@molecule/api-resource-message 1.0.0

package/dist/handlers/messages.js

@@ -0,0 +1,135 @@
+/**
+ * Send + list messages within a thread.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { getThreadById, listMessages, sendMessage } from '../service.js';
+import { sendMessageSchema } from '../validation.js';
+/**
+ * Lists messages in a thread, newest first.
+ *
+ * @param req - The request with `threadId` URL param and optional
+ *   `before` / `limit` query params.
+ * @param res - The response object.
+ */
+export async function listMessagesHandler(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const { threadId } = req.params;
+    if (!threadId) {
+        res.status(400).json({
+            error: t('message.error.missingThreadId', undefined, {
+                defaultValue: 'Thread ID is required',
+            }),
+            errorKey: 'message.error.missingThreadId',
+        });
+        return;
+    }
+    const thread = await getThreadById(threadId);
+    if (!thread) {
+        res.status(404).json({
+            error: t('message.error.threadNotFound', undefined, {
+                defaultValue: 'Thread not found',
+            }),
+            errorKey: 'message.error.threadNotFound',
+        });
+        return;
+    }
+    if (thread.participantAId !== userId && thread.participantBId !== userId) {
+        res.status(403).json({
+            error: t('message.error.notParticipant', undefined, {
+                defaultValue: 'You are not a participant in this thread',
+            }),
+            errorKey: 'message.error.notParticipant',
+        });
+        return;
+    }
+    const before = typeof req.query.before === 'string' ? req.query.before : undefined;
+    const limit = parseInt(req.query.limit, 10) || 50;
+    try {
+        const messages = await listMessages(threadId, { before, limit });
+        res.json({ data: messages, limit });
+    }
+    catch (error) {
+        logger.error('Failed to list messages', { threadId, error });
+        res.status(500).json({
+            error: t('message.error.listMessagesFailed', undefined, {
+                defaultValue: 'Failed to list messages',
+            }),
+            errorKey: 'message.error.listMessagesFailed',
+        });
+    }
+}
+/**
+ * Sends a new message in a thread. Authenticated user must be a
+ * participant. Broadcasts a `message:sent` event when realtime is bonded.
+ *
+ * @param req - The request with `threadId` URL param and message body.
+ * @param res - The response object.
+ */
+export async function sendMessageHandler(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const { threadId } = req.params;
+    if (!threadId) {
+        res.status(400).json({
+            error: t('message.error.missingThreadId', undefined, {
+                defaultValue: 'Thread ID is required',
+            }),
+            errorKey: 'message.error.missingThreadId',
+        });
+        return;
+    }
+    const parsed = sendMessageSchema.safeParse(req.body);
+    if (!parsed.success) {
+        const errors = parsed.error.issues.map((e) => `${e.path.join('.')}: ${e.message}`).join(', ');
+        res.status(400).json({ error: errors, errorKey: 'message.error.validationFailed' });
+        return;
+    }
+    try {
+        const message = await sendMessage(threadId, userId, parsed.data.body, parsed.data.attachments);
+        res.status(201).json(message);
+    }
+    catch (error) {
+        const errorMessage = error instanceof Error ? error.message : 'Unknown error';
+        if (errorMessage.includes('not found')) {
+            res.status(404).json({
+                error: t('message.error.threadNotFound', undefined, {
+                    defaultValue: 'Thread not found',
+                }),
+                errorKey: 'message.error.threadNotFound',
+            });
+            return;
+        }
+        if (errorMessage.includes('not a participant')) {
+            res.status(403).json({
+                error: t('message.error.notParticipant', undefined, {
+                    defaultValue: 'You are not a participant in this thread',
+                }),
+                errorKey: 'message.error.notParticipant',
+            });
+            return;
+        }
+        logger.error('Failed to send message', { threadId, userId, error });
+        res.status(500).json({
+            error: t('message.error.sendFailed', undefined, {
+                defaultValue: 'Failed to send message',
+            }),
+            errorKey: 'message.error.sendFailed',
+        });
+    }
+}

package/dist/handlers/readThread.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Read a single thread by ID.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Returns the thread identified by `:threadId`. The authenticated user
+ * must be a participant.
+ *
+ * @param req - The request with `threadId` URL param.
+ * @param res - The response object.
+ */
+export declare function readThread(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=readThread.d.ts.map

package/dist/handlers/readThread.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"readThread.d.ts","sourceRoot":"","sources":["../../src/handlers/readThread.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAmD3F"}

package/dist/handlers/readThread.js

@@ -0,0 +1,66 @@
+/**
+ * Read a single thread by ID.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { getThreadById } from '../service.js';
+/**
+ * Returns the thread identified by `:threadId`. The authenticated user
+ * must be a participant.
+ *
+ * @param req - The request with `threadId` URL param.
+ * @param res - The response object.
+ */
+export async function readThread(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    const { threadId } = req.params;
+    if (!threadId) {
+        res.status(400).json({
+            error: t('message.error.missingThreadId', undefined, {
+                defaultValue: 'Thread ID is required',
+            }),
+            errorKey: 'message.error.missingThreadId',
+        });
+        return;
+    }
+    try {
+        const thread = await getThreadById(threadId);
+        if (!thread) {
+            res.status(404).json({
+                error: t('message.error.threadNotFound', undefined, {
+                    defaultValue: 'Thread not found',
+                }),
+                errorKey: 'message.error.threadNotFound',
+            });
+            return;
+        }
+        if (thread.participantAId !== userId && thread.participantBId !== userId) {
+            res.status(403).json({
+                error: t('message.error.notParticipant', undefined, {
+                    defaultValue: 'You are not a participant in this thread',
+                }),
+                errorKey: 'message.error.notParticipant',
+            });
+            return;
+        }
+        res.json(thread);
+    }
+    catch (error) {
+        logger.error('Failed to read thread', { threadId, error });
+        res.status(500).json({
+            error: t('message.error.readThreadFailed', undefined, {
+                defaultValue: 'Failed to read thread',
+            }),
+            errorKey: 'message.error.readThreadFailed',
+        });
+    }
+}

package/dist/handlers/unreadCount.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Total unread count across all the authenticated user's threads.
+ *
+ * @module
+ */
+import type { MoleculeRequest, MoleculeResponse } from '@molecule/api-resource';
+/**
+ * Returns the authenticated user's total unread message count.
+ *
+ * @param req - The request.
+ * @param res - The response object.
+ */
+export declare function unreadCount(req: MoleculeRequest, res: MoleculeResponse): Promise<void>;
+//# sourceMappingURL=unreadCount.d.ts.map

package/dist/handlers/unreadCount.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unreadCount.d.ts","sourceRoot":"","sources":["../../src/handlers/unreadCount.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AAI/E;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsB5F"}

package/dist/handlers/unreadCount.js

@@ -0,0 +1,37 @@
+/**
+ * Total unread count across all the authenticated user's threads.
+ *
+ * @module
+ */
+import { t } from '@molecule/api-i18n';
+import { logger } from '@molecule/api-logger';
+import { getTotalUnreadCount } from '../service.js';
+/**
+ * Returns the authenticated user's total unread message count.
+ *
+ * @param req - The request.
+ * @param res - The response object.
+ */
+export async function unreadCount(req, res) {
+    const userId = res.locals.session?.userId;
+    if (!userId) {
+        res.status(401).json({
+            error: t('resource.error.unauthorized', undefined, { defaultValue: 'Unauthorized' }),
+            errorKey: 'resource.error.unauthorized',
+        });
+        return;
+    }
+    try {
+        const total = await getTotalUnreadCount(userId);
+        res.json({ unreadCount: total });
+    }
+    catch (error) {
+        logger.error('Failed to get unread count', { userId, error });
+        res.status(500).json({
+            error: t('message.error.unreadCountFailed', undefined, {
+                defaultValue: 'Failed to get unread count',
+            }),
+            errorKey: 'message.error.unreadCountFailed',
+        });
+    }
+}

package/dist/i18n.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Locale registration for the message resource.
+ *
+ * @module
+ */
+/**
+ * The i18n registered.
+ */
+export declare const i18nRegistered = true;
+//# sourceMappingURL=i18n.d.ts.map

package/dist/i18n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"i18n.d.ts","sourceRoot":"","sources":["../src/i18n.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAWH;;GAEG;AACH,eAAO,MAAM,cAAc,OAAO,CAAA"}

package/dist/i18n.js

@@ -0,0 +1,17 @@
+/**
+ * Locale registration for the message resource.
+ *
+ * @module
+ */
+import { registerLocaleModule } from '@molecule/api-i18n';
+try {
+    const locales = await import('@molecule/api-locales-resource-message');
+    registerLocaleModule(locales);
+}
+catch (_error) {
+    // Locale package not available — translations fall back to inline defaults.
+}
+/**
+ * The i18n registered.
+ */
+export const i18nRegistered = true;

package/dist/index.d.ts

@@ -0,0 +1,82 @@
+/**
+ * 1:1 messaging resource for molecule.dev.
+ *
+ * Direct-message threads between two participants with read-tracking,
+ * unread counters, optional attachments, and realtime broadcast over
+ * `@molecule/api-realtime` when bonded.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { routes, requestHandlerMap } from '@molecule/api-resource-message'
+ *
+ * // Wire routes into your Express app via mlcl inject
+ * // POST   /message-threads
+ * // GET    /message-threads
+ * // GET    /message-threads/unread-count
+ * // GET    /message-threads/:threadId
+ * // GET    /message-threads/:threadId/messages
+ * // POST   /message-threads/:threadId/messages
+ * // POST   /message-threads/:threadId/read
+ * // PATCH  /message-threads/messages/:messageId
+ * // DELETE /message-threads/messages/:messageId
+ * ```
+ *
+ * @remarks
+ * Tables: `src/__setup__/messages.sql` creates `message_threads` + `messages`.
+ * An mlcl-scaffolded API replays `__setup__/*.sql` automatically on migrate;
+ * anywhere else run it once — nothing at runtime creates them.
+ *
+ * Threads are strictly 1:1 — a canonicalised participant pair (creating a
+ * thread with yourself throws) — and PARTICIPANT-SCOPED: every handler reads
+ * the authenticated user from `res.locals.session` (401 without a session;
+ * mount behind your global auth middleware) and rejects non-participants with
+ * 403/404. The sender is always the session user — never accept a sender id
+ * from the request body.
+ *
+ * Realtime delivery is best-effort — messages are persisted before any
+ * broadcast attempt and a missing realtime bond is silently a no-op.
+ * Subscribers should listen on `threadRoomId(threadId)` for
+ * {@link MESSAGE_REALTIME_EVENTS} payloads.
+ *
+ * User-facing strings go through `t(key, …, { defaultValue })`; translations
+ * ship in the companion `@molecule/api-locales-resource-message` bond.
+ *
+ * @e2e
+ * Integration checklist — drive the real messaging UI (live preview, no
+ * mocks), adapt each item to this app's actual threads/screens, and check
+ * every box off one by one. A box you can't check is an integration bug to
+ * fix — not a skip. Messaging PRIVACY is the point here, so the last item is
+ * not optional:
+ * - [ ] Sending a message in a thread persists it and it appears in that
+ *   thread for BOTH participants in chronological (`createdAt`) order, stamped
+ *   with the sender and a timestamp. Send from each side and confirm both see
+ *   the same ordered transcript.
+ * - [ ] Read / unread works: a message you send is unread for the recipient —
+ *   their thread badge and `GET /message-threads/unread-count` increment;
+ *   opening the thread and marking it read (`POST /message-threads/:threadId/read`)
+ *   clears that side's unread count to zero and the total badge drops to match.
+ * - [ ] Editing a message shows an edited state (an "edited" marker /
+ *   `editedAt`) and deleting it removes it or renders a "message was deleted"
+ *   tombstone (`deletedAt`) — and ONLY the author can edit or delete their OWN
+ *   message: the other participant gets no edit/delete affordance and a forged
+ *   PATCH/DELETE on someone else's message is rejected, never applied.
+ * - [ ] Delivery to the other participant: with `@molecule/api-realtime`
+ *   bonded, a new message appears in their already-open thread WITHOUT a
+ *   reload; with no realtime bond it appears on their next load/refresh.
+ * - [ ] PRIVACY / AUTHORIZATION — a thread and its messages are visible ONLY
+ *   to its two participants. Sign in as a THIRD user and confirm they cannot
+ *   read the thread or any message by guessing its id (403/404), cannot post
+ *   into a thread they are not part of (403), and cannot spoof the sender —
+ *   the sender is always the session user, never a request-body field.
+ */
+export * from './authorizers/index.js';
+export * from './browser-guard.js';
+export * from './handlers/index.js';
+export * from './i18n.js';
+export * from './requestHandlerMap.js';
+export * from './routes.js';
+export * from './service.js';
+export * from './types.js';
+export * from './validation.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuEG;AAEH,cAAc,wBAAwB,CAAA;AACtC,cAAc,oBAAoB,CAAA;AAClC,cAAc,qBAAqB,CAAA;AACnC,cAAc,WAAW,CAAA;AACzB,cAAc,wBAAwB,CAAA;AACtC,cAAc,aAAa,CAAA;AAC3B,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA"}

package/dist/index.js

@@ -0,0 +1,81 @@
+/**
+ * 1:1 messaging resource for molecule.dev.
+ *
+ * Direct-message threads between two participants with read-tracking,
+ * unread counters, optional attachments, and realtime broadcast over
+ * `@molecule/api-realtime` when bonded.
+ *
+ * @module
+ * @example
+ * ```typescript
+ * import { routes, requestHandlerMap } from '@molecule/api-resource-message'
+ *
+ * // Wire routes into your Express app via mlcl inject
+ * // POST   /message-threads
+ * // GET    /message-threads
+ * // GET    /message-threads/unread-count
+ * // GET    /message-threads/:threadId
+ * // GET    /message-threads/:threadId/messages
+ * // POST   /message-threads/:threadId/messages
+ * // POST   /message-threads/:threadId/read
+ * // PATCH  /message-threads/messages/:messageId
+ * // DELETE /message-threads/messages/:messageId
+ * ```
+ *
+ * @remarks
+ * Tables: `src/__setup__/messages.sql` creates `message_threads` + `messages`.
+ * An mlcl-scaffolded API replays `__setup__/*.sql` automatically on migrate;
+ * anywhere else run it once — nothing at runtime creates them.
+ *
+ * Threads are strictly 1:1 — a canonicalised participant pair (creating a
+ * thread with yourself throws) — and PARTICIPANT-SCOPED: every handler reads
+ * the authenticated user from `res.locals.session` (401 without a session;
+ * mount behind your global auth middleware) and rejects non-participants with
+ * 403/404. The sender is always the session user — never accept a sender id
+ * from the request body.
+ *
+ * Realtime delivery is best-effort — messages are persisted before any
+ * broadcast attempt and a missing realtime bond is silently a no-op.
+ * Subscribers should listen on `threadRoomId(threadId)` for
+ * {@link MESSAGE_REALTIME_EVENTS} payloads.
+ *
+ * User-facing strings go through `t(key, …, { defaultValue })`; translations
+ * ship in the companion `@molecule/api-locales-resource-message` bond.
+ *
+ * @e2e
+ * Integration checklist — drive the real messaging UI (live preview, no
+ * mocks), adapt each item to this app's actual threads/screens, and check
+ * every box off one by one. A box you can't check is an integration bug to
+ * fix — not a skip. Messaging PRIVACY is the point here, so the last item is
+ * not optional:
+ * - [ ] Sending a message in a thread persists it and it appears in that
+ *   thread for BOTH participants in chronological (`createdAt`) order, stamped
+ *   with the sender and a timestamp. Send from each side and confirm both see
+ *   the same ordered transcript.
+ * - [ ] Read / unread works: a message you send is unread for the recipient —
+ *   their thread badge and `GET /message-threads/unread-count` increment;
+ *   opening the thread and marking it read (`POST /message-threads/:threadId/read`)
+ *   clears that side's unread count to zero and the total badge drops to match.
+ * - [ ] Editing a message shows an edited state (an "edited" marker /
+ *   `editedAt`) and deleting it removes it or renders a "message was deleted"
+ *   tombstone (`deletedAt`) — and ONLY the author can edit or delete their OWN
+ *   message: the other participant gets no edit/delete affordance and a forged
+ *   PATCH/DELETE on someone else's message is rejected, never applied.
+ * - [ ] Delivery to the other participant: with `@molecule/api-realtime`
+ *   bonded, a new message appears in their already-open thread WITHOUT a
+ *   reload; with no realtime bond it appears on their next load/refresh.
+ * - [ ] PRIVACY / AUTHORIZATION — a thread and its messages are visible ONLY
+ *   to its two participants. Sign in as a THIRD user and confirm they cannot
+ *   read the thread or any message by guessing its id (403/404), cannot post
+ *   into a thread they are not part of (403), and cannot spoof the sender —
+ *   the sender is always the session user, never a request-body field.
+ */
+export * from './authorizers/index.js';
+export * from './browser-guard.js';
+export * from './handlers/index.js';
+export * from './i18n.js';
+export * from './requestHandlerMap.js';
+export * from './routes.js';
+export * from './service.js';
+export * from './types.js';
+export * from './validation.js';

package/dist/requestHandlerMap.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Maps route handler names to their implementations.
+ *
+ * @module
+ */
+import { createThread } from './handlers/createThread.js';
+import { deleteMessageHandler } from './handlers/deleteMessage.js';
+import { editMessageHandler } from './handlers/editMessage.js';
+import { listThreads } from './handlers/listThreads.js';
+import { markReadHandler } from './handlers/markRead.js';
+import { listMessagesHandler, sendMessageHandler } from './handlers/messages.js';
+import { readThread } from './handlers/readThread.js';
+import { unreadCount } from './handlers/unreadCount.js';
+/**
+ * Handler map for message resource routes.
+ */
+export declare const requestHandlerMap: {
+    readonly createThread: typeof createThread;
+    readonly listThreads: typeof listThreads;
+    readonly readThread: typeof readThread;
+    readonly listMessages: typeof listMessagesHandler;
+    readonly sendMessage: typeof sendMessageHandler;
+    readonly markRead: typeof markReadHandler;
+    readonly editMessage: typeof editMessageHandler;
+    readonly deleteMessage: typeof deleteMessageHandler;
+    readonly unreadCount: typeof unreadCount;
+};
+//# sourceMappingURL=requestHandlerMap.d.ts.map

package/dist/requestHandlerMap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestHandlerMap.d.ts","sourceRoot":"","sources":["../src/requestHandlerMap.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,4BAA4B,CAAA;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAA;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAA;AAC9D,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAA;AACxD,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAChF,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AAEvD;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;CAUpB,CAAA"}

package/dist/requestHandlerMap.js

@@ -0,0 +1,27 @@
+/**
+ * Maps route handler names to their implementations.
+ *
+ * @module
+ */
+import { createThread } from './handlers/createThread.js';
+import { deleteMessageHandler } from './handlers/deleteMessage.js';
+import { editMessageHandler } from './handlers/editMessage.js';
+import { listThreads } from './handlers/listThreads.js';
+import { markReadHandler } from './handlers/markRead.js';
+import { listMessagesHandler, sendMessageHandler } from './handlers/messages.js';
+import { readThread } from './handlers/readThread.js';
+import { unreadCount } from './handlers/unreadCount.js';
+/**
+ * Handler map for message resource routes.
+ */
+export const requestHandlerMap = {
+    createThread,
+    listThreads,
+    readThread,
+    listMessages: listMessagesHandler,
+    sendMessage: sendMessageHandler,
+    markRead: markReadHandler,
+    editMessage: editMessageHandler,
+    deleteMessage: deleteMessageHandler,
+    unreadCount,
+};

package/dist/routes.d.ts

@@ -0,0 +1,58 @@
+/**
+ * Message resource route definitions.
+ *
+ * Declarative routing — `mlcl inject` reads these to generate the
+ * Express router.
+ *
+ * @module
+ */
+/**
+ * Routes for 1:1 message threads, messages, and read-tracking.
+ */
+export declare const routes: readonly [{
+    readonly method: "post";
+    readonly path: "/message-threads";
+    readonly handler: "createThread";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/message-threads";
+    readonly handler: "listThreads";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/message-threads/unread-count";
+    readonly handler: "unreadCount";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/message-threads/:threadId";
+    readonly handler: "readThread";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "get";
+    readonly path: "/message-threads/:threadId/messages";
+    readonly handler: "listMessages";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "post";
+    readonly path: "/message-threads/:threadId/messages";
+    readonly handler: "sendMessage";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "post";
+    readonly path: "/message-threads/:threadId/read";
+    readonly handler: "markRead";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "patch";
+    readonly path: "/message-threads/messages/:messageId";
+    readonly handler: "editMessage";
+    readonly middlewares: readonly ["authenticate"];
+}, {
+    readonly method: "delete";
+    readonly path: "/message-threads/messages/:messageId";
+    readonly handler: "deleteMessage";
+    readonly middlewares: readonly ["authenticate"];
+}];
+//# sourceMappingURL=routes.d.ts.map

package/dist/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../src/routes.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;GAEG;AACH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuDT,CAAA"}

package/dist/routes.js

@@ -0,0 +1,67 @@
+/**
+ * Message resource route definitions.
+ *
+ * Declarative routing — `mlcl inject` reads these to generate the
+ * Express router.
+ *
+ * @module
+ */
+/**
+ * Routes for 1:1 message threads, messages, and read-tracking.
+ */
+export const routes = [
+    {
+        method: 'post',
+        path: '/message-threads',
+        handler: 'createThread',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'get',
+        path: '/message-threads',
+        handler: 'listThreads',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'get',
+        path: '/message-threads/unread-count',
+        handler: 'unreadCount',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'get',
+        path: '/message-threads/:threadId',
+        handler: 'readThread',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'get',
+        path: '/message-threads/:threadId/messages',
+        handler: 'listMessages',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'post',
+        path: '/message-threads/:threadId/messages',
+        handler: 'sendMessage',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'post',
+        path: '/message-threads/:threadId/read',
+        handler: 'markRead',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'patch',
+        path: '/message-threads/messages/:messageId',
+        handler: 'editMessage',
+        middlewares: ['authenticate'],
+    },
+    {
+        method: 'delete',
+        path: '/message-threads/messages/:messageId',
+        handler: 'deleteMessage',
+        middlewares: ['authenticate'],
+    },
+];