@open-mercato/core 0.6.6-develop.6153.1.b4c555b820 → 0.6.6-develop.6159.1.82dfc232ca

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 3393 entry points
+[build:core] found 3396 entry points
 [build:core] built successfully
 [build:core:generated] found 185 entry points
 [build:core:generated] built successfully

package/dist/modules/messages/api/[id]/actions/[actionId]/route.js

@@ -1,6 +1,7 @@
 import { z } from "zod";
 import { attachOperationMetadataHeader } from "../../../../lib/operationMetadata.js";
 import { resolveMessageContext } from "../../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../../guards.js";
 import { actionResultResponseSchema } from "../../../openapi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["messages.actions"] }
@@ -10,6 +11,27 @@ async function POST(req, { params }) {
   const commandBus = ctx.container.resolve("commandBus");
   const rawBody = await req.json().catch(() => ({}));
   const body = typeof rawBody === "object" && rawBody && !Array.isArray(rawBody) ? rawBody : {};
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: body
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const commandResult = await commandBus.execute("messages.actions.execute", {
       input: {
@@ -39,6 +61,16 @@ async function POST(req, { params }) {
       resourceKind: "messages.message",
       resourceId: params.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error) {

package/dist/modules/messages/api/[id]/actions/[actionId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/messages/api/%5Bid%5D/actions/%5BactionId%5D/route.ts"],
-  "sourcesContent": ["import { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { attachOperationMetadataHeader, type OperationLogEntryLike } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { actionResultResponseSchema } from '../../../openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.actions'] },\n}\n\nexport async function POST(\n  req: Request,\n  { params }: { params: { id: string; actionId: string } }\n) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const rawBody = await req.json().catch(() => ({}))\n  const body = (typeof rawBody === 'object' && rawBody && !Array.isArray(rawBody)\n    ? rawBody\n    : {}) as Record<string, unknown>\n  try {\n    const commandResult = await commandBus.execute('messages.actions.execute', {\n      input: {\n        messageId: params.id,\n        actionId: params.actionId,\n        payload: body,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const result = commandResult.result as {\n      ok: boolean\n      actionId: string\n      result: Record<string, unknown>\n      operationLogEntry?: OperationLogEntryLike | null\n    }\n    const response = Response.json({\n      ok: result.ok,\n      actionId: result.actionId,\n      result: result.result,\n    })\n    attachOperationMetadataHeader(response, result.operationLogEntry ?? null, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Action not found') {\n        return Response.json({ error: 'Action not found' }, { status: 404 })\n      }\n      if (error.message === 'Action already taken') {\n        const actionTaken = (error as Error & { actionTaken?: string }).actionTaken ?? null\n        return Response.json({ error: 'Action already taken', actionTaken }, { status: 409 })\n      }\n      if (error.message === 'Actions have expired') {\n        return Response.json({ error: 'Actions have expired' }, { status: 410 })\n      }\n      if (error.message === 'Action has no executable target') {\n        return Response.json({ error: 'Action has no executable target' }, { status: 409 })\n      }\n      if (error.message === 'Action failed') {\n        return Response.json({ error: 'Action failed' }, { status: 500 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Execute message action',\n      requestBody: { schema: z.record(z.string(), z.unknown()).optional() },\n      responses: [\n        { status: 200, description: 'Action executed', schema: actionResultResponseSchema },\n        { status: 403, description: 'Access denied' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already taken' },\n        { status: 410, description: 'Action expired' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,qCAAiE;AAC1E,SAAS,6BAA6B;AAEtC,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KACpB,KACA,EAAE,OAAO,GACT;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,QAAM,OAAQ,OAAO,YAAY,YAAY,WAAW,CAAC,MAAM,QAAQ,OAAO,IAC1E,UACA,CAAC;AACL,MAAI;AACF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,4BAA4B;AAAA,MACzE,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,SAAS;AAAA,QACT,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,SAAS,cAAc;AAM7B,UAAM,WAAW,SAAS,KAAK;AAAA,MAC7B,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,kCAA8B,UAAU,OAAO,qBAAqB,MAAM;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,oBAAoB;AACxC,eAAO,SAAS,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,cAAM,cAAe,MAA2C,eAAe;AAC/E,eAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtF;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,MAAM,YAAY,mCAAmC;AACvD,eAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpF;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE;AAAA,MACpE,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,2BAA2B;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { attachOperationMetadataHeader, type OperationLogEntryLike } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../../guards'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { actionResultResponseSchema } from '../../../openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.actions'] },\n}\n\nexport async function POST(\n  req: Request,\n  { params }: { params: { id: string; actionId: string } }\n) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const rawBody = await req.json().catch(() => ({}))\n  const body = (typeof rawBody === 'object' && rawBody && !Array.isArray(rawBody)\n    ? rawBody\n    : {}) as Record<string, unknown>\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: body,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    const commandResult = await commandBus.execute('messages.actions.execute', {\n      input: {\n        messageId: params.id,\n        actionId: params.actionId,\n        payload: body,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const result = commandResult.result as {\n      ok: boolean\n      actionId: string\n      result: Record<string, unknown>\n      operationLogEntry?: OperationLogEntryLike | null\n    }\n    const response = Response.json({\n      ok: result.ok,\n      actionId: result.actionId,\n      result: result.result,\n    })\n    attachOperationMetadataHeader(response, result.operationLogEntry ?? null, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Action not found') {\n        return Response.json({ error: 'Action not found' }, { status: 404 })\n      }\n      if (error.message === 'Action already taken') {\n        const actionTaken = (error as Error & { actionTaken?: string }).actionTaken ?? null\n        return Response.json({ error: 'Action already taken', actionTaken }, { status: 409 })\n      }\n      if (error.message === 'Actions have expired') {\n        return Response.json({ error: 'Actions have expired' }, { status: 410 })\n      }\n      if (error.message === 'Action has no executable target') {\n        return Response.json({ error: 'Action has no executable target' }, { status: 409 })\n      }\n      if (error.message === 'Action failed') {\n        return Response.json({ error: 'Action failed' }, { status: 500 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Execute message action',\n      requestBody: { schema: z.record(z.string(), z.unknown()).optional() },\n      responses: [\n        { status: 200, description: 'Action executed', schema: actionResultResponseSchema },\n        { status: 403, description: 'Access denied' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already taken' },\n        { status: 410, description: 'Action expired' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,qCAAiE;AAC1E,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AAEnG,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KACpB,KACA,EAAE,OAAO,GACT;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,QAAM,OAAQ,OAAO,YAAY,YAAY,WAAW,CAAC,MAAM,QAAQ,OAAO,IAC1E,UACA,CAAC;AAEL,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,4BAA4B;AAAA,MACzE,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,SAAS;AAAA,QACT,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,SAAS,cAAc;AAM7B,UAAM,WAAW,SAAS,KAAK;AAAA,MAC7B,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,kCAA8B,UAAU,OAAO,qBAAqB,MAAM;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,oBAAoB;AACxC,eAAO,SAAS,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,cAAM,cAAe,MAA2C,eAAe;AAC/E,eAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtF;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,MAAM,YAAY,mCAAmC;AACvD,eAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpF;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE;AAAA,MACpE,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,2BAA2B;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/archive/route.js

@@ -1,6 +1,7 @@
 import { Message, MessageRecipient } from "../../../data/entities.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { hasOrganizationAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import { errorResponseSchema, okResponseSchema } from "../../openapi.js";
 const metadata = {
   PUT: { requireAuth: true, requireFeatures: ["messages.view"] },
@@ -35,6 +36,27 @@ async function PUT(req, { params }) {
   if ("response" in context) return context.response;
   const { ctx, scope } = context;
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.recipients.archive", {
     input: {
       messageId: params.id,
@@ -56,6 +78,16 @@ async function PUT(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: params.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 async function DELETE(req, { params }) {
@@ -63,6 +95,27 @@ async function DELETE(req, { params }) {
   if ("response" in context) return context.response;
   const { ctx, scope } = context;
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.recipients.unarchive", {
     input: {
       messageId: params.id,
@@ -84,6 +137,16 @@ async function DELETE(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: params.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 const openApi = {

package/dist/modules/messages/api/[id]/archive/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/archive/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { MessageScope } from '../../../lib/routeHelpers'\nimport { errorResponseSchema, okResponseSchema } from '../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']\n\nasync function resolveRecipientContext(\n  req: Request,\n  id: string,\n): Promise<\n  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }\n  | { response: Response }\n> {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (!recipient) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  return { ctx, scope, em, recipient }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.archive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.unarchive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive message',\n      responses: [\n        { status: 200, description: 'Message archived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unarchive message',\n      responses: [\n        { status: 200, description: 'Message unarchived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAGA,SAAS,SAAS,wBAAwB;AAC1C,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAE7D,SAAS,qBAAqB,wBAAwB;AAE/C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAIA,eAAe,wBACb,KACA,IAIA;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACpF;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI,UAAU;AACrC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,IAC3E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,iCAAiC;AAAA,IAC7E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MAC3E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { MessageScope } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport { errorResponseSchema, okResponseSchema } from '../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']\n\nasync function resolveRecipientContext(\n  req: Request,\n  id: string,\n): Promise<\n  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }\n  | { response: Response }\n> {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (!recipient) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  return { ctx, scope, em, recipient }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.recipients.archive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.recipients.unarchive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive message',\n      responses: [\n        { status: 200, description: 'Message archived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unarchive message',\n      responses: [\n        { status: 200, description: 'Message unarchived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,SAAS,wBAAwB;AAC1C,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAE7D,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG,SAAS,qBAAqB,wBAAwB;AAE/C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAIA,eAAe,wBACb,KACA,IAIA;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACpF;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI,UAAU;AACrC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,IAC3E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,iCAAiC;AAAA,IAC7E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MAC3E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/attachments/route.js

@@ -4,6 +4,7 @@ import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from "../..
 import { getMessageAttachments } from "../../../lib/attachments.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import {
   attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
   errorResponseSchema,
@@ -75,6 +76,27 @@ async function POST(req, { params }) {
     return Response.json({ error: "Attachments can only be modified on drafts" }, { status: 409 });
   }
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: message.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.attachments.link_to_draft", {
     input: {
       messageId: message.id,
@@ -97,6 +119,16 @@ async function POST(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: message.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 async function DELETE(req, { params }) {
@@ -122,6 +154,27 @@ async function DELETE(req, { params }) {
     return Response.json({ error: "Attachments can only be modified on drafts" }, { status: 409 });
   }
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: message.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.attachments.unlink_from_draft", {
     input: {
       messageId: message.id,
@@ -144,6 +197,16 @@ async function DELETE(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: message.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 const openApi = {

package/dist/modules/messages/api/[id]/attachments/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/attachments/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { parseUnlinkAttachmentIds } from '../../../commands/attachments'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'\nimport { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,\n  errorResponseSchema,\n  messageAttachmentResponseSchema,\n  okResponseSchema,\n  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (message.senderUserId !== scope.userId && !recipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const attachments = await getMessageAttachments(\n    em,\n    params.id,\n    scope.organizationId,\n    scope.tenantId\n  )\n\n  return Response.json({ attachments })\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = attachmentIdsPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: input.attachmentIds,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = unlinkAttachmentPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: parseUnlinkAttachmentIds(input),\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List message attachments',\n      responses: [\n        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Link attachments to draft message',\n      requestBody: { schema: attachmentIdsOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments linked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unlink attachments from draft message',\n      requestBody: { schema: unlinkAttachmentOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAGA,SAAS,gCAAgC;AACzC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,4BAA4B,qCAAqC;AAC1E,SAAS,6BAAuD;AAChE,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE,8BAA8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,QAAQ,iBAAiB,MAAM,UAAU,CAAC,WAAW;AACvD,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAEA,SAAO,SAAS,KAAK,EAAE,YAAY,CAAC;AACtC;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,2BAA2B,MAAM,IAAI;AAEnD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,8BAA8B,MAAM,IAAI;AAEtD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,IACtF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,yBAAyB,KAAK;AAAA,IAC/C;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,gCAAgC;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,2BAA2B;AAAA,MAClD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,8BAA8B;AAAA,MACrD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,MAC/E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { parseUnlinkAttachmentIds } from '../../../commands/attachments'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'\nimport { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport {\n  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,\n  errorResponseSchema,\n  messageAttachmentResponseSchema,\n  okResponseSchema,\n  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (message.senderUserId !== scope.userId && !recipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const attachments = await getMessageAttachments(\n    em,\n    params.id,\n    scope.organizationId,\n    scope.tenantId\n  )\n\n  return Response.json({ attachments })\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = attachmentIdsPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: input.attachmentIds,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = unlinkAttachmentPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: parseUnlinkAttachmentIds(input),\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: message.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List message attachments',\n      responses: [\n        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Link attachments to draft message',\n      requestBody: { schema: attachmentIdsOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments linked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unlink attachments from draft message',\n      requestBody: { schema: unlinkAttachmentOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,gCAAgC;AACzC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,4BAA4B,qCAAqC;AAC1E,SAAS,6BAAuD;AAChE,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE,8BAA8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,QAAQ,iBAAiB,MAAM,UAAU,CAAC,WAAW;AACvD,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAEA,SAAO,SAAS,KAAK,EAAE,YAAY,CAAC;AACtC;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,2BAA2B,MAAM,IAAI;AAEnD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,8BAA8B,MAAM,IAAI;AAEtD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,IACtF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,yBAAyB,KAAK;AAAA,IAC/C;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,gCAAgC;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,2BAA2B;AAAA,MAClD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,8BAA8B;AAAA,MACrD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,MAC/E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/conversation/archive/route.js

@@ -1,5 +1,6 @@
 import { attachOperationMetadataHeader } from "../../../../lib/operationMetadata.js";
 import { resolveMessageContext } from "../../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../../guards.js";
 import {
   conversationMutationResponseSchema,
   errorResponseSchema
@@ -10,6 +11,27 @@ const metadata = {
 async function PUT(req, { params }) {
   const { ctx, scope } = await resolveMessageContext(req);
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const { result, logEntry } = await commandBus.execute("messages.conversation.archive_for_actor", {
       input: {
@@ -32,6 +54,16 @@ async function PUT(req, { params }) {
       resourceKind: "messages.conversation",
       resourceId: params.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error) {

package/dist/modules/messages/api/[id]/conversation/archive/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/messages/api/%5Bid%5D/conversation/archive/route.ts"],
-  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.archive_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive conversation for current actor',\n      responses: [\n        { status: 200, description: 'Conversation archived', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAC/D;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,2CAA2C;AAAA,MAC/F,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,mCAAmC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../../guards'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.archive_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive conversation for current actor',\n      responses: [\n        { status: 200, description: 'Conversation archived', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAC/D;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,2CAA2C;AAAA,MAC/F,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,mCAAmC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/conversation/read/route.js

@@ -1,5 +1,6 @@
 import { attachOperationMetadataHeader } from "../../../../lib/operationMetadata.js";
 import { resolveMessageContext } from "../../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../../guards.js";
 import {
   conversationMutationResponseSchema,
   errorResponseSchema
@@ -10,6 +11,27 @@ const metadata = {
 async function DELETE(req, { params }) {
   const { ctx, scope } = await resolveMessageContext(req);
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const { result, logEntry } = await commandBus.execute("messages.conversation.mark_unread_for_actor", {
       input: {
@@ -32,6 +54,16 @@ async function DELETE(req, { params }) {
       resourceKind: "messages.conversation",
       resourceId: params.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error) {

package/dist/modules/messages/api/[id]/conversation/read/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/messages/api/%5Bid%5D/conversation/read/route.ts"],
-  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../../openapi'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.mark_unread_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    DELETE: {\n      summary: 'Mark entire conversation as unread for current actor',\n      responses: [\n        { status: 200, description: 'Conversation marked unread', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+CAA+C;AAAA,MACnG,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mCAAmC;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../../guards'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../../openapi'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.mark_unread_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    DELETE: {\n      summary: 'Mark entire conversation as unread for current actor',\n      responses: [\n        { status: 200, description: 'Conversation marked unread', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,+CAA+C;AAAA,MACnG,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mCAAmC;AAAA,MACvG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }