- Shipped
- November 12, 2026 at 1:16 AM UTC
- Author
- Kamo
- Commit
- 5529c35
Member-pinned chat (<kamo-chat member-id>): - bootstrap ?memberId= returns the member's public card (shared PublicOfficerCard: ACTIVE, unlocked TeamMember of the key's org only; anything else ignored) plus mortgageLender (shared MortgageBusiness). Never for a SPECIFIC_AGENT integration (its officer comes from a signed token). - createSupportSession / AI handoff take memberId: vetted the same way, stored on the conversation **************** and assigned straight to that member via assignToPreferredAgent (ASSIGNED notification, no queue-wide NEW_TICKET). - Narrow access exception **************** the pinned member reaches THAT conversation without **************** - ticket detail + join, session read fallback (thread/STOMP/attachments), status changes, their own ticket list **************** the pending-count badge and its live push. Nothing else: no queue, no other ticket, no settings; leaving the company ends it. Missed-message email already follows the assignee. Cross-site continuation: - POST /sessions/support/transfer mints a 10-minute, single-use, 256-bit token (SHA-256 in Redis chat:transfer:*) bound to the conversation + org; POST /sessions/support/resume redeems it with an atomic GET+DEL, only through a key of the same org, returning the same session. Every failure is one 404. Web addresses: - PUT /web-chat-integrations/{id} accepts allowedOrigins: normalized to bare origins, never empty (blank = any website), written to the KEY and mirrored to websiteUrl; busts the gateway key cache. The DTO now carries the key's allowedOrigins.