@open-mercato/core 0.4.5-develop-5191db4ef3 → 0.4.5-develop-9f9549ebc8

package/dist/modules/messages/api/[id]/route.js

@@ -0,0 +1,350 @@
+import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { User } from "../../../auth/data/entities.js";
+import { Message, MessageObject, MessageRecipient } from "../../data/entities.js";
+import { updateDraftSchema } from "../../data/validators.js";
+import { buildResolvedMessageActions } from "../../lib/actions.js";
+import { getMessageObjectType } from "../../lib/message-objects-registry.js";
+import { getMessageTypeOrDefault } from "../../lib/message-types-registry.js";
+import { attachOperationMetadataHeader } from "../../lib/operationMetadata.js";
+import { hasOrganizationAccess, resolveMessageContext } from "../../lib/routeHelpers.js";
+import {
+  errorResponseSchema,
+  messageDetailResponseSchema,
+  okResponseSchema,
+  updateDraftSchema as updateDraftOpenApiSchema
+} from "../openapi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["messages.view"] },
+  PATCH: { requireAuth: true, requireFeatures: ["messages.compose"] },
+  DELETE: { requireAuth: true, requireFeatures: ["messages.view"] }
+};
+async function GET(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em");
+  const url = new URL(req.url);
+  const skipMarkReadParam = url.searchParams.get("skipMarkRead");
+  const skipMarkRead = skipMarkReadParam === "1";
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null
+  });
+  const isSender = message.senderUserId === scope.userId;
+  const isRecipient = Boolean(recipient);
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (!skipMarkRead && recipient && recipient.status === "unread") {
+    const commandBus = ctx.container.resolve("commandBus");
+    await commandBus.execute("messages.recipients.mark_read", {
+      input: {
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req
+      }
+    });
+  }
+  const objects = await em.find(MessageObject, { messageId: params.id });
+  const objectPreviews = await Promise.all(
+    objects.map(async (item) => {
+      const objectType = getMessageObjectType(item.entityModule, item.entityType);
+      if (!objectType?.loadPreview) return null;
+      try {
+        return await objectType.loadPreview(item.entityId, {
+          tenantId: scope.tenantId,
+          organizationId: scope.organizationId
+        });
+      } catch (error) {
+        console.error(
+          `[messages] Failed to load preview for ${item.entityModule}:${item.entityType}:${item.entityId}`,
+          error
+        );
+        return null;
+      }
+    })
+  );
+  const allRecipients = await em.find(MessageRecipient, { messageId: params.id, deletedAt: null });
+  const threadMessages = await em.find(
+    Message,
+    {
+      threadId: message.threadId ?? message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+      isDraft: false
+    },
+    { orderBy: { sentAt: "ASC" } }
+  );
+  const threadMessageIds = threadMessages.map((item) => item.id);
+  const visibleRecipientRows = threadMessageIds.length > 0 ? await em.find(MessageRecipient, {
+    messageId: { $in: threadMessageIds },
+    recipientUserId: scope.userId,
+    deletedAt: null
+  }) : [];
+  const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId));
+  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id));
+  const threadSenderIds = actorVisibleThreadMessages.map((threadMessage) => threadMessage.senderUserId).filter((value) => typeof value === "string" && value.length > 0);
+  const threadSenders = threadSenderIds.length > 0 ? await findWithDecryption(
+    em,
+    User,
+    { id: { $in: Array.from(new Set(threadSenderIds)) } },
+    void 0,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  ) : [];
+  const threadSenderMap = new Map(threadSenders.map((user) => [user.id, user]));
+  const senderUser = await findOneWithDecryption(
+    em,
+    User,
+    { id: message.senderUserId },
+    void 0,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  );
+  const senderName = typeof senderUser?.name === "string" && senderUser.name.trim().length ? senderUser.name.trim() : null;
+  const senderEmail = senderUser?.email ?? null;
+  const messageType = getMessageTypeOrDefault(message.type);
+  const resolvedActionData = buildResolvedMessageActions(message, objects);
+  return Response.json({
+    id: message.id,
+    type: message.type,
+    isDraft: message.isDraft,
+    canEditDraft: message.isDraft && message.senderUserId === scope.userId,
+    visibility: message.visibility,
+    sourceEntityType: message.sourceEntityType,
+    sourceEntityId: message.sourceEntityId,
+    externalEmail: message.externalEmail,
+    externalName: message.externalName,
+    typeDefinition: {
+      labelKey: messageType.labelKey,
+      icon: messageType.icon,
+      color: messageType.color,
+      allowReply: messageType.allowReply ?? true,
+      allowForward: messageType.allowForward ?? true,
+      ui: {
+        listItemComponent: messageType.ui?.listItemComponent ?? null,
+        contentComponent: messageType.ui?.contentComponent ?? null,
+        actionsComponent: messageType.ui?.actionsComponent ?? null
+      }
+    },
+    threadId: message.threadId,
+    parentMessageId: message.parentMessageId,
+    senderUserId: message.senderUserId,
+    senderName,
+    senderEmail,
+    subject: message.subject,
+    body: message.body,
+    bodyFormat: message.bodyFormat,
+    priority: message.priority,
+    sentAt: message.sentAt,
+    actionData: resolvedActionData,
+    actionTaken: message.actionTaken,
+    actionTakenAt: message.actionTakenAt,
+    actionTakenByUserId: message.actionTakenByUserId,
+    recipients: allRecipients.map((item) => ({
+      userId: item.recipientUserId,
+      type: item.recipientType,
+      status: item.status,
+      readAt: item.readAt
+    })),
+    objects: objects.map((item, index) => ({
+      id: item.id,
+      entityModule: item.entityModule,
+      entityType: item.entityType,
+      entityId: item.entityId,
+      actionRequired: item.actionRequired,
+      actionType: item.actionType,
+      actionLabel: item.actionLabel,
+      snapshot: item.entitySnapshot,
+      preview: objectPreviews[index] ?? null
+    })),
+    thread: actorVisibleThreadMessages.map((threadMessage) => {
+      const sender = threadSenderMap.get(threadMessage.senderUserId);
+      const threadSenderName = typeof sender?.name === "string" && sender.name.trim().length ? sender.name.trim() : null;
+      return {
+        id: threadMessage.id,
+        senderUserId: threadMessage.senderUserId,
+        senderName: threadSenderName,
+        senderEmail: sender?.email ?? null,
+        body: threadMessage.body,
+        bodyFormat: threadMessage.bodyFormat,
+        sentAt: threadMessage.sentAt
+      };
+    }),
+    isRead: recipient ? recipient.status !== "unread" : true
+  });
+}
+async function PATCH(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const commandBus = ctx.container.resolve("commandBus");
+  const body = await req.json().catch(() => ({}));
+  const input = updateDraftSchema.parse(body);
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (!message.isDraft) {
+    return Response.json({ error: "Only draft messages can be edited" }, { status: 409 });
+  }
+  try {
+    const { logEntry } = await commandBus.execute("messages.messages.update_draft", {
+      input: {
+        ...input,
+        messageId: message.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req
+      }
+    });
+    const response = Response.json({ ok: true, id: message.id });
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: "messages.message",
+      resourceId: message.id
+    });
+    return response;
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Message type cannot be created by users") {
+        return Response.json({ error: error.message }, { status: 400 });
+      }
+      if (error.message === "Only draft messages can be edited") {
+        return Response.json({ error: error.message }, { status: 409 });
+      }
+      if (error.message === "Access denied") {
+        return Response.json({ error: error.message }, { status: 403 });
+      }
+    }
+    throw error;
+  }
+}
+async function DELETE(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const commandBus = ctx.container.resolve("commandBus");
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  try {
+    const { logEntry } = await commandBus.execute("messages.messages.delete_for_actor", {
+      input: {
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req
+      }
+    });
+    const response = Response.json({ ok: true });
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: "messages.message",
+      resourceId: params.id
+    });
+    return response;
+  } catch (error) {
+    if (error instanceof Error && error.message === "Access denied") {
+      return Response.json({ error: "Access denied" }, { status: 403 });
+    }
+    throw error;
+  }
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    GET: {
+      summary: "Get message detail",
+      responses: [
+        {
+          status: 200,
+          description: "Message detail with actor-visible thread items only",
+          schema: messageDetailResponseSchema
+        }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    },
+    PATCH: {
+      summary: "Update draft message",
+      requestBody: { schema: updateDraftOpenApiSchema },
+      responses: [
+        { status: 200, description: "Draft updated", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema },
+        { status: 409, description: "Only drafts can be edited", schema: errorResponseSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Delete message for current sender/recipient context",
+      responses: [
+        { status: 200, description: "Message deleted", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  PATCH,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/messages/api/%5Bid%5D/route.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '../../../auth/data/entities'\nimport { Message, MessageObject, MessageRecipient } from '../../data/entities'\nimport { updateDraftSchema } from '../../data/validators'\nimport { buildResolvedMessageActions } from '../../lib/actions'\nimport { getMessageObjectType } from '../../lib/message-objects-registry'\nimport { getMessageTypeOrDefault } from '../../lib/message-types-registry'\nimport { attachOperationMetadataHeader } from '../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../lib/routeHelpers'\nimport {\n  errorResponseSchema,\n  messageDetailResponseSchema,\n  okResponseSchema,\n  updateDraftSchema as updateDraftOpenApiSchema,\n} from '../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.view'] },\n  PATCH: { requireAuth: true, requireFeatures: ['messages.compose'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype MessageObjectPreviewPayload = {\n  title: string\n  subtitle?: string\n  status?: string\n  statusColor?: string\n  metadata?: Record<string, string>\n} | null\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n  const url = new URL(req.url)\n  const skipMarkReadParam = url.searchParams.get('skipMarkRead')\n  const skipMarkRead = skipMarkReadParam === '1'\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  const isSender = message.senderUserId === scope.userId\n  const isRecipient = Boolean(recipient)\n\n  if (!isSender && !isRecipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!skipMarkRead && recipient && recipient.status === 'unread') {\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    await commandBus.execute('messages.recipients.mark_read', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  }\n\n  const objects = await em.find(MessageObject, { messageId: params.id })\n  const objectPreviews = await Promise.all(\n    objects.map(async (item): Promise<MessageObjectPreviewPayload> => {\n      const objectType = getMessageObjectType(item.entityModule, item.entityType)\n      if (!objectType?.loadPreview) return null\n      try {\n        return await objectType.loadPreview(item.entityId, {\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n        })\n      } catch (error) {\n        console.error(\n          `[messages] Failed to load preview for ${item.entityModule}:${item.entityType}:${item.entityId}`,\n          error,\n        )\n        return null\n      }\n    }),\n  )\n  const allRecipients = await em.find(MessageRecipient, { messageId: params.id, deletedAt: null })\n\n  const threadMessages = await em.find(\n    Message,\n    {\n      threadId: message.threadId ?? message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n      isDraft: false,\n    },\n    { orderBy: { sentAt: 'ASC' } }\n  )\n  const threadMessageIds = threadMessages.map((item) => item.id)\n  const visibleRecipientRows = threadMessageIds.length > 0\n    ? await em.find(MessageRecipient, {\n      messageId: { $in: threadMessageIds },\n      recipientUserId: scope.userId,\n      deletedAt: null,\n    })\n    : []\n  const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId))\n  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => (\n    threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id)\n  ))\n\n  const threadSenderIds = actorVisibleThreadMessages\n    .map((threadMessage) => threadMessage.senderUserId)\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n\n  const threadSenders = threadSenderIds.length > 0\n    ? await findWithDecryption(\n        em,\n        User,\n        { id: { $in: Array.from(new Set(threadSenderIds)) } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const threadSenderMap = new Map(threadSenders.map((user) => [user.id, user]))\n\n  const senderUser = await findOneWithDecryption(\n    em,\n    User,\n    { id: message.senderUserId },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId }\n  )\n\n  const senderName = typeof senderUser?.name === 'string' && senderUser.name.trim().length\n    ? senderUser.name.trim()\n    : null\n  const senderEmail = senderUser?.email ?? null\n\n  const messageType = getMessageTypeOrDefault(message.type)\n  const resolvedActionData = buildResolvedMessageActions(message, objects)\n\n  return Response.json({\n    id: message.id,\n    type: message.type,\n    isDraft: message.isDraft,\n    canEditDraft: message.isDraft && message.senderUserId === scope.userId,\n    visibility: message.visibility,\n    sourceEntityType: message.sourceEntityType,\n    sourceEntityId: message.sourceEntityId,\n    externalEmail: message.externalEmail,\n    externalName: message.externalName,\n    typeDefinition: {\n      labelKey: messageType.labelKey,\n      icon: messageType.icon,\n      color: messageType.color,\n      allowReply: messageType.allowReply ?? true,\n      allowForward: messageType.allowForward ?? true,\n      ui: {\n        listItemComponent: messageType.ui?.listItemComponent ?? null,\n        contentComponent: messageType.ui?.contentComponent ?? null,\n        actionsComponent: messageType.ui?.actionsComponent ?? null,\n      },\n    },\n    threadId: message.threadId,\n    parentMessageId: message.parentMessageId,\n    senderUserId: message.senderUserId,\n    senderName,\n    senderEmail,\n    subject: message.subject,\n    body: message.body,\n    bodyFormat: message.bodyFormat,\n    priority: message.priority,\n    sentAt: message.sentAt,\n    actionData: resolvedActionData,\n    actionTaken: message.actionTaken,\n    actionTakenAt: message.actionTakenAt,\n    actionTakenByUserId: message.actionTakenByUserId,\n    recipients: allRecipients.map((item) => ({\n      userId: item.recipientUserId,\n      type: item.recipientType,\n      status: item.status,\n      readAt: item.readAt,\n    })),\n    objects: objects.map((item, index) => ({\n      id: item.id,\n      entityModule: item.entityModule,\n      entityType: item.entityType,\n      entityId: item.entityId,\n      actionRequired: item.actionRequired,\n      actionType: item.actionType,\n      actionLabel: item.actionLabel,\n      snapshot: item.entitySnapshot,\n      preview: objectPreviews[index] ?? null,\n    })),\n    thread: actorVisibleThreadMessages.map((threadMessage) => {\n      const sender = threadSenderMap.get(threadMessage.senderUserId)\n      const threadSenderName = typeof sender?.name === 'string' && sender.name.trim().length\n        ? sender.name.trim()\n        : null\n\n      return {\n        id: threadMessage.id,\n        senderUserId: threadMessage.senderUserId,\n        senderName: threadSenderName,\n        senderEmail: sender?.email ?? null,\n        body: threadMessage.body,\n        bodyFormat: threadMessage.bodyFormat,\n        sentAt: threadMessage.sentAt,\n      }\n    }),\n    isRead: recipient ? recipient.status !== 'unread' : true,\n  })\n}\n\nexport async function PATCH(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = updateDraftSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Only draft messages can be edited' }, { status: 409 })\n  }\n\n  try {\n    const { logEntry } = await commandBus.execute('messages.messages.update_draft', {\n      input: {\n        ...input,\n        messageId: message.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true, id: message.id })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message type cannot be created by users') {\n        return Response.json({ error: error.message }, { status: 400 })\n      }\n      if (error.message === 'Only draft messages can be edited') {\n        return Response.json({ error: error.message }, { status: 409 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  try {\n    const { logEntry } = await commandBus.execute('messages.messages.delete_for_actor', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error && error.message === 'Access denied') {\n      return Response.json({ error: 'Access denied' }, { status: 403 })\n    }\n    throw error\n  }\n\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Get message detail',\n      responses: [\n        {\n          status: 200,\n          description: 'Message detail with actor-visible thread items only',\n          schema: messageDetailResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update draft message',\n      requestBody: { schema: updateDraftOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Draft updated', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only drafts can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete message for current sender/recipient context',\n      responses: [\n        { status: 200, description: 'Message deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,YAAY;AACrB,SAAS,SAAS,eAAe,wBAAwB;AACzD,SAAS,yBAAyB;AAClC,SAAS,mCAAmC;AAC5C,SAAS,4BAA4B;AACrC,SAAS,+BAA+B;AACxC,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAC7D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,OAChB;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAUA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,oBAAoB,IAAI,aAAa,IAAI,cAAc;AAC7D,QAAM,eAAe,sBAAsB;AAE3C,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,QAAM,cAAc,QAAQ,SAAS;AAErC,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,gBAAgB,aAAa,UAAU,WAAW,UAAU;AAC/D,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,WAAW,QAAQ,iCAAiC;AAAA,MACxD,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,UAAU,MAAM,GAAG,KAAK,eAAe,EAAE,WAAW,OAAO,GAAG,CAAC;AACrE,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC,QAAQ,IAAI,OAAO,SAA+C;AAChE,YAAM,aAAa,qBAAqB,KAAK,cAAc,KAAK,UAAU;AAC1E,UAAI,CAAC,YAAY,YAAa,QAAO;AACrC,UAAI;AACF,eAAO,MAAM,WAAW,YAAY,KAAK,UAAU;AAAA,UACjD,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,QACxB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,gBAAQ;AAAA,UACN,yCAAyC,KAAK,YAAY,IAAI,KAAK,UAAU,IAAI,KAAK,QAAQ;AAAA,UAC9F;AAAA,QACF;AACA,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,MAAM,GAAG,KAAK,kBAAkB,EAAE,WAAW,OAAO,IAAI,WAAW,KAAK,CAAC;AAE/F,QAAM,iBAAiB,MAAM,GAAG;AAAA,IAC9B;AAAA,IACA;AAAA,MACE,UAAU,QAAQ,YAAY,QAAQ;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,MACX,SAAS;AAAA,IACX;AAAA,IACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,EAC/B;AACA,QAAM,mBAAmB,eAAe,IAAI,CAAC,SAAS,KAAK,EAAE;AAC7D,QAAM,uBAAuB,iBAAiB,SAAS,IACnD,MAAM,GAAG,KAAK,kBAAkB;AAAA,IAChC,WAAW,EAAE,KAAK,iBAAiB;AAAA,IACnC,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC,IACC,CAAC;AACL,QAAM,6BAA6B,IAAI,IAAI,qBAAqB,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;AAC7F,QAAM,6BAA6B,eAAe,OAAO,CAAC,kBACxD,cAAc,iBAAiB,MAAM,UAAU,2BAA2B,IAAI,cAAc,EAAE,CAC/F;AAED,QAAM,kBAAkB,2BACrB,IAAI,CAAC,kBAAkB,cAAc,YAAY,EACjD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAEnF,QAAM,gBAAgB,gBAAgB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE;AAAA,IACpD;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,kBAAkB,IAAI,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAE5E,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,aAAa;AAAA,IAC3B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,QAAM,aAAa,OAAO,YAAY,SAAS,YAAY,WAAW,KAAK,KAAK,EAAE,SAC9E,WAAW,KAAK,KAAK,IACrB;AACJ,QAAM,cAAc,YAAY,SAAS;AAEzC,QAAM,cAAc,wBAAwB,QAAQ,IAAI;AACxD,QAAM,qBAAqB,4BAA4B,SAAS,OAAO;AAEvE,SAAO,SAAS,KAAK;AAAA,IACnB,IAAI,QAAQ;AAAA,IACZ,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ,WAAW,QAAQ,iBAAiB,MAAM;AAAA,IAChE,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,eAAe,QAAQ;AAAA,IACvB,cAAc,QAAQ;AAAA,IACtB,gBAAgB;AAAA,MACd,UAAU,YAAY;AAAA,MACtB,MAAM,YAAY;AAAA,MAClB,OAAO,YAAY;AAAA,MACnB,YAAY,YAAY,cAAc;AAAA,MACtC,cAAc,YAAY,gBAAgB;AAAA,MAC1C,IAAI;AAAA,QACF,mBAAmB,YAAY,IAAI,qBAAqB;AAAA,QACxD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,QACtD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,MACxD;AAAA,IACF;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,IAClB,QAAQ,QAAQ;AAAA,IAChB,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB,eAAe,QAAQ;AAAA,IACvB,qBAAqB,QAAQ;AAAA,IAC7B,YAAY,cAAc,IAAI,CAAC,UAAU;AAAA,MACvC,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,QAAQ,KAAK;AAAA,IACf,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW;AAAA,MACrC,IAAI,KAAK;AAAA,MACT,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,SAAS,eAAe,KAAK,KAAK;AAAA,IACpC,EAAE;AAAA,IACF,QAAQ,2BAA2B,IAAI,CAAC,kBAAkB;AACxD,YAAM,SAAS,gBAAgB,IAAI,cAAc,YAAY;AAC7D,YAAM,mBAAmB,OAAO,QAAQ,SAAS,YAAY,OAAO,KAAK,KAAK,EAAE,SAC5E,OAAO,KAAK,KAAK,IACjB;AAEJ,aAAO;AAAA,QACL,IAAI,cAAc;AAAA,QAClB,cAAc,cAAc;AAAA,QAC5B,YAAY;AAAA,QACZ,aAAa,QAAQ,SAAS;AAAA,QAC9B,MAAM,cAAc;AAAA,QACpB,YAAY,cAAc;AAAA,QAC1B,QAAQ,cAAc;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,IACD,QAAQ,YAAY,UAAU,WAAW,WAAW;AAAA,EACtD,CAAC;AACH;AAEA,eAAsB,MAAM,KAAc,EAAE,OAAO,GAA+B;AAChF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAE1C,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,kCAAkC;AAAA,MAC9E,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,GAAG,CAAC;AAC3D,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,2CAA2C;AAC/D,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,qCAAqC;AACzD,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI;AACF,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,MAClF,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,SAAS,MAAM,YAAY,iBAAiB;AAC/D,aAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AACA,UAAM;AAAA,EACR;AAEF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,iBAAiB;AAAA,MACxE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,oBAAoB;AAAA,MACvF;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/messages/api/object-types/route.js

@@ -0,0 +1,54 @@
+import { messageObjectTypesQuerySchema } from "../../data/validators.js";
+import { getMessageObjectTypesForMessageType } from "../../lib/message-objects-registry.js";
+import {
+  messageObjectTypeListResponseSchema,
+  messageObjectTypesQuerySchema as messageObjectTypesQueryOpenApiSchema
+} from "../openapi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["messages.compose"] }
+};
+async function GET(req) {
+  const params = Object.fromEntries(new URL(req.url).searchParams);
+  const parsed = messageObjectTypesQuerySchema.safeParse(params);
+  if (!parsed.success) {
+    return Response.json({ error: "messageType is required" }, { status: 400 });
+  }
+  const input = parsed.data;
+  const items = getMessageObjectTypesForMessageType(input.messageType).map((objectType) => ({
+    module: objectType.module,
+    entityType: objectType.entityType,
+    labelKey: objectType.labelKey,
+    icon: objectType.icon,
+    actions: objectType.actions.map((action) => ({
+      id: action.id,
+      labelKey: action.labelKey,
+      variant: action.variant,
+      icon: action.icon,
+      commandId: action.commandId,
+      href: action.href,
+      isTerminal: action.isTerminal,
+      confirmRequired: action.confirmRequired,
+      confirmMessage: action.confirmMessage
+    }))
+  }));
+  return Response.json({ items });
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    GET: {
+      summary: "List registered message object types for a message type",
+      query: messageObjectTypesQueryOpenApiSchema,
+      responses: [
+        { status: 200, description: "Message object types", schema: messageObjectTypeListResponseSchema },
+        { status: 400, description: "Invalid query" }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/object-types/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/messages/api/object-types/route.ts"],
+  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { messageObjectTypesQuerySchema } from '../../data/validators'\nimport { getMessageObjectTypesForMessageType } from '../../lib/message-objects-registry'\nimport {\n  messageObjectTypeListResponseSchema,\n  messageObjectTypesQuerySchema as messageObjectTypesQueryOpenApiSchema,\n} from '../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function GET(req: Request) {\n  const params = Object.fromEntries(new URL(req.url).searchParams)\n  const parsed = messageObjectTypesQuerySchema.safeParse(params)\n  if (!parsed.success) {\n    return Response.json({ error: 'messageType is required' }, { status: 400 })\n  }\n  const input = parsed.data\n\n  const items = getMessageObjectTypesForMessageType(input.messageType).map((objectType) => ({\n    module: objectType.module,\n    entityType: objectType.entityType,\n    labelKey: objectType.labelKey,\n    icon: objectType.icon,\n    actions: objectType.actions.map((action) => ({\n      id: action.id,\n      labelKey: action.labelKey,\n      variant: action.variant,\n      icon: action.icon,\n      commandId: action.commandId,\n      href: action.href,\n      isTerminal: action.isTerminal,\n      confirmRequired: action.confirmRequired,\n      confirmMessage: action.confirmMessage,\n    })),\n  }))\n\n  return Response.json({ items })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List registered message object types for a message type',\n      query: messageObjectTypesQueryOpenApiSchema,\n      responses: [\n        { status: 200, description: 'Message object types', schema: messageObjectTypeListResponseSchema },\n        { status: 400, description: 'Invalid query' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,qCAAqC;AAC9C,SAAS,2CAA2C;AACpD;AAAA,EACE;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,SAAS,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,YAAY;AAC/D,QAAM,SAAS,8BAA8B,UAAU,MAAM;AAC7D,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,SAAS,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACA,QAAM,QAAQ,OAAO;AAErB,QAAM,QAAQ,oCAAoC,MAAM,WAAW,EAAE,IAAI,CAAC,gBAAgB;AAAA,IACxF,QAAQ,WAAW;AAAA,IACnB,YAAY,WAAW;AAAA,IACvB,UAAU,WAAW;AAAA,IACrB,MAAM,WAAW;AAAA,IACjB,SAAS,WAAW,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC3C,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,MAChB,MAAM,OAAO;AAAA,MACb,WAAW,OAAO;AAAA,MAClB,MAAM,OAAO;AAAA,MACb,YAAY,OAAO;AAAA,MACnB,iBAAiB,OAAO;AAAA,MACxB,gBAAgB,OAAO;AAAA,IACzB,EAAE;AAAA,EACJ,EAAE;AAEF,SAAO,SAAS,KAAK,EAAE,MAAM,CAAC;AAChC;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oCAAoC;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,MAC9C;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}