parentVisible) {
+      const { translate } = await resolveTranslations();
+      return NextResponse.json(
+        {
+          error: translate(
+            "customers.email.errors.parentMessageNotFound",
+            "The email you are replying to was not found"
+          )
+        },
+        { status: 404 }
+      );
+    }
+  }
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId,
@@ -142,7 +185,7 @@ const openApi = {
         { status: 400, description: "Invalid person id" },
         { status: 401, description: "Unauthorized" },
         { status: 403, description: "Missing customers.email.compose feature or mutation guard rejection" },
-        { status: 404, description: "Person or channel not found" },
+        { status: 404, description: "Person or channel not found, or the reply parent is not an email the caller can see on this Person" },
         { status: 409, description: "Channel not connected" },
         { status: 422, description: "Invalid request body" },
         { status: 500, description: "Send failed" }

package/dist/modules/customers/api/people/[id]/emails/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customers/api/people/%5Bid%5D/emails/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveAuthActorId } from '../../../../lib/interactionRequestContext'\nimport { CustomerEntity } from '../../../../data/entities'\nimport type { SendAsUserService } from '@open-mercato/core/modules/communication_channels/lib/send-as-user'\n\nexport const metadata = {\n  path: '/customers/people/[id]/emails',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['customers.email.compose'],\n  },\n}\n\nconst composeSchema = z\n  .object({\n    userChannelId: z.string().uuid(),\n    to: z.array(z.string().email()).min(1).max(50),\n    cc: z.array(z.string().email()).max(50).optional(),\n    bcc: z.array(z.string().email()).max(50).optional(),\n    subject: z.string().min(1).max(500),\n    body: z.string().min(1).max(200_000),\n    bodyFormat: z.enum(['text', 'html']).default('html'),\n    visibility: z.enum(['private', 'shared']).default('private'),\n    inReplyTo: z.string().max(500).optional(),\n    references: z.array(z.string().max(500)).max(50).optional(),\n    parentMessageId: z.string().uuid().optional(),\n  })\n  .strict()\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof composeSchema>\n  try {\n    body = composeSchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const userId = resolveAuthActorId(auth)\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // 1. Verify the Person exists in the caller's tenant, then fail-closed on the\n  //    record's own organization \u2014 same pattern as the [id]/route.ts GET handler.\n  //    Loading by tenant + id (not a hand-rolled selected org) keeps this working\n  //    under the \"All organizations\" scope; the record's own org then becomes the\n  //    concrete org the guard and the outbound message are attributed to.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId,\n    resourceKind: 'customers.person',\n    resourceId: personId,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  // 2. Call the hub's send-as-user facade in-process (resolved via DI) so the\n  //    customers module makes no HTTP self-call. `crmVisibility` and `crmPersonId`\n  //    are injected as channelMetadata so the link-channel-message subscriber can\n  //    anchor the sent message back to this Person on the\n  //    `communication_channels.message.sent` event.\n  const sendAsUserService = container.resolve(\n    'communicationChannelsSendAsUser',\n  ) as SendAsUserService\n\n  const sendResult = await sendAsUserService(\n    container,\n    { userId: auth.sub as string, tenantId: auth.tenantId as string, organizationId, auth },\n    {\n      userChannelId: body.userChannelId,\n      to: body.to,\n      cc: body.cc,\n      bcc: body.bcc,\n      subject: body.subject,\n      body: body.bodyFormat === 'html' ? { html: body.body } : { plain: body.body },\n      inReplyTo: body.inReplyTo,\n      references: body.references,\n      parentMessageId: body.parentMessageId,\n      channelMetadata: {\n        crmVisibility: body.visibility,\n        crmPersonId: personId,\n      },\n    },\n  )\n\n  if (!sendResult.ok) {\n    return NextResponse.json({ error: sendResult.error }, { status: sendResult.status })\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId,\n      resourceKind: 'customers.person',\n      resourceId: personId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  // Delivery is async (handled by the outbound queue worker), so this is the\n  // enqueue time \u2014 not the provider send time \u2014 and the provider's external\n  // message id is not known yet (the worker assigns it on successful delivery).\n  return NextResponse.json({\n    messageId: sendResult.messageId,\n    threadId: sendResult.threadId,\n    queuedAt: new Date().toISOString(),\n  })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    POST: {\n      summary: 'Compose + send an email anchored to a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email queued for send' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.email.compose feature or mutation guard rejection' },\n        { status: 404, description: 'Person or channel not found' },\n        { status: 409, description: 'Channel not connected' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Send failed' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAGxB,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,yBAAyB;AAAA,EAC7C;AACF;AAEA,MAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC7C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACjD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAClD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA,EACnD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC9C,CAAC,EACA,OAAO;AAMV,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,cAAc,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,SAAS,mBAAmB,IAAI;AACtC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAO3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EAC9G;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAOA,QAAM,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,QAAQ,KAAK,KAAe,UAAU,KAAK,UAAoB,gBAAgB,KAAK;AAAA,IACtF;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,IAAI,KAAK;AAAA,MACT,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,MAAM,KAAK,eAAe,SAAS,EAAE,MAAM,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,KAAK;AAAA,MAC5E,WAAW,KAAK;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,iBAAiB,KAAK;AAAA,MACtB,iBAAiB;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,MAAM,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAKA,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,8BAA8B;AAAA,QAC1D,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  validateCrudMutationGuard,\n  runCrudMutationGuardAfterSuccess,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveAuthActorId } from '../../../../lib/interactionRequestContext'\nimport { CustomerEntity } from '../../../../data/entities'\nimport { listGrantsForViewerOnPerson, listSharedChannelIds } from '../../../../lib/conversationShares'\nimport { isMessageOnPersonEmailHistory } from '../../../../lib/personEmailThreads'\nimport type { SendAsUserService } from '@open-mercato/core/modules/communication_channels/lib/send-as-user'\n\nexport const metadata = {\n  path: '/customers/people/[id]/emails',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['customers.email.compose'],\n  },\n}\n\nconst composeSchema = z\n  .object({\n    userChannelId: z.string().uuid(),\n    to: z.array(z.string().email()).min(1).max(50),\n    cc: z.array(z.string().email()).max(50).optional(),\n    bcc: z.array(z.string().email()).max(50).optional(),\n    subject: z.string().min(1).max(500),\n    body: z.string().min(1).max(200_000),\n    bodyFormat: z.enum(['text', 'html']).default('html'),\n    visibility: z.enum(['private', 'shared']).default('private'),\n    inReplyTo: z.string().max(500).optional(),\n    references: z.array(z.string().max(500)).max(50).optional(),\n    parentMessageId: z.string().uuid().optional(),\n  })\n  .strict()\n\ntype RbacService = {\n  userHasAllFeatures: (\n    userId: string,\n    required: string[],\n    scope: { tenantId: string | null; organizationId: string | null },\n  ) => Promise<boolean>\n}\n\nasync function callerHasFeature(\n  container: { resolve: (name: string) => unknown },\n  userId: string,\n  feature: string,\n  scope: { tenantId: string; organizationId: string | null },\n): Promise<boolean> {\n  try {\n    const rbac = container.resolve('rbacService') as RbacService | undefined\n    if (typeof rbac?.userHasAllFeatures !== 'function') return false\n    return await rbac.userHasAllFeatures(userId, [feature], scope)\n  } catch {\n    return false\n  }\n}\n\ntype RouteContext = {\n  params: Promise<{ id: string }> | { id: string }\n}\n\nexport async function POST(req: Request, context: RouteContext): Promise<Response> {\n  const { id: personId } = await context.params\n  if (!z.string().uuid().safeParse(personId).success) {\n    return NextResponse.json({ error: 'Invalid person id' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof composeSchema>\n  try {\n    body = composeSchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  const userId = resolveAuthActorId(auth)\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  // 1. Verify the Person exists in the caller's tenant, then fail-closed on the\n  //    record's own organization \u2014 same pattern as the [id]/route.ts GET handler.\n  //    Loading by tenant + id (not a hand-rolled selected org) keeps this working\n  //    under the \"All organizations\" scope; the record's own org then becomes the\n  //    concrete org the guard and the outbound message are attributed to.\n  const person = await findOneWithDecryption(\n    em,\n    CustomerEntity,\n    {\n      id: personId,\n      kind: 'person',\n      tenantId: auth.tenantId,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId: auth.tenantId as string, organizationId: resolveSingleOrganizationIdOrDeny(scope, auth) ?? null },\n  )\n  if (!person) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n  const organizationId = (person as { organizationId?: string | null }).organizationId ?? null\n  if (!isOrganizationReadAccessAllowed({ scope, auth, organizationId })) {\n    return NextResponse.json({ error: 'Person not found' }, { status: 404 })\n  }\n\n  // A reply parent decides which thread the sent email joins, so it must be an\n  // email this caller could see on this Person's Emails tab \u2014 the same feature,\n  // anchor and visibility rule as `GET .../email-threads`, including conversation\n  // shares and shared team mailboxes. Anything else answers like an unknown id.\n  if (body.parentMessageId) {\n    const viewerUserId = auth.isApiKey ? null : auth.sub ?? null\n    const shareScope = { tenantId: auth.tenantId as string, organizationId }\n    const canViewPeople = await callerHasFeature(container, userId, 'customers.people.view', shareScope)\n    const [sharedConversations, sharedChannelIds] = canViewPeople\n      ? await Promise.all([\n          listGrantsForViewerOnPerson(em, shareScope, viewerUserId, personId),\n          listSharedChannelIds(em, shareScope, viewerUserId),\n        ])\n      : [[], []]\n    const parentVisible =\n      canViewPeople &&\n      (await isMessageOnPersonEmailHistory(em, {\n        personId,\n        tenantId: auth.tenantId as string,\n        organizationId,\n        viewerUserId,\n        userFeatures: undefined,\n        sharedConversations,\n        sharedChannelIds,\n        messageId: body.parentMessageId,\n      }))\n    if (!parentVisible) {\n      const { translate } = await resolveTranslations()\n      return NextResponse.json(\n        {\n          error: translate(\n            'customers.email.errors.parentMessageNotFound',\n            'The email you are replying to was not found',\n          ),\n        },\n        { status: 404 },\n      )\n    }\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: auth.tenantId,\n    organizationId,\n    userId,\n    resourceKind: 'customers.person',\n    resourceId: personId,\n    operation: 'custom',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  // 2. Call the hub's send-as-user facade in-process (resolved via DI) so the\n  //    customers module makes no HTTP self-call. `crmVisibility` and `crmPersonId`\n  //    are injected as channelMetadata so the link-channel-message subscriber can\n  //    anchor the sent message back to this Person on the\n  //    `communication_channels.message.sent` event.\n  const sendAsUserService = container.resolve(\n    'communicationChannelsSendAsUser',\n  ) as SendAsUserService\n\n  const sendResult = await sendAsUserService(\n    container,\n    { userId: auth.sub as string, tenantId: auth.tenantId as string, organizationId, auth },\n    {\n      userChannelId: body.userChannelId,\n      to: body.to,\n      cc: body.cc,\n      bcc: body.bcc,\n      subject: body.subject,\n      body: body.bodyFormat === 'html' ? { html: body.body } : { plain: body.body },\n      inReplyTo: body.inReplyTo,\n      references: body.references,\n      parentMessageId: body.parentMessageId,\n      channelMetadata: {\n        crmVisibility: body.visibility,\n        crmPersonId: personId,\n      },\n    },\n  )\n\n  if (!sendResult.ok) {\n    return NextResponse.json({ error: sendResult.error }, { status: sendResult.status })\n  }\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: auth.tenantId,\n      organizationId,\n      userId,\n      resourceKind: 'customers.person',\n      resourceId: personId,\n      operation: 'custom',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  // Delivery is async (handled by the outbound queue worker), so this is the\n  // enqueue time \u2014 not the provider send time \u2014 and the provider's external\n  // message id is not known yet (the worker assigns it on successful delivery).\n  return NextResponse.json({\n    messageId: sendResult.messageId,\n    threadId: sendResult.threadId,\n    queuedAt: new Date().toISOString(),\n  })\n}\n\nexport const openApi = {\n  tags: ['Customers', 'Email'],\n  methods: {\n    POST: {\n      summary: 'Compose + send an email anchored to a Person',\n      tags: ['Customers', 'Email'],\n      responses: [\n        { status: 200, description: 'Email queued for send' },\n        { status: 400, description: 'Invalid person id' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 403, description: 'Missing customers.email.compose feature or mutation guard rejection' },\n        { status: 404, description: 'Person or channel not found, or the reply parent is not an email the caller can see on this Person' },\n        { status: 409, description: 'Channel not connected' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Send failed' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,uCAAuC;AAChD,SAAS,2BAA2B;AACpC,SAAS,0BAA0B;AACnC,SAAS,sBAAsB;AAC/B,SAAS,6BAA6B,4BAA4B;AAClE,SAAS,qCAAqC;AAGvC,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,yBAAyB;AAAA,EAC7C;AACF;AAEA,MAAM,gBAAgB,EACnB,OAAO;AAAA,EACN,eAAe,EAAE,OAAO,EAAE,KAAK;AAAA,EAC/B,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE;AAAA,EAC7C,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EACjD,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAClD,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAClC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAO;AAAA,EACnC,YAAY,EAAE,KAAK,CAAC,QAAQ,MAAM,CAAC,EAAE,QAAQ,MAAM;AAAA,EACnD,YAAY,EAAE,KAAK,CAAC,WAAW,QAAQ,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC3D,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC9C,CAAC,EACA,OAAO;AAUV,eAAe,iBACb,WACA,QACA,SACA,OACkB;AAClB,MAAI;AACF,UAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAI,OAAO,MAAM,uBAAuB,WAAY,QAAO;AAC3D,WAAO,MAAM,KAAK,mBAAmB,QAAQ,CAAC,OAAO,GAAG,KAAK;AAAA,EAC/D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,eAAsB,KAAK,KAAc,SAA0C;AACjF,QAAM,EAAE,IAAI,SAAS,IAAI,MAAM,QAAQ;AACvC,MAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,QAAQ,EAAE,SAAS;AAClD,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,cAAc,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EAC1D,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,SAAS,mBAAmB,IAAI;AACtC,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAExF,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAO3D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,MAAM;AAAA,MACN,UAAU,KAAK;AAAA,MACf,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAoB,gBAAgB,kCAAkC,OAAO,IAAI,KAAK,KAAK;AAAA,EAC9G;AACA,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AACA,QAAM,iBAAkB,OAA8C,kBAAkB;AACxF,MAAI,CAAC,gCAAgC,EAAE,OAAO,MAAM,eAAe,CAAC,GAAG;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAMA,MAAI,KAAK,iBAAiB;AACxB,UAAM,eAAe,KAAK,WAAW,OAAO,KAAK,OAAO;AACxD,UAAM,aAAa,EAAE,UAAU,KAAK,UAAoB,eAAe;AACvE,UAAM,gBAAgB,MAAM,iBAAiB,WAAW,QAAQ,yBAAyB,UAAU;AACnG,UAAM,CAAC,qBAAqB,gBAAgB,IAAI,gBAC5C,MAAM,QAAQ,IAAI;AAAA,MAChB,4BAA4B,IAAI,YAAY,cAAc,QAAQ;AAAA,MAClE,qBAAqB,IAAI,YAAY,YAAY;AAAA,IACnD,CAAC,IACD,CAAC,CAAC,GAAG,CAAC,CAAC;AACX,UAAM,gBACJ,iBACC,MAAM,8BAA8B,IAAI;AAAA,MACvC;AAAA,MACA,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd;AAAA,MACA;AAAA,MACA,WAAW,KAAK;AAAA,IAClB,CAAC;AACH,QAAI,CAAC,eAAe;AAClB,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAOA,QAAM,oBAAoB,UAAU;AAAA,IAClC;AAAA,EACF;AAEA,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA,EAAE,QAAQ,KAAK,KAAe,UAAU,KAAK,UAAoB,gBAAgB,KAAK;AAAA,IACtF;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,IAAI,KAAK;AAAA,MACT,IAAI,KAAK;AAAA,MACT,KAAK,KAAK;AAAA,MACV,SAAS,KAAK;AAAA,MACd,MAAM,KAAK,eAAe,SAAS,EAAE,MAAM,KAAK,KAAK,IAAI,EAAE,OAAO,KAAK,KAAK;AAAA,MAC5E,WAAW,KAAK;AAAA,MAChB,YAAY,KAAK;AAAA,MACjB,iBAAiB,KAAK;AAAA,MACtB,iBAAiB;AAAA,QACf,eAAe,KAAK;AAAA,QACpB,aAAa;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,WAAW,IAAI;AAClB,WAAO,aAAa,KAAK,EAAE,OAAO,WAAW,MAAM,GAAG,EAAE,QAAQ,WAAW,OAAO,CAAC;AAAA,EACrF;AAEA,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,KAAK;AAAA,MACf;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAKA,SAAO,aAAa,KAAK;AAAA,IACvB,WAAW,WAAW;AAAA,IACtB,UAAU,WAAW;AAAA,IACrB,WAAU,oBAAI,KAAK,GAAE,YAAY;AAAA,EACnC,CAAC;AACH;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,aAAa,OAAO;AAAA,EAC3B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,aAAa,OAAO;AAAA,MAC3B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,sEAAsE;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,qGAAqG;AAAA,QACjI,EAAE,QAAQ,KAAK,aAAa,wBAAwB;AAAA,QACpD,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
   "names": []
 }

package/dist/modules/customers/lib/personEmailThreads.js

@@ -220,7 +220,42 @@ async function buildPersonEmailThreads(em, opts) {
   threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt));
   return threads.slice(0, maxThreads);
 }
+async function isMessageOnPersonEmailHistory(em, opts) {
+  const { personId, tenantId, organizationId, messageId } = opts;
+  const dscope = { tenantId, organizationId: organizationId ?? null };
+  const linkWhere = { messageId, tenantId };
+  if (organizationId) linkWhere.organizationId = organizationId;
+  const links = await findWithDecryption(
+    em,
+    "MessageChannelLink",
+    linkWhere,
+    void 0,
+    dscope
+  );
+  const linkIds = links.map((link) => typeof link.id === "string" ? link.id : null).filter((value) => !!value);
+  if (linkIds.length === 0) return false;
+  const interactionWhere = {
+    entity: personId,
+    interactionType: "email",
+    deletedAt: null,
+    tenantId,
+    externalMessageId: { $in: linkIds }
+  };
+  if (organizationId) interactionWhere.organizationId = organizationId;
+  Object.assign(
+    interactionWhere,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: opts.viewerUserId,
+      userFeatures: opts.userFeatures,
+      sharedConversations: opts.sharedConversations,
+      sharedChannelIds: opts.sharedChannelIds
+    })
+  );
+  const visible = await em.count(CustomerInteraction, interactionWhere);
+  return visible > 0;
+}
 export {
-  buildPersonEmailThreads
+  buildPersonEmailThreads,
+  isMessageOnPersonEmailHistory
 };
 //# sourceMappingURL=personEmailThreads.js.map

package/dist/modules/customers/lib/personEmailThreads.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customers/lib/personEmailThreads.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerInteraction } from '../data/entities'\nimport { resolveUserNames } from './userNames'\nimport { buildEmailVisibilityMikroFilter } from './visibilityFilter'\nimport type { ConversationShareGrant } from './conversationShares'\n\n/**\n * Read model that turns a Person's email `CustomerInteraction` rows into\n * Gmail-style threads for the CRM Person page.\n *\n * The Person\u2194email anchor lives only on `CustomerInteraction`\n * (`interactionType='email'`, `externalMessageId` \u2192 `MessageChannelLink.id`).\n * The thread grouping key and the rich per-message content (From/To/Cc, body,\n * direction) live in the communication_channels hub. We read the hub entities\n * by their string class names \u2014 the same cross-module pattern used by\n * `link-channel-message-handler.ts` \u2014 so the customers module never imports the\n * hub's entity classes (root AGENTS.md: no direct ORM relationships between\n * modules).\n */\n\nexport type EmailThreadDirection = 'inbound' | 'outbound'\n\nexport type PersonEmailMessage = {\n  id: string\n  /** Open Mercato `messages.message` id \u2014 used as `parentMessageId` when replying so the reply joins this thread. */\n  messageId: string | null\n  /** RFC2822 Message-ID of this email \u2014 used as `In-Reply-To` on a reply. */\n  rfcMessageId: string | null\n  /** RFC2822 References chain for this email. */\n  references: string[]\n  direction: EmailThreadDirection\n  fromName: string | null\n  fromEmail: string | null\n  /**\n   * True when the viewer is the author of this message. Outbound email carries\n   * no `from` header in `channelMetadata`, so the sender label cannot be derived\n   * from the addresses \u2014 and since conversation/channel sharing lets a teammate\n   * read someone else's outbound mail, direction alone is not the author either.\n   */\n  authoredByViewer: boolean\n  /** Display label of the sending colleague; null for the viewer's own mail and for inbound. */\n  authorName: string | null\n  to: string[]\n  cc: string[]\n  subject: string | null\n  bodyText: string | null\n  sentAt: string\n  providerKey: string | null\n}\n\nexport type PersonEmailThread = {\n  threadKey: string\n  subject: string | null\n  preview: string | null\n  participants: string[]\n  lastMessageAt: string\n  messageCount: number\n  providerKey: string | null\n  lastDirection: EmailThreadDirection\n  messages: PersonEmailMessage[]\n}\n\nexport type BuildPersonEmailThreadsOptions = {\n  personId: string\n  tenantId: string\n  organizationId: string | null\n  viewerUserId: string | null\n  userFeatures: string[] | null | undefined\n  /**\n   * Conversation shares that widen this viewer's access. Optional and fail-closed:\n   * omitting it yields the strict owner-only view.\n   */\n  sharedConversations?: ConversationShareGrant[]\n  /** Channels marked as shared team mailboxes; optional and fail-closed. */\n  sharedChannelIds?: string[]\n  maxThreads?: number\n  maxMessagesPerThread?: number\n}\n\nconst DEFAULT_MAX_THREADS = 50\nconst DEFAULT_MAX_MESSAGES_PER_THREAD = 200\nconst PREVIEW_LENGTH = 140\n\ntype JsonRecord = Record<string, unknown>\n\n/** Extracts `{ email, name }[]` from the many shapes a channel address field can take. */\nfunction extractAddresses(value: unknown): Array<{ email: string; name: string | null }> {\n  const out: Array<{ email: string; name: string | null }> = []\n  const pushOne = (item: unknown): void => {\n    if (typeof item === 'string') {\n      const trimmed = item.trim()\n      if (trimmed) out.push({ email: trimmed, name: null })\n      return\n    }\n    if (item && typeof item === 'object') {\n      const rec = item as JsonRecord\n      const address = typeof rec.address === 'string' ? rec.address.trim() : null\n      const name = typeof rec.name === 'string' && rec.name.trim() ? rec.name.trim() : null\n      if (address) out.push({ email: address, name })\n    }\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) pushOne(item)\n  } else {\n    pushOne(value)\n  }\n  return out\n}\n\nfunction firstString(...values: unknown[]): string | null {\n  for (const value of values) {\n    if (typeof value === 'string' && value.trim().length > 0) return value\n  }\n  return null\n}\n\nfunction toStringArray(...values: unknown[]): string[] {\n  for (const value of values) {\n    if (Array.isArray(value)) {\n      const strings = value.filter((item): item is string => typeof item === 'string' && item.trim().length > 0)\n      if (strings.length > 0) return strings\n    }\n  }\n  return []\n}\n\nfunction truncate(value: string | null): string | null {\n  if (!value) return value\n  const collapsed = value.replace(/\\s+/g, ' ').trim()\n  if (collapsed.length <= PREVIEW_LENGTH) return collapsed\n  return `${collapsed.slice(0, PREVIEW_LENGTH - 1)}\u2026`\n}\n\n/**\n * Builds the per-Person email-thread read model. Pure data assembly \u2014 callers\n * are responsible for auth and scoping (tenantId/organizationId required).\n */\nexport async function buildPersonEmailThreads(\n  em: EntityManager,\n  opts: BuildPersonEmailThreadsOptions,\n): Promise<PersonEmailThread[]> {\n  const {\n    personId,\n    tenantId,\n    organizationId,\n    viewerUserId,\n    userFeatures,\n    sharedConversations,\n    sharedChannelIds,\n    maxThreads = DEFAULT_MAX_THREADS,\n    maxMessagesPerThread = DEFAULT_MAX_MESSAGES_PER_THREAD,\n  } = opts\n\n  // \u2500\u2500 (1) Load the Person's email interactions (the Person\u2194email anchor) \u2500\u2500\n  const interactionWhere: JsonRecord = {\n    entity: personId,\n    interactionType: 'email',\n    deletedAt: null,\n    tenantId,\n  }\n  if (organizationId) interactionWhere.organizationId = organizationId\n\n  // Per-email visibility (v1: strict owner-only, no admin bypass) \u2014 the CRM\n  // Person page applies the SAME rule as every other interactions read path via\n  // `buildEmailVisibilityMikroFilter`, so the Emails tab and the `/interactions`\n  // timeline can never disagree about who sees an email:\n  //   - `visibility = 'shared'` is visible to every user with CRM access to this\n  //     Person (lets a teammate pick up a handed-off thread),\n  //   - `visibility = 'private'` is visible ONLY to its author (the mailbox\n  //     owner) \u2014 never to teammates, not even an admin/superadmin (team\n  //     oversight is a deliberate v2 follow-up),\n  //   - legacy/unset rows (`visibility IS NULL`) stay visible so pre-existing\n  //     CRM history is never silently hidden.\n  // Fail-closed: a null viewer (API-key caller) never matches the author arm, so\n  // it only ever sees shared/legacy rows \u2014 never anyone's private email.\n  // Merge the WHOLE fragment. Cherry-picking `.$or` here would silently discard\n  // any other arm the predicate grows, which fails OPEN at a compile-clean call\n  // site \u2014 the exact hazard the fragment contract now documents.\n  Object.assign(\n    interactionWhere,\n    buildEmailVisibilityMikroFilter({\n      currentUserId: viewerUserId,\n      userFeatures,\n      sharedConversations,\n      sharedChannelIds,\n    }),\n  )\n\n  // `customer_interaction.title`/`body` are encrypted at rest, so reads go\n  // through `findWithDecryption` even though we only consume non-encrypted\n  // columns here \u2014 this keeps the encrypted-entity contract intact.\n  const dscope = { tenantId, organizationId: organizationId ?? null }\n  const interactions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    interactionWhere as never,\n    { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: maxThreads * 20 },\n    dscope,\n  )) as CustomerInteraction[]\n\n  const linkIdByInteraction = new Map<string, { occurredAt: Date; authorUserId: string | null }>()\n  const linkIds: string[] = []\n  for (const interaction of interactions) {\n    const linkId = interaction.externalMessageId\n    if (!linkId || linkIdByInteraction.has(linkId)) continue\n    linkIdByInteraction.set(linkId, {\n      occurredAt: interaction.occurredAt ?? interaction.createdAt,\n      authorUserId: interaction.authorUserId ?? null,\n    })\n    linkIds.push(linkId)\n  }\n  if (linkIds.length === 0) return []\n\n  // \u2500\u2500 (2) Resolve MessageChannelLink rows (rich content + direction) \u2500\u2500\u2500\u2500\u2500\u2500\n  const linkWhere: JsonRecord = { id: { $in: linkIds }, tenantId }\n  if (organizationId) linkWhere.organizationId = organizationId\n  const links = (await findWithDecryption(\n    em,\n    'MessageChannelLink' as never,\n    linkWhere as never,\n    undefined,\n    dscope,\n  )) as JsonRecord[]\n\n  // \u2500\u2500 (3) Resolve hub Message rows (the authoritative thread grouping) \u2500\u2500\u2500\u2500\n  const messageIds = Array.from(\n    new Set(\n      links\n        .map((link) => (typeof link.messageId === 'string' ? (link.messageId as string) : null))\n        .filter((value): value is string => !!value),\n    ),\n  )\n  const messageById = new Map<string, JsonRecord>()\n  if (messageIds.length > 0) {\n    const messageWhere: JsonRecord = { id: { $in: messageIds }, tenantId }\n    if (organizationId) messageWhere.organizationId = organizationId\n    const messages = (await findWithDecryption(\n      em,\n      'Message' as never,\n      messageWhere as never,\n      undefined,\n      dscope,\n    )) as JsonRecord[]\n    for (const message of messages) {\n      if (typeof message.id === 'string') messageById.set(message.id, message)\n    }\n  }\n\n  // \u2500\u2500 (3b) Resolve sender labels for colleagues' messages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // Only for authors other than the viewer: their own mail renders as \"You\" and\n  // needs no lookup. A shared conversation is exactly the case where a message\n  // the viewer did not write shows up in their thread list, so without this the\n  // UI would have to fall back on direction and misattribute it to the reader.\n  const foreignAuthorIds = Array.from(\n    new Set(\n      Array.from(linkIdByInteraction.values())\n        .map((entry) => entry.authorUserId)\n        .filter((id): id is string => !!id && id !== viewerUserId),\n    ),\n  )\n  const authorNames = foreignAuthorIds.length\n    ? await resolveUserNames(em, tenantId, organizationId, foreignAuthorIds)\n    : new Map<string, string>()\n\n  // \u2500\u2500 (4) Build per-message DTOs grouped by thread \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threadsByKey = new Map<string, PersonEmailThread>()\n\n  for (const link of links) {\n    const linkId = typeof link.id === 'string' ? (link.id as string) : null\n    if (!linkId) continue\n    const direction: EmailThreadDirection = link.direction === 'outbound' ? 'outbound' : 'inbound'\n    // `authorUserId` on the interaction is the MAILBOX OWNER, which on an\n    // inbound message is the recipient, not the sender \u2014 so authorship is an\n    // outbound-only notion. Inbound senders are named by the `from` header.\n    const authorUserId = direction === 'outbound' ? linkIdByInteraction.get(linkId)?.authorUserId ?? null : null\n    const authoredByViewer = !!viewerUserId && !!authorUserId && authorUserId === viewerUserId\n    const providerKey = typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n    const payload = (link.channelPayload ?? null) as JsonRecord | null\n    const meta = (link.channelMetadata ?? null) as JsonRecord | null\n    const messageId = typeof link.messageId === 'string' ? (link.messageId as string) : null\n    const message = messageId ? messageById.get(messageId) ?? null : null\n\n    // Outbound addresses live in channelMetadata; inbound in channelPayload.\n    // Prefer the direction-appropriate source, fall back to the other.\n    const primary = direction === 'outbound' ? meta : payload\n    const secondary = direction === 'outbound' ? payload : meta\n    const fromList = extractAddresses(primary?.from ?? secondary?.from)\n    const toList = extractAddresses(primary?.to ?? secondary?.to)\n    const ccList = extractAddresses(primary?.cc ?? secondary?.cc)\n\n    const subject = firstString(\n      primary?.subject,\n      secondary?.subject,\n      typeof message?.subject === 'string' ? message.subject : null,\n    )\n    const bodyText = firstString(\n      direction === 'outbound' ? meta?.bodyText : payload?.text,\n      direction === 'outbound' ? payload?.text : meta?.bodyText,\n      typeof message?.body === 'string' ? message.body : null,\n    )\n\n    const sentAtRaw =\n      (typeof message?.sentAt === 'string' || message?.sentAt instanceof Date\n        ? message.sentAt\n        : null) ??\n      (link.createdAt instanceof Date || typeof link.createdAt === 'string' ? link.createdAt : null) ??\n      linkIdByInteraction.get(linkId)?.occurredAt ??\n      new Date()\n    const sentAt = (sentAtRaw instanceof Date ? sentAtRaw : new Date(sentAtRaw)).toISOString()\n\n    const threadKey =\n      (typeof message?.threadId === 'string' && message.threadId ? message.threadId : null) ??\n      (messageId ? `message:${messageId}` : `link:${linkId}`)\n\n    const dto: PersonEmailMessage = {\n      id: linkId,\n      messageId,\n      rfcMessageId: firstString(primary?.messageId, secondary?.messageId),\n      references: toStringArray(primary?.references, secondary?.references),\n      direction,\n      fromName: fromList[0]?.name ?? null,\n      fromEmail: fromList[0]?.email ?? null,\n      authoredByViewer,\n      authorName: authoredByViewer ? null : authorUserId ? authorNames.get(authorUserId) ?? null : null,\n      to: toList.map((a) => a.email),\n      cc: ccList.map((a) => a.email),\n      subject,\n      bodyText,\n      sentAt,\n      providerKey,\n    }\n\n    const existing = threadsByKey.get(threadKey)\n    if (existing) {\n      existing.messages.push(dto)\n    } else {\n      threadsByKey.set(threadKey, {\n        threadKey,\n        subject,\n        preview: null,\n        participants: [],\n        lastMessageAt: sentAt,\n        messageCount: 0,\n        providerKey,\n        lastDirection: direction,\n        messages: [dto],\n      })\n    }\n  }\n\n  // \u2500\u2500 (5) Finalize thread summaries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threads: PersonEmailThread[] = []\n  for (const thread of threadsByKey.values()) {\n    thread.messages.sort((a, b) => a.sentAt.localeCompare(b.sentAt))\n    if (thread.messages.length > maxMessagesPerThread) {\n      thread.messages = thread.messages.slice(thread.messages.length - maxMessagesPerThread)\n    }\n    const last = thread.messages[thread.messages.length - 1]\n    const firstWithSubject = thread.messages.find((m) => m.subject)\n    const participantSet = new Set<string>()\n    for (const message of thread.messages) {\n      // External counterpart = the \"from\" for inbound, the \"to\" for outbound.\n      if (message.direction === 'inbound' && message.fromEmail) participantSet.add(message.fromEmail)\n      if (message.direction === 'outbound') message.to.forEach((email) => participantSet.add(email))\n    }\n    thread.subject = firstWithSubject?.subject ?? thread.subject\n    thread.preview = truncate(last?.bodyText ?? null)\n    thread.participants = Array.from(participantSet)\n    thread.lastMessageAt = last?.sentAt ?? thread.lastMessageAt\n    thread.lastDirection = last?.direction ?? thread.lastDirection\n    thread.providerKey = last?.providerKey ?? thread.providerKey\n    thread.messageCount = thread.messages.length\n    threads.push(thread)\n  }\n\n  threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))\n  return threads.slice(0, maxThreads)\n}\n"],
-  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AACjC,SAAS,uCAAuC;AA4EhD,MAAM,sBAAsB;AAC5B,MAAM,kCAAkC;AACxC,MAAM,iBAAiB;AAKvB,SAAS,iBAAiB,OAA+D;AACvF,QAAM,MAAqD,CAAC;AAC5D,QAAM,UAAU,CAAC,SAAwB;AACvC,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,MAAM,KAAK,CAAC;AACpD;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,YAAM,MAAM;AACZ,YAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,IAAI;AACvE,YAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;AACjF,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,KAAK,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,SAAQ,IAAI;AAAA,EACxC,OAAO;AACL,YAAQ,KAAK;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA6B;AACrD,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,UAAU,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AACzG,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,SAAS,OAAqC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAClD,MAAI,UAAU,UAAU,eAAgB,QAAO;AAC/C,SAAO,GAAG,UAAU,MAAM,GAAG,iBAAiB,CAAC,CAAC;AAClD;AAMA,eAAsB,wBACpB,IACA,MAC8B;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,uBAAuB;AAAA,EACzB,IAAI;AAGJ,QAAM,mBAA+B;AAAA,IACnC,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,EACF;AACA,MAAI,eAAgB,kBAAiB,iBAAiB;AAkBtD,SAAO;AAAA,IACL;AAAA,IACA,gCAAgC;AAAA,MAC9B,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,EAAE,UAAU,gBAAgB,kBAAkB,KAAK;AAClE,QAAM,eAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,SAAS,EAAE,YAAY,QAAQ,WAAW,OAAO,GAAG,OAAO,aAAa,GAAG;AAAA,IAC7E;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAA+D;AAC/F,QAAM,UAAoB,CAAC;AAC3B,aAAW,eAAe,cAAc;AACtC,UAAM,SAAS,YAAY;AAC3B,QAAI,CAAC,UAAU,oBAAoB,IAAI,MAAM,EAAG;AAChD,wBAAoB,IAAI,QAAQ;AAAA,MAC9B,YAAY,YAAY,cAAc,YAAY;AAAA,MAClD,cAAc,YAAY,gBAAgB;AAAA,IAC5C,CAAC;AACD,YAAQ,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAwB,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,SAAS;AAC/D,MAAI,eAAgB,WAAU,iBAAiB;AAC/C,QAAM,QAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,QAAM,aAAa,MAAM;AAAA,IACvB,IAAI;AAAA,MACF,MACG,IAAI,CAAC,SAAU,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB,IAAK,EACtF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,eAA2B,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,SAAS;AACrE,QAAI,eAAgB,cAAa,iBAAiB;AAClD,UAAM,WAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,QAAQ,OAAO,SAAU,aAAY,IAAI,QAAQ,IAAI,OAAO;AAAA,IACzE;AAAA,EACF;AAQA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,KAAK,oBAAoB,OAAO,CAAC,EACpC,IAAI,CAAC,UAAU,MAAM,YAAY,EACjC,OAAO,CAAC,OAAqB,CAAC,CAAC,MAAM,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,cAAc,iBAAiB,SACjC,MAAM,iBAAiB,IAAI,UAAU,gBAAgB,gBAAgB,IACrE,oBAAI,IAAoB;AAG5B,QAAM,eAAe,oBAAI,IAA+B;AAExD,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,OAAO,WAAY,KAAK,KAAgB;AACnE,QAAI,CAAC,OAAQ;AACb,UAAM,YAAkC,KAAK,cAAc,aAAa,aAAa;AAIrF,UAAM,eAAe,cAAc,aAAa,oBAAoB,IAAI,MAAM,GAAG,gBAAgB,OAAO;AACxG,UAAM,mBAAmB,CAAC,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,iBAAiB;AAC9E,UAAM,cAAc,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAC1F,UAAM,UAAW,KAAK,kBAAkB;AACxC,UAAM,OAAQ,KAAK,mBAAmB;AACtC,UAAM,YAAY,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB;AACpF,UAAM,UAAU,YAAY,YAAY,IAAI,SAAS,KAAK,OAAO;AAIjE,UAAM,UAAU,cAAc,aAAa,OAAO;AAClD,UAAM,YAAY,cAAc,aAAa,UAAU;AACvD,UAAM,WAAW,iBAAiB,SAAS,QAAQ,WAAW,IAAI;AAClE,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAC5D,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAE5D,UAAM,UAAU;AAAA,MACd,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,SAAS,YAAY,WAAW,QAAQ,UAAU;AAAA,IAC3D;AACA,UAAM,WAAW;AAAA,MACf,cAAc,aAAa,MAAM,WAAW,SAAS;AAAA,MACrD,cAAc,aAAa,SAAS,OAAO,MAAM;AAAA,MACjD,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,IACrD;AAEA,UAAM,aACH,OAAO,SAAS,WAAW,YAAY,SAAS,kBAAkB,OAC/D,QAAQ,SACR,UACH,KAAK,qBAAqB,QAAQ,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,SACzF,oBAAoB,IAAI,MAAM,GAAG,cACjC,oBAAI,KAAK;AACX,UAAM,UAAU,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS,GAAG,YAAY;AAEzF,UAAM,aACH,OAAO,SAAS,aAAa,YAAY,QAAQ,WAAW,QAAQ,WAAW,UAC/E,YAAY,WAAW,SAAS,KAAK,QAAQ,MAAM;AAEtD,UAAM,MAA0B;AAAA,MAC9B,IAAI;AAAA,MACJ;AAAA,MACA,cAAc,YAAY,SAAS,WAAW,WAAW,SAAS;AAAA,MAClE,YAAY,cAAc,SAAS,YAAY,WAAW,UAAU;AAAA,MACpE;AAAA,MACA,UAAU,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC/B,WAAW,SAAS,CAAC,GAAG,SAAS;AAAA,MACjC;AAAA,MACA,YAAY,mBAAmB,OAAO,eAAe,YAAY,IAAI,YAAY,KAAK,OAAO;AAAA,MAC7F,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,IAAI,SAAS;AAC3C,QAAI,UAAU;AACZ,eAAS,SAAS,KAAK,GAAG;AAAA,IAC5B,OAAO;AACL,mBAAa,IAAI,WAAW;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,cAAc,CAAC;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd;AAAA,QACA,eAAe;AAAA,QACf,UAAU,CAAC,GAAG;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,UAA+B,CAAC;AACtC,aAAW,UAAU,aAAa,OAAO,GAAG;AAC1C,WAAO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAC/D,QAAI,OAAO,SAAS,SAAS,sBAAsB;AACjD,aAAO,WAAW,OAAO,SAAS,MAAM,OAAO,SAAS,SAAS,oBAAoB;AAAA,IACvF;AACA,UAAM,OAAO,OAAO,SAAS,OAAO,SAAS,SAAS,CAAC;AACvD,UAAM,mBAAmB,OAAO,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AAC9D,UAAM,iBAAiB,oBAAI,IAAY;AACvC,eAAW,WAAW,OAAO,UAAU;AAErC,UAAI,QAAQ,cAAc,aAAa,QAAQ,UAAW,gBAAe,IAAI,QAAQ,SAAS;AAC9F,UAAI,QAAQ,cAAc,WAAY,SAAQ,GAAG,QAAQ,CAAC,UAAU,eAAe,IAAI,KAAK,CAAC;AAAA,IAC/F;AACA,WAAO,UAAU,kBAAkB,WAAW,OAAO;AACrD,WAAO,UAAU,SAAS,MAAM,YAAY,IAAI;AAChD,WAAO,eAAe,MAAM,KAAK,cAAc;AAC/C,WAAO,gBAAgB,MAAM,UAAU,OAAO;AAC9C,WAAO,gBAAgB,MAAM,aAAa,OAAO;AACjD,WAAO,cAAc,MAAM,eAAe,OAAO;AACjD,WAAO,eAAe,OAAO,SAAS;AACtC,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,cAAc,EAAE,aAAa,CAAC;AACrE,SAAO,QAAQ,MAAM,GAAG,UAAU;AACpC;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CustomerInteraction } from '../data/entities'\nimport { resolveUserNames } from './userNames'\nimport { buildEmailVisibilityMikroFilter } from './visibilityFilter'\nimport type { ConversationShareGrant } from './conversationShares'\n\n/**\n * Read model that turns a Person's email `CustomerInteraction` rows into\n * Gmail-style threads for the CRM Person page.\n *\n * The Person\u2194email anchor lives only on `CustomerInteraction`\n * (`interactionType='email'`, `externalMessageId` \u2192 `MessageChannelLink.id`).\n * The thread grouping key and the rich per-message content (From/To/Cc, body,\n * direction) live in the communication_channels hub. We read the hub entities\n * by their string class names \u2014 the same cross-module pattern used by\n * `link-channel-message-handler.ts` \u2014 so the customers module never imports the\n * hub's entity classes (root AGENTS.md: no direct ORM relationships between\n * modules).\n */\n\nexport type EmailThreadDirection = 'inbound' | 'outbound'\n\nexport type PersonEmailMessage = {\n  id: string\n  /** Open Mercato `messages.message` id \u2014 used as `parentMessageId` when replying so the reply joins this thread. */\n  messageId: string | null\n  /** RFC2822 Message-ID of this email \u2014 used as `In-Reply-To` on a reply. */\n  rfcMessageId: string | null\n  /** RFC2822 References chain for this email. */\n  references: string[]\n  direction: EmailThreadDirection\n  fromName: string | null\n  fromEmail: string | null\n  /**\n   * True when the viewer is the author of this message. Outbound email carries\n   * no `from` header in `channelMetadata`, so the sender label cannot be derived\n   * from the addresses \u2014 and since conversation/channel sharing lets a teammate\n   * read someone else's outbound mail, direction alone is not the author either.\n   */\n  authoredByViewer: boolean\n  /** Display label of the sending colleague; null for the viewer's own mail and for inbound. */\n  authorName: string | null\n  to: string[]\n  cc: string[]\n  subject: string | null\n  bodyText: string | null\n  sentAt: string\n  providerKey: string | null\n}\n\nexport type PersonEmailThread = {\n  threadKey: string\n  subject: string | null\n  preview: string | null\n  participants: string[]\n  lastMessageAt: string\n  messageCount: number\n  providerKey: string | null\n  lastDirection: EmailThreadDirection\n  messages: PersonEmailMessage[]\n}\n\nexport type BuildPersonEmailThreadsOptions = {\n  personId: string\n  tenantId: string\n  organizationId: string | null\n  viewerUserId: string | null\n  userFeatures: string[] | null | undefined\n  /**\n   * Conversation shares that widen this viewer's access. Optional and fail-closed:\n   * omitting it yields the strict owner-only view.\n   */\n  sharedConversations?: ConversationShareGrant[]\n  /** Channels marked as shared team mailboxes; optional and fail-closed. */\n  sharedChannelIds?: string[]\n  maxThreads?: number\n  maxMessagesPerThread?: number\n}\n\nconst DEFAULT_MAX_THREADS = 50\nconst DEFAULT_MAX_MESSAGES_PER_THREAD = 200\nconst PREVIEW_LENGTH = 140\n\ntype JsonRecord = Record<string, unknown>\n\n/** Extracts `{ email, name }[]` from the many shapes a channel address field can take. */\nfunction extractAddresses(value: unknown): Array<{ email: string; name: string | null }> {\n  const out: Array<{ email: string; name: string | null }> = []\n  const pushOne = (item: unknown): void => {\n    if (typeof item === 'string') {\n      const trimmed = item.trim()\n      if (trimmed) out.push({ email: trimmed, name: null })\n      return\n    }\n    if (item && typeof item === 'object') {\n      const rec = item as JsonRecord\n      const address = typeof rec.address === 'string' ? rec.address.trim() : null\n      const name = typeof rec.name === 'string' && rec.name.trim() ? rec.name.trim() : null\n      if (address) out.push({ email: address, name })\n    }\n  }\n  if (Array.isArray(value)) {\n    for (const item of value) pushOne(item)\n  } else {\n    pushOne(value)\n  }\n  return out\n}\n\nfunction firstString(...values: unknown[]): string | null {\n  for (const value of values) {\n    if (typeof value === 'string' && value.trim().length > 0) return value\n  }\n  return null\n}\n\nfunction toStringArray(...values: unknown[]): string[] {\n  for (const value of values) {\n    if (Array.isArray(value)) {\n      const strings = value.filter((item): item is string => typeof item === 'string' && item.trim().length > 0)\n      if (strings.length > 0) return strings\n    }\n  }\n  return []\n}\n\nfunction truncate(value: string | null): string | null {\n  if (!value) return value\n  const collapsed = value.replace(/\\s+/g, ' ').trim()\n  if (collapsed.length <= PREVIEW_LENGTH) return collapsed\n  return `${collapsed.slice(0, PREVIEW_LENGTH - 1)}\u2026`\n}\n\n/**\n * Builds the per-Person email-thread read model. Pure data assembly \u2014 callers\n * are responsible for auth and scoping (tenantId/organizationId required).\n */\nexport async function buildPersonEmailThreads(\n  em: EntityManager,\n  opts: BuildPersonEmailThreadsOptions,\n): Promise<PersonEmailThread[]> {\n  const {\n    personId,\n    tenantId,\n    organizationId,\n    viewerUserId,\n    userFeatures,\n    sharedConversations,\n    sharedChannelIds,\n    maxThreads = DEFAULT_MAX_THREADS,\n    maxMessagesPerThread = DEFAULT_MAX_MESSAGES_PER_THREAD,\n  } = opts\n\n  // \u2500\u2500 (1) Load the Person's email interactions (the Person\u2194email anchor) \u2500\u2500\n  const interactionWhere: JsonRecord = {\n    entity: personId,\n    interactionType: 'email',\n    deletedAt: null,\n    tenantId,\n  }\n  if (organizationId) interactionWhere.organizationId = organizationId\n\n  // Per-email visibility (v1: strict owner-only, no admin bypass) \u2014 the CRM\n  // Person page applies the SAME rule as every other interactions read path via\n  // `buildEmailVisibilityMikroFilter`, so the Emails tab and the `/interactions`\n  // timeline can never disagree about who sees an email:\n  //   - `visibility = 'shared'` is visible to every user with CRM access to this\n  //     Person (lets a teammate pick up a handed-off thread),\n  //   - `visibility = 'private'` is visible ONLY to its author (the mailbox\n  //     owner) \u2014 never to teammates, not even an admin/superadmin (team\n  //     oversight is a deliberate v2 follow-up),\n  //   - legacy/unset rows (`visibility IS NULL`) stay visible so pre-existing\n  //     CRM history is never silently hidden.\n  // Fail-closed: a null viewer (API-key caller) never matches the author arm, so\n  // it only ever sees shared/legacy rows \u2014 never anyone's private email.\n  // Merge the WHOLE fragment. Cherry-picking `.$or` here would silently discard\n  // any other arm the predicate grows, which fails OPEN at a compile-clean call\n  // site \u2014 the exact hazard the fragment contract now documents.\n  Object.assign(\n    interactionWhere,\n    buildEmailVisibilityMikroFilter({\n      currentUserId: viewerUserId,\n      userFeatures,\n      sharedConversations,\n      sharedChannelIds,\n    }),\n  )\n\n  // `customer_interaction.title`/`body` are encrypted at rest, so reads go\n  // through `findWithDecryption` even though we only consume non-encrypted\n  // columns here \u2014 this keeps the encrypted-entity contract intact.\n  const dscope = { tenantId, organizationId: organizationId ?? null }\n  const interactions = (await findWithDecryption(\n    em,\n    CustomerInteraction,\n    interactionWhere as never,\n    { orderBy: { occurredAt: 'desc', createdAt: 'desc' }, limit: maxThreads * 20 },\n    dscope,\n  )) as CustomerInteraction[]\n\n  const linkIdByInteraction = new Map<string, { occurredAt: Date; authorUserId: string | null }>()\n  const linkIds: string[] = []\n  for (const interaction of interactions) {\n    const linkId = interaction.externalMessageId\n    if (!linkId || linkIdByInteraction.has(linkId)) continue\n    linkIdByInteraction.set(linkId, {\n      occurredAt: interaction.occurredAt ?? interaction.createdAt,\n      authorUserId: interaction.authorUserId ?? null,\n    })\n    linkIds.push(linkId)\n  }\n  if (linkIds.length === 0) return []\n\n  // \u2500\u2500 (2) Resolve MessageChannelLink rows (rich content + direction) \u2500\u2500\u2500\u2500\u2500\u2500\n  const linkWhere: JsonRecord = { id: { $in: linkIds }, tenantId }\n  if (organizationId) linkWhere.organizationId = organizationId\n  const links = (await findWithDecryption(\n    em,\n    'MessageChannelLink' as never,\n    linkWhere as never,\n    undefined,\n    dscope,\n  )) as JsonRecord[]\n\n  // \u2500\u2500 (3) Resolve hub Message rows (the authoritative thread grouping) \u2500\u2500\u2500\u2500\n  const messageIds = Array.from(\n    new Set(\n      links\n        .map((link) => (typeof link.messageId === 'string' ? (link.messageId as string) : null))\n        .filter((value): value is string => !!value),\n    ),\n  )\n  const messageById = new Map<string, JsonRecord>()\n  if (messageIds.length > 0) {\n    const messageWhere: JsonRecord = { id: { $in: messageIds }, tenantId }\n    if (organizationId) messageWhere.organizationId = organizationId\n    const messages = (await findWithDecryption(\n      em,\n      'Message' as never,\n      messageWhere as never,\n      undefined,\n      dscope,\n    )) as JsonRecord[]\n    for (const message of messages) {\n      if (typeof message.id === 'string') messageById.set(message.id, message)\n    }\n  }\n\n  // \u2500\u2500 (3b) Resolve sender labels for colleagues' messages \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  //\n  // Only for authors other than the viewer: their own mail renders as \"You\" and\n  // needs no lookup. A shared conversation is exactly the case where a message\n  // the viewer did not write shows up in their thread list, so without this the\n  // UI would have to fall back on direction and misattribute it to the reader.\n  const foreignAuthorIds = Array.from(\n    new Set(\n      Array.from(linkIdByInteraction.values())\n        .map((entry) => entry.authorUserId)\n        .filter((id): id is string => !!id && id !== viewerUserId),\n    ),\n  )\n  const authorNames = foreignAuthorIds.length\n    ? await resolveUserNames(em, tenantId, organizationId, foreignAuthorIds)\n    : new Map<string, string>()\n\n  // \u2500\u2500 (4) Build per-message DTOs grouped by thread \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threadsByKey = new Map<string, PersonEmailThread>()\n\n  for (const link of links) {\n    const linkId = typeof link.id === 'string' ? (link.id as string) : null\n    if (!linkId) continue\n    const direction: EmailThreadDirection = link.direction === 'outbound' ? 'outbound' : 'inbound'\n    // `authorUserId` on the interaction is the MAILBOX OWNER, which on an\n    // inbound message is the recipient, not the sender \u2014 so authorship is an\n    // outbound-only notion. Inbound senders are named by the `from` header.\n    const authorUserId = direction === 'outbound' ? linkIdByInteraction.get(linkId)?.authorUserId ?? null : null\n    const authoredByViewer = !!viewerUserId && !!authorUserId && authorUserId === viewerUserId\n    const providerKey = typeof link.providerKey === 'string' ? (link.providerKey as string) : null\n    const payload = (link.channelPayload ?? null) as JsonRecord | null\n    const meta = (link.channelMetadata ?? null) as JsonRecord | null\n    const messageId = typeof link.messageId === 'string' ? (link.messageId as string) : null\n    const message = messageId ? messageById.get(messageId) ?? null : null\n\n    // Outbound addresses live in channelMetadata; inbound in channelPayload.\n    // Prefer the direction-appropriate source, fall back to the other.\n    const primary = direction === 'outbound' ? meta : payload\n    const secondary = direction === 'outbound' ? payload : meta\n    const fromList = extractAddresses(primary?.from ?? secondary?.from)\n    const toList = extractAddresses(primary?.to ?? secondary?.to)\n    const ccList = extractAddresses(primary?.cc ?? secondary?.cc)\n\n    const subject = firstString(\n      primary?.subject,\n      secondary?.subject,\n      typeof message?.subject === 'string' ? message.subject : null,\n    )\n    const bodyText = firstString(\n      direction === 'outbound' ? meta?.bodyText : payload?.text,\n      direction === 'outbound' ? payload?.text : meta?.bodyText,\n      typeof message?.body === 'string' ? message.body : null,\n    )\n\n    const sentAtRaw =\n      (typeof message?.sentAt === 'string' || message?.sentAt instanceof Date\n        ? message.sentAt\n        : null) ??\n      (link.createdAt instanceof Date || typeof link.createdAt === 'string' ? link.createdAt : null) ??\n      linkIdByInteraction.get(linkId)?.occurredAt ??\n      new Date()\n    const sentAt = (sentAtRaw instanceof Date ? sentAtRaw : new Date(sentAtRaw)).toISOString()\n\n    const threadKey =\n      (typeof message?.threadId === 'string' && message.threadId ? message.threadId : null) ??\n      (messageId ? `message:${messageId}` : `link:${linkId}`)\n\n    const dto: PersonEmailMessage = {\n      id: linkId,\n      messageId,\n      rfcMessageId: firstString(primary?.messageId, secondary?.messageId),\n      references: toStringArray(primary?.references, secondary?.references),\n      direction,\n      fromName: fromList[0]?.name ?? null,\n      fromEmail: fromList[0]?.email ?? null,\n      authoredByViewer,\n      authorName: authoredByViewer ? null : authorUserId ? authorNames.get(authorUserId) ?? null : null,\n      to: toList.map((a) => a.email),\n      cc: ccList.map((a) => a.email),\n      subject,\n      bodyText,\n      sentAt,\n      providerKey,\n    }\n\n    const existing = threadsByKey.get(threadKey)\n    if (existing) {\n      existing.messages.push(dto)\n    } else {\n      threadsByKey.set(threadKey, {\n        threadKey,\n        subject,\n        preview: null,\n        participants: [],\n        lastMessageAt: sentAt,\n        messageCount: 0,\n        providerKey,\n        lastDirection: direction,\n        messages: [dto],\n      })\n    }\n  }\n\n  // \u2500\u2500 (5) Finalize thread summaries \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n  const threads: PersonEmailThread[] = []\n  for (const thread of threadsByKey.values()) {\n    thread.messages.sort((a, b) => a.sentAt.localeCompare(b.sentAt))\n    if (thread.messages.length > maxMessagesPerThread) {\n      thread.messages = thread.messages.slice(thread.messages.length - maxMessagesPerThread)\n    }\n    const last = thread.messages[thread.messages.length - 1]\n    const firstWithSubject = thread.messages.find((m) => m.subject)\n    const participantSet = new Set<string>()\n    for (const message of thread.messages) {\n      // External counterpart = the \"from\" for inbound, the \"to\" for outbound.\n      if (message.direction === 'inbound' && message.fromEmail) participantSet.add(message.fromEmail)\n      if (message.direction === 'outbound') message.to.forEach((email) => participantSet.add(email))\n    }\n    thread.subject = firstWithSubject?.subject ?? thread.subject\n    thread.preview = truncate(last?.bodyText ?? null)\n    thread.participants = Array.from(participantSet)\n    thread.lastMessageAt = last?.sentAt ?? thread.lastMessageAt\n    thread.lastDirection = last?.direction ?? thread.lastDirection\n    thread.providerKey = last?.providerKey ?? thread.providerKey\n    thread.messageCount = thread.messages.length\n    threads.push(thread)\n  }\n\n  threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))\n  return threads.slice(0, maxThreads)\n}\n\nexport type PersonEmailMessageAccessOptions = Pick<\n  BuildPersonEmailThreadsOptions,\n  'personId' | 'tenantId' | 'organizationId' | 'viewerUserId' | 'userFeatures' | 'sharedConversations' | 'sharedChannelIds'\n> & {\n  /** Open Mercato `messages.message` id the caller wants to reply to. */\n  messageId: string\n}\n\n/**\n * Whether `messageId` is on this Person's email history as the viewer sees it \u2014\n * i.e. whether {@link buildPersonEmailThreads} would show it to them.\n *\n * Walks the same anchor (email `CustomerInteraction` \u2192 `MessageChannelLink` \u2192\n * message) with the same scope and the same visibility predicate, so a reply\n * from the Person page can only name a parent the Emails tab could have shown:\n * the viewer's own mail, shared or legacy mail, a conversation shared for THIS\n * Person, or a shared team mailbox. Callers remain responsible for resolving the\n * Person in scope first.\n */\nexport async function isMessageOnPersonEmailHistory(\n  em: EntityManager,\n  opts: PersonEmailMessageAccessOptions,\n): Promise<boolean> {\n  const { personId, tenantId, organizationId, messageId } = opts\n  const dscope = { tenantId, organizationId: organizationId ?? null }\n\n  const linkWhere: JsonRecord = { messageId, tenantId }\n  if (organizationId) linkWhere.organizationId = organizationId\n  const links = (await findWithDecryption(\n    em,\n    'MessageChannelLink' as never,\n    linkWhere as never,\n    undefined,\n    dscope,\n  )) as JsonRecord[]\n  const linkIds = links\n    .map((link) => (typeof link.id === 'string' ? (link.id as string) : null))\n    .filter((value): value is string => !!value)\n  if (linkIds.length === 0) return false\n\n  const interactionWhere: JsonRecord = {\n    entity: personId,\n    interactionType: 'email',\n    deletedAt: null,\n    tenantId,\n    externalMessageId: { $in: linkIds },\n  }\n  if (organizationId) interactionWhere.organizationId = organizationId\n  Object.assign(\n    interactionWhere,\n    buildEmailVisibilityMikroFilter({\n      currentUserId: opts.viewerUserId,\n      userFeatures: opts.userFeatures,\n      sharedConversations: opts.sharedConversations,\n      sharedChannelIds: opts.sharedChannelIds,\n    }),\n  )\n  const visible = await em.count(CustomerInteraction, interactionWhere as never)\n  return visible > 0\n}\n"],
+  "mappings": "AACA,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,wBAAwB;AACjC,SAAS,uCAAuC;AA4EhD,MAAM,sBAAsB;AAC5B,MAAM,kCAAkC;AACxC,MAAM,iBAAiB;AAKvB,SAAS,iBAAiB,OAA+D;AACvF,QAAM,MAAqD,CAAC;AAC5D,QAAM,UAAU,CAAC,SAAwB;AACvC,QAAI,OAAO,SAAS,UAAU;AAC5B,YAAM,UAAU,KAAK,KAAK;AAC1B,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,MAAM,KAAK,CAAC;AACpD;AAAA,IACF;AACA,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,YAAM,MAAM;AACZ,YAAM,UAAU,OAAO,IAAI,YAAY,WAAW,IAAI,QAAQ,KAAK,IAAI;AACvE,YAAM,OAAO,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI;AACjF,UAAI,QAAS,KAAI,KAAK,EAAE,OAAO,SAAS,KAAK,CAAC;AAAA,IAChD;AAAA,EACF;AACA,MAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,eAAW,QAAQ,MAAO,SAAQ,IAAI;AAAA,EACxC,OAAO;AACL,YAAQ,KAAK;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,eAAe,QAAkC;AACxD,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO;AAAA,EACnE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,QAA6B;AACrD,aAAW,SAAS,QAAQ;AAC1B,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,YAAM,UAAU,MAAM,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AACzG,UAAI,QAAQ,SAAS,EAAG,QAAO;AAAA,IACjC;AAAA,EACF;AACA,SAAO,CAAC;AACV;AAEA,SAAS,SAAS,OAAqC;AACrD,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,MAAM,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAClD,MAAI,UAAU,UAAU,eAAgB,QAAO;AAC/C,SAAO,GAAG,UAAU,MAAM,GAAG,iBAAiB,CAAC,CAAC;AAClD;AAMA,eAAsB,wBACpB,IACA,MAC8B;AAC9B,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa;AAAA,IACb,uBAAuB;AAAA,EACzB,IAAI;AAGJ,QAAM,mBAA+B;AAAA,IACnC,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,EACF;AACA,MAAI,eAAgB,kBAAiB,iBAAiB;AAkBtD,SAAO;AAAA,IACL;AAAA,IACA,gCAAgC;AAAA,MAC9B,eAAe;AAAA,MACf;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAKA,QAAM,SAAS,EAAE,UAAU,gBAAgB,kBAAkB,KAAK;AAClE,QAAM,eAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,EAAE,SAAS,EAAE,YAAY,QAAQ,WAAW,OAAO,GAAG,OAAO,aAAa,GAAG;AAAA,IAC7E;AAAA,EACF;AAEA,QAAM,sBAAsB,oBAAI,IAA+D;AAC/F,QAAM,UAAoB,CAAC;AAC3B,aAAW,eAAe,cAAc;AACtC,UAAM,SAAS,YAAY;AAC3B,QAAI,CAAC,UAAU,oBAAoB,IAAI,MAAM,EAAG;AAChD,wBAAoB,IAAI,QAAQ;AAAA,MAC9B,YAAY,YAAY,cAAc,YAAY;AAAA,MAClD,cAAc,YAAY,gBAAgB;AAAA,IAC5C,CAAC;AACD,YAAQ,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,QAAQ,WAAW,EAAG,QAAO,CAAC;AAGlC,QAAM,YAAwB,EAAE,IAAI,EAAE,KAAK,QAAQ,GAAG,SAAS;AAC/D,MAAI,eAAgB,WAAU,iBAAiB;AAC/C,QAAM,QAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAGA,QAAM,aAAa,MAAM;AAAA,IACvB,IAAI;AAAA,MACF,MACG,IAAI,CAAC,SAAU,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB,IAAK,EACtF,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAAA,IAC/C;AAAA,EACF;AACA,QAAM,cAAc,oBAAI,IAAwB;AAChD,MAAI,WAAW,SAAS,GAAG;AACzB,UAAM,eAA2B,EAAE,IAAI,EAAE,KAAK,WAAW,GAAG,SAAS;AACrE,QAAI,eAAgB,cAAa,iBAAiB;AAClD,UAAM,WAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,eAAW,WAAW,UAAU;AAC9B,UAAI,OAAO,QAAQ,OAAO,SAAU,aAAY,IAAI,QAAQ,IAAI,OAAO;AAAA,IACzE;AAAA,EACF;AAQA,QAAM,mBAAmB,MAAM;AAAA,IAC7B,IAAI;AAAA,MACF,MAAM,KAAK,oBAAoB,OAAO,CAAC,EACpC,IAAI,CAAC,UAAU,MAAM,YAAY,EACjC,OAAO,CAAC,OAAqB,CAAC,CAAC,MAAM,OAAO,YAAY;AAAA,IAC7D;AAAA,EACF;AACA,QAAM,cAAc,iBAAiB,SACjC,MAAM,iBAAiB,IAAI,UAAU,gBAAgB,gBAAgB,IACrE,oBAAI,IAAoB;AAG5B,QAAM,eAAe,oBAAI,IAA+B;AAExD,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,OAAO,WAAY,KAAK,KAAgB;AACnE,QAAI,CAAC,OAAQ;AACb,UAAM,YAAkC,KAAK,cAAc,aAAa,aAAa;AAIrF,UAAM,eAAe,cAAc,aAAa,oBAAoB,IAAI,MAAM,GAAG,gBAAgB,OAAO;AACxG,UAAM,mBAAmB,CAAC,CAAC,gBAAgB,CAAC,CAAC,gBAAgB,iBAAiB;AAC9E,UAAM,cAAc,OAAO,KAAK,gBAAgB,WAAY,KAAK,cAAyB;AAC1F,UAAM,UAAW,KAAK,kBAAkB;AACxC,UAAM,OAAQ,KAAK,mBAAmB;AACtC,UAAM,YAAY,OAAO,KAAK,cAAc,WAAY,KAAK,YAAuB;AACpF,UAAM,UAAU,YAAY,YAAY,IAAI,SAAS,KAAK,OAAO;AAIjE,UAAM,UAAU,cAAc,aAAa,OAAO;AAClD,UAAM,YAAY,cAAc,aAAa,UAAU;AACvD,UAAM,WAAW,iBAAiB,SAAS,QAAQ,WAAW,IAAI;AAClE,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAC5D,UAAM,SAAS,iBAAiB,SAAS,MAAM,WAAW,EAAE;AAE5D,UAAM,UAAU;AAAA,MACd,SAAS;AAAA,MACT,WAAW;AAAA,MACX,OAAO,SAAS,YAAY,WAAW,QAAQ,UAAU;AAAA,IAC3D;AACA,UAAM,WAAW;AAAA,MACf,cAAc,aAAa,MAAM,WAAW,SAAS;AAAA,MACrD,cAAc,aAAa,SAAS,OAAO,MAAM;AAAA,MACjD,OAAO,SAAS,SAAS,WAAW,QAAQ,OAAO;AAAA,IACrD;AAEA,UAAM,aACH,OAAO,SAAS,WAAW,YAAY,SAAS,kBAAkB,OAC/D,QAAQ,SACR,UACH,KAAK,qBAAqB,QAAQ,OAAO,KAAK,cAAc,WAAW,KAAK,YAAY,SACzF,oBAAoB,IAAI,MAAM,GAAG,cACjC,oBAAI,KAAK;AACX,UAAM,UAAU,qBAAqB,OAAO,YAAY,IAAI,KAAK,SAAS,GAAG,YAAY;AAEzF,UAAM,aACH,OAAO,SAAS,aAAa,YAAY,QAAQ,WAAW,QAAQ,WAAW,UAC/E,YAAY,WAAW,SAAS,KAAK,QAAQ,MAAM;AAEtD,UAAM,MAA0B;AAAA,MAC9B,IAAI;AAAA,MACJ;AAAA,MACA,cAAc,YAAY,SAAS,WAAW,WAAW,SAAS;AAAA,MAClE,YAAY,cAAc,SAAS,YAAY,WAAW,UAAU;AAAA,MACpE;AAAA,MACA,UAAU,SAAS,CAAC,GAAG,QAAQ;AAAA,MAC/B,WAAW,SAAS,CAAC,GAAG,SAAS;AAAA,MACjC;AAAA,MACA,YAAY,mBAAmB,OAAO,eAAe,YAAY,IAAI,YAAY,KAAK,OAAO;AAAA,MAC7F,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,MAC7B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAEA,UAAM,WAAW,aAAa,IAAI,SAAS;AAC3C,QAAI,UAAU;AACZ,eAAS,SAAS,KAAK,GAAG;AAAA,IAC5B,OAAO;AACL,mBAAa,IAAI,WAAW;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,SAAS;AAAA,QACT,cAAc,CAAC;AAAA,QACf,eAAe;AAAA,QACf,cAAc;AAAA,QACd;AAAA,QACA,eAAe;AAAA,QACf,UAAU,CAAC,GAAG;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,UAA+B,CAAC;AACtC,aAAW,UAAU,aAAa,OAAO,GAAG;AAC1C,WAAO,SAAS,KAAK,CAAC,GAAG,MAAM,EAAE,OAAO,cAAc,EAAE,MAAM,CAAC;AAC/D,QAAI,OAAO,SAAS,SAAS,sBAAsB;AACjD,aAAO,WAAW,OAAO,SAAS,MAAM,OAAO,SAAS,SAAS,oBAAoB;AAAA,IACvF;AACA,UAAM,OAAO,OAAO,SAAS,OAAO,SAAS,SAAS,CAAC;AACvD,UAAM,mBAAmB,OAAO,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AAC9D,UAAM,iBAAiB,oBAAI,IAAY;AACvC,eAAW,WAAW,OAAO,UAAU;AAErC,UAAI,QAAQ,cAAc,aAAa,QAAQ,UAAW,gBAAe,IAAI,QAAQ,SAAS;AAC9F,UAAI,QAAQ,cAAc,WAAY,SAAQ,GAAG,QAAQ,CAAC,UAAU,eAAe,IAAI,KAAK,CAAC;AAAA,IAC/F;AACA,WAAO,UAAU,kBAAkB,WAAW,OAAO;AACrD,WAAO,UAAU,SAAS,MAAM,YAAY,IAAI;AAChD,WAAO,eAAe,MAAM,KAAK,cAAc;AAC/C,WAAO,gBAAgB,MAAM,UAAU,OAAO;AAC9C,WAAO,gBAAgB,MAAM,aAAa,OAAO;AACjD,WAAO,cAAc,MAAM,eAAe,OAAO;AACjD,WAAO,eAAe,OAAO,SAAS;AACtC,YAAQ,KAAK,MAAM;AAAA,EACrB;AAEA,UAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,cAAc,cAAc,EAAE,aAAa,CAAC;AACrE,SAAO,QAAQ,MAAM,GAAG,UAAU;AACpC;AAqBA,eAAsB,8BACpB,IACA,MACkB;AAClB,QAAM,EAAE,UAAU,UAAU,gBAAgB,UAAU,IAAI;AAC1D,QAAM,SAAS,EAAE,UAAU,gBAAgB,kBAAkB,KAAK;AAElE,QAAM,YAAwB,EAAE,WAAW,SAAS;AACpD,MAAI,eAAgB,WAAU,iBAAiB;AAC/C,QAAM,QAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,UAAU,MACb,IAAI,CAAC,SAAU,OAAO,KAAK,OAAO,WAAY,KAAK,KAAgB,IAAK,EACxE,OAAO,CAAC,UAA2B,CAAC,CAAC,KAAK;AAC7C,MAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,QAAM,mBAA+B;AAAA,IACnC,QAAQ;AAAA,IACR,iBAAiB;AAAA,IACjB,WAAW;AAAA,IACX;AAAA,IACA,mBAAmB,EAAE,KAAK,QAAQ;AAAA,EACpC;AACA,MAAI,eAAgB,kBAAiB,iBAAiB;AACtD,SAAO;AAAA,IACL;AAAA,IACA,gCAAgC;AAAA,MAC9B,eAAe,KAAK;AAAA,MACpB,cAAc,KAAK;AAAA,MACnB,qBAAqB,KAAK;AAAA,MAC1B,kBAAkB,KAAK;AAAA,IACzB,CAAC;AAAA,EACH;AACA,QAAM,UAAU,MAAM,GAAG,MAAM,qBAAqB,gBAAyB;AAC7E,SAAO,UAAU;AACnB;",
   "names": []
 }

package/dist/modules/messages/api/[id]/route.js

@@ -13,9 +13,9 @@ import { getMessageTypeOrDefault } from "../../lib/message-types-registry.js";
 import { attachOperationMetadataHeader } from "../../lib/operationMetadata.js";
 import {
   canPostToChannelThread,
-  hasChannelThreadReadAccess,
   hasOrganizationAccess,
-  resolveMessageContext
+  resolveMessageContext,
+  resolveMessageReadAccess
 } from "../../lib/routeHelpers.js";
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../guards.js";
 import {
@@ -67,14 +67,8 @@ async function GET(req, { params }) {
   if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }
-  const recipient = await em.findOne(MessageRecipient, {
-    messageId: params.id,
-    recipientUserId: scope.userId,
-    deletedAt: null
-  });
-  const isSender = message.senderUserId === scope.userId;
+  const { recipient, isSender, hasChannelThreadAccess } = await resolveMessageReadAccess(ctx, scope, message);
   const isRecipient = Boolean(recipient);
-  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message);
   if (!isSender && !isRecipient && !hasChannelThreadAccess) {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }