@pegma/support-desk-application 0.1.0

package/dist/index.js

@@ -0,0 +1,3048 @@
+import { auditRecordId, defineAudit } from "@pegma/audit";
+import { hasPermission } from "@pegma/authorization-core";
+import { defineMail, maxMailAttempts } from "@pegma/mail";
+import { noopLogger } from "@pegma/spine";
+import { defineCollection, MAX_SCAN_PAGE_SIZE, } from "@pegma/storage-core";
+import { applyTicketEvent, createTicket } from "@pegma/support-desk-core";
+export const supportPermissions = Object.freeze({
+    create: "support.ticket.create",
+    readOwn: "support.ticket.read.own",
+    replyOwn: "support.ticket.reply.own",
+    queueRead: "support.queue.read",
+    replyAny: "support.ticket.reply.any",
+    note: "support.ticket.note",
+    assign: "support.ticket.assign",
+    manage: "support.ticket.manage",
+    auditRead: "support.audit.read",
+});
+export const defaultSupportDeskLimits = Object.freeze({
+    maxSubjectCharacters: 200,
+    maxMessageCharacters: 20_000,
+    maxTicketsPerPrincipal: 100,
+    maxMessagesPerTicket: 100,
+    maxRecordsPerTicket: 512,
+});
+export class SupportDeskAuthorizationError extends Error {
+    permission;
+    constructor(permission) {
+        super(`Permission required: ${permission}`);
+        this.permission = permission;
+        this.name = "SupportDeskAuthorizationError";
+    }
+}
+export class SupportDeskNotFoundError extends Error {
+    constructor() {
+        super("Ticket not found");
+        this.name = "SupportDeskNotFoundError";
+    }
+}
+export class SupportDeskConflictError extends Error {
+    constructor(message = "The ticket changed before the command could commit") {
+        super(message);
+        this.name = "SupportDeskConflictError";
+    }
+}
+export class SupportDeskLimitError extends Error {
+    field;
+    maximum;
+    constructor(field, maximum) {
+        super(`${field} exceeds the configured limit of ${maximum}`);
+        this.field = field;
+        this.maximum = maximum;
+        this.name = "SupportDeskLimitError";
+    }
+}
+/**
+ * Staff queue online scan hit a configured materialization budget before the
+ * projection scan cycle completed. Hosts map this to HTTP 503; never return a
+ * partial queue page for this outcome.
+ */
+export class SupportDeskQueueCapacityError extends Error {
+    budget;
+    maximum;
+    constructor(budget, maximum) {
+        super(`Staff queue scan exhausted the ${budget} budget of ${maximum} before a complete cycle`);
+        this.budget = budget;
+        this.maximum = maximum;
+        this.name = "SupportDeskQueueCapacityError";
+    }
+}
+function encodeIdempotencyPart(value) {
+    return encodeURIComponent(value).replaceAll(/[!'()*]/g, (character) => `%${character.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+/** Closed MVP registry of durable accepted-change audit action names. */
+export const supportTicketAuditActions = Object.freeze({
+    created: "support.ticket.created",
+    customerReplied: "support.ticket.customer_replied",
+    staffReplied: "support.ticket.staff_replied",
+    noteAdded: "support.ticket.note_added",
+    assigned: "support.ticket.assigned",
+    unassigned: "support.ticket.unassigned",
+    priorityChanged: "support.ticket.priority_changed",
+    resolved: "support.ticket.resolved",
+    closed: "support.ticket.closed",
+    reopened: "support.ticket.reopened",
+});
+export const deliveryCallbackDedupeDays = 30;
+export const maxDeliveryCallbacksPerBucket = 256;
+export const inboundReceiptDedupeDays = 30;
+export const maxInboundReceiptsPerBucket = 256;
+function receiptSlotId(slot, field) {
+    if (!/^[0-9a-f]{2}$/.test(slot)) {
+        throw new TypeError(`${field} must be exactly two lowercase hex digits`);
+    }
+    return `slot:${slot}`;
+}
+function jsonCodec(key) {
+    return {
+        encode(value) {
+            const location = key(value);
+            return {
+                partition: location.partition,
+                id: location.id,
+                payload: JSON.stringify(value),
+            };
+        },
+        decode(record) {
+            if (typeof record.payload !== "string") {
+                throw new TypeError("stored Support Desk record has no JSON payload");
+            }
+            return JSON.parse(record.payload);
+        },
+    };
+}
+const supportRecordKey = (record) => ({
+    partition: record.partition,
+    id: record.id,
+});
+export const supportRecords = defineCollection({
+    name: "support-desk.records.v1",
+    key: supportRecordKey,
+    codec: jsonCodec(supportRecordKey),
+});
+function requireSupportMailJob(job) {
+    requireIdentifier(job.partition, "mail job.partition");
+    requireIdentifier(job.id, "mail job.id");
+    requireIdentifier(job.contentRef, "mail job.contentRef");
+}
+function requireDeliveryWrapper(record) {
+    requireSupportMailJob(record.job);
+    if (record.partition !== record.job.partition ||
+        record.id !== `delivery:${record.job.id}` ||
+        record.ticketId !== record.job.partition ||
+        record.messageId !== record.job.contentRef) {
+        throw new TypeError("stored delivery wrapper does not match its nested mail job");
+    }
+}
+/**
+ * Project generic mail state into Support Desk's durable record union.
+ *
+ * Physical identity stays Support-owned (`delivery:*`), while the nested job
+ * round-trips exactly for authoritative collection-wide discovery.
+ */
+export const supportMail = defineMail({
+    collection: supportRecords,
+    key: ({ partition, jobId }) => {
+        requireIdentifier(partition, "mail candidate.partition");
+        requireIdentifier(jobId, "mail candidate.jobId");
+        return {
+            partition,
+            id: `delivery:${jobId}`,
+        };
+    },
+    toRecord(job, previous) {
+        requireSupportMailJob(job);
+        if (previous !== null && previous.kind !== "delivery_job") {
+            throw new TypeError("mail projection collided with a non-mail record");
+        }
+        if (previous !== null &&
+            (previous.ticketId !== job.partition ||
+                previous.messageId !== job.contentRef)) {
+            throw new TypeError("mail transition does not match the delivery wrapper's causal binding");
+        }
+        return {
+            kind: "delivery_job",
+            partition: job.partition,
+            id: `delivery:${job.id}`,
+            ticketId: job.partition,
+            messageId: previous?.messageId ?? job.contentRef,
+            job,
+        };
+    },
+    toJob(record) {
+        if (record.kind !== "delivery_job")
+            return null;
+        requireDeliveryWrapper(record);
+        return record.job;
+    },
+});
+function requireAuditMember(record) {
+    if (record.partition !== record.event.subject ||
+        record.id !== auditRecordId(record.event.id)) {
+        throw new TypeError("stored audit member does not match its nested AuditEvent");
+    }
+}
+/**
+ * Project generic audit events into Support Desk's durable record union.
+ *
+ * Physical identity is `auditRecordId(event.id)`; the event itself is the
+ * accepted-change record. Domain `TicketEvent` values stay pure workflow input.
+ */
+export const supportAudit = defineAudit({
+    collection: supportRecords,
+    toRecord(event) {
+        const record = {
+            kind: "audit",
+            partition: event.subject,
+            id: auditRecordId(event.id),
+            event,
+        };
+        requireAuditMember(record);
+        return record;
+    },
+    toEvent(record) {
+        if (record.kind !== "audit") {
+            return null;
+        }
+        requireAuditMember(record);
+        return record.event;
+    },
+});
+function ticketAuditAction(input) {
+    return supportAudit.action({
+        id: input.commandId,
+        occurredAt: input.occurredAt,
+        actor: { kind: "principal", principalId: input.actorId },
+        action: input.action,
+        subject: input.ticketId,
+        sequence: input.revision,
+        details: {
+            commandId: input.commandId,
+            correlationId: input.correlationId,
+            ...(input.details ?? {}),
+        },
+    });
+}
+const customerTicketIndexKey = (record) => ({
+    partition: record.principalId,
+    id: "tickets",
+});
+export const customerTicketIndex = defineCollection({
+    name: "support-desk.customer-ticket-index.v1",
+    key: customerTicketIndexKey,
+    codec: jsonCodec(customerTicketIndexKey),
+});
+const ticketNumberKey = (_record) => ({
+    partition: ticketNumberPartition,
+    id: ticketNumberRecordId,
+});
+/**
+ * One counter per Support Desk instance. Reservation is outside the ticket
+ * transaction; gaps are accepted when a later create step fails.
+ */
+export const ticketNumbers = defineCollection({
+    name: "support-desk.ticket-numbers.v1",
+    key: ticketNumberKey,
+    codec: jsonCodec(ticketNumberKey),
+});
+const inboundReceiptKey = (record) => ({
+    partition: record.bucket,
+    id: receiptSlotId(record.slot, "inbound receipt slot"),
+});
+export const inboundReceipts = defineCollection({
+    name: "support-desk.inbound-receipts.v1",
+    key: inboundReceiptKey,
+    codec: jsonCodec(inboundReceiptKey),
+});
+const deliveryCallbackReceiptKey = (record) => ({
+    partition: record.bucket,
+    id: receiptSlotId(record.slot, "delivery callback slot"),
+});
+export const deliveryCallbackReceipts = defineCollection({
+    name: "support-desk.delivery-callback-receipts.v1",
+    key: deliveryCallbackReceiptKey,
+    codec: jsonCodec(deliveryCallbackReceiptKey),
+});
+const queueIndexKey = (record) => ({
+    partition: record.ticketId,
+    id: record.id,
+});
+export const queueIndex = defineCollection({
+    name: "support-desk.queue-index.v1",
+    key: queueIndexKey,
+    codec: jsonCodec(queueIndexKey),
+});
+/** Default terminal-retention cutoff shared by projection, repair, and sweep. */
+export const defaultQueueTerminalRetentionMilliseconds = 30 * 86_400_000;
+export const defaultQueueScanBudgets = Object.freeze({
+    maxPhysicalRows: 10_000,
+    maxScanPages: 100,
+    maxActiveResults: 1_000,
+    scanPageSize: 100,
+});
+export const ticketNumberPartition = "instance";
+export const ticketNumberRecordId = "ticket-number";
+const maxNotificationVariables = 32;
+const maxNotificationVariableBytes = 8_192;
+const maxNotificationVariableTotalBytes = 8_192;
+const maxAllowedCategories = 32;
+const categoryPattern = /^[a-z][a-z0-9_]{0,31}$/;
+function requirePermission(access, permission) {
+    if (!hasPermission(access, permission)) {
+        throw new SupportDeskAuthorizationError(permission);
+    }
+}
+function requireNonempty(value, field) {
+    if (value.trim().length === 0) {
+        throw new TypeError(`${field} must be a non-empty string`);
+    }
+}
+function requireIdentifier(value, field) {
+    requireNonempty(value, field);
+    if (value.length > 200 || /[\u0000-\u001F\u007F]/.test(value)) {
+        throw new TypeError(`${field} must be at most 200 characters with no controls`);
+    }
+}
+const outboundMessageIdLocalPart = /^[A-Za-z0-9!#$%&'*+/=?^_`{|}~.-]+$/;
+const outboundMessageIdDomain = /^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+export function validateOutboundMessageId(value, field = "outboundMessageId") {
+    if (typeof value !== "string") {
+        throw new TypeError(`${field} must be a header-safe ASCII Message-ID`);
+    }
+    const match = /^<([^<>@\s]+)@([^<>@\s]+)>$/.exec(value);
+    const local = match?.[1] ?? "";
+    const domain = match?.[2] ?? "";
+    if (value.length > 254 ||
+        /[\u0000-\u001F\u007F]/.test(value) ||
+        !outboundMessageIdLocalPart.test(local) ||
+        local.startsWith(".") ||
+        local.endsWith(".") ||
+        local.includes("..") ||
+        !outboundMessageIdDomain.test(domain)) {
+        throw new TypeError(`${field} must be a header-safe ASCII Message-ID`);
+    }
+    return value;
+}
+function enforceLimit(value, field, maximum) {
+    requireNonempty(value, field);
+    if ([...value].length > maximum) {
+        throw new SupportDeskLimitError(field, maximum);
+    }
+}
+function ticketKey(ticketId) {
+    return { partition: ticketId, id: "ticket" };
+}
+function ticketQuotaKey(ticketId) {
+    return { partition: ticketId, id: "quota" };
+}
+function ticketReservationKey(ticketId) {
+    return { partition: ticketId, id: "reservation" };
+}
+function commandKey(ticketId, commandId) {
+    return { partition: ticketId, id: `command:${commandId}` };
+}
+function ownDataProperty(source, key, field, optional = false) {
+    const descriptor = Object.getOwnPropertyDescriptor(source, key);
+    if (descriptor === undefined) {
+        if (optional) {
+            return undefined;
+        }
+        throw new TypeError(`${field} must be an own data property`);
+    }
+    if (!Object.hasOwn(descriptor, "value")) {
+        throw new TypeError(`${field} must be an own data property, not an accessor`);
+    }
+    return descriptor.value;
+}
+function snapshotNotificationVariables(input) {
+    if (input === null ||
+        (typeof input !== "object" && typeof input !== "function")) {
+        throw new TypeError("notification.variables must be an object");
+    }
+    const descriptors = Object.getOwnPropertyDescriptors(input);
+    const names = Reflect.ownKeys(descriptors);
+    if (names.length > maxNotificationVariables) {
+        throw new TypeError(`notification.variables may contain at most ${maxNotificationVariables} values`);
+    }
+    const values = new Map();
+    const encoder = new TextEncoder();
+    let totalBytes = 0;
+    for (const name of names) {
+        if (typeof name !== "string" || !/^[a-z][a-z0-9_]{0,63}$/.test(name)) {
+            throw new TypeError("notification.variables must use safe names");
+        }
+        const descriptor = descriptors[name];
+        if (descriptor === undefined ||
+            !descriptor.enumerable ||
+            !Object.hasOwn(descriptor, "value") ||
+            typeof descriptor.value !== "string") {
+            throw new TypeError("notification.variables must use enumerable own string values");
+        }
+        const valueBytes = encoder.encode(descriptor.value).byteLength;
+        if (valueBytes > maxNotificationVariableBytes) {
+            throw new TypeError(`notification variable values may contain at most ${maxNotificationVariableBytes} bytes`);
+        }
+        totalBytes += valueBytes;
+        if (totalBytes > maxNotificationVariableTotalBytes) {
+            throw new TypeError(`notification.variables exceed the ${maxNotificationVariableTotalBytes} byte limit`);
+        }
+        values.set(name, descriptor.value);
+    }
+    const sorted = {};
+    for (const name of [...values.keys()].sort((left, right) => left < right ? -1 : left > right ? 1 : 0)) {
+        sorted[name] = values.get(name);
+    }
+    return Object.freeze(sorted);
+}
+function snapshotNotification(input) {
+    if (input === null ||
+        (typeof input !== "object" && typeof input !== "function")) {
+        throw new TypeError("notification must be an object");
+    }
+    const readString = (key) => {
+        const value = ownDataProperty(input, key, `notification.${key}`);
+        if (typeof value !== "string") {
+            throw new TypeError(`notification.${key} must be a string`);
+        }
+        return value;
+    };
+    const id = readString("id");
+    const recipientRef = readString("recipientRef");
+    const templateId = readString("templateId");
+    const templateVersion = ownDataProperty(input, "templateVersion", "notification.templateVersion");
+    const variables = snapshotNotificationVariables(ownDataProperty(input, "variables", "notification.variables"));
+    const subject = readString("subject");
+    const outboundMessageId = readString("outboundMessageId");
+    const maxAttempts = ownDataProperty(input, "maxAttempts", "notification.maxAttempts", true);
+    requireIdentifier(id, "notification.id");
+    requireIdentifier(recipientRef, "notification.recipientRef");
+    requireIdentifier(templateId, "notification.templateId");
+    if (!Number.isSafeInteger(templateVersion) ||
+        templateVersion <= 0) {
+        throw new TypeError("notification.templateVersion must be a positive safe integer");
+    }
+    if (subject.trim().length === 0 ||
+        subject.length > 500 ||
+        /[\u0000-\u001F\u007F]/.test(subject)) {
+        throw new TypeError("notification.subject must be at most 500 characters with no controls");
+    }
+    validateOutboundMessageId(outboundMessageId, "notification.outboundMessageId");
+    if (maxAttempts !== undefined &&
+        (!Number.isSafeInteger(maxAttempts) ||
+            maxAttempts <= 0 ||
+            maxAttempts > maxMailAttempts)) {
+        throw new TypeError(`notification.maxAttempts must be between 1 and ${maxMailAttempts}`);
+    }
+    return Object.freeze({
+        id,
+        recipientRef,
+        templateId,
+        templateVersion: templateVersion,
+        variables,
+        subject,
+        outboundMessageId,
+        ...(maxAttempts === undefined
+            ? {}
+            : { maxAttempts: maxAttempts }),
+    });
+}
+function boundaryObject(input, field) {
+    if (input === null ||
+        (typeof input !== "object" && typeof input !== "function")) {
+        throw new TypeError(`${field} must be an object`);
+    }
+    return input;
+}
+function boundaryString(value, field) {
+    if (typeof value !== "string") {
+        throw new TypeError(`${field} must be a string`);
+    }
+    return value;
+}
+const requesterEmailMaximumCharacters = 254;
+const requesterEmailLocalPart = /^[A-Za-z0-9.!#$%&'*+/=?^_`{|}~-]+$/;
+const requesterEmailDomain = /^(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?\.)+[A-Za-z0-9](?:[A-Za-z0-9-]{0,61}[A-Za-z0-9])?$/;
+function normalizeRequesterEmail(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError("requesterEmail must be a string");
+    }
+    if (value.length > requesterEmailMaximumCharacters ||
+        /[\u0000-\u001F\u007F<>&"\\]/.test(value)) {
+        throw new TypeError(`requesterEmail must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
+    }
+    const normalized = value.trim();
+    const separator = normalized.indexOf("@");
+    const local = normalized.slice(0, separator);
+    const domain = normalized.slice(separator + 1);
+    if (normalized.length === 0 ||
+        /\s/.test(normalized) ||
+        separator <= 0 ||
+        separator !== normalized.lastIndexOf("@") ||
+        local.length > 64 ||
+        local.startsWith(".") ||
+        local.endsWith(".") ||
+        local.includes("..") ||
+        !requesterEmailLocalPart.test(local) ||
+        domain.length > 253 ||
+        !requesterEmailDomain.test(domain)) {
+        throw new TypeError(`requesterEmail must be a plain email address of at most ${requesterEmailMaximumCharacters} characters`);
+    }
+    return `${local}@${domain.toLowerCase()}`;
+}
+function snapshotCategory(value, field) {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (typeof value !== "string") {
+        throw new TypeError(`${field} must be a string`);
+    }
+    if (!categoryPattern.test(value)) {
+        throw new TypeError(`${field} must match ${categoryPattern.source} and contain no controls`);
+    }
+    return value;
+}
+function snapshotCreateCustomerTicketCommand(input) {
+    const source = boundaryObject(input, "create command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "create command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "create command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "create command.ticketId"),
+        messageId: ownDataProperty(source, "messageId", "create command.messageId"),
+        subject: ownDataProperty(source, "subject", "create command.subject"),
+        body: ownDataProperty(source, "body", "create command.body"),
+        category: ownDataProperty(source, "category", "create command.category", true),
+        requesterEmail: ownDataProperty(source, "requesterEmail", "create command.requesterEmail", true),
+        notification: ownDataProperty(source, "notification", "create command.notification", true),
+    };
+    const category = snapshotCategory(raw.category, "create command.category");
+    const requesterEmail = normalizeRequesterEmail(raw.requesterEmail);
+    const notification = raw.notification === undefined
+        ? undefined
+        : snapshotNotification(raw.notification);
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "create command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "create command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "create command.ticketId"),
+        messageId: boundaryString(raw.messageId, "create command.messageId"),
+        subject: boundaryString(raw.subject, "create command.subject"),
+        body: boundaryString(raw.body, "create command.body"),
+        ...(category === undefined ? {} : { category }),
+        ...(requesterEmail === undefined ? {} : { requesterEmail }),
+        ...(notification === undefined ? {} : { notification }),
+    });
+}
+function snapshotReplyToCustomerTicketCommand(input) {
+    const source = boundaryObject(input, "reply command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "reply command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "reply command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "reply command.ticketId"),
+        messageId: ownDataProperty(source, "messageId", "reply command.messageId"),
+        body: ownDataProperty(source, "body", "reply command.body"),
+        notification: ownDataProperty(source, "notification", "reply command.notification", true),
+    };
+    const notification = raw.notification === undefined
+        ? undefined
+        : snapshotNotification(raw.notification);
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "reply command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "reply command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "reply command.ticketId"),
+        messageId: boundaryString(raw.messageId, "reply command.messageId"),
+        body: boundaryString(raw.body, "reply command.body"),
+        ...(notification === undefined ? {} : { notification }),
+    });
+}
+function deliveryJobAction(ticketId, messageId, now, input) {
+    return supportMail.action({
+        partition: ticketId,
+        id: input.id,
+        recipientRef: input.recipientRef,
+        contentRef: messageId,
+        createdAt: now,
+        ...(input.maxAttempts === undefined
+            ? {}
+            : { maxAttempts: input.maxAttempts }),
+    });
+}
+function deliveryContent(input) {
+    return input === undefined
+        ? undefined
+        : {
+            templateId: input.templateId,
+            templateVersion: input.templateVersion,
+            variables: input.variables,
+            subject: input.subject,
+            outboundMessageId: input.outboundMessageId,
+        };
+}
+function bindNotificationTicketNumber(input, ticketNumber) {
+    const ticketNumberText = String(ticketNumber);
+    const names = Object.keys(input.variables);
+    if (!Object.hasOwn(input.variables, "ticket_number") &&
+        names.length >= maxNotificationVariables) {
+        throw new TypeError(`notification.variables may contain at most ${maxNotificationVariables} values`);
+    }
+    const variables = {
+        ...input.variables,
+        ticket_number: ticketNumberText,
+    };
+    // Re-validate the final map so injection cannot exceed count/byte limits.
+    const frozenVariables = snapshotNotificationVariables(variables);
+    return Object.freeze({
+        ...input,
+        subject: input.subject.replaceAll("{{ticket_number}}", ticketNumberText),
+        variables: frozenVariables,
+    });
+}
+function toCustomerMessage(message) {
+    return Object.freeze({
+        id: message.id,
+        ticketId: message.ticketId,
+        authorKind: message.authorKind,
+        channel: message.channel,
+        visibility: message.visibility,
+        format: message.format,
+        body: message.body,
+        createdAt: message.createdAt,
+    });
+}
+function customerMessages(records) {
+    const messages = records.filter((record) => record.kind === "message" && record.message.visibility === "customer");
+    const ordinals = new Set();
+    for (const record of messages) {
+        if (!Number.isSafeInteger(record.ordinal) || record.ordinal <= 0) {
+            throw new TypeError("stored customer message has no valid explicit ordinal; migrate the record before reading it");
+        }
+        if (ordinals.has(record.ordinal)) {
+            throw new TypeError("stored customer messages contain a duplicate explicit ordinal");
+        }
+        ordinals.add(record.ordinal);
+    }
+    return messages
+        .sort((left, right) => left.ordinal - right.ordinal)
+        .map((record) => toCustomerMessage(record.message));
+}
+function toCustomerTicketSummary(ticket) {
+    // Pre-Task-2 durable tickets lack customerUpdatedAt. Fall back to createdAt
+    // (never staff-only updatedAt) so list/detail stay ordered and DTO-complete
+    // without leaking note/assignment/priority activity.
+    const customerUpdatedAt = ticket.customerUpdatedAt ?? ticket.createdAt;
+    return Object.freeze({
+        id: ticket.id,
+        number: ticket.number,
+        subject: ticket.subject,
+        ...(ticket.category === undefined ? {} : { category: ticket.category }),
+        status: ticket.status,
+        channel: ticket.channel,
+        createdAt: ticket.createdAt,
+        customerUpdatedAt,
+    });
+}
+async function authoritativeView(records, principalId, ticketId, maxRecordsPerTicket) {
+    const all = await records.list(ticketId);
+    const ticketRecord = all.find((record) => record.kind === "ticket");
+    // Ownership before partition errors so foreign ticket IDs never leak capacity.
+    if (ticketRecord === undefined ||
+        ticketRecord.ticket.requester.association !== "authenticated" ||
+        ticketRecord.ticket.requester.principalId !== principalId) {
+        throw new SupportDeskNotFoundError();
+    }
+    enforcePartitionRecordLimit(all.length, maxRecordsPerTicket);
+    return {
+        ticket: toCustomerTicketSummary(ticketRecord.ticket),
+        messages: customerMessages(all),
+    };
+}
+/**
+ * Validate and copy host-supplied category allowlist into a private Set.
+ * The host array is not retained; the Set is application-owned state.
+ */
+function parseAllowedCategories(input) {
+    if (input === undefined) {
+        return undefined;
+    }
+    if (!Array.isArray(input)) {
+        throw new TypeError("application options.allowedCategories must be an array");
+    }
+    if (input.length > maxAllowedCategories) {
+        throw new TypeError(`application options.allowedCategories may contain at most ${maxAllowedCategories} values`);
+    }
+    const values = new Set();
+    for (let index = 0; index < input.length; index += 1) {
+        const field = `application options.allowedCategories[${index}]`;
+        const value = ownDataProperty(input, index, field);
+        if (typeof value !== "string") {
+            throw new TypeError(`${field} must be a string`);
+        }
+        if (!categoryPattern.test(value)) {
+            throw new TypeError(`${field} must match ${categoryPattern.source} and contain no controls`);
+        }
+        if (values.has(value)) {
+            throw new TypeError("application options.allowedCategories must not contain duplicates");
+        }
+        values.add(value);
+    }
+    return values;
+}
+function duplicateMatches(existing, commandType, messageId, requestFingerprint) {
+    return (existing?.kind === "command" &&
+        existing.commandType === commandType &&
+        existing.messageId === messageId &&
+        existing.requestFingerprint === requestFingerprint);
+}
+const TICKET_PRIORITIES = [
+    "low",
+    "normal",
+    "high",
+    "urgent",
+];
+function staffMessages(records) {
+    const messages = records.filter((record) => record.kind === "message");
+    const ordinals = new Set();
+    for (const record of messages) {
+        if (!Number.isSafeInteger(record.ordinal) || record.ordinal <= 0) {
+            throw new TypeError("stored message has no valid explicit ordinal; migrate the record before reading it");
+        }
+        if (ordinals.has(record.ordinal)) {
+            throw new TypeError("stored messages contain a duplicate explicit ordinal");
+        }
+        ordinals.add(record.ordinal);
+    }
+    return messages
+        .sort((left, right) => left.ordinal - right.ordinal)
+        .map((record) => Object.freeze({ ...record.message }));
+}
+function enforcePartitionRecordLimit(recordCount, maximum, additional = 0) {
+    if (recordCount + additional > maximum) {
+        throw new SupportDeskLimitError("ticket_partition", maximum);
+    }
+}
+async function staffAuthoritativeView(records, ticketId, maxRecordsPerTicket) {
+    const all = await records.list(ticketId);
+    enforcePartitionRecordLimit(all.length, maxRecordsPerTicket);
+    const ticketRecord = all.find((record) => record.kind === "ticket");
+    if (ticketRecord === undefined) {
+        throw new SupportDeskNotFoundError();
+    }
+    return {
+        ticket: ticketRecord.ticket,
+        messages: staffMessages(all),
+    };
+}
+/** Staff mutations that return full ticket detail also require queue read. */
+function requireStaffMutationAccess(access, permission) {
+    requirePermission(access, supportPermissions.queueRead);
+    requirePermission(access, permission);
+}
+function clampTicketTime(sampledNow, ticketUpdatedAt) {
+    const sampledEpoch = canonicalTimestamp(sampledNow, "clock.now()");
+    const storedEpoch = canonicalTimestamp(ticketUpdatedAt, "ticket.updatedAt");
+    return sampledEpoch < storedEpoch ? ticketUpdatedAt : sampledNow;
+}
+function snapshotStaffReplyCommand(input) {
+    const source = boundaryObject(input, "staff reply command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "staff reply command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "staff reply command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "staff reply command.ticketId"),
+        messageId: ownDataProperty(source, "messageId", "staff reply command.messageId"),
+        body: ownDataProperty(source, "body", "staff reply command.body"),
+        notification: ownDataProperty(source, "notification", "staff reply command.notification", true),
+    };
+    const notification = raw.notification === undefined
+        ? undefined
+        : snapshotNotification(raw.notification);
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "staff reply command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "staff reply command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "staff reply command.ticketId"),
+        messageId: boundaryString(raw.messageId, "staff reply command.messageId"),
+        body: boundaryString(raw.body, "staff reply command.body"),
+        ...(notification === undefined ? {} : { notification }),
+    });
+}
+function snapshotAddNoteCommand(input) {
+    const source = boundaryObject(input, "add note command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "add note command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "add note command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "add note command.ticketId"),
+        messageId: ownDataProperty(source, "messageId", "add note command.messageId"),
+        body: ownDataProperty(source, "body", "add note command.body"),
+    };
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "add note command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "add note command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "add note command.ticketId"),
+        messageId: boundaryString(raw.messageId, "add note command.messageId"),
+        body: boundaryString(raw.body, "add note command.body"),
+    });
+}
+function snapshotAssignTicketCommand(input) {
+    const source = boundaryObject(input, "assign command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "assign command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "assign command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "assign command.ticketId"),
+        assigneeId: ownDataProperty(source, "assigneeId", "assign command.assigneeId"),
+        messageId: ownDataProperty(source, "messageId", "assign command.messageId", true),
+        body: ownDataProperty(source, "body", "assign command.body", true),
+        notification: ownDataProperty(source, "notification", "assign command.notification", true),
+    };
+    if (raw.assigneeId !== null && typeof raw.assigneeId !== "string") {
+        throw new TypeError("assign command.assigneeId must be a string or null");
+    }
+    const notification = raw.notification === undefined
+        ? undefined
+        : snapshotNotification(raw.notification);
+    const messageId = raw.messageId === undefined
+        ? undefined
+        : boundaryString(raw.messageId, "assign command.messageId");
+    const body = raw.body === undefined
+        ? undefined
+        : boundaryString(raw.body, "assign command.body");
+    if (notification !== undefined ||
+        messageId !== undefined ||
+        body !== undefined) {
+        if (messageId === undefined || body === undefined) {
+            throw new TypeError("assign command requires messageId and body when recording a notification message");
+        }
+    }
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "assign command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "assign command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "assign command.ticketId"),
+        assigneeId: raw.assigneeId === null
+            ? null
+            : boundaryString(raw.assigneeId, "assign command.assigneeId"),
+        ...(messageId === undefined ? {} : { messageId }),
+        ...(body === undefined ? {} : { body }),
+        ...(notification === undefined ? {} : { notification }),
+    });
+}
+function snapshotChangePriorityCommand(input) {
+    const source = boundaryObject(input, "change priority command");
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", "change priority command.commandId"),
+        correlationId: ownDataProperty(source, "correlationId", "change priority command.correlationId"),
+        ticketId: ownDataProperty(source, "ticketId", "change priority command.ticketId"),
+        priority: ownDataProperty(source, "priority", "change priority command.priority"),
+    };
+    if (typeof raw.priority !== "string" ||
+        !TICKET_PRIORITIES.includes(raw.priority)) {
+        throw new TypeError(`change priority command.priority must be one of: ${TICKET_PRIORITIES.join(", ")}`);
+    }
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, "change priority command.commandId"),
+        correlationId: boundaryString(raw.correlationId, "change priority command.correlationId"),
+        ticketId: boundaryString(raw.ticketId, "change priority command.ticketId"),
+        priority: raw.priority,
+    });
+}
+function snapshotLifecycleTicketCommand(input, field) {
+    const source = boundaryObject(input, field);
+    const raw = {
+        commandId: ownDataProperty(source, "commandId", `${field}.commandId`),
+        correlationId: ownDataProperty(source, "correlationId", `${field}.correlationId`),
+        ticketId: ownDataProperty(source, "ticketId", `${field}.ticketId`),
+        messageId: ownDataProperty(source, "messageId", `${field}.messageId`, true),
+        body: ownDataProperty(source, "body", `${field}.body`, true),
+        notification: ownDataProperty(source, "notification", `${field}.notification`, true),
+    };
+    const notification = raw.notification === undefined
+        ? undefined
+        : snapshotNotification(raw.notification);
+    const messageId = raw.messageId === undefined
+        ? undefined
+        : boundaryString(raw.messageId, `${field}.messageId`);
+    const body = raw.body === undefined
+        ? undefined
+        : boundaryString(raw.body, `${field}.body`);
+    if (notification !== undefined ||
+        messageId !== undefined ||
+        body !== undefined) {
+        if (messageId === undefined || body === undefined) {
+            throw new TypeError(`${field} requires messageId and body when recording a lifecycle message or notification`);
+        }
+    }
+    return Object.freeze({
+        commandId: boundaryString(raw.commandId, `${field}.commandId`),
+        correlationId: boundaryString(raw.correlationId, `${field}.correlationId`),
+        ticketId: boundaryString(raw.ticketId, `${field}.ticketId`),
+        ...(messageId === undefined ? {} : { messageId }),
+        ...(body === undefined ? {} : { body }),
+        ...(notification === undefined ? {} : { notification }),
+    });
+}
+function stableNotification(notification) {
+    return notification ?? null;
+}
+async function requestFingerprint(value) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(value)));
+    return [...new Uint8Array(digest)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+function isTerminalTicketStatus(status) {
+    return status === "resolved" || status === "closed";
+}
+function terminalTimestamp(ticket) {
+    if (ticket.status === "resolved") {
+        return ticket.resolvedAt ?? ticket.updatedAt;
+    }
+    if (ticket.status === "closed") {
+        return ticket.closedAt ?? ticket.resolvedAt ?? ticket.updatedAt;
+    }
+    return ticket.updatedAt;
+}
+function ticketBeyondTerminalCutoff(ticket, now, terminalRetentionMilliseconds) {
+    if (!isTerminalTicketStatus(ticket.status)) {
+        return false;
+    }
+    const nowEpoch = canonicalTimestamp(now, "clock.now()");
+    const terminalEpoch = canonicalTimestamp(terminalTimestamp(ticket), "ticket terminal time");
+    return nowEpoch - terminalEpoch >= terminalRetentionMilliseconds;
+}
+function deriveQueueIndexRecord(ticket) {
+    return {
+        ticketId: ticket.id,
+        id: "queue",
+        projectedRevision: ticket.revision,
+        state: isTerminalTicketStatus(ticket.status) ? "inactive" : "active",
+        status: ticket.status,
+        priority: ticket.priority,
+        ...(ticket.category === undefined ? {} : { category: ticket.category }),
+        requesterAssociation: ticket.requester.association,
+        channel: ticket.channel,
+        ...(ticket.assignedTo === undefined
+            ? {}
+            : { assignedTo: ticket.assignedTo }),
+        updatedAt: ticket.updatedAt,
+    };
+}
+function queueIndexContentEqual(left, right) {
+    return (left.ticketId === right.ticketId &&
+        left.id === right.id &&
+        left.projectedRevision === right.projectedRevision &&
+        left.state === right.state &&
+        left.status === right.status &&
+        left.priority === right.priority &&
+        left.category === right.category &&
+        left.requesterAssociation === right.requesterAssociation &&
+        left.channel === right.channel &&
+        left.assignedTo === right.assignedTo &&
+        left.updatedAt === right.updatedAt);
+}
+function queueProjectionKey(ticketId) {
+    return { partition: ticketId, id: "queue" };
+}
+/**
+ * Load the authoritative ticket and project the entire queue row from it.
+ *
+ * Never accepts a caller-supplied `Ticket` snapshot. Accepts only a newer
+ * revision or an identical equal-revision replay. Authoritative terminal
+ * tickets beyond the shared retention cutoff keep the projection absent or
+ * are conditionally deleted — they never recreate an inactive row.
+ */
+export async function projectTicketToQueue(ticketId, options) {
+    requireIdentifier(ticketId, "ticketId");
+    const source = boundaryObject(options, "projectTicketToQueue options");
+    const store = ownDataProperty(source, "store", "projectTicketToQueue options.store");
+    const clock = ownDataProperty(source, "clock", "projectTicketToQueue options.clock");
+    const rawRetention = ownDataProperty(source, "terminalRetentionMilliseconds", "projectTicketToQueue options.terminalRetentionMilliseconds");
+    const rawAttempts = ownDataProperty(source, "maxConflictAttempts", "projectTicketToQueue options.maxConflictAttempts", true);
+    if (typeof rawRetention !== "number") {
+        throw new TypeError("projectTicketToQueue options.terminalRetentionMilliseconds must be a number");
+    }
+    const terminalRetentionMilliseconds = rawRetention;
+    if (!Number.isSafeInteger(terminalRetentionMilliseconds) ||
+        terminalRetentionMilliseconds < 0) {
+        throw new TypeError("terminalRetentionMilliseconds must be a non-negative safe integer");
+    }
+    const maxConflictAttempts = rawAttempts === undefined ? 4 : rawAttempts;
+    if (!Number.isSafeInteger(maxConflictAttempts) ||
+        maxConflictAttempts <= 0 ||
+        maxConflictAttempts > 20) {
+        throw new TypeError("maxConflictAttempts must be between 1 and 20");
+    }
+    const records = store.collection(supportRecords);
+    const projections = store.collection(queueIndex);
+    const ticketRecord = await records.get(ticketKey(ticketId));
+    if (ticketRecord?.kind !== "ticket") {
+        const existing = await projections.getVersioned(queueProjectionKey(ticketId));
+        if (existing === null) {
+            return "absent";
+        }
+        const removed = await projections.deleteIfUnchanged(queueProjectionKey(ticketId), existing.version);
+        return removed ? "deleted" : "kept";
+    }
+    const ticket = ticketRecord.ticket;
+    if (ticket.id !== ticketId) {
+        throw new TypeError("stored ticket id does not match its partition");
+    }
+    // Sample the host clock only for terminal retention. Active tickets never
+    // consult wall time, so post-commit projection does not consume sequence
+    // clocks used by ticket mutations.
+    if (isTerminalTicketStatus(ticket.status)) {
+        const now = clock.now();
+        if (ticketBeyondTerminalCutoff(ticket, now, terminalRetentionMilliseconds)) {
+            const existing = await projections.getVersioned(queueProjectionKey(ticketId));
+            if (existing === null) {
+                return "absent";
+            }
+            // Only prune a projection that still matches this terminal revision.
+            // A concurrent reopen can land a newer active row between the ticket
+            // read and this delete; that row must be preserved for repair to see.
+            if (existing.value.projectedRevision !== ticket.revision) {
+                return "kept";
+            }
+            const removed = await projections.deleteIfUnchanged(queueProjectionKey(ticketId), existing.version);
+            return removed ? "deleted" : "kept";
+        }
+    }
+    const derived = deriveQueueIndexRecord(ticket);
+    const result = await projections.update(queueProjectionKey(ticketId), (current) => {
+        if (current === null) {
+            return { action: "write", value: derived };
+        }
+        if (current.ticketId !== ticketId || current.id !== "queue") {
+            throw new TypeError("queue projection key does not match its payload");
+        }
+        if (current.projectedRevision > derived.projectedRevision) {
+            return { action: "keep" };
+        }
+        if (current.projectedRevision < derived.projectedRevision) {
+            return { action: "write", value: derived };
+        }
+        if (queueIndexContentEqual(current, derived)) {
+            return { action: "keep" };
+        }
+        throw new SupportDeskConflictError("Queue projection revision collision with divergent content");
+    }, { maxAttempts: maxConflictAttempts });
+    return result.written ? "written" : "kept";
+}
+function toStaffQueueItem(ticket) {
+    return Object.freeze({
+        ticketId: ticket.id,
+        revision: ticket.revision,
+        status: ticket.status,
+        priority: ticket.priority,
+        ...(ticket.category === undefined ? {} : { category: ticket.category }),
+        requesterAssociation: ticket.requester.association,
+        channel: ticket.channel,
+        ...(ticket.assignedTo === undefined
+            ? {}
+            : { assignedTo: ticket.assignedTo }),
+        updatedAt: ticket.updatedAt,
+    });
+}
+function normalizeFilterList(value) {
+    if (value === undefined) {
+        return undefined;
+    }
+    return new Set(Array.isArray(value) ? value : [value]);
+}
+function staffQueueItemMatches(item, query) {
+    const statuses = normalizeFilterList(query.status);
+    if (statuses !== undefined && !statuses.has(item.status)) {
+        return false;
+    }
+    const priorities = normalizeFilterList(query.priority);
+    if (priorities !== undefined && !priorities.has(item.priority)) {
+        return false;
+    }
+    const associations = normalizeFilterList(query.association);
+    if (associations !== undefined &&
+        !associations.has(item.requesterAssociation)) {
+        return false;
+    }
+    const channels = normalizeFilterList(query.channel);
+    if (channels !== undefined && !channels.has(item.channel)) {
+        return false;
+    }
+    if (query.unassignedOnly === true && item.assignedTo !== undefined) {
+        return false;
+    }
+    if (query.assignedTo !== undefined &&
+        (item.assignedTo === undefined || item.assignedTo !== query.assignedTo)) {
+        return false;
+    }
+    return true;
+}
+const QUEUE_FILTER_STATUSES = [
+    "open",
+    "waiting_on_support",
+    "waiting_on_customer",
+    "resolved",
+    "closed",
+];
+const QUEUE_FILTER_PRIORITIES = [
+    "low",
+    "normal",
+    "high",
+    "urgent",
+];
+const QUEUE_FILTER_ASSOCIATIONS = [
+    "authenticated",
+    "matched_email",
+    "unverified",
+];
+const QUEUE_FILTER_CHANNELS = ["web", "email", "api"];
+function snapshotEnumOrEnumArray(value, field, allowed) {
+    const allow = (candidate) => {
+        if (!allowed.includes(candidate)) {
+            throw new TypeError(`${field} must be one of: ${allowed.join(", ")}`);
+        }
+        return candidate;
+    };
+    if (typeof value === "string") {
+        return allow(value);
+    }
+    if (Array.isArray(value)) {
+        const items = [];
+        for (let index = 0; index < value.length; index += 1) {
+            const item = ownDataProperty(value, index, `${field}[${index}]`);
+            if (typeof item !== "string") {
+                throw new TypeError(`${field} must be a string or an array of strings`);
+            }
+            items.push(allow(item));
+        }
+        return items;
+    }
+    throw new TypeError(`${field} must be a string or an array of strings`);
+}
+function snapshotStaffQueueQuery(input) {
+    if (input === undefined) {
+        return Object.freeze({});
+    }
+    const source = boundaryObject(input, "staff queue query");
+    const readOptional = (key) => ownDataProperty(source, key, `staff queue query.${key}`, true);
+    const status = readOptional("status");
+    const priority = readOptional("priority");
+    const association = readOptional("association");
+    const channel = readOptional("channel");
+    const assignedTo = readOptional("assignedTo");
+    const unassignedOnly = readOptional("unassignedOnly");
+    const sort = readOptional("sort");
+    if (assignedTo !== undefined) {
+        if (typeof assignedTo !== "string") {
+            throw new TypeError("staff queue query.assignedTo must be a string");
+        }
+        requireIdentifier(assignedTo, "staff queue query.assignedTo");
+    }
+    if (unassignedOnly !== undefined && typeof unassignedOnly !== "boolean") {
+        throw new TypeError("staff queue query.unassignedOnly must be a boolean");
+    }
+    if (sort !== undefined &&
+        sort !== "updated_newest" &&
+        sort !== "updated_oldest") {
+        throw new TypeError('staff queue query.sort must be "updated_newest" or "updated_oldest"');
+    }
+    const query = {};
+    if (status !== undefined) {
+        query.status =
+            snapshotEnumOrEnumArray(status, "staff queue query.status", QUEUE_FILTER_STATUSES);
+    }
+    if (priority !== undefined) {
+        query.priority =
+            snapshotEnumOrEnumArray(priority, "staff queue query.priority", QUEUE_FILTER_PRIORITIES);
+    }
+    if (association !== undefined) {
+        query.association =
+            snapshotEnumOrEnumArray(association, "staff queue query.association", QUEUE_FILTER_ASSOCIATIONS);
+    }
+    if (channel !== undefined) {
+        query.channel =
+            snapshotEnumOrEnumArray(channel, "staff queue query.channel", QUEUE_FILTER_CHANNELS);
+    }
+    if (assignedTo !== undefined) {
+        query.assignedTo =
+            assignedTo;
+    }
+    if (unassignedOnly !== undefined) {
+        query.unassignedOnly =
+            unassignedOnly;
+    }
+    if (sort !== undefined) {
+        query.sort =
+            sort;
+    }
+    return Object.freeze(query);
+}
+/**
+ * Scan one page of authoritative `support-desk.records.v1` rows and project
+ * every ticket found. Hosts persist `nextCursor` only after this call returns
+ * successfully for the whole page.
+ */
+export async function repairQueueProjectionPage(options) {
+    const source = boundaryObject(options, "queue repair page options");
+    const store = ownDataProperty(source, "store", "queue repair page options.store");
+    const clock = ownDataProperty(source, "clock", "queue repair page options.clock");
+    const rawCursor = ownDataProperty(source, "cursor", "queue repair page options.cursor", true);
+    const rawLimit = ownDataProperty(source, "limit", "queue repair page options.limit", true);
+    const rawRetention = ownDataProperty(source, "terminalRetentionMilliseconds", "queue repair page options.terminalRetentionMilliseconds");
+    const rawAttempts = ownDataProperty(source, "maxConflictAttempts", "queue repair page options.maxConflictAttempts", true);
+    if (rawCursor !== undefined && typeof rawCursor !== "string") {
+        throw new TypeError("queue repair page options.cursor must be a string");
+    }
+    if (typeof rawRetention !== "number") {
+        throw new TypeError("queue repair page options.terminalRetentionMilliseconds must be a number");
+    }
+    const limit = rawLimit === undefined ? 100 : rawLimit;
+    if (!Number.isSafeInteger(limit) ||
+        limit <= 0 ||
+        limit > MAX_SCAN_PAGE_SIZE) {
+        throw new TypeError(`queue repair page options.limit must be between 1 and ${MAX_SCAN_PAGE_SIZE}`);
+    }
+    const records = store.collection(supportRecords);
+    const page = await records.scan({
+        limit,
+        ...(rawCursor === undefined ? {} : { cursor: rawCursor }),
+    });
+    let projected = 0;
+    for (const entry of page.records) {
+        if (entry.value.kind !== "ticket") {
+            continue;
+        }
+        if (entry.key.id !== "ticket" ||
+            entry.key.partition !== entry.value.partition) {
+            continue;
+        }
+        await projectTicketToQueue(entry.value.ticket.id, {
+            store,
+            clock,
+            terminalRetentionMilliseconds: rawRetention,
+            ...(rawAttempts === undefined
+                ? {}
+                : { maxConflictAttempts: rawAttempts }),
+        });
+        projected += 1;
+    }
+    return {
+        nextCursor: page.nextCursor,
+        physicalRows: page.records.length,
+        projected,
+    };
+}
+/**
+ * Sweep inactive queue rows only after reloading the authoritative ticket and
+ * confirming it is still terminal beyond the shared retention cutoff, then
+ * `deleteIfUnchanged`.
+ */
+export async function sweepInactiveQueueProjections(options) {
+    const source = boundaryObject(options, "queue inactive sweep options");
+    const store = ownDataProperty(source, "store", "queue inactive sweep options.store");
+    const clock = ownDataProperty(source, "clock", "queue inactive sweep options.clock");
+    const rawCursor = ownDataProperty(source, "cursor", "queue inactive sweep options.cursor", true);
+    const rawLimit = ownDataProperty(source, "limit", "queue inactive sweep options.limit", true);
+    const rawRetention = ownDataProperty(source, "terminalRetentionMilliseconds", "queue inactive sweep options.terminalRetentionMilliseconds");
+    if (rawCursor !== undefined && typeof rawCursor !== "string") {
+        throw new TypeError("queue inactive sweep options.cursor must be a string");
+    }
+    if (typeof rawRetention !== "number") {
+        throw new TypeError("queue inactive sweep options.terminalRetentionMilliseconds must be a number");
+    }
+    const limit = rawLimit === undefined ? 100 : rawLimit;
+    if (!Number.isSafeInteger(limit) ||
+        limit <= 0 ||
+        limit > MAX_SCAN_PAGE_SIZE) {
+        throw new TypeError(`queue inactive sweep options.limit must be between 1 and ${MAX_SCAN_PAGE_SIZE}`);
+    }
+    const terminalRetentionMilliseconds = rawRetention;
+    if (!Number.isSafeInteger(terminalRetentionMilliseconds) ||
+        terminalRetentionMilliseconds < 0) {
+        throw new TypeError("terminalRetentionMilliseconds must be a non-negative safe integer");
+    }
+    const projections = store.collection(queueIndex);
+    const records = store.collection(supportRecords);
+    const page = await projections.scan({
+        limit,
+        ...(rawCursor === undefined ? {} : { cursor: rawCursor }),
+    });
+    const now = clock.now();
+    let deleted = 0;
+    for (const entry of page.records) {
+        if (entry.value.state !== "inactive") {
+            continue;
+        }
+        if (entry.key.partition !== entry.value.ticketId ||
+            entry.key.id !== "queue") {
+            continue;
+        }
+        const ticketRecord = await records.get(ticketKey(entry.value.ticketId));
+        if (ticketRecord?.kind !== "ticket") {
+            if (await projections.deleteIfUnchanged(queueProjectionKey(entry.value.ticketId), entry.version)) {
+                deleted += 1;
+            }
+            continue;
+        }
+        if (!ticketBeyondTerminalCutoff(ticketRecord.ticket, now, terminalRetentionMilliseconds)) {
+            continue;
+        }
+        if (await projections.deleteIfUnchanged(queueProjectionKey(entry.value.ticketId), entry.version)) {
+            deleted += 1;
+        }
+    }
+    return {
+        nextCursor: page.nextCursor,
+        physicalRows: page.records.length,
+        deleted,
+    };
+}
+export function createSupportDeskApplication(options) {
+    const source = boundaryObject(options, "application options");
+    const store = ownDataProperty(source, "store", "application options.store");
+    const clock = ownDataProperty(source, "clock", "application options.clock");
+    const rawLogger = ownDataProperty(source, "logger", "application options.logger", true);
+    const logger = rawLogger === undefined ? noopLogger : rawLogger;
+    const rawLimits = ownDataProperty(source, "limits", "application options.limits", true);
+    const rawMaxConflictAttempts = ownDataProperty(source, "maxConflictAttempts", "application options.maxConflictAttempts", true);
+    const rawTerminalRetention = ownDataProperty(source, "queueTerminalRetentionMilliseconds", "application options.queueTerminalRetentionMilliseconds", true);
+    const rawQueueBudgets = ownDataProperty(source, "queueScanBudgets", "application options.queueScanBudgets", true);
+    const allowedCategories = parseAllowedCategories(ownDataProperty(source, "allowedCategories", "application options.allowedCategories", true));
+    const limitOverrides = {};
+    if (rawLimits !== undefined) {
+        const limitSource = boundaryObject(rawLimits, "application options.limits");
+        for (const field of [
+            "maxSubjectCharacters",
+            "maxMessageCharacters",
+            "maxTicketsPerPrincipal",
+            "maxMessagesPerTicket",
+            "maxRecordsPerTicket",
+        ]) {
+            const value = ownDataProperty(limitSource, field, `application options.limits.${field}`, true);
+            if (value !== undefined) {
+                if (typeof value !== "number") {
+                    throw new TypeError(`application options.limits.${field} must be a number`);
+                }
+                limitOverrides[field] = value;
+            }
+        }
+    }
+    if (rawMaxConflictAttempts !== undefined &&
+        typeof rawMaxConflictAttempts !== "number") {
+        throw new TypeError("application options.maxConflictAttempts must be a number");
+    }
+    const records = store.collection(supportRecords);
+    const index = store.collection(customerTicketIndex);
+    const numbers = store.collection(ticketNumbers);
+    const projections = store.collection(queueIndex);
+    const limits = { ...defaultSupportDeskLimits, ...limitOverrides };
+    const maxConflictAttempts = rawMaxConflictAttempts ?? 4;
+    if (!Number.isSafeInteger(maxConflictAttempts) ||
+        maxConflictAttempts <= 0 ||
+        maxConflictAttempts > 20) {
+        throw new TypeError("maxConflictAttempts must be between 1 and 20");
+    }
+    const terminalRetentionMilliseconds = rawTerminalRetention === undefined
+        ? defaultQueueTerminalRetentionMilliseconds
+        : rawTerminalRetention;
+    if (!Number.isSafeInteger(terminalRetentionMilliseconds) ||
+        terminalRetentionMilliseconds < 0) {
+        throw new TypeError("queueTerminalRetentionMilliseconds must be a non-negative safe integer");
+    }
+    const queueBudgetOverrides = {};
+    if (rawQueueBudgets !== undefined) {
+        const budgetSource = boundaryObject(rawQueueBudgets, "application options.queueScanBudgets");
+        for (const field of [
+            "maxPhysicalRows",
+            "maxScanPages",
+            "maxActiveResults",
+            "scanPageSize",
+        ]) {
+            const value = ownDataProperty(budgetSource, field, `application options.queueScanBudgets.${field}`, true);
+            if (value !== undefined) {
+                if (typeof value !== "number") {
+                    throw new TypeError(`application options.queueScanBudgets.${field} must be a number`);
+                }
+                queueBudgetOverrides[field] = value;
+            }
+        }
+    }
+    const queueBudgets = {
+        ...defaultQueueScanBudgets,
+        ...queueBudgetOverrides,
+    };
+    if (!Number.isSafeInteger(queueBudgets.scanPageSize) ||
+        queueBudgets.scanPageSize <= 0 ||
+        queueBudgets.scanPageSize > MAX_SCAN_PAGE_SIZE) {
+        throw new TypeError(`queueScanBudgets.scanPageSize must be between 1 and ${MAX_SCAN_PAGE_SIZE}`);
+    }
+    for (const field of [
+        "maxPhysicalRows",
+        "maxScanPages",
+        "maxActiveResults",
+    ]) {
+        const value = queueBudgets[field];
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new TypeError(`queueScanBudgets.${field} must be a positive safe integer`);
+        }
+    }
+    const limitMaximums = {
+        maxSubjectCharacters: 1_000,
+        maxMessageCharacters: 20_000,
+        maxTicketsPerPrincipal: 1_000,
+        maxMessagesPerTicket: 100,
+        maxRecordsPerTicket: 2_000,
+    };
+    for (const field of Object.keys(limits)) {
+        const value = limits[field];
+        if (!Number.isSafeInteger(value) ||
+            value <= 0 ||
+            value > limitMaximums[field]) {
+            throw new TypeError(`${field} must be a positive safe integer no greater than ${limitMaximums[field]}`);
+        }
+    }
+    let projectionHealth = Object.freeze({
+        consecutiveFailures: 0,
+    });
+    async function safeProjectQueue(ticketId) {
+        try {
+            await projectTicketToQueue(ticketId, {
+                store,
+                clock,
+                terminalRetentionMilliseconds,
+                maxConflictAttempts,
+            });
+            // Health success does not sample the host clock: ticket mutations and
+            // sequence-clock tests must not observe projection bookkeeping as time.
+            projectionHealth = Object.freeze({
+                consecutiveFailures: 0,
+                ...(projectionHealth.lastFailureAt === undefined
+                    ? {}
+                    : {
+                        lastFailureAt: projectionHealth.lastFailureAt,
+                        lastFailureTicketId: projectionHealth.lastFailureTicketId,
+                        lastFailureMessage: projectionHealth.lastFailureMessage,
+                    }),
+            });
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : "queue projection failed";
+            // Failure diagnostics must never fail a committed command response.
+            let lastFailureAt;
+            try {
+                lastFailureAt = clock.now();
+            }
+            catch {
+                lastFailureAt = undefined;
+            }
+            projectionHealth = Object.freeze({
+                consecutiveFailures: projectionHealth.consecutiveFailures + 1,
+                ...(lastFailureAt === undefined ? {} : { lastFailureAt }),
+                lastFailureTicketId: ticketId,
+                lastFailureMessage: message,
+            });
+            try {
+                logger.log("error", "support-desk.queue.projection_failed", {
+                    ticketId,
+                    message,
+                });
+            }
+            catch {
+                // ignore logger transport failures
+            }
+        }
+    }
+    async function customerViewAfterChange(principalId, ticketId) {
+        await safeProjectQueue(ticketId);
+        return authoritativeView(records, principalId, ticketId, limits.maxRecordsPerTicket);
+    }
+    async function staffViewAfterChange(ticketId) {
+        await safeProjectQueue(ticketId);
+        return staffAuthoritativeView(records, ticketId, limits.maxRecordsPerTicket);
+    }
+    async function reserveCustomerTicket(principalId, ticketId, reservedAt) {
+        requireIdentifier(principalId, "principalId");
+        requireIdentifier(ticketId, "ticketId");
+        canonicalTimestamp(reservedAt, "reservedAt");
+        const observedFence = await records.get(ticketReservationKey(ticketId));
+        const nextGeneration = observedFence?.kind === "ticket_reservation"
+            ? observedFence.generation + 1
+            : 1;
+        if (!Number.isSafeInteger(nextGeneration)) {
+            throw new SupportDeskConflictError("Customer ticket reservation generation is exhausted");
+        }
+        const newToken = crypto.randomUUID();
+        const result = await index.update({ partition: principalId, id: "tickets" }, (current) => {
+            if (current === null) {
+                return {
+                    action: "write",
+                    value: {
+                        principalId,
+                        entries: [
+                            {
+                                ticketId,
+                                reservationToken: newToken,
+                                reservationGeneration: nextGeneration,
+                                reservedAt,
+                                state: "reserved",
+                            },
+                        ],
+                    },
+                };
+            }
+            if (current.entries.some((entry) => entry.ticketId === ticketId)) {
+                return { action: "keep" };
+            }
+            if (current.entries.length >= limits.maxTicketsPerPrincipal) {
+                throw new SupportDeskLimitError("customer_tickets", limits.maxTicketsPerPrincipal);
+            }
+            return {
+                action: "write",
+                value: {
+                    ...current,
+                    entries: [
+                        ...current.entries,
+                        {
+                            ticketId,
+                            reservationToken: newToken,
+                            reservationGeneration: nextGeneration,
+                            reservedAt,
+                            state: "reserved",
+                        },
+                    ],
+                },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        const reservation = result.value?.entries.find((entry) => entry.ticketId === ticketId);
+        if (reservation === undefined) {
+            throw new SupportDeskConflictError("Customer ticket reservation was not stored");
+        }
+        const fence = await records.get(ticketReservationKey(ticketId));
+        if (reservation.state === "reserved" &&
+            fence?.kind === "ticket_reservation" &&
+            fence.state === "cancelled" &&
+            fence.generation >= reservation.reservationGeneration) {
+            throw new SupportDeskConflictError("Customer ticket reservation cancellation is still being finalized");
+        }
+        return reservation;
+    }
+    async function confirmCustomerTicket(principalId, ticketId, reservationToken, reservationGeneration) {
+        const result = await index.update({ partition: principalId, id: "tickets" }, (current) => {
+            if (current === null) {
+                return { action: "keep" };
+            }
+            const entry = current.entries.find((candidate) => candidate.ticketId === ticketId);
+            if (entry === undefined ||
+                entry.reservationToken !== reservationToken ||
+                entry.reservationGeneration !== reservationGeneration) {
+                return { action: "keep" };
+            }
+            if (entry.state === "confirmed") {
+                return { action: "keep" };
+            }
+            return {
+                action: "write",
+                value: {
+                    ...current,
+                    entries: current.entries.map((candidate) => candidate.ticketId === ticketId
+                        ? { ...candidate, state: "confirmed" }
+                        : candidate),
+                },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        const confirmed = result.value?.entries.find((entry) => entry.ticketId === ticketId &&
+            entry.reservationToken === reservationToken &&
+            entry.reservationGeneration === reservationGeneration &&
+            entry.state === "confirmed");
+        if (confirmed === undefined) {
+            throw new SupportDeskConflictError("Committed ticket reservation could not be confirmed");
+        }
+    }
+    async function reserveTicketNumber() {
+        const result = await numbers.update({ partition: ticketNumberPartition, id: ticketNumberRecordId }, (current) => {
+            const lastIssued = current?.lastIssued ?? 0;
+            if (!Number.isSafeInteger(lastIssued) || lastIssued < 0) {
+                throw new SupportDeskConflictError("Ticket number counter is corrupt");
+            }
+            if (lastIssued >= Number.MAX_SAFE_INTEGER) {
+                throw new SupportDeskConflictError("Ticket number sequence is exhausted");
+            }
+            return {
+                action: "write",
+                value: { lastIssued: lastIssued + 1 },
+            };
+        }, { maxAttempts: maxConflictAttempts });
+        const issued = result.value?.lastIssued;
+        if (issued === undefined || !Number.isSafeInteger(issued) || issued <= 0) {
+            throw new SupportDeskConflictError("Ticket number was not reserved");
+        }
+        return issued;
+    }
+    return {
+        async createCustomerTicket(access, input) {
+            requirePermission(access, supportPermissions.create);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotCreateCustomerTicketCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.messageId, "messageId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            enforceLimit(command.subject, "subject", limits.maxSubjectCharacters);
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const fingerprintPayload = {
+                type: "create_customer_ticket",
+                ticketId: command.ticketId,
+                messageId: command.messageId,
+                subject: command.subject,
+                body: command.body,
+                // Omit absent category so pre-category receipts still match retries.
+                ...(command.category === undefined
+                    ? {}
+                    : { category: command.category }),
+                requesterEmail: command.requesterEmail ?? null,
+                notification: stableNotification(command.notification),
+            };
+            const fingerprint = await requestFingerprint(fingerprintPayload);
+            // Replay an already committed create before host allowlist checks so a
+            // later config change cannot break idempotent retries of the same command.
+            // Replay never reserves another instance ticket number.
+            const existingCreate = await records.get(commandKey(command.ticketId, command.commandId));
+            let createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, fingerprint);
+            if (!createIsReplay &&
+                existingCreate?.kind === "command" &&
+                existingCreate.commandType === "create_customer_ticket" &&
+                existingCreate.messageId === command.messageId) {
+                // Pre-Task-3 receipts included ticketNumber in the fingerprint.
+                const existingTicket = await records.get(ticketKey(command.ticketId));
+                if (existingTicket?.kind === "ticket") {
+                    // Pre-Task-3 hashed ticketNumber immediately after ticketId.
+                    const legacyFingerprint = await requestFingerprint({
+                        type: fingerprintPayload.type,
+                        ticketId: fingerprintPayload.ticketId,
+                        ticketNumber: existingTicket.ticket.number,
+                        messageId: fingerprintPayload.messageId,
+                        subject: fingerprintPayload.subject,
+                        body: fingerprintPayload.body,
+                        ...(command.category === undefined
+                            ? {}
+                            : { category: command.category }),
+                        requesterEmail: fingerprintPayload.requesterEmail,
+                        notification: fingerprintPayload.notification,
+                    });
+                    createIsReplay = duplicateMatches(existingCreate, "create_customer_ticket", command.messageId, legacyFingerprint);
+                }
+            }
+            if (createIsReplay) {
+                // A crash after ticket commit and before index confirmation must still
+                // converge the principal hint on retry.
+                const fence = await records.get(ticketReservationKey(command.ticketId));
+                if (fence?.kind === "ticket_reservation" &&
+                    fence.state === "committed") {
+                    await confirmCustomerTicket(access.principalId, command.ticketId, fence.token, fence.generation);
+                }
+                return customerViewAfterChange(access.principalId, command.ticketId);
+            }
+            if (command.category !== undefined) {
+                if (allowedCategories === undefined ||
+                    !allowedCategories.has(command.category)) {
+                    throw new TypeError("create command.category is not configured for this Support Desk instance");
+                }
+            }
+            // Fail closed before durable number/index reservation so a too-small
+            // partition budget cannot exhaust the principal ticket index with
+            // reserved-but-never-created tickets.
+            const estimatedCreateRows = 6 + // ticket, quota, reservation, message, audit, command
+                (command.notification === undefined ? 0 : 1);
+            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, estimatedCreateRows);
+            // Reserve outside the ticket transaction; gaps are accepted if create fails.
+            const ticketNumber = await reserveTicketNumber();
+            // Bind host-supplied notification content to the reserved number so mail
+            // cannot advertise a guessed ticket number.
+            const notification = command.notification === undefined
+                ? undefined
+                : bindNotificationTicketNumber(command.notification, ticketNumber);
+            const now = clock.now();
+            const ticket = createTicket({
+                id: command.ticketId,
+                number: ticketNumber,
+                subject: command.subject,
+                channel: "web",
+                ...(command.category === undefined
+                    ? {}
+                    : { category: command.category }),
+                requester: {
+                    association: "authenticated",
+                    principalId: access.principalId,
+                    ...(command.requesterEmail === undefined
+                        ? {}
+                        : { email: command.requesterEmail }),
+                },
+                createdAt: now,
+            });
+            const message = {
+                id: command.messageId,
+                ticketId: command.ticketId,
+                authorKind: "customer",
+                authorPrincipalId: access.principalId,
+                channel: "web",
+                visibility: "customer",
+                format: "plain_text",
+                body: command.body,
+                createdAt: now,
+            };
+            const notificationJob = notification === undefined
+                ? undefined
+                : deliveryJobAction(command.ticketId, command.messageId, now, notification);
+            const notificationContent = deliveryContent(notification);
+            const reservation = await reserveCustomerTicket(access.principalId, command.ticketId, now);
+            const existingReservation = await records.getVersioned(ticketReservationKey(command.ticketId));
+            if (existingReservation?.value.kind === "ticket_reservation" &&
+                existingReservation.value.state === "committed" &&
+                (existingReservation.value.token !== reservation.reservationToken ||
+                    existingReservation.value.generation !==
+                        reservation.reservationGeneration)) {
+                throw new SupportDeskConflictError("Ticket reservation belongs to a different create attempt");
+            }
+            if (existingReservation?.value.kind === "ticket_reservation" &&
+                existingReservation.value.state === "cancelled" &&
+                existingReservation.value.generation >=
+                    reservation.reservationGeneration) {
+                throw new SupportDeskConflictError("Customer ticket reservation was cancelled before commit");
+            }
+            const committedReservation = {
+                kind: "ticket_reservation",
+                partition: command.ticketId,
+                id: "reservation",
+                token: reservation.reservationToken,
+                generation: reservation.reservationGeneration,
+                state: "committed",
+            };
+            const reservationActions = existingReservation === null
+                ? [{ action: "insert", value: committedReservation }]
+                : existingReservation.value.kind === "ticket_reservation" &&
+                    existingReservation.value.state === "cancelled" &&
+                    existingReservation.value.generation <
+                        reservation.reservationGeneration
+                    ? [
+                        {
+                            action: "putIfUnchanged",
+                            value: committedReservation,
+                            version: existingReservation.version,
+                        },
+                    ]
+                    : [];
+            const actions = [
+                {
+                    action: "insert",
+                    value: {
+                        kind: "ticket",
+                        partition: command.ticketId,
+                        id: "ticket",
+                        ticket,
+                    },
+                },
+                {
+                    action: "insert",
+                    value: {
+                        kind: "ticket_quota",
+                        partition: command.ticketId,
+                        id: "quota",
+                        messageCount: 1,
+                    },
+                },
+                ...reservationActions,
+                {
+                    action: "insert",
+                    value: {
+                        kind: "message",
+                        partition: command.ticketId,
+                        id: `message:${command.messageId}`,
+                        ordinal: ticket.revision,
+                        message,
+                        ...(notificationContent === undefined
+                            ? {}
+                            : { deliveryContent: notificationContent }),
+                    },
+                },
+                ticketAuditAction({
+                    commandId: command.commandId,
+                    correlationId: command.correlationId,
+                    ticketId: command.ticketId,
+                    revision: ticket.revision,
+                    actorId: access.principalId,
+                    occurredAt: now,
+                    action: supportTicketAuditActions.created,
+                }),
+                {
+                    action: "insert",
+                    value: {
+                        kind: "command",
+                        partition: command.ticketId,
+                        id: `command:${command.commandId}`,
+                        commandId: command.commandId,
+                        commandType: "create_customer_ticket",
+                        messageId: command.messageId,
+                        requestFingerprint: fingerprint,
+                        completedAt: now,
+                    },
+                },
+                ...(notificationJob === undefined ? [] : [notificationJob]),
+            ];
+            // Create starts an empty partition; fail closed if the first write would
+            // exceed the configured physical-record budget.
+            enforcePartitionRecordLimit(0, limits.maxRecordsPerTicket, actions.length);
+            const outcome = await records.transact(command.ticketId, actions);
+            if (!outcome.committed) {
+                const existing = await records.get(commandKey(command.ticketId, command.commandId));
+                if (!duplicateMatches(existing, "create_customer_ticket", command.messageId, fingerprint)) {
+                    throw new SupportDeskConflictError();
+                }
+            }
+            await confirmCustomerTicket(access.principalId, command.ticketId, reservation.reservationToken, reservation.reservationGeneration);
+            return customerViewAfterChange(access.principalId, command.ticketId);
+        },
+        async replyToCustomerTicket(access, input) {
+            requirePermission(access, supportPermissions.replyOwn);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotReplyToCustomerTicketCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.messageId, "messageId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const fingerprint = await requestFingerprint({
+                type: "reply_customer_ticket",
+                ticketId: command.ticketId,
+                messageId: command.messageId,
+                body: command.body,
+                notification: stableNotification(command.notification),
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "reply_customer_ticket", command.messageId, fingerprint)) {
+                    return customerViewAfterChange(access.principalId, command.ticketId);
+                }
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket" ||
+                    versioned.value.ticket.requester.association !== "authenticated" ||
+                    versioned.value.ticket.requester.principalId !== access.principalId) {
+                    throw new SupportDeskNotFoundError();
+                }
+                const partitionRows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, command.notification === undefined ? 3 : 4);
+                const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                if (quota?.value.kind !== "ticket_quota") {
+                    throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                }
+                if (quota.value.messageCount >= limits.maxMessagesPerTicket) {
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                }
+                const sampledNow = clock.now();
+                const sampledEpoch = canonicalTimestamp(sampledNow, "clock.now()");
+                const storedEpoch = canonicalTimestamp(versioned.value.ticket.updatedAt, "ticket.updatedAt");
+                const now = sampledEpoch < storedEpoch
+                    ? versioned.value.ticket.updatedAt
+                    : sampledNow;
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "customer_replied",
+                    actorId: access.principalId,
+                    occurredAt: now,
+                });
+                const message = {
+                    id: command.messageId,
+                    ticketId: command.ticketId,
+                    authorKind: "customer",
+                    authorPrincipalId: access.principalId,
+                    channel: "web",
+                    visibility: "customer",
+                    format: "plain_text",
+                    body: command.body,
+                    createdAt: now,
+                };
+                const notificationContent = deliveryContent(command.notification);
+                const notificationJob = command.notification === undefined
+                    ? undefined
+                    : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    {
+                        action: "putIfUnchanged",
+                        version: quota.version,
+                        value: {
+                            ...quota.value,
+                            messageCount: quota.value.messageCount + 1,
+                        },
+                    },
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "message",
+                            partition: command.ticketId,
+                            id: `message:${command.messageId}`,
+                            ordinal: updated.revision,
+                            message,
+                            ...(notificationContent === undefined
+                                ? {}
+                                : { deliveryContent: notificationContent }),
+                        },
+                    },
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: supportTicketAuditActions.customerReplied,
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "reply_customer_ticket",
+                            messageId: command.messageId,
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                        },
+                    },
+                    ...(notificationJob === undefined ? [] : [notificationJob]),
+                ]);
+                if (outcome.committed) {
+                    return customerViewAfterChange(access.principalId, command.ticketId);
+                }
+                const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(nowDuplicate, "reply_customer_ticket", command.messageId, fingerprint)) {
+                    return customerViewAfterChange(access.principalId, command.ticketId);
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async listCustomerTickets(access) {
+            requirePermission(access, supportPermissions.readOwn);
+            requireIdentifier(access.principalId, "principalId");
+            const hints = await index.get({
+                partition: access.principalId,
+                id: "tickets",
+            });
+            const tickets = [];
+            for (const hint of hints?.entries ?? []) {
+                try {
+                    tickets.push((await authoritativeView(records, access.principalId, hint.ticketId, limits.maxRecordsPerTicket)).ticket);
+                }
+                catch (error) {
+                    if (!(error instanceof SupportDeskNotFoundError)) {
+                        throw error;
+                    }
+                }
+            }
+            return tickets.sort((left, right) => right.customerUpdatedAt.localeCompare(left.customerUpdatedAt));
+        },
+        async readCustomerTicket(access, ticketId) {
+            requirePermission(access, supportPermissions.readOwn);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            return authoritativeView(records, access.principalId, ticketId, limits.maxRecordsPerTicket);
+        },
+        async readStaffTicket(access, ticketId) {
+            requirePermission(access, supportPermissions.queueRead);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            return staffAuthoritativeView(records, ticketId, limits.maxRecordsPerTicket);
+        },
+        async listStaffQueue(access, input) {
+            requirePermission(access, supportPermissions.queueRead);
+            requireIdentifier(access.principalId, "principalId");
+            const query = snapshotStaffQueueQuery(input);
+            // Request-local cursor only: every online queue read starts without one
+            // and consumes a single complete projection scan cycle.
+            let cursor;
+            let physicalRows = 0;
+            let pages = 0;
+            const confirmed = [];
+            const seenTicketIds = new Set();
+            const capacityExhausted = (budget, maximum) => {
+                try {
+                    logger.log("warn", "support-desk.queue.capacity_exhausted", {
+                        budget,
+                        maximum,
+                        physicalRows,
+                        pages,
+                        activeResults: confirmed.length,
+                    });
+                }
+                catch {
+                    // ignore logger transport failures
+                }
+                throw new SupportDeskQueueCapacityError(budget, maximum);
+            };
+            for (;;) {
+                if (pages >= queueBudgets.maxScanPages) {
+                    capacityExhausted("scan_pages", queueBudgets.maxScanPages);
+                }
+                const remainingPhysical = queueBudgets.maxPhysicalRows - physicalRows;
+                if (remainingPhysical <= 0) {
+                    capacityExhausted("physical_rows", queueBudgets.maxPhysicalRows);
+                }
+                pages += 1;
+                // Request only what the remaining physical-row budget allows so the
+                // configured maximum actually bounds adapter work.
+                const pageLimit = Math.min(queueBudgets.scanPageSize, remainingPhysical);
+                // Codec failures abort the scan page; do not return a partial queue.
+                const page = await projections.scan({
+                    limit: pageLimit,
+                    ...(cursor === undefined ? {} : { cursor }),
+                });
+                physicalRows += page.records.length;
+                if (physicalRows > queueBudgets.maxPhysicalRows) {
+                    capacityExhausted("physical_rows", queueBudgets.maxPhysicalRows);
+                }
+                for (const entry of page.records) {
+                    const projection = entry.value;
+                    if (projection.id !== "queue" ||
+                        entry.key.partition !== projection.ticketId ||
+                        entry.key.id !== "queue") {
+                        continue;
+                    }
+                    if (projection.state !== "active") {
+                        continue;
+                    }
+                    // Confirm every candidate against the authoritative ticket.
+                    const ticketRecord = await records.get(ticketKey(projection.ticketId));
+                    if (ticketRecord?.kind !== "ticket") {
+                        continue;
+                    }
+                    const ticket = ticketRecord.ticket;
+                    if (ticket.id !== projection.ticketId ||
+                        ticket.revision !== projection.projectedRevision ||
+                        isTerminalTicketStatus(ticket.status)) {
+                        continue;
+                    }
+                    if (seenTicketIds.has(ticket.id)) {
+                        // Scan pages may repeat rows; de-duplicate after confirmation.
+                        continue;
+                    }
+                    if (confirmed.length >= queueBudgets.maxActiveResults) {
+                        capacityExhausted("active_results", queueBudgets.maxActiveResults);
+                    }
+                    seenTicketIds.add(ticket.id);
+                    confirmed.push(toStaffQueueItem(ticket));
+                }
+                if (page.nextCursor === null) {
+                    break;
+                }
+                cursor = page.nextCursor;
+            }
+            const filtered = confirmed.filter((item) => staffQueueItemMatches(item, query));
+            const sort = query.sort ?? "updated_newest";
+            filtered.sort((left, right) => {
+                const byTime = sort === "updated_oldest"
+                    ? left.updatedAt.localeCompare(right.updatedAt)
+                    : right.updatedAt.localeCompare(left.updatedAt);
+                if (byTime !== 0) {
+                    return byTime;
+                }
+                return left.ticketId.localeCompare(right.ticketId);
+            });
+            return { items: filtered.map((item) => Object.freeze({ ...item })) };
+        },
+        queueProjectionHealth() {
+            return projectionHealth;
+        },
+        async replyAsStaff(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.replyAny);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotStaffReplyCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.messageId, "messageId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const fingerprint = await requestFingerprint({
+                type: "staff_reply",
+                ticketId: command.ticketId,
+                messageId: command.messageId,
+                body: command.body,
+                notification: stableNotification(command.notification),
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "staff_reply", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket") {
+                    throw new SupportDeskNotFoundError();
+                }
+                const partitionRows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, command.notification === undefined ? 3 : 4);
+                const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                if (quota?.value.kind !== "ticket_quota") {
+                    throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                }
+                if (quota.value.messageCount >= limits.maxMessagesPerTicket) {
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                }
+                const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "support_replied",
+                    actorId: access.principalId,
+                    occurredAt: now,
+                });
+                const message = {
+                    id: command.messageId,
+                    ticketId: command.ticketId,
+                    authorKind: "staff",
+                    authorPrincipalId: access.principalId,
+                    channel: "web",
+                    visibility: "customer",
+                    format: "plain_text",
+                    body: command.body,
+                    createdAt: now,
+                };
+                const notificationContent = deliveryContent(command.notification);
+                const notificationJob = command.notification === undefined
+                    ? undefined
+                    : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    {
+                        action: "putIfUnchanged",
+                        version: quota.version,
+                        value: {
+                            ...quota.value,
+                            messageCount: quota.value.messageCount + 1,
+                        },
+                    },
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "message",
+                            partition: command.ticketId,
+                            id: `message:${command.messageId}`,
+                            ordinal: updated.revision,
+                            message,
+                            ...(notificationContent === undefined
+                                ? {}
+                                : { deliveryContent: notificationContent }),
+                        },
+                    },
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: supportTicketAuditActions.staffReplied,
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "staff_reply",
+                            messageId: command.messageId,
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                        },
+                    },
+                    ...(notificationJob === undefined ? [] : [notificationJob]),
+                ]);
+                if (outcome.committed) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(nowDuplicate, "staff_reply", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async addNote(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.note);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotAddNoteCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.messageId, "messageId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            const fingerprint = await requestFingerprint({
+                type: "add_note",
+                ticketId: command.ticketId,
+                messageId: command.messageId,
+                body: command.body,
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "add_note", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket") {
+                    throw new SupportDeskNotFoundError();
+                }
+                const partitionRows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 3);
+                const quota = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                if (quota?.value.kind !== "ticket_quota") {
+                    throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                }
+                if (quota.value.messageCount >= limits.maxMessagesPerTicket) {
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                }
+                const statusBefore = versioned.value.ticket.status;
+                const customerUpdatedBefore = versioned.value.ticket.customerUpdatedAt;
+                const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "note_added",
+                    actorId: access.principalId,
+                    occurredAt: now,
+                });
+                // Notes must never change lifecycle or customer-visible timestamps.
+                if (updated.status !== statusBefore ||
+                    updated.customerUpdatedAt !== customerUpdatedBefore) {
+                    throw new SupportDeskConflictError("Internal note unexpectedly changed customer-visible ticket state");
+                }
+                const message = {
+                    id: command.messageId,
+                    ticketId: command.ticketId,
+                    authorKind: "staff",
+                    authorPrincipalId: access.principalId,
+                    channel: "web",
+                    visibility: "internal",
+                    format: "plain_text",
+                    body: command.body,
+                    createdAt: now,
+                };
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    {
+                        action: "putIfUnchanged",
+                        version: quota.version,
+                        value: {
+                            ...quota.value,
+                            messageCount: quota.value.messageCount + 1,
+                        },
+                    },
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "message",
+                            partition: command.ticketId,
+                            id: `message:${command.messageId}`,
+                            ordinal: updated.revision,
+                            message,
+                        },
+                    },
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: supportTicketAuditActions.noteAdded,
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "add_note",
+                            messageId: command.messageId,
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                        },
+                    },
+                ]);
+                if (outcome.committed) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(nowDuplicate, "add_note", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async assignTicket(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.assign);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotAssignTicketCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            if (command.assigneeId !== null) {
+                requireIdentifier(command.assigneeId, "assigneeId");
+            }
+            if (command.messageId !== undefined) {
+                requireIdentifier(command.messageId, "messageId");
+            }
+            if (command.body !== undefined) {
+                enforceLimit(command.body, "body", limits.maxMessageCharacters);
+            }
+            const fingerprint = await requestFingerprint({
+                type: "assign_ticket",
+                ticketId: command.ticketId,
+                assigneeId: command.assigneeId,
+                messageId: command.messageId ?? null,
+                body: command.body ?? null,
+                notification: stableNotification(command.notification),
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "assign_ticket", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket") {
+                    throw new SupportDeskNotFoundError();
+                }
+                const addedRecords = command.messageId === undefined
+                    ? 2
+                    : command.notification === undefined
+                        ? 3
+                        : 4;
+                const partitionRows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords);
+                let quotaVersion = null;
+                if (command.messageId !== undefined) {
+                    quotaVersion = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                    if (quotaVersion?.value.kind !== "ticket_quota") {
+                        throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                    }
+                    if (quotaVersion.value.messageCount >= limits.maxMessagesPerTicket) {
+                        throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                    }
+                }
+                const statusBefore = versioned.value.ticket.status;
+                const customerUpdatedBefore = versioned.value.ticket.customerUpdatedAt;
+                const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "assigned",
+                    actorId: access.principalId,
+                    assigneeId: command.assigneeId,
+                    occurredAt: now,
+                });
+                if (updated.status !== statusBefore ||
+                    updated.customerUpdatedAt !== customerUpdatedBefore) {
+                    throw new SupportDeskConflictError("Assignment unexpectedly changed customer-visible ticket state");
+                }
+                // Optional system message + mail so assignment notifications share the
+                // ticket transaction with the assignment itself.
+                const systemMessage = command.messageId === undefined || command.body === undefined
+                    ? undefined
+                    : {
+                        id: command.messageId,
+                        ticketId: command.ticketId,
+                        authorKind: "system",
+                        channel: "web",
+                        visibility: "internal",
+                        format: "plain_text",
+                        body: command.body,
+                        createdAt: now,
+                    };
+                const notificationContent = deliveryContent(command.notification);
+                const notificationJob = command.notification === undefined || command.messageId === undefined
+                    ? undefined
+                    : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    ...(quotaVersion === null ||
+                        systemMessage === undefined ||
+                        quotaVersion.value.kind !== "ticket_quota"
+                        ? []
+                        : [
+                            {
+                                action: "putIfUnchanged",
+                                version: quotaVersion.version,
+                                value: {
+                                    kind: "ticket_quota",
+                                    partition: command.ticketId,
+                                    id: "quota",
+                                    messageCount: quotaVersion.value.messageCount + 1,
+                                },
+                            },
+                        ]),
+                    ...(systemMessage === undefined
+                        ? []
+                        : [
+                            {
+                                action: "insert",
+                                value: {
+                                    kind: "message",
+                                    partition: command.ticketId,
+                                    id: `message:${command.messageId}`,
+                                    ordinal: updated.revision,
+                                    message: systemMessage,
+                                    ...(notificationContent === undefined
+                                        ? {}
+                                        : { deliveryContent: notificationContent }),
+                                },
+                            },
+                        ]),
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: command.assigneeId === null
+                            ? supportTicketAuditActions.unassigned
+                            : supportTicketAuditActions.assigned,
+                        details: command.assigneeId === null
+                            ? {}
+                            : { assigneeId: command.assigneeId },
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "assign_ticket",
+                            ...(command.messageId === undefined
+                                ? {}
+                                : { messageId: command.messageId }),
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                        },
+                    },
+                    ...(notificationJob === undefined ? [] : [notificationJob]),
+                ]);
+                if (outcome.committed) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(nowDuplicate, "assign_ticket", command.messageId, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async changePriority(access, input) {
+            requireStaffMutationAccess(access, supportPermissions.manage);
+            requireIdentifier(access.principalId, "principalId");
+            const command = snapshotChangePriorityCommand(input);
+            requireIdentifier(command.ticketId, "ticketId");
+            requireIdentifier(command.commandId, "commandId");
+            requireIdentifier(command.correlationId, "correlationId");
+            const fingerprint = await requestFingerprint({
+                type: "change_priority",
+                ticketId: command.ticketId,
+                priority: command.priority,
+            });
+            for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+                const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(duplicate, "change_priority", undefined, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const versioned = await records.getVersioned(ticketKey(command.ticketId));
+                if (versioned?.value.kind !== "ticket") {
+                    throw new SupportDeskNotFoundError();
+                }
+                const partitionRows = await records.list(command.ticketId);
+                enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, 2);
+                const statusBefore = versioned.value.ticket.status;
+                const customerUpdatedBefore = versioned.value.ticket.customerUpdatedAt;
+                const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+                const updated = applyTicketEvent(versioned.value.ticket, {
+                    type: "priority_changed",
+                    actorId: access.principalId,
+                    priority: command.priority,
+                    occurredAt: now,
+                });
+                if (updated.status !== statusBefore ||
+                    updated.customerUpdatedAt !== customerUpdatedBefore) {
+                    throw new SupportDeskConflictError("Priority change unexpectedly changed customer-visible ticket state");
+                }
+                const outcome = await records.transact(command.ticketId, [
+                    {
+                        action: "putIfUnchanged",
+                        version: versioned.version,
+                        value: { ...versioned.value, ticket: updated },
+                    },
+                    ticketAuditAction({
+                        commandId: command.commandId,
+                        correlationId: command.correlationId,
+                        ticketId: command.ticketId,
+                        revision: updated.revision,
+                        actorId: access.principalId,
+                        occurredAt: now,
+                        action: supportTicketAuditActions.priorityChanged,
+                        details: { priority: command.priority },
+                    }),
+                    {
+                        action: "insert",
+                        value: {
+                            kind: "command",
+                            partition: command.ticketId,
+                            id: `command:${command.commandId}`,
+                            commandId: command.commandId,
+                            commandType: "change_priority",
+                            requestFingerprint: fingerprint,
+                            completedAt: now,
+                        },
+                    },
+                ]);
+                if (outcome.committed) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+                const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+                if (duplicateMatches(nowDuplicate, "change_priority", undefined, fingerprint)) {
+                    return staffViewAfterChange(command.ticketId);
+                }
+            }
+            throw new SupportDeskConflictError();
+        },
+        async resolveTicket(access, input) {
+            return mutateLifecycle(access, input, {
+                commandType: "resolve_ticket",
+                eventType: "resolved",
+                auditAction: supportTicketAuditActions.resolved,
+                field: "resolve command",
+            });
+        },
+        async closeTicket(access, input) {
+            return mutateLifecycle(access, input, {
+                commandType: "close_ticket",
+                eventType: "closed",
+                auditAction: supportTicketAuditActions.closed,
+                field: "close command",
+            });
+        },
+        async reopenTicket(access, input) {
+            return mutateLifecycle(access, input, {
+                commandType: "reopen_ticket",
+                eventType: "reopened",
+                auditAction: supportTicketAuditActions.reopened,
+                field: "reopen command",
+            });
+        },
+        async readTicketAuditHistory(access, ticketId) {
+            requirePermission(access, supportPermissions.auditRead);
+            requireIdentifier(access.principalId, "principalId");
+            requireIdentifier(ticketId, "ticketId");
+            const partitionRows = await records.list(ticketId);
+            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket);
+            const ticket = partitionRows.find((record) => record.kind === "ticket");
+            if (ticket === undefined) {
+                throw new SupportDeskNotFoundError();
+            }
+            return supportAudit.history(records, ticketId);
+        },
+    };
+    async function mutateLifecycle(access, input, spec) {
+        requireStaffMutationAccess(access, supportPermissions.manage);
+        requireIdentifier(access.principalId, "principalId");
+        const command = snapshotLifecycleTicketCommand(input, spec.field);
+        requireIdentifier(command.ticketId, "ticketId");
+        requireIdentifier(command.commandId, "commandId");
+        requireIdentifier(command.correlationId, "correlationId");
+        if (command.messageId !== undefined) {
+            requireIdentifier(command.messageId, "messageId");
+        }
+        if (command.body !== undefined) {
+            enforceLimit(command.body, "body", limits.maxMessageCharacters);
+        }
+        const fingerprint = await requestFingerprint({
+            type: spec.commandType,
+            ticketId: command.ticketId,
+            messageId: command.messageId ?? null,
+            body: command.body ?? null,
+            notification: stableNotification(command.notification),
+        });
+        for (let attempt = 1; attempt <= maxConflictAttempts; attempt += 1) {
+            const duplicate = await records.get(commandKey(command.ticketId, command.commandId));
+            if (duplicateMatches(duplicate, spec.commandType, command.messageId, fingerprint)) {
+                return staffViewAfterChange(command.ticketId);
+            }
+            const versioned = await records.getVersioned(ticketKey(command.ticketId));
+            if (versioned?.value.kind !== "ticket") {
+                throw new SupportDeskNotFoundError();
+            }
+            const partitionRows = await records.list(command.ticketId);
+            const addedRecords = command.messageId === undefined
+                ? 2 // audit + command
+                : command.notification === undefined
+                    ? 3 // message + audit + command
+                    : 4; // message + audit + command + delivery
+            enforcePartitionRecordLimit(partitionRows.length, limits.maxRecordsPerTicket, addedRecords);
+            let quotaVersion = null;
+            if (command.messageId !== undefined) {
+                quotaVersion = await records.getVersioned(ticketQuotaKey(command.ticketId));
+                if (quotaVersion?.value.kind !== "ticket_quota") {
+                    throw new SupportDeskConflictError("Ticket partition quota metadata is missing");
+                }
+                if (quotaVersion.value.messageCount >= limits.maxMessagesPerTicket) {
+                    throw new SupportDeskLimitError("ticket_messages", limits.maxMessagesPerTicket);
+                }
+            }
+            const now = clampTicketTime(clock.now(), versioned.value.ticket.updatedAt);
+            const updated = applyTicketEvent(versioned.value.ticket, {
+                type: spec.eventType,
+                actorId: access.principalId,
+                occurredAt: now,
+            });
+            // Optional system message + mail commit with the lifecycle change so a
+            // resolution notification cannot be lost after the ticket is resolved.
+            const systemMessage = command.messageId === undefined || command.body === undefined
+                ? undefined
+                : {
+                    id: command.messageId,
+                    ticketId: command.ticketId,
+                    authorKind: "system",
+                    channel: "web",
+                    visibility: "customer",
+                    format: "plain_text",
+                    body: command.body,
+                    createdAt: now,
+                };
+            const notificationContent = deliveryContent(command.notification);
+            const notificationJob = command.notification === undefined || command.messageId === undefined
+                ? undefined
+                : deliveryJobAction(command.ticketId, command.messageId, now, command.notification);
+            const outcome = await records.transact(command.ticketId, [
+                {
+                    action: "putIfUnchanged",
+                    version: versioned.version,
+                    value: { ...versioned.value, ticket: updated },
+                },
+                ...(quotaVersion === null ||
+                    systemMessage === undefined ||
+                    quotaVersion.value.kind !== "ticket_quota"
+                    ? []
+                    : [
+                        {
+                            action: "putIfUnchanged",
+                            version: quotaVersion.version,
+                            value: {
+                                kind: "ticket_quota",
+                                partition: command.ticketId,
+                                id: "quota",
+                                messageCount: quotaVersion.value.messageCount + 1,
+                            },
+                        },
+                    ]),
+                ...(systemMessage === undefined
+                    ? []
+                    : [
+                        {
+                            action: "insert",
+                            value: {
+                                kind: "message",
+                                partition: command.ticketId,
+                                id: `message:${command.messageId}`,
+                                ordinal: updated.revision,
+                                message: systemMessage,
+                                ...(notificationContent === undefined
+                                    ? {}
+                                    : { deliveryContent: notificationContent }),
+                            },
+                        },
+                    ]),
+                ticketAuditAction({
+                    commandId: command.commandId,
+                    correlationId: command.correlationId,
+                    ticketId: command.ticketId,
+                    revision: updated.revision,
+                    actorId: access.principalId,
+                    occurredAt: now,
+                    action: spec.auditAction,
+                }),
+                {
+                    action: "insert",
+                    value: {
+                        kind: "command",
+                        partition: command.ticketId,
+                        id: `command:${command.commandId}`,
+                        commandId: command.commandId,
+                        commandType: spec.commandType,
+                        ...(command.messageId === undefined
+                            ? {}
+                            : { messageId: command.messageId }),
+                        requestFingerprint: fingerprint,
+                        completedAt: now,
+                    },
+                },
+                ...(notificationJob === undefined ? [] : [notificationJob]),
+            ]);
+            if (outcome.committed) {
+                return staffViewAfterChange(command.ticketId);
+            }
+            const nowDuplicate = await records.get(commandKey(command.ticketId, command.commandId));
+            if (duplicateMatches(nowDuplicate, spec.commandType, command.messageId, fingerprint)) {
+                return staffViewAfterChange(command.ticketId);
+            }
+        }
+        throw new SupportDeskConflictError();
+    }
+}
+function canonicalTimestamp(value, field) {
+    const epoch = Date.parse(value);
+    if (!Number.isFinite(epoch) || new Date(epoch).toISOString() !== value) {
+        throw new TypeError(`${field} must be a canonical ISO timestamp`);
+    }
+    return epoch;
+}
+async function receiptHash(owner, providerEventId) {
+    const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(`${owner}\u0000${providerEventId}`));
+    return [...new Uint8Array(digest).slice(0, 16)]
+        .map((byte) => byte.toString(16).padStart(2, "0"))
+        .join("");
+}
+export async function inboundReceiptLocation(channelId, providerEventId) {
+    requireIdentifier(channelId, "channelId");
+    requireIdentifier(providerEventId, "providerEventId");
+    const hash = await receiptHash(channelId, providerEventId);
+    const bucket = `${encodeIdempotencyPart(channelId)}:${hash.slice(0, 30)}`;
+    if (bucket.length > 300) {
+        throw new TypeError("inbound receipt bucket exceeds the safe key length");
+    }
+    return { bucket, slot: hash.slice(30) };
+}
+export async function inboundReceiptBucket(channelId, providerEventId) {
+    return (await inboundReceiptLocation(channelId, providerEventId)).bucket;
+}
+async function deliveryCallbackLocation(provider, providerEventId) {
+    requireIdentifier(provider, "provider");
+    requireIdentifier(providerEventId, "providerEventId");
+    const hash = await receiptHash(provider, providerEventId);
+    const bucket = `${encodeIdempotencyPart(provider)}:${hash.slice(0, 30)}`;
+    if (bucket.length > 300) {
+        throw new TypeError("delivery callback bucket exceeds the safe key length");
+    }
+    return { bucket, slot: hash.slice(30) };
+}
+export async function deliveryCallbackBucket(provider, providerEventId) {
+    return (await deliveryCallbackLocation(provider, providerEventId)).bucket;
+}
+function callbackReceiptKey(location) {
+    return { partition: location.bucket, id: `slot:${location.slot}` };
+}
+function callbackMatches(stored, receipt) {
+    return (stored.provider === receipt.provider &&
+        stored.providerEventId === receipt.providerEventId &&
+        stored.ticketId === receipt.ticketId &&
+        stored.deliveryJobId === receipt.deliveryJobId &&
+        stored.submissionGeneration === receipt.submissionGeneration &&
+        stored.providerMessageRef === receipt.providerMessageRef &&
+        stored.status === receipt.status &&
+        stored.occurredAt === receipt.occurredAt &&
+        stored.failureCategory === receipt.failureCategory);
+}
+const CALLBACK_FAILURE_CATEGORY = /^[a-z][a-z0-9_]{0,63}$/;
+const DEFAULT_CALLBACK_FAILURE_CATEGORY = "provider_callback_failure";
+function snapshotDeliveryCallback(input) {
+    if (input === null ||
+        (typeof input !== "object" && typeof input !== "function")) {
+        throw new TypeError("delivery callback must be an object");
+    }
+    const readString = (key) => {
+        const descriptor = Object.getOwnPropertyDescriptor(input, key);
+        if (descriptor === undefined || !Object.hasOwn(descriptor, "value")) {
+            throw new TypeError(`delivery callback ${key} must be an own data property`);
+        }
+        if (typeof descriptor.value !== "string") {
+            throw new TypeError(`delivery callback ${key} must be a string`);
+        }
+        return descriptor.value;
+    };
+    const readOptionalString = (key) => {
+        const descriptor = Object.getOwnPropertyDescriptor(input, key);
+        if (descriptor === undefined)
+            return undefined;
+        if (!Object.hasOwn(descriptor, "value")) {
+            throw new TypeError(`delivery callback ${key} must be a string`);
+        }
+        if (descriptor.value === undefined)
+            return undefined;
+        if (typeof descriptor.value !== "string") {
+            throw new TypeError(`delivery callback ${key} must be a string`);
+        }
+        return descriptor.value;
+    };
+    const generation = Object.getOwnPropertyDescriptor(input, "submissionGeneration");
+    if (generation === undefined ||
+        !Object.hasOwn(generation, "value") ||
+        typeof generation.value !== "number") {
+        throw new TypeError("delivery callback submissionGeneration must be an own numeric data property");
+    }
+    if (!Number.isSafeInteger(generation.value) ||
+        generation.value < 1 ||
+        generation.value > maxMailAttempts) {
+        throw new TypeError(`delivery callback submissionGeneration must be between 1 and ${maxMailAttempts}`);
+    }
+    const status = readString("status");
+    if (status !== "delivered" && status !== "failed") {
+        throw new TypeError("callback status must be delivered or failed");
+    }
+    const providerMessageRef = readOptionalString("providerMessageRef");
+    if (providerMessageRef !== undefined &&
+        (providerMessageRef.trim().length === 0 ||
+            providerMessageRef.length > 512 ||
+            /[\u0000-\u001F\u007F]/.test(providerMessageRef))) {
+        throw new TypeError("delivery callback providerMessageRef must be non-empty, at most 512 characters, and contain no controls");
+    }
+    const suppliedFailureCategory = readOptionalString("failureCategory");
+    if (status === "delivered" && suppliedFailureCategory !== undefined) {
+        throw new TypeError("a delivered callback cannot include a failureCategory");
+    }
+    const failureCategory = status === "failed"
+        ? (suppliedFailureCategory ?? DEFAULT_CALLBACK_FAILURE_CATEGORY)
+        : undefined;
+    if (failureCategory !== undefined &&
+        !CALLBACK_FAILURE_CATEGORY.test(failureCategory)) {
+        throw new TypeError("delivery callback failureCategory must be a coarse safe token");
+    }
+    return Object.freeze({
+        provider: readString("provider"),
+        providerEventId: readString("providerEventId"),
+        ticketId: readString("ticketId"),
+        deliveryJobId: readString("deliveryJobId"),
+        submissionGeneration: generation.value,
+        ...(providerMessageRef === undefined ? {} : { providerMessageRef }),
+        status,
+        occurredAt: readString("occurredAt"),
+        ...(failureCategory === undefined ? {} : { failureCategory }),
+    });
+}
+export async function recordDeliveryCallback(store, input, clock) {
+    const receipt = snapshotDeliveryCallback(input);
+    requireIdentifier(receipt.provider, "provider");
+    requireIdentifier(receipt.providerEventId, "providerEventId");
+    requireIdentifier(receipt.ticketId, "ticketId");
+    requireIdentifier(receipt.deliveryJobId, "deliveryJobId");
+    canonicalTimestamp(receipt.occurredAt, "occurredAt");
+    const callbackFailureCategory = receipt.status === "failed"
+        ? (receipt.failureCategory ?? DEFAULT_CALLBACK_FAILURE_CATEGORY)
+        : undefined;
+    const processedAt = clock.now();
+    canonicalTimestamp(processedAt, "clock.now()");
+    const receipts = store.collection(deliveryCallbackReceipts);
+    const location = await deliveryCallbackLocation(receipt.provider, receipt.providerEventId);
+    const inserted = await receipts.insertIfAbsent({
+        ...receipt,
+        ...location,
+    });
+    if (!callbackMatches(inserted.value, receipt)) {
+        throw new SupportDeskConflictError("A delivery callback idempotency key was reused for different input or its bounded hash slot collided");
+    }
+    if (!inserted.inserted && inserted.value.processedAt !== undefined) {
+        return { duplicate: true, job: null };
+    }
+    const records = store.collection(supportRecords);
+    const result = await supportMail.applyAuthenticatedCallback(records, {
+        partition: receipt.ticketId,
+        jobId: receipt.deliveryJobId,
+        submissionGeneration: receipt.submissionGeneration,
+        ...(receipt.providerMessageRef === undefined
+            ? {}
+            : { providerMessageRef: receipt.providerMessageRef }),
+        status: receipt.status,
+        occurredAt: receipt.occurredAt,
+        ...(callbackFailureCategory === undefined
+            ? {}
+            : { failureCategory: callbackFailureCategory }),
+    }, clock);
+    await receipts.update(callbackReceiptKey(location), (current) => current === null || current.processedAt !== undefined
+        ? { action: "keep" }
+        : {
+            action: "write",
+            value: { ...current, processedAt },
+        });
+    return {
+        duplicate: !inserted.inserted,
+        job: result === null
+            ? null
+            : {
+                kind: "delivery_job",
+                partition: result.partition,
+                id: `delivery:${result.id}`,
+                ticketId: result.partition,
+                messageId: result.contentRef,
+                job: result,
+            },
+    };
+}
+function snapshotReceiptSweepInput(input, field) {
+    const source = boundaryObject(input, field);
+    const raw = {
+        bucket: ownDataProperty(source, "bucket", `${field}.bucket`),
+        processedBefore: ownDataProperty(source, "processedBefore", `${field}.processedBefore`),
+        maxDeletes: ownDataProperty(source, "maxDeletes", `${field}.maxDeletes`, true),
+    };
+    if (raw.maxDeletes !== undefined && typeof raw.maxDeletes !== "number") {
+        throw new TypeError(`${field}.maxDeletes must be a number`);
+    }
+    return Object.freeze({
+        bucket: boundaryString(raw.bucket, `${field}.bucket`),
+        processedBefore: boundaryString(raw.processedBefore, `${field}.processedBefore`),
+        ...(raw.maxDeletes === undefined ? {} : { maxDeletes: raw.maxDeletes }),
+    });
+}
+export async function sweepInboundReceipts(store, clock, input) {
+    const request = snapshotReceiptSweepInput(input, "inbound receipt sweep");
+    const { bucket, processedBefore } = request;
+    if (bucket.length === 0 ||
+        bucket.length > 300 ||
+        /[\u0000-\u001F\u007F]/.test(bucket)) {
+        throw new TypeError("bucket must be at most 300 characters with no controls");
+    }
+    const now = canonicalTimestamp(clock.now(), "clock.now()");
+    const horizonBefore = new Date(now - inboundReceiptDedupeDays * 86_400_000).toISOString();
+    canonicalTimestamp(processedBefore, "processedBefore");
+    const maxDeletes = request.maxDeletes ?? 100;
+    if (!Number.isSafeInteger(maxDeletes) ||
+        maxDeletes <= 0 ||
+        maxDeletes > 1_000) {
+        throw new TypeError("maxDeletes must be between 1 and 1000");
+    }
+    const receipts = store.collection(inboundReceipts);
+    const candidates = (await receipts.listVersioned(bucket))
+        .filter((versioned) => versioned.value.status !== "processing" &&
+        versioned.value.processedAt !== undefined &&
+        versioned.value.processedAt <= processedBefore &&
+        versioned.value.processedAt < horizonBefore)
+        .slice(0, maxDeletes);
+    let deleted = 0;
+    for (const candidate of candidates) {
+        if (await receipts.deleteIfUnchanged({
+            partition: bucket,
+            id: receiptSlotId(candidate.value.slot, "inbound receipt slot"),
+        }, candidate.version)) {
+            deleted += 1;
+        }
+    }
+    return deleted;
+}
+export async function sweepDeliveryCallbackReceipts(store, clock, input) {
+    const request = snapshotReceiptSweepInput(input, "delivery callback receipt sweep");
+    const { bucket, processedBefore } = request;
+    if (bucket.length === 0 ||
+        bucket.length > 300 ||
+        /[\u0000-\u001F\u007F]/.test(bucket)) {
+        throw new TypeError("bucket must be at most 300 characters with no controls");
+    }
+    const now = canonicalTimestamp(clock.now(), "clock.now()");
+    const horizonBefore = new Date(now - deliveryCallbackDedupeDays * 86_400_000).toISOString();
+    canonicalTimestamp(processedBefore, "processedBefore");
+    const maxDeletes = request.maxDeletes ?? 100;
+    if (!Number.isSafeInteger(maxDeletes) ||
+        maxDeletes <= 0 ||
+        maxDeletes > 1_000) {
+        throw new TypeError("maxDeletes must be between 1 and 1000");
+    }
+    const receipts = store.collection(deliveryCallbackReceipts);
+    const candidates = (await receipts.listVersioned(bucket))
+        .filter((versioned) => versioned.value.processedAt !== undefined &&
+        versioned.value.processedAt <= processedBefore &&
+        versioned.value.processedAt < horizonBefore)
+        .slice(0, maxDeletes);
+    let deleted = 0;
+    for (const candidate of candidates) {
+        if (await receipts.deleteIfUnchanged({
+            partition: bucket,
+            id: receiptSlotId(candidate.value.slot, "delivery callback slot"),
+        }, candidate.version)) {
+            deleted += 1;
+        }
+    }
+    return deleted;
+}
+/**
+ * Remove stale ticket hints from one bounded principal index record.
+ *
+ * The index is never an authorization answer. A reserved hint may remain
+ * after a process stops before creating its ticket; this sweep confirms every
+ * hint against authoritative ticket state before retaining it.
+ */
+export async function pruneCustomerTicketIndex(store, principalId, input) {
+    requireIdentifier(principalId, "principalId");
+    const source = boundaryObject(input, "customer ticket index prune");
+    const reservedBefore = boundaryString(ownDataProperty(source, "reservedBefore", "customer ticket index prune.reservedBefore"), "customer ticket index prune.reservedBefore");
+    canonicalTimestamp(reservedBefore, "reservedBefore");
+    const index = store.collection(customerTicketIndex);
+    const records = store.collection(supportRecords);
+    const result = await index.update({ partition: principalId, id: "tickets" }, async (current) => {
+        if (current === null) {
+            return { action: "keep" };
+        }
+        const retained = [];
+        for (const entry of current.entries) {
+            const ticket = await records.get(ticketKey(entry.ticketId));
+            if (ticket?.kind === "ticket" &&
+                ticket.ticket.requester.association === "authenticated" &&
+                ticket.ticket.requester.principalId === principalId) {
+                retained.push({ ...entry, state: "confirmed" });
+                continue;
+            }
+            if (entry.state === "confirmed") {
+                continue;
+            }
+            if (entry.reservedAt >= reservedBefore) {
+                retained.push(entry);
+                continue;
+            }
+            const fence = await records.update(ticketReservationKey(entry.ticketId), (current) => {
+                if (current?.kind === "ticket_reservation" &&
+                    current.state === "committed") {
+                    return { action: "keep" };
+                }
+                if (current?.kind === "ticket_reservation" &&
+                    current.state === "cancelled" &&
+                    current.generation >= entry.reservationGeneration) {
+                    return { action: "keep" };
+                }
+                return {
+                    action: "write",
+                    value: {
+                        kind: "ticket_reservation",
+                        partition: entry.ticketId,
+                        id: "reservation",
+                        token: entry.reservationToken,
+                        generation: entry.reservationGeneration,
+                        state: "cancelled",
+                    },
+                };
+            });
+            if (fence.value?.kind === "ticket_reservation" &&
+                fence.value.state === "committed" &&
+                fence.value.token === entry.reservationToken &&
+                fence.value.generation === entry.reservationGeneration) {
+                retained.push({ ...entry, state: "confirmed" });
+            }
+        }
+        return retained.length === current.entries.length &&
+            retained.every((entry, position) => entry === current.entries[position])
+            ? { action: "keep" }
+            : {
+                action: "write",
+                value: { ...current, entries: retained },
+            };
+    });
+    return result.value?.entries.map((entry) => entry.ticketId) ?? [];
+}
+//# sourceMappingURL=index.js.map