@open-mercato/core 0.6.6-develop.6153.1.b4c555b820 → 0.6.6-develop.6159.1.82dfc232ca

package/dist/modules/messages/api/[id]/conversation/route.js

@@ -1,5 +1,6 @@
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import {
   conversationMutationResponseSchema,
   errorResponseSchema
@@ -10,6 +11,27 @@ const metadata = {
 async function DELETE(req, { params }) {
   const { ctx, scope } = await resolveMessageContext(req);
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const { result, logEntry } = await commandBus.execute("messages.conversation.delete_for_actor", {
       input: {
@@ -32,6 +54,16 @@ async function DELETE(req, { params }) {
       resourceKind: "messages.conversation",
       resourceId: params.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.conversation",
+      resourceId: params.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error) {

package/dist/modules/messages/api/[id]/conversation/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/conversation/route.ts"],
-  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.delete_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    DELETE: {\n      summary: 'Delete conversation for current actor',\n      responses: [\n        { status: 200, description: 'Conversation deleted', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,MAC9F,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,mCAAmC;AAAA,MACjG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.delete_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    DELETE: {\n      summary: 'Delete conversation for current actor',\n      responses: [\n        { status: 200, description: 'Conversation deleted', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,MAC9F,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,mCAAmC;AAAA,MACjG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/forward/route.js

@@ -1,6 +1,7 @@
 import { forwardMessageSchema } from "../../../data/validators.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { canUseMessageEmailFeature, parseRequestBodySafe, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import { forwardResponseSchema, forwardMessageSchema as forwardSchema } from "../../openapi.js";
 const metadata = {
   POST: { requireAuth: true, requireFeatures: ["messages.compose"] }
@@ -13,6 +14,27 @@ async function POST(req, { params }) {
   if (input.sendViaEmail && !await canUseMessageEmailFeature(ctx, scope)) {
     return Response.json({ error: "Missing feature: messages.email" }, { status: 403 });
   }
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: null,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   let commandResult;
   try {
     commandResult = await commandBus.execute("messages.messages.forward", {
@@ -55,6 +77,16 @@ async function POST(req, { params }) {
     resourceKind: "messages.message",
     resourceId: newMessageId
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: newMessageId,
+    operation: "create",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 const openApi = {

package/dist/modules/messages/api/[id]/forward/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/forward/route.ts"],
-  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { forwardMessageSchema } from '../../../data/validators'\nimport { attachOperationMetadataHeader, OperationLogEntryLike } from '../../../lib/operationMetadata'\nimport { canUseMessageEmailFeature, parseRequestBodySafe, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { forwardResponseSchema, forwardMessageSchema as forwardSchema } from '../../openapi'\nimport { MessageCommandExecuteResult } from '../../../commands/shared'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await parseRequestBodySafe(req)\n  const input = forwardMessageSchema.parse(body)\n  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  let commandResult: { result: MessageCommandExecuteResult; logEntry: unknown }\n  try {\n    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.forward', {\n      input: {\n        ...input,\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Forward is not allowed for this message type') {\n        return Response.json({ error: 'Forward is not allowed for this message type' }, { status: 409 })\n      }\n      if (error.message === 'Forward body exceeds maximum length') {\n        return Response.json({ error: 'Forward body exceeds maximum length' }, { status: 413 })\n      }\n    }\n    throw error\n  }\n  const newMessageId = commandResult.result.id\n\n  const response = Response.json({ id: newMessageId }, { status: 201 })\n  attachOperationMetadataHeader(response, commandResult.logEntry as OperationLogEntryLike, {\n    resourceKind: 'messages.message',\n    resourceId: newMessageId,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Forward a message and optionally include attachments from the forwarded conversation slice',\n      requestBody: { schema: forwardSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Message forwarded',\n          schema: forwardResponseSchema,\n        },\n        { status: 403, description: 'Access denied' },\n        { status: 404, description: 'Message not found' },\n        { status: 409, description: 'Forward not allowed for message type' },\n        { status: 413, description: 'Forward body exceeds maximum length' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AACA,SAAS,4BAA4B;AACrC,SAAS,qCAA4D;AACrE,SAAS,2BAA2B,sBAAsB,6BAA6B;AAEvF,SAAS,uBAAuB,wBAAwB,qBAAqB;AAGtE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,qBAAqB,GAAG;AAC3C,QAAM,QAAQ,qBAAqB,MAAM,IAAI;AAC7C,MAAI,MAAM,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,QAA8C,6BAA6B;AAAA,MAC1G,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,gDAAgD;AACpE,eAAO,SAAS,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACjG;AACA,UAAI,MAAM,YAAY,uCAAuC;AAC3D,eAAO,SAAS,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,cAAc,OAAO;AAE1C,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpE,gCAA8B,UAAU,cAAc,UAAmC;AAAA,IACvF,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { forwardMessageSchema } from '../../../data/validators'\nimport { attachOperationMetadataHeader, OperationLogEntryLike } from '../../../lib/operationMetadata'\nimport { canUseMessageEmailFeature, parseRequestBodySafe, resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { forwardResponseSchema, forwardMessageSchema as forwardSchema } from '../../openapi'\nimport { MessageCommandExecuteResult } from '../../../commands/shared'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await parseRequestBodySafe(req)\n  const input = forwardMessageSchema.parse(body)\n  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  let commandResult: { result: MessageCommandExecuteResult; logEntry: unknown }\n  try {\n    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.forward', {\n      input: {\n        ...input,\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Forward is not allowed for this message type') {\n        return Response.json({ error: 'Forward is not allowed for this message type' }, { status: 409 })\n      }\n      if (error.message === 'Forward body exceeds maximum length') {\n        return Response.json({ error: 'Forward body exceeds maximum length' }, { status: 413 })\n      }\n    }\n    throw error\n  }\n  const newMessageId = commandResult.result.id\n\n  const response = Response.json({ id: newMessageId }, { status: 201 })\n  attachOperationMetadataHeader(response, commandResult.logEntry as OperationLogEntryLike, {\n    resourceKind: 'messages.message',\n    resourceId: newMessageId,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: newMessageId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Forward a message and optionally include attachments from the forwarded conversation slice',\n      requestBody: { schema: forwardSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Message forwarded',\n          schema: forwardResponseSchema,\n        },\n        { status: 403, description: 'Access denied' },\n        { status: 404, description: 'Message not found' },\n        { status: 409, description: 'Forward not allowed for message type' },\n        { status: 413, description: 'Forward body exceeds maximum length' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,4BAA4B;AACrC,SAAS,qCAA4D;AACrE,SAAS,2BAA2B,sBAAsB,6BAA6B;AACvF,SAAS,qBAAqB,qCAAqC,gCAAgC;AAEnG,SAAS,uBAAuB,wBAAwB,qBAAqB;AAGtE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,qBAAqB,GAAG;AAC3C,QAAM,QAAQ,qBAAqB,MAAM,IAAI;AAC7C,MAAI,MAAM,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,QAA8C,6BAA6B;AAAA,MAC1G,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,gDAAgD;AACpE,eAAO,SAAS,KAAK,EAAE,OAAO,+CAA+C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACjG;AACA,UAAI,MAAM,YAAY,uCAAuC;AAC3D,eAAO,SAAS,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACxF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,eAAe,cAAc,OAAO;AAE1C,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpE,gCAA8B,UAAU,cAAc,UAAmC;AAAA,IACvF,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,cAAc;AAAA,MACrC,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,uCAAuC;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,sCAAsC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/read/route.js

@@ -1,6 +1,7 @@
 import { Message, MessageRecipient } from "../../../data/entities.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { hasOrganizationAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import { errorResponseSchema, okResponseSchema } from "../../openapi.js";
 const metadata = {
   PUT: { requireAuth: true, requireFeatures: ["messages.view"] },
@@ -35,6 +36,27 @@ async function PUT(req, { params }) {
   if ("response" in context) return context.response;
   const { ctx, scope } = context;
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.recipients.mark_read", {
     input: {
       messageId: params.id,
@@ -56,6 +78,16 @@ async function PUT(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: params.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 async function DELETE(req, { params }) {
@@ -63,6 +95,27 @@ async function DELETE(req, { params }) {
   if ("response" in context) return context.response;
   const { ctx, scope } = context;
   const commandBus = ctx.container.resolve("commandBus");
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   const { logEntry } = await commandBus.execute("messages.recipients.mark_unread", {
     input: {
       messageId: params.id,
@@ -84,6 +137,16 @@ async function DELETE(req, { params }) {
     resourceKind: "messages.message",
     resourceId: params.id
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: params.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 const openApi = {

package/dist/modules/messages/api/[id]/read/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/read/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { MessageScope } from '../../../lib/routeHelpers'\nimport { errorResponseSchema, okResponseSchema } from '../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']\n\nasync function resolveRecipientContext(\n  req: Request,\n  id: string,\n): Promise<\n  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }\n  | { response: Response }\n> {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (!recipient) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  return { ctx, scope, em, recipient }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.mark_read', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.mark_unread', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Mark message as read',\n      responses: [\n        { status: 200, description: 'Message marked read', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Mark message as unread',\n      responses: [\n        { status: 200, description: 'Message marked unread', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAGA,SAAS,SAAS,wBAAwB;AAC1C,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAE7D,SAAS,qBAAqB,wBAAwB;AAE/C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAIA,eAAe,wBACb,KACA,IAIA;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACpF;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI,UAAU;AACrC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,iCAAiC;AAAA,IAC7E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,mCAAmC;AAAA,IAC/E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,iBAAiB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { MessageScope } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport { errorResponseSchema, okResponseSchema } from '../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']\n\nasync function resolveRecipientContext(\n  req: Request,\n  id: string,\n): Promise<\n  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }\n  | { response: Response }\n> {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (!recipient) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  return { ctx, scope, em, recipient }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.recipients.mark_read', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n  const { logEntry } = await commandBus.execute('messages.recipients.mark_unread', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Mark message as read',\n      responses: [\n        { status: 200, description: 'Message marked read', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Mark message as unread',\n      responses: [\n        { status: 200, description: 'Message marked unread', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,SAAS,wBAAwB;AAC1C,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAE7D,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG,SAAS,qBAAqB,wBAAwB;AAE/C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAIA,eAAe,wBACb,KACA,IAIA;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACpF;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI,UAAU;AACrC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,iCAAiC;AAAA,IAC7E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AACA,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,mCAAmC;AAAA,IAC/E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,IACnB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,MAC9E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,iBAAiB;AAAA,MAChF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/reply/route.js

@@ -1,6 +1,7 @@
 import { replyMessageSchema } from "../../../data/validators.js";
 import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
 import { canUseMessageEmailFeature, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../../guards.js";
 import {
   errorResponseSchema,
   forwardResponseSchema,
@@ -17,6 +18,27 @@ async function POST(req, { params }) {
   if (input.sendViaEmail && !await canUseMessageEmailFeature(ctx, scope)) {
     return Response.json({ error: "Missing feature: messages.email" }, { status: 403 });
   }
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: null,
+      operation: "create",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   let commandResult;
   try {
     commandResult = await commandBus.execute("messages.messages.reply", {
@@ -59,6 +81,16 @@ async function POST(req, { params }) {
     resourceKind: "messages.message",
     resourceId: messageId
   });
+  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: scope.userId,
+    resourceKind: "messages.message",
+    resourceId: messageId,
+    operation: "create",
+    requestMethod: req.method,
+    requestHeaders: req.headers
+  });
   return response;
 }
 const openApi = {

package/dist/modules/messages/api/[id]/reply/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/reply/route.ts"],
-  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { replyMessageSchema } from '../../../data/validators'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { canUseMessageEmailFeature, resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  errorResponseSchema,\n  forwardResponseSchema,\n  replyMessageSchema as replyOpenApiSchema,\n} from '../../openapi'\nimport { MessageCommandExecuteResult } from '../../../commands/shared'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = replyMessageSchema.parse(body)\n  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  let commandResult\n  try {\n    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.reply', {\n      input: {\n        ...input,\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Reply is not allowed for this message type') {\n        return Response.json({ error: 'Reply is not allowed for this message type' }, { status: 409 })\n      }\n      if (error.message === 'No recipients available for reply') {\n        return Response.json({ error: 'No recipients available for reply' }, { status: 409 })\n      }\n    }\n    throw error\n  }\n  const messageId = commandResult.result.id\n\n  const response = Response.json({ id: messageId }, { status: 201 })\n  attachOperationMetadataHeader(response, commandResult.logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Reply to message',\n      requestBody: { schema: replyOpenApiSchema },\n      responses: [\n        { status: 201, description: 'Reply created', schema: forwardResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Reply not allowed for message type', schema: errorResponseSchema },\n        { status: 409, description: 'No recipients available for reply', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAEA,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,6BAA6B;AACjE;AAAA,EACE;AAAA,EACA;AAAA,EACA,sBAAsB;AAAA,OACjB;AAGA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,mBAAmB,MAAM,IAAI;AAC3C,MAAI,MAAM,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,QAA8C,2BAA2B;AAAA,MACxG,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,8CAA8C;AAClE,eAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC/F;AACA,UAAI,MAAM,YAAY,qCAAqC;AACzD,eAAO,SAAS,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,YAAY,cAAc,OAAO;AAEvC,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjE,gCAA8B,UAAU,cAAc,UAAU;AAAA,IAC9D,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,sBAAsB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,oBAAoB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { replyMessageSchema } from '../../../data/validators'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { canUseMessageEmailFeature, resolveMessageContext } from '../../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../../guards'\nimport {\n  errorResponseSchema,\n  forwardResponseSchema,\n  replyMessageSchema as replyOpenApiSchema,\n} from '../../openapi'\nimport { MessageCommandExecuteResult } from '../../../commands/shared'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = replyMessageSchema.parse(body)\n  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  let commandResult\n  try {\n    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.reply', {\n      input: {\n        ...input,\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Reply is not allowed for this message type') {\n        return Response.json({ error: 'Reply is not allowed for this message type' }, { status: 409 })\n      }\n      if (error.message === 'No recipients available for reply') {\n        return Response.json({ error: 'No recipients available for reply' }, { status: 409 })\n      }\n    }\n    throw error\n  }\n  const messageId = commandResult.result.id\n\n  const response = Response.json({ id: messageId }, { status: 201 })\n  attachOperationMetadataHeader(response, commandResult.logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Reply to message',\n      requestBody: { schema: replyOpenApiSchema },\n      responses: [\n        { status: 201, description: 'Reply created', schema: forwardResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Reply not allowed for message type', schema: errorResponseSchema },\n        { status: 409, description: 'No recipients available for reply', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,0BAA0B;AACnC,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,EACA,sBAAsB;AAAA,OACjB;AAGA,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,mBAAmB,MAAM,IAAI;AAC3C,MAAI,MAAM,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,oBAAgB,MAAM,WAAW,QAA8C,2BAA2B;AAAA,MACxG,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,8CAA8C;AAClE,eAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC/F;AACA,UAAI,MAAM,YAAY,qCAAqC;AACzD,eAAO,SAAS,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtF;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACA,QAAM,YAAY,cAAc,OAAO;AAEvC,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AACjE,gCAA8B,UAAU,cAAc,UAAU;AAAA,IAC9D,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,mBAAmB;AAAA,MAC1C,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,sBAAsB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,oBAAoB;AAAA,QAC9F,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/[id]/route.js

@@ -7,6 +7,7 @@ import { getMessageObjectType } from "../../lib/message-objects-registry.js";
 import { getMessageTypeOrDefault } from "../../lib/message-types-registry.js";
 import { attachOperationMetadataHeader } from "../../lib/operationMetadata.js";
 import { hasOrganizationAccess, resolveMessageContext } from "../../lib/routeHelpers.js";
+import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "../guards.js";
 import {
   errorResponseSchema,
   messageDetailResponseSchema,
@@ -225,6 +226,27 @@ async function PATCH(req, { params }) {
   if (!message.isDraft) {
     return Response.json({ error: "Only draft messages can be edited" }, { status: 409 });
   }
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: message.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const { logEntry } = await commandBus.execute("messages.messages.update_draft", {
       input: {
@@ -248,6 +270,16 @@ async function PATCH(req, { params }) {
       resourceKind: "messages.message",
       resourceId: message.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: message.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error) {
@@ -279,6 +311,27 @@ async function DELETE(req, { params }) {
   if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }
+  const guardResult = await runMessageMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null
+    },
+    resolveUserFeatures(ctx.auth)
+  );
+  if (!guardResult.ok) {
+    return Response.json(
+      guardResult.errorBody ?? { error: "Operation blocked by guard" },
+      { status: guardResult.errorStatus ?? 422 }
+    );
+  }
   try {
     const { logEntry } = await commandBus.execute("messages.messages.delete_for_actor", {
       input: {
@@ -301,6 +354,16 @@ async function DELETE(req, { params }) {
       resourceKind: "messages.message",
       resourceId: params.id
     });
+    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: "messages.message",
+      resourceId: params.id,
+      operation: "delete",
+      requestMethod: req.method,
+      requestHeaders: req.headers
+    });
     return response;
   } catch (error) {
     if (error instanceof Error && error.message === "Access denied") {