@@ -3,27 +3,23 @@ import type { NextConfig } from "next"
 const isDev = process.env.NODE_ENV !== "production"
 
 /**
- * Content Security Policy. Email bodies are rendered inside sandboxed
- * iframes without script execution, so remote content can never run code.
+ * Page CSP (with a per-request script nonce) is set in `src/proxy.ts`. API
+ * routes skip the proxy, so they get this static policy without any inline
+ * script allowance.
  */
-const csp = [
+const apiCsp = [
   "default-src 'self'",
-  `script-src 'self' 'unsafe-inline'${isDev ? " 'unsafe-eval'" : ""} https://js.stripe.com`,
+  "script-src 'self'",
   "style-src 'self' 'unsafe-inline'",
-  "img-src 'self' data: blob: https: http:",
+  "img-src 'self' data: blob: https:",
   "font-src 'self' data:",
-  "media-src 'self' blob: data:",
-  `connect-src 'self'${isDev ? " ws: wss:" : ""} https://api.stripe.com`,
-  "frame-src 'self' blob: https://js.stripe.com https://checkout.stripe.com",
   "frame-ancestors 'none'",
   "object-src 'none'",
   "base-uri 'self'",
-  "form-action 'self' https://checkout.stripe.com https://billing.stripe.com https://accounts.google.com https://login.microsoftonline.com",
-  ...(isDev ? [] : ["upgrade-insecure-requests"]),
+  "form-action 'self'",
 ].join("; ")
 
 const securityHeaders = [
-  { key: "Content-Security-Policy", value: csp },
   { key: "X-Content-Type-Options", value: "nosniff" },
   { key: "X-Frame-Options", value: "DENY" },
   { key: "Referrer-Policy", value: "strict-origin-when-cross-origin" },
@@ -39,15 +35,15 @@ const nextConfig: NextConfig = {
   allowedDevOrigins: ["127.0.0.1"],
   reactStrictMode: true,
   serverExternalPackages: ["imapflow", "mailparser", "nodemailer", "sanitize-html", "postgres"],
-  images: {
-    remotePatterns: [{ protocol: "https", hostname: "**" }],
-  },
+  // next/image isn't used; without optimization `/_next/image` can't be abused as an open image proxy
+  images: { unoptimized: true },
   experimental: {
     serverActions: { bodySizeLimit: "30mb" },
   },
   async headers() {
     return [
       { source: "/:path*", headers: securityHeaders },
+      { source: "/api/:path*", headers: [{ key: "Content-Security-Policy", value: apiCsp }] },
       // Downloaded attachments / inline previews: never run scripts in our origin.
       {
         source: "/api/w/:slug/attachments/:id",
 
@@ -1,5 +1,6 @@
 import { z } from "zod"
 import { ApiError, json, parseJson, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { getConversationAccess } from "@/server/access"
 import { assertAiAvailable, draftReply, toApiError } from "@/server/ai"
 
@@ -16,6 +17,7 @@ const body = z.object({
 /** POST /api/w/[slug]/ai/draft { conversationId, tone?, instructions?, currentDraft? } → { text, html } */
 export const POST = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "conversations.read")
   const input = await parseJson(req, body)
   const access = await getConversationAccess(ctx, input.conversationId)
   if (!access) throw new ApiError(404, "Conversation not found", "not_found")
 
@@ -1,5 +1,6 @@
 import { z } from "zod"
 import { ApiError, json, parseJson, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { getConversationAccess } from "@/server/access"
 import { assertAiAvailable, cachedSummary, storeSummary, summarizeConversation, toApiError } from "@/server/ai"
 
@@ -10,6 +11,7 @@ const body = z.object({ conversationId: z.uuid(), refresh: z.boolean().optional(
 /** POST /api/w/[slug]/ai/summarize { conversationId, refresh? } → { summary, cached } */
 export const POST = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "conversations.read")
   const { conversationId, refresh } = await parseJson(req, body)
   const access = await getConversationAccess(ctx, conversationId)
   if (!access) throw new ApiError(404, "Conversation not found", "not_found")
 
@@ -1,6 +1,7 @@
 import { and, eq } from "drizzle-orm"
 import { db, schema } from "@/server/db"
 import { ApiError, json, parseJson, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { assertWritable } from "@/server/authz"
 import { audit } from "@/server/audit"
 import {
@@ -24,6 +25,7 @@ type P = { slug: string; contactId: string }
 async function load(req: Parameters<typeof requireApiOrg>[0], params: Promise<P>) {
   const { slug, contactId } = await params
   const ctx = await requireApiOrg(req, slug)
+  assertApiScope(ctx, "contacts.read")
   const contact = isUuid(contactId) ? await getContact(ctx, contactId) : null
   if (!contact) throw new ApiError(404, "Contact not found", "not_found")
   return { ctx, contact }
 
@@ -1,5 +1,6 @@
 import { z } from "zod"
 import { ApiError, parseQuery, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { searchContacts } from "@/server/contacts"
 
 type P = { slug: string }
@@ -22,6 +23,7 @@ function csvCell(value: unknown) {
 export const GET = route<P>(async (req, { params }) => {
   const { slug } = await params
   const ctx = await requireApiOrg(req, slug)
+  assertApiScope(ctx, "contacts.read")
   if (!ctx.permissions.has("contacts.manage") && !ctx.permissions.has("conversations.export")) {
     throw new ApiError(403, "You don't have permission to export contacts", "forbidden")
   }
 
@@ -2,6 +2,7 @@ import { z } from "zod"
 import { and, eq, inArray, isNull, or, sql } from "drizzle-orm"
 import { db, schema } from "@/server/db"
 import { ApiError, json, parseJson, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { assertWritable } from "@/server/authz"
 import { audit } from "@/server/audit"
 import { rateLimit } from "@/server/rate-limit"
@@ -30,6 +31,7 @@ const body = z.object({
 /** POST /api/w/[slug]/contacts/import → { created, updated, skipped, invalid } */
 export const POST = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "contacts.read")
   assertWritable(ctx)
   const input = await parseJson(req, body)
   if (!input.isPrivate && !ctx.permissions.has("contacts.manage")) {
 
@@ -1,5 +1,6 @@
 import { z } from "zod"
 import { ApiError, json, parseQuery, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { contactDto, getContactByEmail, isValidEmail, normalizeEmail, recentConversationsFor } from "@/server/contacts"
 
 type P = { slug: string }
@@ -12,6 +13,7 @@ const query = z.object({ email: z.string().max(254), limit: z.coerce.number().in
  */
 export const GET = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "contacts.read")
   const { email: raw, limit } = parseQuery(req, query)
   const email = normalizeEmail(raw)
   if (!isValidEmail(email)) throw new ApiError(400, "Invalid email address", "validation_error")
 
@@ -2,6 +2,7 @@ import { z } from "zod"
 import { and, eq, inArray } from "drizzle-orm"
 import { db, schema } from "@/server/db"
 import { ApiError, json, parseJson, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { assertWritable } from "@/server/authz"
 import { audit } from "@/server/audit"
 import {
@@ -29,6 +30,7 @@ const body = z.object({
  */
 export const POST = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "contacts.read")
   assertWritable(ctx)
   const { targetId, sourceIds } = await parseJson(req, body)
   const ids = [...new Set([targetId, ...sourceIds])]
@@ -37,7 +39,7 @@ export const POST = route<P>(async (req, { params }) => {
   const rows = await db
     .select()
     .from(schema.contacts)
-    .where(and(visibleContactsWhere(ctx), inArray(schema.contacts.id, ids)))
+    .where(and(await visibleContactsWhere(ctx), inArray(schema.contacts.id, ids)))
   const target = rows.find((r) => r.id === targetId)
   const sources = rows.filter((r) => r.id !== targetId)
   if (!target || sources.length !== ids.length - 1) throw new ApiError(404, "Contact not found", "not_found")
 
@@ -1,6 +1,7 @@
 import { z } from "zod"
 import { db, schema } from "@/server/db"
 import { ApiError, json, parseJson, parseQuery, requireApiOrg, route } from "@/server/api"
+import { assertApiScope } from "@/server/conversations/context"
 import { assertWritable } from "@/server/authz"
 import {
   contactDto,
@@ -32,6 +33,7 @@ const listQuery = z.object({
 /** GET /api/w/[slug]/contacts?q&company&tag&scope&sort&limit&offset&facets=1 */
 export const GET = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "contacts.read")
   const query = parseQuery(req, listQuery)
   const [result, facets] = await Promise.all([
     searchContacts(ctx, query),
@@ -47,6 +49,7 @@ export const GET = route<P>(async (req, { params }) => {
 /** POST /api/w/[slug]/contacts → ContactDto */
 export const POST = route<P>(async (req, { params }) => {
   const ctx = await requireApiOrg(req, (await params).slug)
+  assertApiScope(ctx, "contacts.read")
   assertWritable(ctx)
   const input = await parseJson(req, contactInput)
   const email = normalizeEmail(input.email)
 
@@ -2,27 +2,33 @@ import type { NextRequest } from "next/server"
 import { and, eq, gt, isNull, or } from "drizzle-orm"
 import { errorResponse, requireApiOrg } from "@/server/api"
 import { SESSION_COOKIE, validateSessionToken } from "@/server/auth/session"
-import { subscribe } from "@/server/realtime"
+import { subscribe, type RealtimeEvent } from "@/server/realtime"
 import { db, schema } from "@/server/db"
+import { getAccountAccess, visibleConversationIds } from "@/server/access"
+import { assertApiScope } from "@/server/conversations/context"
 
 export const dynamic = "force-dynamic"
 export const runtime = "nodejs"
 
 const HEARTBEAT_MS = 20_000
 const RECHECK_MS = 5 * 60_000
+const VISIBILITY_TTL_MS = 30_000
 
 /**
  * GET /api/w/[slug]/events — Server-Sent Events stream of realtime events
  * for this workspace (`data: RealtimeEvent` JSON per message). Events with
- * `userIds` are only delivered to those users. Clients refetch data on events;
- * visibility is enforced by the regular API. Heartbeat comment every 20s; the
- * session and membership are re-validated every 5 minutes.
+ * `userIds` are only delivered to those users; events about a conversation
+ * only to members who can see it (cached per connection for 30s). Clients
+ * refetch data on events; the regular API enforces visibility as well.
+ * Heartbeat comment every 20s; the session and membership are re-validated
+ * every 5 minutes.
  */
 export async function GET(req: NextRequest, { params }: { params: Promise<{ slug: string }> }) {
   const { slug } = await params
   let ctx: Awaited<ReturnType<typeof requireApiOrg>>
   try {
     ctx = await requireApiOrg(req, slug)
+    assertApiScope(ctx, "conversations.read")
   } catch (err) {
     return errorResponse(err)
   }
@@ -33,6 +39,31 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ slug
   let closed = false
   let cleanup = () => {}
 
+  const visibility = new Map<string, { visible: boolean; at: number }>()
+  let accounts: { ids: string[]; at: number } | null = null
+  const canSee = async (conversationId: string) => {
+    const now = Date.now()
+    const hit = visibility.get(conversationId)
+    if (hit && now - hit.at < VISIBILITY_TTL_MS) return hit.visible
+    if (!accounts || now - accounts.at >= VISIBILITY_TTL_MS) accounts = { ids: [...(await getAccountAccess(ctx)).keys()], at: now }
+    const visible = (await visibleConversationIds(ctx, [conversationId], accounts.ids)).has(conversationId)
+    if (visibility.size >= 5000) visibility.clear()
+    visibility.set(conversationId, { visible, at: now })
+    return visible
+  }
+  /** Explicitly addressed events and my own always arrive; other conversation events need visibility. */
+  const deliverable = async (event: RealtimeEvent) => {
+    if (!event.conversationId) return true
+    if (event.userIds) {
+      // Addressed to me about this conversation (assigned, mentioned...): its visibility may have changed.
+      visibility.delete(event.conversationId)
+      return true
+    }
+    if (event.actorId === me) return true
+    return canSee(event.conversationId).catch(() => false)
+  }
+  let queue = Promise.resolve()
+
   const stream = new ReadableStream<Uint8Array>({
     async start(controller) {
       const send = (chunk: string) => {
@@ -49,9 +80,13 @@ export async function GET(req: NextRequest, { params }: { params: Promise<{ slug
       const unsubscribe = await subscribe((event) => {
         if (event.orgId !== orgId) return
         if (event.userIds && !event.userIds.includes(me)) return
-        const { userIds: _recipients, ...payload } = event
-        void _recipients
-        send(`data: ${JSON.stringify(payload)}\n\n`)
+        // Chained to keep the order of events while visibility is checked.
+        queue = queue.then(async () => {
+          if (closed || !(await deliverable(event))) return
+          const { userIds: _recipients, ...payload } = event
+          void _recipients
+          send(`data: ${JSON.stringify(payload)}\n\n`)
+        })
       })
       const heartbeat = setInterval(() => send(`: ping ${Date.now()}\n\n`), HEARTBEAT_MS)
       const recheck = setInterval(async () => {