npm - @open-mercato/core - Versions diffs - 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7 - Mend

@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (1458) hide show

package/dist/modules/messages/api/[id]/route.js CHANGED Viewed

@@ -337,21 +337,6 @@ async function DELETE(req, { params }) {
   if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
     return Response.json({ error: "Access denied" }, { status: 403 });
   }
-  const isSender = message.senderUserId === scope.userId;
-  const isRecipient = isSender ? false : Boolean(await findOneWithDecryption(
-    em,
-    MessageRecipient,
-    {
-      messageId: params.id,
-      recipientUserId: scope.userId,
-      deletedAt: null
-    },
-    void 0,
-    { tenantId: scope.tenantId, organizationId: scope.organizationId }
-  ));
-  if (!isSender && !isRecipient) {
-    return Response.json({ error: "Access denied" }, { status: 403 });
-  }
   const guardResult = await runMessageMutationGuards(
     ctx.container,
     {

package/dist/modules/messages/api/[id]/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/messages/api/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '../../../auth/data/entities'\nimport { Message, MessageObject, MessageRecipient } from '../../data/entities'\nimport { updateDraftSchema } from '../../data/validators'\nimport { buildResolvedMessageActions } from '../../lib/actions'\nimport { MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND } from '../../lib/constants'\nimport { getMessageObjectType } from '../../lib/message-objects-registry'\nimport { getMessageTypeOrDefault } from '../../lib/message-types-registry'\nimport { attachOperationMetadataHeader } from '../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../guards'\nimport {\n  errorResponseSchema,\n  messageDetailResponseSchema,\n  okResponseSchema,\n  updateDraftSchema as updateDraftOpenApiSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('messages').child({ component: 'api' })\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PATCH: { requireAuth: true, requireFeatures: ['messages.compose'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype MessageObjectPreviewPayload = {\n  title: string\n  subtitle?: string\n  status?: string\n  statusColor?: string\n  metadata?: Record<string, string>\n} | null\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n  const url = new URL(req.url)\n  const skipMarkReadParam = url.searchParams.get('skipMarkRead')\n  const skipMarkRead = skipMarkReadParam === '1'\n\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: params.id,\n      tenantId: scope.tenantId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  const isSender = message.senderUserId === scope.userId\n  const isRecipient = Boolean(recipient)\n\n  if (!isSender && !isRecipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const autoMarkRead = !skipMarkRead && recipient?.status === 'unread'\n  const readAt = autoMarkRead ? new Date() : recipient?.readAt ?? null\n\n  const objects = await em.find(MessageObject, { messageId: params.id })\n  const objectPreviews = await Promise.all(\n    objects.map(async (item): Promise<MessageObjectPreviewPayload> => {\n      const objectType = getMessageObjectType(item.entityModule, item.entityType)\n      if (!objectType?.loadPreview) return null\n      try {\n        return await objectType.loadPreview(item.entityId, {\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n        })\n      } catch (error) {\n        logger.error('Failed to load preview', { entityModule: item.entityModule, entityType: item.entityType, entityId: item.entityId, err: error })\n        return null\n      }\n    }),\n  )\n  const allRecipients = await em.find(MessageRecipient, { messageId: params.id, deletedAt: null })\n\n  const threadMessages = await findWithDecryption(\n    em,\n    Message,\n    {\n      threadId: message.threadId ?? message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n      isDraft: false,\n    },\n    { orderBy: { sentAt: 'ASC' } },\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  const threadMessageIds = threadMessages.map((item) => item.id)\n  const visibleRecipientRows = threadMessageIds.length > 0\n    ? await em.find(MessageRecipient, {\n      messageId: { $in: threadMessageIds },\n      recipientUserId: scope.userId,\n      deletedAt: null,\n    })\n    : []\n  const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId))\n  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => (\n    threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id)\n  ))\n\n  const actorRecipientStatusByMessageId = new Map<string, string>()\n  for (const row of visibleRecipientRows) {\n    actorRecipientStatusByMessageId.set(row.messageId, row.status)\n  }\n  if (recipient) {\n    actorRecipientStatusByMessageId.set(params.id, autoMarkRead ? 'read' : recipient.status)\n  }\n  const actorRecipientStatuses = Array.from(actorRecipientStatusByMessageId.values())\n  const conversationArchived = actorRecipientStatuses.length > 0\n    && actorRecipientStatuses.every((status) => status === 'archived')\n  const conversationAllUnread = actorRecipientStatuses.length > 0\n    && actorRecipientStatuses.every((status) => status === 'unread')\n\n  const threadSenderIds = actorVisibleThreadMessages\n    .map((threadMessage) => threadMessage.senderUserId)\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n\n  const threadSenders = threadSenderIds.length > 0\n    ? await findWithDecryption(\n        em,\n        User,\n        { id: { $in: Array.from(new Set(threadSenderIds)) } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const threadSenderMap = new Map(threadSenders.map((user) => [user.id, user]))\n\n  const senderUser = await findOneWithDecryption(\n    em,\n    User,\n    { id: message.senderUserId },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId }\n  )\n\n  const senderName = typeof senderUser?.name === 'string' && senderUser.name.trim().length\n    ? senderUser.name.trim()\n    : null\n  const senderEmail = senderUser?.email ?? null\n\n  const messageType = getMessageTypeOrDefault(message.type)\n  const resolvedActionData = buildResolvedMessageActions(message, objects)\n\n  if (autoMarkRead) {\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    await commandBus.execute('messages.recipients.mark_read', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  }\n\n  return Response.json({\n    id: message.id,\n    updatedAt: message.updatedAt ?? null,\n    type: message.type,\n    isDraft: message.isDraft,\n    canEditDraft: message.isDraft && message.senderUserId === scope.userId,\n    canArchive: Boolean(recipient),\n    isArchived: recipient?.status === 'archived',\n    visibility: message.visibility,\n    sourceEntityType: message.sourceEntityType,\n    sourceEntityId: message.sourceEntityId,\n    externalEmail: message.externalEmail,\n    externalName: message.externalName,\n    typeDefinition: {\n      labelKey: messageType.labelKey,\n      icon: messageType.icon,\n      color: messageType.color,\n      allowReply: messageType.allowReply ?? true,\n      allowForward: messageType.allowForward ?? true,\n      ui: {\n        listItemComponent: messageType.ui?.listItemComponent ?? null,\n        contentComponent: messageType.ui?.contentComponent ?? null,\n        actionsComponent: messageType.ui?.actionsComponent ?? null,\n      },\n    },\n    threadId: message.threadId,\n    parentMessageId: message.parentMessageId,\n    senderUserId: message.senderUserId,\n    senderName,\n    senderEmail,\n    subject: message.subject,\n    body: message.body,\n    bodyFormat: message.bodyFormat,\n    priority: message.priority,\n    sentAt: message.sentAt,\n    actionData: resolvedActionData,\n    actionTaken: message.actionTaken,\n    actionTakenAt: message.actionTakenAt,\n    actionTakenByUserId: message.actionTakenByUserId,\n    recipients: allRecipients.map((item) => ({\n      userId: item.recipientUserId,\n      type: item.recipientType,\n      status: autoMarkRead && item.recipientUserId === scope.userId ? 'read' : item.status,\n      readAt: autoMarkRead && item.recipientUserId === scope.userId ? readAt : item.readAt,\n    })),\n    objects: objects.map((item, index) => ({\n      id: item.id,\n      entityModule: item.entityModule,\n      entityType: item.entityType,\n      entityId: item.entityId,\n      actionRequired: item.actionRequired,\n      actionType: item.actionType,\n      actionLabel: item.actionLabel,\n      snapshot: item.entitySnapshot,\n      preview: objectPreviews[index] ?? null,\n    })),\n    thread: actorVisibleThreadMessages.map((threadMessage) => {\n      const sender = threadSenderMap.get(threadMessage.senderUserId)\n      const threadSenderName = typeof sender?.name === 'string' && sender.name.trim().length\n        ? sender.name.trim()\n        : null\n\n      return {\n        id: threadMessage.id,\n        senderUserId: threadMessage.senderUserId,\n        senderName: threadSenderName,\n        senderEmail: sender?.email ?? null,\n        body: threadMessage.body,\n        bodyFormat: threadMessage.bodyFormat,\n        sentAt: threadMessage.sentAt,\n      }\n    }),\n    isRead: recipient ? (autoMarkRead || recipient.status !== 'unread') : true,\n    conversationArchived,\n    conversationAllUnread,\n  })\n}\n\nexport async function PATCH(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = updateDraftSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Only draft messages can be edited' }, { status: 409 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    // Reject stale draft edits/sends before mutating: compare the client's\n    // expected version (extension header) against the loaded draft.\n    enforceCommandOptimisticLock({\n      resourceKind: MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND,\n      resourceId: message.id,\n      current: message.updatedAt,\n      request: req,\n    })\n\n    const { logEntry } = await commandBus.execute('messages.messages.update_draft', {\n      input: {\n        ...input,\n        messageId: message.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true, id: message.id })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return Response.json(error.body, { status: error.status })\n    }\n    if (error instanceof Error) {\n      if (error.message === 'Message type cannot be created by users') {\n        return Response.json({ error: error.message }, { status: 400 })\n      }\n      if (error.message === 'Only draft messages can be edited') {\n        return Response.json({ error: error.message }, { status: 409 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const isSender = message.senderUserId === scope.userId\n  // Only look the recipient row up when the actor is not the sender: deleting one's own\n  // message is the common path, and the lookup is a decryption-aware query.\n  const isRecipient = isSender\n    ? false\n    : Boolean(await findOneWithDecryption(\n      em,\n      MessageRecipient,\n      {\n        messageId: params.id,\n        recipientUserId: scope.userId,\n        deletedAt: null,\n      },\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    ))\n\n  if (!isSender && !isRecipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    // Reject a stale delete before mutating: a tab that loaded an older version\n    // of the message must refresh rather than silently delete a changed record.\n    enforceCommandOptimisticLock({\n      resourceKind: MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND,\n      resourceId: message.id,\n      current: message.updatedAt,\n      request: req,\n    })\n\n    const { logEntry } = await commandBus.execute('messages.messages.delete_for_actor', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return Response.json(error.body, { status: error.status })\n    }\n    if (error instanceof Error && error.message === 'Access denied') {\n      return Response.json({ error: 'Access denied' }, { status: 403 })\n    }\n    throw error\n  }\n\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Get message detail',\n      responses: [\n        {\n          status: 200,\n          description: 'Message detail with actor-visible thread items only',\n          schema: messageDetailResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update draft message',\n      requestBody: { schema: updateDraftOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Draft updated', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only drafts can be edited, or the draft was modified concurrently (optimistic lock conflict)', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete message for current sender/recipient context',\n      responses: [\n        { status: 200, description: 'Message deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Message was modified concurrently (optimistic lock conflict)', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAGA,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,YAAY;AACrB,SAAS,SAAS,eAAe,wBAAwB;AACzD,SAAS,yBAAyB;AAClC,SAAS,mCAAmC;AAC5C,SAAS,6CAA6C;AACtD,SAAS,4BAA4B;AACrC,SAAS,+BAA+B;AACxC,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAC7D,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,OAChB;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE3D,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAUA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,oBAAoB,IAAI,aAAa,IAAI,cAAc;AAC7D,QAAM,eAAe,sBAAsB;AAE3C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,QAAM,cAAc,QAAQ,SAAS;AAErC,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,eAAe,CAAC,gBAAgB,WAAW,WAAW;AAC5D,QAAM,SAAS,eAAe,oBAAI,KAAK,IAAI,WAAW,UAAU;AAEhE,QAAM,UAAU,MAAM,GAAG,KAAK,eAAe,EAAE,WAAW,OAAO,GAAG,CAAC;AACrE,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC,QAAQ,IAAI,OAAO,SAA+C;AAChE,YAAM,aAAa,qBAAqB,KAAK,cAAc,KAAK,UAAU;AAC1E,UAAI,CAAC,YAAY,YAAa,QAAO;AACrC,UAAI;AACF,eAAO,MAAM,WAAW,YAAY,KAAK,UAAU;AAAA,UACjD,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,QACxB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,eAAO,MAAM,0BAA0B,EAAE,cAAc,KAAK,cAAc,YAAY,KAAK,YAAY,UAAU,KAAK,UAAU,KAAK,MAAM,CAAC;AAC5I,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,MAAM,GAAG,KAAK,kBAAkB,EAAE,WAAW,OAAO,IAAI,WAAW,KAAK,CAAC;AAE/F,QAAM,iBAAiB,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,QAAQ,YAAY,QAAQ;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,MACX,SAAS;AAAA,IACX;AAAA,IACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,IAC7B,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,QAAM,mBAAmB,eAAe,IAAI,CAAC,SAAS,KAAK,EAAE;AAC7D,QAAM,uBAAuB,iBAAiB,SAAS,IACnD,MAAM,GAAG,KAAK,kBAAkB;AAAA,IAChC,WAAW,EAAE,KAAK,iBAAiB;AAAA,IACnC,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC,IACC,CAAC;AACL,QAAM,6BAA6B,IAAI,IAAI,qBAAqB,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;AAC7F,QAAM,6BAA6B,eAAe,OAAO,CAAC,kBACxD,cAAc,iBAAiB,MAAM,UAAU,2BAA2B,IAAI,cAAc,EAAE,CAC/F;AAED,QAAM,kCAAkC,oBAAI,IAAoB;AAChE,aAAW,OAAO,sBAAsB;AACtC,oCAAgC,IAAI,IAAI,WAAW,IAAI,MAAM;AAAA,EAC/D;AACA,MAAI,WAAW;AACb,oCAAgC,IAAI,OAAO,IAAI,eAAe,SAAS,UAAU,MAAM;AAAA,EACzF;AACA,QAAM,yBAAyB,MAAM,KAAK,gCAAgC,OAAO,CAAC;AAClF,QAAM,uBAAuB,uBAAuB,SAAS,KACxD,uBAAuB,MAAM,CAAC,WAAW,WAAW,UAAU;AACnE,QAAM,wBAAwB,uBAAuB,SAAS,KACzD,uBAAuB,MAAM,CAAC,WAAW,WAAW,QAAQ;AAEjE,QAAM,kBAAkB,2BACrB,IAAI,CAAC,kBAAkB,cAAc,YAAY,EACjD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAEnF,QAAM,gBAAgB,gBAAgB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE;AAAA,IACpD;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,kBAAkB,IAAI,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAE5E,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,aAAa;AAAA,IAC3B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,QAAM,aAAa,OAAO,YAAY,SAAS,YAAY,WAAW,KAAK,KAAK,EAAE,SAC9E,WAAW,KAAK,KAAK,IACrB;AACJ,QAAM,cAAc,YAAY,SAAS;AAEzC,QAAM,cAAc,wBAAwB,QAAQ,IAAI;AACxD,QAAM,qBAAqB,4BAA4B,SAAS,OAAO;AAEvE,MAAI,cAAc;AAChB,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,WAAW,QAAQ,iCAAiC;AAAA,MACxD,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,SAAS,KAAK;AAAA,IACnB,IAAI,QAAQ;AAAA,IACZ,WAAW,QAAQ,aAAa;AAAA,IAChC,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ,WAAW,QAAQ,iBAAiB,MAAM;AAAA,IAChE,YAAY,QAAQ,SAAS;AAAA,IAC7B,YAAY,WAAW,WAAW;AAAA,IAClC,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,eAAe,QAAQ;AAAA,IACvB,cAAc,QAAQ;AAAA,IACtB,gBAAgB;AAAA,MACd,UAAU,YAAY;AAAA,MACtB,MAAM,YAAY;AAAA,MAClB,OAAO,YAAY;AAAA,MACnB,YAAY,YAAY,cAAc;AAAA,MACtC,cAAc,YAAY,gBAAgB;AAAA,MAC1C,IAAI;AAAA,QACF,mBAAmB,YAAY,IAAI,qBAAqB;AAAA,QACxD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,QACtD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,MACxD;AAAA,IACF;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,IAClB,QAAQ,QAAQ;AAAA,IAChB,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB,eAAe,QAAQ;AAAA,IACvB,qBAAqB,QAAQ;AAAA,IAC7B,YAAY,cAAc,IAAI,CAAC,UAAU;AAAA,MACvC,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,gBAAgB,KAAK,oBAAoB,MAAM,SAAS,SAAS,KAAK;AAAA,MAC9E,QAAQ,gBAAgB,KAAK,oBAAoB,MAAM,SAAS,SAAS,KAAK;AAAA,IAChF,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW;AAAA,MACrC,IAAI,KAAK;AAAA,MACT,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,SAAS,eAAe,KAAK,KAAK;AAAA,IACpC,EAAE;AAAA,IACF,QAAQ,2BAA2B,IAAI,CAAC,kBAAkB;AACxD,YAAM,SAAS,gBAAgB,IAAI,cAAc,YAAY;AAC7D,YAAM,mBAAmB,OAAO,QAAQ,SAAS,YAAY,OAAO,KAAK,KAAK,EAAE,SAC5E,OAAO,KAAK,KAAK,IACjB;AAEJ,aAAO;AAAA,QACL,IAAI,cAAc;AAAA,QAClB,cAAc,cAAc;AAAA,QAC5B,YAAY;AAAA,QACZ,aAAa,QAAQ,SAAS;AAAA,QAC9B,MAAM,cAAc;AAAA,QACpB,YAAY,cAAc;AAAA,QAC1B,QAAQ,cAAc;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,IACD,QAAQ,YAAa,gBAAgB,UAAU,WAAW,WAAY;AAAA,IACtE;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,MAAM,KAAc,EAAE,OAAO,GAA+B;AAChF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAE1C,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,kCAAkC;AAAA,MAC9E,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,GAAG,CAAC;AAC3D,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,IACtB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,2CAA2C;AAC/D,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,qCAAqC;AACzD,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAGhD,QAAM,cAAc,WAChB,QACA,QAAQ,MAAM;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,MACE,WAAW,OAAO;AAAA,MAClB,iBAAiB,MAAM;AAAA,MACvB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,CAAC;AAEH,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,MAClF,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,iBAAiB,SAAS,MAAM,YAAY,iBAAiB;AAC/D,aAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AACA,UAAM;AAAA,EACR;AAEF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,iBAAiB;AAAA,MACxE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gGAAgG,QAAQ,oBAAoB;AAAA,MAC1J;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gEAAgE,QAAQ,oBAAoB;AAAA,MAC1H;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '../../../auth/data/entities'\nimport { Message, MessageObject, MessageRecipient } from '../../data/entities'\nimport { updateDraftSchema } from '../../data/validators'\nimport { buildResolvedMessageActions } from '../../lib/actions'\nimport { MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND } from '../../lib/constants'\nimport { getMessageObjectType } from '../../lib/message-objects-registry'\nimport { getMessageTypeOrDefault } from '../../lib/message-types-registry'\nimport { attachOperationMetadataHeader } from '../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../guards'\nimport {\n  errorResponseSchema,\n  messageDetailResponseSchema,\n  okResponseSchema,\n  updateDraftSchema as updateDraftOpenApiSchema,\n} from '../openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('messages').child({ component: 'api' })\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PATCH: { requireAuth: true, requireFeatures: ['messages.compose'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype MessageObjectPreviewPayload = {\n  title: string\n  subtitle?: string\n  status?: string\n  statusColor?: string\n  metadata?: Record<string, string>\n} | null\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n  const url = new URL(req.url)\n  const skipMarkReadParam = url.searchParams.get('skipMarkRead')\n  const skipMarkRead = skipMarkReadParam === '1'\n\n  const message = await findOneWithDecryption(\n    em,\n    Message,\n    {\n      id: params.id,\n      tenantId: scope.tenantId,\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  const isSender = message.senderUserId === scope.userId\n  const isRecipient = Boolean(recipient)\n\n  if (!isSender && !isRecipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const autoMarkRead = !skipMarkRead && recipient?.status === 'unread'\n  const readAt = autoMarkRead ? new Date() : recipient?.readAt ?? null\n\n  const objects = await em.find(MessageObject, { messageId: params.id })\n  const objectPreviews = await Promise.all(\n    objects.map(async (item): Promise<MessageObjectPreviewPayload> => {\n      const objectType = getMessageObjectType(item.entityModule, item.entityType)\n      if (!objectType?.loadPreview) return null\n      try {\n        return await objectType.loadPreview(item.entityId, {\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n        })\n      } catch (error) {\n        logger.error('Failed to load preview', { entityModule: item.entityModule, entityType: item.entityType, entityId: item.entityId, err: error })\n        return null\n      }\n    }),\n  )\n  const allRecipients = await em.find(MessageRecipient, { messageId: params.id, deletedAt: null })\n\n  const threadMessages = await findWithDecryption(\n    em,\n    Message,\n    {\n      threadId: message.threadId ?? message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n      isDraft: false,\n    },\n    { orderBy: { sentAt: 'ASC' } },\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  const threadMessageIds = threadMessages.map((item) => item.id)\n  const visibleRecipientRows = threadMessageIds.length > 0\n    ? await em.find(MessageRecipient, {\n      messageId: { $in: threadMessageIds },\n      recipientUserId: scope.userId,\n      deletedAt: null,\n    })\n    : []\n  const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId))\n  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => (\n    threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id)\n  ))\n\n  const actorRecipientStatusByMessageId = new Map<string, string>()\n  for (const row of visibleRecipientRows) {\n    actorRecipientStatusByMessageId.set(row.messageId, row.status)\n  }\n  if (recipient) {\n    actorRecipientStatusByMessageId.set(params.id, autoMarkRead ? 'read' : recipient.status)\n  }\n  const actorRecipientStatuses = Array.from(actorRecipientStatusByMessageId.values())\n  const conversationArchived = actorRecipientStatuses.length > 0\n    && actorRecipientStatuses.every((status) => status === 'archived')\n  const conversationAllUnread = actorRecipientStatuses.length > 0\n    && actorRecipientStatuses.every((status) => status === 'unread')\n\n  const threadSenderIds = actorVisibleThreadMessages\n    .map((threadMessage) => threadMessage.senderUserId)\n    .filter((value): value is string => typeof value === 'string' && value.length > 0)\n\n  const threadSenders = threadSenderIds.length > 0\n    ? await findWithDecryption(\n        em,\n        User,\n        { id: { $in: Array.from(new Set(threadSenderIds)) } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const threadSenderMap = new Map(threadSenders.map((user) => [user.id, user]))\n\n  const senderUser = await findOneWithDecryption(\n    em,\n    User,\n    { id: message.senderUserId },\n    undefined,\n    { tenantId: scope.tenantId, organizationId: scope.organizationId }\n  )\n\n  const senderName = typeof senderUser?.name === 'string' && senderUser.name.trim().length\n    ? senderUser.name.trim()\n    : null\n  const senderEmail = senderUser?.email ?? null\n\n  const messageType = getMessageTypeOrDefault(message.type)\n  const resolvedActionData = buildResolvedMessageActions(message, objects)\n\n  if (autoMarkRead) {\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    await commandBus.execute('messages.recipients.mark_read', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n  }\n\n  return Response.json({\n    id: message.id,\n    updatedAt: message.updatedAt ?? null,\n    type: message.type,\n    isDraft: message.isDraft,\n    canEditDraft: message.isDraft && message.senderUserId === scope.userId,\n    canArchive: Boolean(recipient),\n    isArchived: recipient?.status === 'archived',\n    visibility: message.visibility,\n    sourceEntityType: message.sourceEntityType,\n    sourceEntityId: message.sourceEntityId,\n    externalEmail: message.externalEmail,\n    externalName: message.externalName,\n    typeDefinition: {\n      labelKey: messageType.labelKey,\n      icon: messageType.icon,\n      color: messageType.color,\n      allowReply: messageType.allowReply ?? true,\n      allowForward: messageType.allowForward ?? true,\n      ui: {\n        listItemComponent: messageType.ui?.listItemComponent ?? null,\n        contentComponent: messageType.ui?.contentComponent ?? null,\n        actionsComponent: messageType.ui?.actionsComponent ?? null,\n      },\n    },\n    threadId: message.threadId,\n    parentMessageId: message.parentMessageId,\n    senderUserId: message.senderUserId,\n    senderName,\n    senderEmail,\n    subject: message.subject,\n    body: message.body,\n    bodyFormat: message.bodyFormat,\n    priority: message.priority,\n    sentAt: message.sentAt,\n    actionData: resolvedActionData,\n    actionTaken: message.actionTaken,\n    actionTakenAt: message.actionTakenAt,\n    actionTakenByUserId: message.actionTakenByUserId,\n    recipients: allRecipients.map((item) => ({\n      userId: item.recipientUserId,\n      type: item.recipientType,\n      status: autoMarkRead && item.recipientUserId === scope.userId ? 'read' : item.status,\n      readAt: autoMarkRead && item.recipientUserId === scope.userId ? readAt : item.readAt,\n    })),\n    objects: objects.map((item, index) => ({\n      id: item.id,\n      entityModule: item.entityModule,\n      entityType: item.entityType,\n      entityId: item.entityId,\n      actionRequired: item.actionRequired,\n      actionType: item.actionType,\n      actionLabel: item.actionLabel,\n      snapshot: item.entitySnapshot,\n      preview: objectPreviews[index] ?? null,\n    })),\n    thread: actorVisibleThreadMessages.map((threadMessage) => {\n      const sender = threadSenderMap.get(threadMessage.senderUserId)\n      const threadSenderName = typeof sender?.name === 'string' && sender.name.trim().length\n        ? sender.name.trim()\n        : null\n\n      return {\n        id: threadMessage.id,\n        senderUserId: threadMessage.senderUserId,\n        senderName: threadSenderName,\n        senderEmail: sender?.email ?? null,\n        body: threadMessage.body,\n        bodyFormat: threadMessage.bodyFormat,\n        sentAt: threadMessage.sentAt,\n      }\n    }),\n    isRead: recipient ? (autoMarkRead || recipient.status !== 'unread') : true,\n    conversationArchived,\n    conversationAllUnread,\n  })\n}\n\nexport async function PATCH(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = updateDraftSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Only draft messages can be edited' }, { status: 409 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    // Reject stale draft edits/sends before mutating: compare the client's\n    // expected version (extension header) against the loaded draft.\n    enforceCommandOptimisticLock({\n      resourceKind: MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND,\n      resourceId: message.id,\n      current: message.updatedAt,\n      request: req,\n    })\n\n    const { logEntry } = await commandBus.execute('messages.messages.update_draft', {\n      input: {\n        ...input,\n        messageId: message.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true, id: message.id })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: message.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return Response.json(error.body, { status: error.status })\n    }\n    if (error instanceof Error) {\n      if (error.message === 'Message type cannot be created by users') {\n        return Response.json({ error: error.message }, { status: 400 })\n      }\n      if (error.message === 'Only draft messages can be edited') {\n        return Response.json({ error: error.message }, { status: 409 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: null,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  try {\n    // Reject a stale delete before mutating: a tab that loaded an older version\n    // of the message must refresh rather than silently delete a changed record.\n    enforceCommandOptimisticLock({\n      resourceKind: MESSAGE_OPTIMISTIC_LOCK_RESOURCE_KIND,\n      resourceId: message.id,\n      current: message.updatedAt,\n      request: req,\n    })\n\n    const { logEntry } = await commandBus.execute('messages.messages.delete_for_actor', {\n      input: {\n        messageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json({ ok: true })\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n      operation: 'delete',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n    })\n    return response\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return Response.json(error.body, { status: error.status })\n    }\n    if (error instanceof Error && error.message === 'Access denied') {\n      return Response.json({ error: 'Access denied' }, { status: 403 })\n    }\n    throw error\n  }\n\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Get message detail',\n      responses: [\n        {\n          status: 200,\n          description: 'Message detail with actor-visible thread items only',\n          schema: messageDetailResponseSchema,\n        },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    PATCH: {\n      summary: 'Update draft message',\n      requestBody: { schema: updateDraftOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Draft updated', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only drafts can be edited, or the draft was modified concurrently (optimistic lock conflict)', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete message for current sender/recipient context',\n      responses: [\n        { status: 200, description: 'Message deleted', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Message was modified concurrently (optimistic lock conflict)', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,uBAAuB;AAChC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,YAAY;AACrB,SAAS,SAAS,eAAe,wBAAwB;AACzD,SAAS,yBAAyB;AAClC,SAAS,mCAAmC;AAC5C,SAAS,6CAA6C;AACtD,SAAS,4BAA4B;AACrC,SAAS,+BAA+B;AACxC,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAC7D,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB;AAAA,OAChB;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,UAAU,EAAE,MAAM,EAAE,WAAW,MAAM,CAAC;AAE3D,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAAA,EAClE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAUA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,oBAAoB,IAAI,aAAa,IAAI,cAAc;AAC7D,QAAM,eAAe,sBAAsB;AAE3C,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,OAAO;AAAA,MACX,UAAU,MAAM;AAAA,MAChB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,QAAM,cAAc,QAAQ,SAAS;AAErC,MAAI,CAAC,YAAY,CAAC,aAAa;AAC7B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,eAAe,CAAC,gBAAgB,WAAW,WAAW;AAC5D,QAAM,SAAS,eAAe,oBAAI,KAAK,IAAI,WAAW,UAAU;AAEhE,QAAM,UAAU,MAAM,GAAG,KAAK,eAAe,EAAE,WAAW,OAAO,GAAG,CAAC;AACrE,QAAM,iBAAiB,MAAM,QAAQ;AAAA,IACnC,QAAQ,IAAI,OAAO,SAA+C;AAChE,YAAM,aAAa,qBAAqB,KAAK,cAAc,KAAK,UAAU;AAC1E,UAAI,CAAC,YAAY,YAAa,QAAO;AACrC,UAAI;AACF,eAAO,MAAM,WAAW,YAAY,KAAK,UAAU;AAAA,UACjD,UAAU,MAAM;AAAA,UAChB,gBAAgB,MAAM;AAAA,QACxB,CAAC;AAAA,MACH,SAAS,OAAO;AACd,eAAO,MAAM,0BAA0B,EAAE,cAAc,KAAK,cAAc,YAAY,KAAK,YAAY,UAAU,KAAK,UAAU,KAAK,MAAM,CAAC;AAC5I,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACA,QAAM,gBAAgB,MAAM,GAAG,KAAK,kBAAkB,EAAE,WAAW,OAAO,IAAI,WAAW,KAAK,CAAC;AAE/F,QAAM,iBAAiB,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,MACE,UAAU,QAAQ,YAAY,QAAQ;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,MACX,SAAS;AAAA,IACX;AAAA,IACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,IAC7B,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,QAAM,mBAAmB,eAAe,IAAI,CAAC,SAAS,KAAK,EAAE;AAC7D,QAAM,uBAAuB,iBAAiB,SAAS,IACnD,MAAM,GAAG,KAAK,kBAAkB;AAAA,IAChC,WAAW,EAAE,KAAK,iBAAiB;AAAA,IACnC,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC,IACC,CAAC;AACL,QAAM,6BAA6B,IAAI,IAAI,qBAAqB,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC;AAC7F,QAAM,6BAA6B,eAAe,OAAO,CAAC,kBACxD,cAAc,iBAAiB,MAAM,UAAU,2BAA2B,IAAI,cAAc,EAAE,CAC/F;AAED,QAAM,kCAAkC,oBAAI,IAAoB;AAChE,aAAW,OAAO,sBAAsB;AACtC,oCAAgC,IAAI,IAAI,WAAW,IAAI,MAAM;AAAA,EAC/D;AACA,MAAI,WAAW;AACb,oCAAgC,IAAI,OAAO,IAAI,eAAe,SAAS,UAAU,MAAM;AAAA,EACzF;AACA,QAAM,yBAAyB,MAAM,KAAK,gCAAgC,OAAO,CAAC;AAClF,QAAM,uBAAuB,uBAAuB,SAAS,KACxD,uBAAuB,MAAM,CAAC,WAAW,WAAW,UAAU;AACnE,QAAM,wBAAwB,uBAAuB,SAAS,KACzD,uBAAuB,MAAM,CAAC,WAAW,WAAW,QAAQ;AAEjE,QAAM,kBAAkB,2BACrB,IAAI,CAAC,kBAAkB,cAAc,YAAY,EACjD,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC;AAEnF,QAAM,gBAAgB,gBAAgB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,EAAE,EAAE;AAAA,IACpD;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,kBAAkB,IAAI,IAAI,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAE5E,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,QAAQ,aAAa;AAAA,IAC3B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AAEA,QAAM,aAAa,OAAO,YAAY,SAAS,YAAY,WAAW,KAAK,KAAK,EAAE,SAC9E,WAAW,KAAK,KAAK,IACrB;AACJ,QAAM,cAAc,YAAY,SAAS;AAEzC,QAAM,cAAc,wBAAwB,QAAQ,IAAI;AACxD,QAAM,qBAAqB,4BAA4B,SAAS,OAAO;AAEvE,MAAI,cAAc;AAChB,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,WAAW,QAAQ,iCAAiC;AAAA,MACxD,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAAA,EACH;AAEA,SAAO,SAAS,KAAK;AAAA,IACnB,IAAI,QAAQ;AAAA,IACZ,WAAW,QAAQ,aAAa;AAAA,IAChC,MAAM,QAAQ;AAAA,IACd,SAAS,QAAQ;AAAA,IACjB,cAAc,QAAQ,WAAW,QAAQ,iBAAiB,MAAM;AAAA,IAChE,YAAY,QAAQ,SAAS;AAAA,IAC7B,YAAY,WAAW,WAAW;AAAA,IAClC,YAAY,QAAQ;AAAA,IACpB,kBAAkB,QAAQ;AAAA,IAC1B,gBAAgB,QAAQ;AAAA,IACxB,eAAe,QAAQ;AAAA,IACvB,cAAc,QAAQ;AAAA,IACtB,gBAAgB;AAAA,MACd,UAAU,YAAY;AAAA,MACtB,MAAM,YAAY;AAAA,MAClB,OAAO,YAAY;AAAA,MACnB,YAAY,YAAY,cAAc;AAAA,MACtC,cAAc,YAAY,gBAAgB;AAAA,MAC1C,IAAI;AAAA,QACF,mBAAmB,YAAY,IAAI,qBAAqB;AAAA,QACxD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,QACtD,kBAAkB,YAAY,IAAI,oBAAoB;AAAA,MACxD;AAAA,IACF;AAAA,IACA,UAAU,QAAQ;AAAA,IAClB,iBAAiB,QAAQ;AAAA,IACzB,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA,SAAS,QAAQ;AAAA,IACjB,MAAM,QAAQ;AAAA,IACd,YAAY,QAAQ;AAAA,IACpB,UAAU,QAAQ;AAAA,IAClB,QAAQ,QAAQ;AAAA,IAChB,YAAY;AAAA,IACZ,aAAa,QAAQ;AAAA,IACrB,eAAe,QAAQ;AAAA,IACvB,qBAAqB,QAAQ;AAAA,IAC7B,YAAY,cAAc,IAAI,CAAC,UAAU;AAAA,MACvC,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK;AAAA,MACX,QAAQ,gBAAgB,KAAK,oBAAoB,MAAM,SAAS,SAAS,KAAK;AAAA,MAC9E,QAAQ,gBAAgB,KAAK,oBAAoB,MAAM,SAAS,SAAS,KAAK;AAAA,IAChF,EAAE;AAAA,IACF,SAAS,QAAQ,IAAI,CAAC,MAAM,WAAW;AAAA,MACrC,IAAI,KAAK;AAAA,MACT,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK;AAAA,MAClB,UAAU,KAAK;AAAA,MACf,SAAS,eAAe,KAAK,KAAK;AAAA,IACpC,EAAE;AAAA,IACF,QAAQ,2BAA2B,IAAI,CAAC,kBAAkB;AACxD,YAAM,SAAS,gBAAgB,IAAI,cAAc,YAAY;AAC7D,YAAM,mBAAmB,OAAO,QAAQ,SAAS,YAAY,OAAO,KAAK,KAAK,EAAE,SAC5E,OAAO,KAAK,KAAK,IACjB;AAEJ,aAAO;AAAA,QACL,IAAI,cAAc;AAAA,QAClB,cAAc,cAAc;AAAA,QAC5B,YAAY;AAAA,QACZ,aAAa,QAAQ,SAAS;AAAA,QAC9B,MAAM,cAAc;AAAA,QACpB,YAAY,cAAc;AAAA,QAC1B,QAAQ,cAAc;AAAA,MACxB;AAAA,IACF,CAAC;AAAA,IACD,QAAQ,YAAa,gBAAgB,UAAU,WAAW,WAAY;AAAA,IACtE;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,MAAM,KAAc,EAAE,OAAO,GAA+B;AAChF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,kBAAkB,MAAM,IAAI;AAE1C,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,oCAAoC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,kCAAkC;AAAA,MAC9E,OAAO;AAAA,QACL,GAAG;AAAA,QACH,WAAW,QAAQ;AAAA,QACnB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,MAAM,IAAI,QAAQ,GAAG,CAAC;AAC3D,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,IACtB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,2CAA2C;AAC/D,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,qCAAqC;AACzD,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEF;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,QAAQ;AAAA,MACpB,SAAS,QAAQ;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,MAClF,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,UAAM,oCAAoC,YAAY,uBAAuB;AAAA,MAC3E,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,MACnB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,IACtB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,SAAS,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,iBAAiB,SAAS,MAAM,YAAY,iBAAiB;AAC/D,aAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AACA,UAAM;AAAA,EACR;AAEF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,OAAO;AAAA,MACL,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,yBAAyB;AAAA,MAChD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,iBAAiB;AAAA,MACxE;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gGAAgG,QAAQ,oBAAoB;AAAA,MAC1J;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,iBAAiB;AAAA,MAC1E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gEAAgE,QAAQ,oBAAoB;AAAA,MAC1H;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/api/route.js CHANGED Viewed

@@ -1,14 +1,5 @@
-import { createHash } from "node:crypto";
 import { z } from "zod";
 import { sql } from "kysely";
-import { runWithCacheTenant } from "@open-mercato/cache";
-import {
-  buildCollectionTags,
-  debugCrudCache,
-  isCrudCacheEnabled,
-  normalizeTagSegment,
-  resolveCrudCache
-} from "@open-mercato/shared/lib/crud/cache";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { lookupHashCandidates } from "@open-mercato/shared/lib/encryption/aes";
 import { User } from "../../auth/data/entities.js";
@@ -19,7 +10,6 @@ import { getMessageType } from "../lib/message-types-registry.js";
 import { validateMessageObjectsForType } from "../lib/object-validation.js";
 import { attachOperationMetadataHeader } from "../lib/operationMetadata.js";
 import { canUseMessageEmailFeature, resolveMessageContext } from "../lib/routeHelpers.js";
-import { applyMessageParticipantScope } from "../lib/participantScope.js";
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from "./guards.js";
 import { findMessageIdsBySearchTokens } from "../lib/searchLookup.js";
 import {
@@ -29,62 +19,19 @@ import {
   messageListItemSchema
 } from "./openapi.js";
 const NO_MATCH_ID = "00000000-0000-0000-0000-000000000000";
-const MESSAGE_LIST_CACHE_TTL_MS = 3e4;
-const MESSAGE_LIST_RESOURCE = "messages.message";
 function getDb(em) {
   return em.getKysely();
 }
-function normalizeCacheFilterValue(value) {
-  if (value === void 0) return null;
-  if (value instanceof Date) return value.toISOString();
-  if (Array.isArray(value)) return value.map(normalizeCacheFilterValue);
-  if (value && typeof value === "object") {
-    return Object.entries(value).sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)).map(([key, entryValue]) => [key, normalizeCacheFilterValue(entryValue)]);
-  }
-  return value;
-}
-function buildMessageListFilterSignature(input) {
-  const canonicalInput = Object.entries(input).sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey)).map(([key, value]) => [key, normalizeCacheFilterValue(value)]);
-  return createHash("sha256").update(JSON.stringify(canonicalInput)).digest("hex").slice(0, 32);
-}
-function buildMessageListCacheKey(scope, input) {
-  return [
-    "messages:list:v1",
-    `tenant:${normalizeTagSegment(scope.tenantId)}`,
-    `org:${normalizeTagSegment(scope.organizationId)}`,
-    `user:${normalizeTagSegment(scope.userId)}`,
-    `filters:${buildMessageListFilterSignature(input)}`
-  ].join("|");
-}
-function isMessageListPayload(value) {
-  if (!value || typeof value !== "object") return false;
-  const payload = value;
-  return Array.isArray(payload.items) && typeof payload.page === "number" && typeof payload.pageSize === "number" && typeof payload.total === "number" && typeof payload.totalPages === "number";
-}
 const metadata = {
   GET: { requireAuth: true },
   POST: { requireAuth: true, requireFeatures: ["messages.compose"] }
 };
 async function GET(req) {
   const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em");
   const url = new URL(req.url);
   const params = Object.fromEntries(url.searchParams);
   const input = listMessagesSchema.parse(params);
-  const cache = isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null;
-  const cacheKey = cache ? buildMessageListCacheKey(scope, input) : null;
-  if (cache && cacheKey) {
-    try {
-      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey));
-      if (isMessageListPayload(cached)) {
-        return Response.json(cached);
-      }
-    } catch (error) {
-      debugCrudCache("messages-list-cache-read-failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  const em = ctx.container.resolve("em");
   const db = getDb(em);
   const searchIds = input.search ? await findMessageIdsBySearchTokens({
     em,
@@ -120,7 +67,11 @@ async function GET(req) {
         joinRecipient();
         break;
       case "all":
-        q = applyMessageParticipantScope(q, scope.userId);
+        joinRecipient();
+        q = q.where((eb) => eb.or([
+          eb("m.sender_user_id", "=", scope.userId),
+          eb("r.message_id", "is not", null)
+        ]));
         break;
       default: {
         const unsupportedFolder = input.folder;
@@ -217,7 +168,7 @@ async function GET(req) {
     const name = typeof user.name === "string" && user.name.trim().length ? user.name.trim() : null;
     senderMetaById.set(user.id, { name, email: user.email ?? null });
   });
-  const payload = {
+  return Response.json({
     items: typedRows.map((row) => {
       const message = messagesById.get(row.id);
       if (!message) return null;
@@ -257,27 +208,7 @@ async function GET(req) {
     pageSize: input.pageSize,
     total,
     totalPages: Math.ceil(total / input.pageSize)
-  };
-  if (cache && cacheKey) {
-    try {
-      await runWithCacheTenant(
-        scope.tenantId,
-        () => cache.set(cacheKey, payload, {
-          ttl: MESSAGE_LIST_CACHE_TTL_MS,
-          tags: buildCollectionTags(
-            MESSAGE_LIST_RESOURCE,
-            scope.tenantId,
-            [scope.organizationId]
-          )
-        })
-      );
-    } catch (error) {
-      debugCrudCache("messages-list-cache-write-failed", {
-        error: error instanceof Error ? error.message : String(error)
-      });
-    }
-  }
-  return Response.json(payload);
+  });
 }
 async function POST(req) {
   const { ctx, scope } = await resolveMessageContext(req);

package/dist/modules/messages/api/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/messages/api/route.ts"],
-  "sourcesContent": ["import { createHash } from 'node:crypto'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql } from 'kysely'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport {\n  buildCollectionTags,\n  debugCrudCache,\n  isCrudCacheEnabled,\n  normalizeTagSegment,\n  resolveCrudCache,\n} from '@open-mercato/shared/lib/crud/cache'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'\nimport { User } from '../../auth/data/entities'\nimport { Message, MessageObject } from '../data/entities'\nimport { composeMessageSchema, listMessagesSchema, type ListMessagesInput } from '../data/validators'\nimport { MESSAGE_ATTACHMENT_ENTITY_ID } from '../lib/constants'\nimport { getMessageType } from '../lib/message-types-registry'\nimport { validateMessageObjectsForType } from '../lib/object-validation'\nimport { attachOperationMetadataHeader } from '../lib/operationMetadata'\nimport { canUseMessageEmailFeature, resolveMessageContext } from '../lib/routeHelpers'\nimport { applyMessageParticipantScope } from '../lib/participantScope'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from './guards'\nimport { findMessageIdsBySearchTokens } from '../lib/searchLookup'\nimport { MessageCommandExecuteResult } from '../commands/shared'\nimport {\n  composeMessageSchema as composeSchema,\n  composeResponseSchema,\n  listMessagesSchema as listSchema,\n  messageListItemSchema,\n} from './openapi'\n\ntype MessageCommandExecuteResultWithThreadId = MessageCommandExecuteResult & {\n  threadId: string\n}\n\nconst NO_MATCH_ID = '00000000-0000-0000-0000-000000000000'\nconst MESSAGE_LIST_CACHE_TTL_MS = 30_000\nconst MESSAGE_LIST_RESOURCE = 'messages.message'\n\nfunction getDb(em: EntityManager): Kysely<any> {\n  return em.getKysely<any>()\n}\n\ntype MessageListScopeRow = {\n  id: string\n  sender_user_id: string\n  is_draft: boolean\n  recipient_status: string | null\n  read_at: string | null\n}\n\ntype AttachmentCountRow = {\n  record_id: string\n  count: string | number\n}\n\ntype RecipientCountRow = {\n  message_id: string\n  count: string | number\n}\n\ntype MessageListPayload = {\n  items: Array<Record<string, unknown>>\n  page: number\n  pageSize: number\n  total: number\n  totalPages: number\n}\n\ntype MessageListScope = Awaited<ReturnType<typeof resolveMessageContext>>['scope']\n\nfunction normalizeCacheFilterValue(value: unknown): unknown {\n  if (value === undefined) return null\n  if (value instanceof Date) return value.toISOString()\n  if (Array.isArray(value)) return value.map(normalizeCacheFilterValue)\n  if (value && typeof value === 'object') {\n    return Object.entries(value as Record<string, unknown>)\n      .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))\n      .map(([key, entryValue]) => [key, normalizeCacheFilterValue(entryValue)])\n  }\n  return value\n}\n\nfunction buildMessageListFilterSignature(input: ListMessagesInput): string {\n  const canonicalInput = Object.entries(input)\n    .sort(([leftKey], [rightKey]) => leftKey.localeCompare(rightKey))\n    .map(([key, value]) => [key, normalizeCacheFilterValue(value)])\n\n  return createHash('sha256')\n    .update(JSON.stringify(canonicalInput))\n    .digest('hex')\n    .slice(0, 32)\n}\n\nfunction buildMessageListCacheKey(scope: MessageListScope, input: ListMessagesInput): string {\n  return [\n    'messages:list:v1',\n    `tenant:${normalizeTagSegment(scope.tenantId)}`,\n    `org:${normalizeTagSegment(scope.organizationId)}`,\n    `user:${normalizeTagSegment(scope.userId)}`,\n    `filters:${buildMessageListFilterSignature(input)}`,\n  ].join('|')\n}\n\nfunction isMessageListPayload(value: unknown): value is MessageListPayload {\n  if (!value || typeof value !== 'object') return false\n  const payload = value as Partial<MessageListPayload>\n  return Array.isArray(payload.items)\n    && typeof payload.page === 'number'\n    && typeof payload.pageSize === 'number'\n    && typeof payload.total === 'number'\n    && typeof payload.totalPages === 'number'\n}\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const url = new URL(req.url)\n  const params = Object.fromEntries(url.searchParams)\n  const input = listMessagesSchema.parse(params)\n\n  const cache = isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null\n  const cacheKey = cache ? buildMessageListCacheKey(scope, input) : null\n  if (cache && cacheKey) {\n    try {\n      const cached = await runWithCacheTenant(scope.tenantId, () => cache.get(cacheKey))\n      if (isMessageListPayload(cached)) {\n        return Response.json(cached)\n      }\n    } catch (error) {\n      debugCrudCache('messages-list-cache-read-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  const em = ctx.container.resolve('em') as EntityManager\n  const db = getDb(em) as any\n\n  const searchIds = input.search\n    ? await findMessageIdsBySearchTokens({\n        em,\n        query: input.search,\n        tenantId: scope.tenantId ?? null,\n        organizationId: scope.organizationId,\n      })\n    : undefined\n\n  const buildBaseQuery = () => {\n    let q: any = db\n      .selectFrom('messages as m')\n      .where('m.tenant_id', '=', scope.tenantId)\n      .where('m.deleted_at', 'is', null)\n\n    if (scope.organizationId) {\n      q = q.where('m.organization_id', '=', scope.organizationId)\n    } else {\n      q = q.where('m.organization_id', 'is', null)\n    }\n\n    const joinRecipient = () => {\n      q = q.leftJoin('message_recipients as r', (jb: any) => jb\n        .onRef('m.id', '=', 'r.message_id')\n        .on('r.recipient_user_id', '=', scope.userId))\n    }\n\n    switch (input.folder) {\n      case 'inbox':\n        joinRecipient()\n        q = q\n          .where('r.message_id', 'is not', null)\n          .where('r.deleted_at', 'is', null)\n          .where('r.archived_at', 'is', null)\n          .where('m.is_draft', '=', false)\n        break\n      case 'archived':\n        joinRecipient()\n        q = q\n          .where('r.message_id', 'is not', null)\n          .where('r.deleted_at', 'is', null)\n          .where('r.archived_at', 'is not', null)\n        break\n      case 'sent':\n        q = q\n          .where('m.sender_user_id', '=', scope.userId)\n          .where('m.is_draft', '=', false)\n        joinRecipient()\n        break\n      case 'drafts':\n        q = q\n          .where('m.sender_user_id', '=', scope.userId)\n          .where('m.is_draft', '=', true)\n        joinRecipient()\n        break\n      case 'all':\n        // Sender-OR-recipient participant scope shared with the\n        // communication_channels message enricher \u2014 see participantScope.ts (#4133).\n        q = applyMessageParticipantScope(q, scope.userId)\n        break\n      default: {\n        const unsupportedFolder: never = input.folder\n        throw new Error(`Unsupported folder: ${String(unsupportedFolder)}`)\n      }\n    }\n\n    if (input.status) q = q.where('r.status', '=', input.status)\n    if (input.type) q = q.where('m.type', '=', input.type)\n    if (input.visibility) q = q.where('m.visibility', '=', input.visibility)\n    if (input.sourceEntityType) q = q.where('m.source_entity_type', '=', input.sourceEntityType)\n    if (input.sourceEntityId) q = q.where('m.source_entity_id', '=', input.sourceEntityId)\n    if (input.externalEmail) q = q.where('m.external_email_hash', 'in', lookupHashCandidates(input.externalEmail))\n    if (input.senderId) q = q.where('m.sender_user_id', '=', input.senderId)\n\n    if (input.search) {\n      if (!searchIds || searchIds.length === 0) {\n        q = q.where('m.id', '=', NO_MATCH_ID)\n      } else {\n        q = q.where('m.id', 'in', searchIds)\n      }\n    }\n\n    if (input.since) q = q.where('m.sent_at', '>', new Date(input.since))\n\n    if (input.hasObjects !== undefined) {\n      const existsFn = (eb: any) => eb.exists(\n        eb.selectFrom('message_objects')\n          .select(sql<number>`1`.as('one'))\n          .whereRef('message_objects.message_id', '=', 'm.id')\n      )\n      const notExistsFn = (eb: any) => eb.not(eb.exists(\n        eb.selectFrom('message_objects')\n          .select(sql<number>`1`.as('one'))\n          .whereRef('message_objects.message_id', '=', 'm.id')\n      ))\n      q = input.hasObjects ? q.where(existsFn) : q.where(notExistsFn)\n    }\n\n    if (input.hasAttachments !== undefined) {\n      const existsFn = (eb: any) => eb.exists(\n        eb.selectFrom('attachments')\n          .select(sql<number>`1`.as('one'))\n          .where('attachments.entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n          .where(sql<boolean>`attachments.record_id = m.id::text`)\n      )\n      const notExistsFn = (eb: any) => eb.not(eb.exists(\n        eb.selectFrom('attachments')\n          .select(sql<number>`1`.as('one'))\n          .where('attachments.entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n          .where(sql<boolean>`attachments.record_id = m.id::text`)\n      ))\n      q = input.hasAttachments ? q.where(existsFn) : q.where(notExistsFn)\n    }\n\n    if (input.hasActions !== undefined) {\n      q = input.hasActions\n        ? q.where('m.action_data', 'is not', null)\n        : q.where('m.action_data', 'is', null)\n    }\n\n    return q\n  }\n\n  // Audited for #3386 rollout (P3): sort is on m.sent_at (a plain timestamp \u2014\n  // not in the messages:message encryption map whose encrypted fields are:\n  // subject, body, external_email, external_name, action_data, action_result).\n  // The handler already uses the correct two-phase shape: Kysely SQL\n  // ORDER BY + LIMIT/OFFSET produces a bounded page of IDs, then\n  // findWithDecryption is called only for those IDs \u2014 never for the full\n  // result set. The #3278 unbounded-decrypt hazard does not apply here.\n  // Covered by __tests__/list.test.ts.\n  const countResult = await buildBaseQuery()\n    .select(sql<number>`count(*)`.as('count'))\n    .executeTakeFirst() as { count: string | number } | undefined\n  const total = Number(countResult?.count ?? 0)\n\n  const offset = (input.page - 1) * input.pageSize\n  const scopeRows = await buildBaseQuery()\n    .select([\n      'm.id',\n      'm.sender_user_id',\n      'm.is_draft',\n      'r.status as recipient_status',\n      'r.read_at',\n    ])\n    .orderBy('m.sent_at', 'desc')\n    .offset(offset)\n    .limit(input.pageSize)\n    .execute()\n\n  const typedRows = scopeRows as MessageListScopeRow[]\n  const messageIds = typedRows.map((row) => row.id)\n\n  const messageEntities = messageIds.length > 0\n    ? await findWithDecryption(\n        em,\n        Message,\n        { id: { $in: messageIds } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const messagesById = new Map<string, Message>()\n  for (const message of messageEntities) {\n    messagesById.set(message.id, message)\n  }\n\n  const objects = messageIds.length > 0\n    ? await em.find(MessageObject, { messageId: { $in: messageIds } })\n    : []\n\n  const objectsByMessage = objects.reduce((acc, obj) => {\n    if (!acc[obj.messageId]) acc[obj.messageId] = []\n    acc[obj.messageId].push(obj)\n    return acc\n  }, {} as Record<string, MessageObject[]>)\n\n  const attachmentCounts: AttachmentCountRow[] = messageIds.length > 0\n    ? await (getDb(em) as any)\n        .selectFrom('attachments')\n        .select(['record_id', sql<string>`count(*)`.as('count')])\n        .where('entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n        .where('record_id', 'in', messageIds)\n        .groupBy('record_id')\n        .execute()\n    : []\n\n  const attachmentCountByMessage = attachmentCounts.reduce((acc: Record<string, number>, row) => {\n    acc[row.record_id] = Number(row.count)\n    return acc\n  }, {})\n\n  const recipientCounts: RecipientCountRow[] = messageIds.length > 0\n    ? await (getDb(em) as any)\n        .selectFrom('message_recipients')\n        .select(['message_id', sql<string>`count(*)`.as('count')])\n        .where('message_id', 'in', messageIds)\n        .where('deleted_at', 'is', null)\n        .groupBy('message_id')\n        .execute()\n    : []\n\n  const recipientCountByMessage = recipientCounts.reduce((acc: Record<string, number>, row) => {\n    acc[row.message_id] = Number(row.count)\n    return acc\n  }, {})\n\n  const senderUserIds = Array.from(new Set(typedRows.map((row) => row.sender_user_id).filter(Boolean)))\n  const senderUsers = senderUserIds.length > 0\n    ? await findWithDecryption(\n        em,\n        User,\n        { id: { $in: senderUserIds } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const senderMetaById = new Map<string, { name: string | null; email: string | null }>()\n  senderUsers.forEach((user) => {\n    const name = typeof user.name === 'string' && user.name.trim().length ? user.name.trim() : null\n    senderMetaById.set(user.id, { name, email: user.email ?? null })\n  })\n\n  const payload: MessageListPayload = {\n    items: typedRows\n      .map((row) => {\n        const message = messagesById.get(row.id)\n        if (!message) return null\n        const body = typeof message.body === 'string' ? message.body : ''\n        const bodyPreview = body.substring(0, 150) + (body.length > 150 ? '...' : '')\n        const actionData = message.actionData ?? null\n        return {\n          ...(senderMetaById.get(row.sender_user_id)\n            ? {\n                senderName: senderMetaById.get(row.sender_user_id)?.name ?? null,\n                senderEmail: senderMetaById.get(row.sender_user_id)?.email ?? null,\n              }\n            : { senderName: null, senderEmail: null }),\n          id: message.id,\n          type: message.type,\n          visibility: message.visibility ?? null,\n          sourceEntityType: message.sourceEntityType ?? null,\n          sourceEntityId: message.sourceEntityId ?? null,\n          externalEmail: message.externalEmail ?? null,\n          externalName: message.externalName ?? null,\n          subject: message.subject,\n          bodyPreview,\n          senderUserId: message.senderUserId,\n          priority: message.priority,\n          status: row.recipient_status ?? (row.is_draft ? 'draft' : 'sent'),\n          hasObjects: (objectsByMessage[message.id] || []).length > 0,\n          objectCount: (objectsByMessage[message.id] || []).length,\n          hasAttachments: (attachmentCountByMessage[message.id] || 0) > 0,\n          attachmentCount: attachmentCountByMessage[message.id] || 0,\n          recipientCount: recipientCountByMessage[message.id] || 0,\n          hasActions:\n            Boolean(actionData?.actions?.length)\n            || Boolean(getMessageType(message.type)?.defaultActions?.length)\n            || (objectsByMessage[message.id] || []).some((item) => item.actionRequired && Boolean(item.actionType)),\n          actionTaken: message.actionTaken ?? null,\n          sentAt: message.sentAt ? message.sentAt.toISOString() : null,\n          readAt: row.read_at,\n          threadId: message.threadId ?? null,\n        }\n      })\n      .filter((item): item is NonNullable<typeof item> => item !== null),\n    page: input.page,\n    pageSize: input.pageSize,\n    total,\n    totalPages: Math.ceil(total / input.pageSize),\n  }\n\n  if (cache && cacheKey) {\n    try {\n      await runWithCacheTenant(scope.tenantId, () =>\n        cache.set(cacheKey, payload, {\n          ttl: MESSAGE_LIST_CACHE_TTL_MS,\n          tags: buildCollectionTags(\n            MESSAGE_LIST_RESOURCE,\n            scope.tenantId,\n            [scope.organizationId],\n          ),\n        }),\n      )\n    } catch (error) {\n      debugCrudCache('messages-list-cache-write-failed', {\n        error: error instanceof Error ? error.message : String(error),\n      })\n    }\n  }\n\n  return Response.json(payload)\n}\n\nexport async function POST(req: Request) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = composeMessageSchema.parse(body)\n\n  const isPublicVisibility = input.visibility === 'public'\n  const sendViaEmail = isPublicVisibility ? true : input.sendViaEmail\n  if (sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  if (input.objects?.length) {\n    const objectValidationError = validateMessageObjectsForType(input.type, input.objects)\n    if (objectValidationError) {\n      return Response.json({ error: objectValidationError }, { status: 400 })\n    }\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const { result, logEntry } = await commandBus.execute('messages.messages.compose', {\n    input: {\n      ...input,\n      sendViaEmail,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n  const { id: messageId, threadId: responseThreadId } = result as unknown as MessageCommandExecuteResultWithThreadId\n\n  const response = Response.json({ id: messageId, threadId: responseThreadId }, { status: 201 })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List messages',\n      query: listSchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Message list',\n          schema: z.object({\n            items: z.array(messageListItemSchema),\n            page: z.number(),\n            pageSize: z.number(),\n            total: z.number(),\n            totalPages: z.number(),\n          }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Compose a message',\n      requestBody: {\n        schema: composeSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Message created',\n          schema: composeResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,SAAS;AAElB,SAAsB,WAAW;AACjC,SAAS,0BAA0B;AAEnC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,SAAS,qBAAqB;AACvC,SAAS,sBAAsB,0BAAkD;AACjF,SAAS,oCAAoC;AAC7C,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,oCAAoC;AAC7C,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG,SAAS,oCAAoC;AAE7C;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,EACA,sBAAsB;AAAA,EACtB;AAAA,OACK;AAMP,MAAM,cAAc;AACpB,MAAM,4BAA4B;AAClC,MAAM,wBAAwB;AAE9B,SAAS,MAAM,IAAgC;AAC7C,SAAO,GAAG,UAAe;AAC3B;AA8BA,SAAS,0BAA0B,OAAyB;AAC1D,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,yBAAyB;AACpE,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,WAAO,OAAO,QAAQ,KAAgC,EACnD,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,MAAM,QAAQ,cAAc,QAAQ,CAAC,EAC/D,IAAI,CAAC,CAAC,KAAK,UAAU,MAAM,CAAC,KAAK,0BAA0B,UAAU,CAAC,CAAC;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,OAAkC;AACzE,QAAM,iBAAiB,OAAO,QAAQ,KAAK,EACxC,KAAK,CAAC,CAAC,OAAO,GAAG,CAAC,QAAQ,MAAM,QAAQ,cAAc,QAAQ,CAAC,EAC/D,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,0BAA0B,KAAK,CAAC,CAAC;AAEhE,SAAO,WAAW,QAAQ,EACvB,OAAO,KAAK,UAAU,cAAc,CAAC,EACrC,OAAO,KAAK,EACZ,MAAM,GAAG,EAAE;AAChB;AAEA,SAAS,yBAAyB,OAAyB,OAAkC;AAC3F,SAAO;AAAA,IACL;AAAA,IACA,UAAU,oBAAoB,MAAM,QAAQ,CAAC;AAAA,IAC7C,OAAO,oBAAoB,MAAM,cAAc,CAAC;AAAA,IAChD,QAAQ,oBAAoB,MAAM,MAAM,CAAC;AAAA,IACzC,WAAW,gCAAgC,KAAK,CAAC;AAAA,EACnD,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,qBAAqB,OAA6C;AACzE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,UAAU;AAChB,SAAO,MAAM,QAAQ,QAAQ,KAAK,KAC7B,OAAO,QAAQ,SAAS,YACxB,OAAO,QAAQ,aAAa,YAC5B,OAAO,QAAQ,UAAU,YACzB,OAAO,QAAQ,eAAe;AACrC;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,OAAO,YAAY,IAAI,YAAY;AAClD,QAAM,QAAQ,mBAAmB,MAAM,MAAM;AAE7C,QAAM,QAAQ,mBAAmB,IAAI,iBAAiB,IAAI,SAAS,IAAI;AACvE,QAAM,WAAW,QAAQ,yBAAyB,OAAO,KAAK,IAAI;AAClE,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM,SAAS,MAAM,mBAAmB,MAAM,UAAU,MAAM,MAAM,IAAI,QAAQ,CAAC;AACjF,UAAI,qBAAqB,MAAM,GAAG;AAChC,eAAO,SAAS,KAAK,MAAM;AAAA,MAC7B;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,mCAAmC;AAAA,QAChD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,KAAK,MAAM,EAAE;AAEnB,QAAM,YAAY,MAAM,SACpB,MAAM,6BAA6B;AAAA,IACjC;AAAA,IACA,OAAO,MAAM;AAAA,IACb,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,EACxB,CAAC,IACD;AAEJ,QAAM,iBAAiB,MAAM;AAC3B,QAAI,IAAS,GACV,WAAW,eAAe,EAC1B,MAAM,eAAe,KAAK,MAAM,QAAQ,EACxC,MAAM,gBAAgB,MAAM,IAAI;AAEnC,QAAI,MAAM,gBAAgB;AACxB,UAAI,EAAE,MAAM,qBAAqB,KAAK,MAAM,cAAc;AAAA,IAC5D,OAAO;AACL,UAAI,EAAE,MAAM,qBAAqB,MAAM,IAAI;AAAA,IAC7C;AAEA,UAAM,gBAAgB,MAAM;AAC1B,UAAI,EAAE,SAAS,2BAA2B,CAAC,OAAY,GACpD,MAAM,QAAQ,KAAK,cAAc,EACjC,GAAG,uBAAuB,KAAK,MAAM,MAAM,CAAC;AAAA,IACjD;AAEA,YAAQ,MAAM,QAAQ;AAAA,MACpB,KAAK;AACH,sBAAc;AACd,YAAI,EACD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,gBAAgB,MAAM,IAAI,EAChC,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,cAAc,KAAK,KAAK;AACjC;AAAA,MACF,KAAK;AACH,sBAAc;AACd,YAAI,EACD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,gBAAgB,MAAM,IAAI,EAChC,MAAM,iBAAiB,UAAU,IAAI;AACxC;AAAA,MACF,KAAK;AACH,YAAI,EACD,MAAM,oBAAoB,KAAK,MAAM,MAAM,EAC3C,MAAM,cAAc,KAAK,KAAK;AACjC,sBAAc;AACd;AAAA,MACF,KAAK;AACH,YAAI,EACD,MAAM,oBAAoB,KAAK,MAAM,MAAM,EAC3C,MAAM,cAAc,KAAK,IAAI;AAChC,sBAAc;AACd;AAAA,MACF,KAAK;AAGH,YAAI,6BAA6B,GAAG,MAAM,MAAM;AAChD;AAAA,MACF,SAAS;AACP,cAAM,oBAA2B,MAAM;AACvC,cAAM,IAAI,MAAM,uBAAuB,OAAO,iBAAiB,CAAC,EAAE;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,MAAM;AAC3D,QAAI,MAAM,KAAM,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,IAAI;AACrD,QAAI,MAAM,WAAY,KAAI,EAAE,MAAM,gBAAgB,KAAK,MAAM,UAAU;AACvE,QAAI,MAAM,iBAAkB,KAAI,EAAE,MAAM,wBAAwB,KAAK,MAAM,gBAAgB;AAC3F,QAAI,MAAM,eAAgB,KAAI,EAAE,MAAM,sBAAsB,KAAK,MAAM,cAAc;AACrF,QAAI,MAAM,cAAe,KAAI,EAAE,MAAM,yBAAyB,MAAM,qBAAqB,MAAM,aAAa,CAAC;AAC7G,QAAI,MAAM,SAAU,KAAI,EAAE,MAAM,oBAAoB,KAAK,MAAM,QAAQ;AAEvE,QAAI,MAAM,QAAQ;AAChB,UAAI,CAAC,aAAa,UAAU,WAAW,GAAG;AACxC,YAAI,EAAE,MAAM,QAAQ,KAAK,WAAW;AAAA,MACtC,OAAO;AACL,YAAI,EAAE,MAAM,QAAQ,MAAM,SAAS;AAAA,MACrC;AAAA,IACF;AAEA,QAAI,MAAM,MAAO,KAAI,EAAE,MAAM,aAAa,KAAK,IAAI,KAAK,MAAM,KAAK,CAAC;AAEpE,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,WAAW,CAAC,OAAY,GAAG;AAAA,QAC/B,GAAG,WAAW,iBAAiB,EAC5B,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,SAAS,8BAA8B,KAAK,MAAM;AAAA,MACvD;AACA,YAAM,cAAc,CAAC,OAAY,GAAG,IAAI,GAAG;AAAA,QACzC,GAAG,WAAW,iBAAiB,EAC5B,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,SAAS,8BAA8B,KAAK,MAAM;AAAA,MACvD,CAAC;AACD,UAAI,MAAM,aAAa,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,WAAW;AAAA,IAChE;AAEA,QAAI,MAAM,mBAAmB,QAAW;AACtC,YAAM,WAAW,CAAC,OAAY,GAAG;AAAA,QAC/B,GAAG,WAAW,aAAa,EACxB,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,yBAAyB,KAAK,4BAA4B,EAChE,MAAM,uCAAgD;AAAA,MAC3D;AACA,YAAM,cAAc,CAAC,OAAY,GAAG,IAAI,GAAG;AAAA,QACzC,GAAG,WAAW,aAAa,EACxB,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,yBAAyB,KAAK,4BAA4B,EAChE,MAAM,uCAAgD;AAAA,MAC3D,CAAC;AACD,UAAI,MAAM,iBAAiB,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,WAAW;AAAA,IACpE;AAEA,QAAI,MAAM,eAAe,QAAW;AAClC,UAAI,MAAM,aACN,EAAE,MAAM,iBAAiB,UAAU,IAAI,IACvC,EAAE,MAAM,iBAAiB,MAAM,IAAI;AAAA,IACzC;AAEA,WAAO;AAAA,EACT;AAUA,QAAM,cAAc,MAAM,eAAe,EACtC,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AACpB,QAAM,QAAQ,OAAO,aAAa,SAAS,CAAC;AAE5C,QAAM,UAAU,MAAM,OAAO,KAAK,MAAM;AACxC,QAAM,YAAY,MAAM,eAAe,EACpC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ,aAAa,MAAM,EAC3B,OAAO,MAAM,EACb,MAAM,MAAM,QAAQ,EACpB,QAAQ;AAEX,QAAM,YAAY;AAClB,QAAM,aAAa,UAAU,IAAI,CAAC,QAAQ,IAAI,EAAE;AAEhD,QAAM,kBAAkB,WAAW,SAAS,IACxC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE;AAAA,IAC1B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,eAAe,oBAAI,IAAqB;AAC9C,aAAW,WAAW,iBAAiB;AACrC,iBAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAEA,QAAM,UAAU,WAAW,SAAS,IAChC,MAAM,GAAG,KAAK,eAAe,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,IAC/D,CAAC;AAEL,QAAM,mBAAmB,QAAQ,OAAO,CAAC,KAAK,QAAQ;AACpD,QAAI,CAAC,IAAI,IAAI,SAAS,EAAG,KAAI,IAAI,SAAS,IAAI,CAAC;AAC/C,QAAI,IAAI,SAAS,EAAE,KAAK,GAAG;AAC3B,WAAO;AAAA,EACT,GAAG,CAAC,CAAoC;AAExC,QAAM,mBAAyC,WAAW,SAAS,IAC/D,MAAO,MAAM,EAAE,EACZ,WAAW,aAAa,EACxB,OAAO,CAAC,aAAa,cAAsB,GAAG,OAAO,CAAC,CAAC,EACvD,MAAM,aAAa,KAAK,4BAA4B,EACpD,MAAM,aAAa,MAAM,UAAU,EACnC,QAAQ,WAAW,EACnB,QAAQ,IACX,CAAC;AAEL,QAAM,2BAA2B,iBAAiB,OAAO,CAAC,KAA6B,QAAQ;AAC7F,QAAI,IAAI,SAAS,IAAI,OAAO,IAAI,KAAK;AACrC,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAuC,WAAW,SAAS,IAC7D,MAAO,MAAM,EAAE,EACZ,WAAW,oBAAoB,EAC/B,OAAO,CAAC,cAAc,cAAsB,GAAG,OAAO,CAAC,CAAC,EACxD,MAAM,cAAc,MAAM,UAAU,EACpC,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ,YAAY,EACpB,QAAQ,IACX,CAAC;AAEL,QAAM,0BAA0B,gBAAgB,OAAO,CAAC,KAA6B,QAAQ;AAC3F,QAAI,IAAI,UAAU,IAAI,OAAO,IAAI,KAAK;AACtC,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,UAAU,IAAI,CAAC,QAAQ,IAAI,cAAc,EAAE,OAAO,OAAO,CAAC,CAAC;AACpG,QAAM,cAAc,cAAc,SAAS,IACvC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,cAAc,EAAE;AAAA,IAC7B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,iBAAiB,oBAAI,IAA2D;AACtF,cAAY,QAAQ,CAAC,SAAS;AAC5B,UAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,KAAK,KAAK,KAAK,IAAI;AAC3F,mBAAe,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,EACjE,CAAC;AAED,QAAM,UAA8B;AAAA,IAClC,OAAO,UACJ,IAAI,CAAC,QAAQ;AACZ,YAAM,UAAU,aAAa,IAAI,IAAI,EAAE;AACvC,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC/D,YAAM,cAAc,KAAK,UAAU,GAAG,GAAG,KAAK,KAAK,SAAS,MAAM,QAAQ;AAC1E,YAAM,aAAa,QAAQ,cAAc;AACzC,aAAO;AAAA,QACL,GAAI,eAAe,IAAI,IAAI,cAAc,IACrC;AAAA,UACE,YAAY,eAAe,IAAI,IAAI,cAAc,GAAG,QAAQ;AAAA,UAC5D,aAAa,eAAe,IAAI,IAAI,cAAc,GAAG,SAAS;AAAA,QAChE,IACA,EAAE,YAAY,MAAM,aAAa,KAAK;AAAA,QAC1C,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,YAAY,QAAQ,cAAc;AAAA,QAClC,kBAAkB,QAAQ,oBAAoB;AAAA,QAC9C,gBAAgB,QAAQ,kBAAkB;AAAA,QAC1C,eAAe,QAAQ,iBAAiB;AAAA,QACxC,cAAc,QAAQ,gBAAgB;AAAA,QACtC,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB,QAAQ,IAAI,qBAAqB,IAAI,WAAW,UAAU;AAAA,QAC1D,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG,SAAS;AAAA,QAC1D,cAAc,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG;AAAA,QAClD,iBAAiB,yBAAyB,QAAQ,EAAE,KAAK,KAAK;AAAA,QAC9D,iBAAiB,yBAAyB,QAAQ,EAAE,KAAK;AAAA,QACzD,gBAAgB,wBAAwB,QAAQ,EAAE,KAAK;AAAA,QACvD,YACE,QAAQ,YAAY,SAAS,MAAM,KAChC,QAAQ,eAAe,QAAQ,IAAI,GAAG,gBAAgB,MAAM,MAC3D,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,kBAAkB,QAAQ,KAAK,UAAU,CAAC;AAAA,QACxG,aAAa,QAAQ,eAAe;AAAA,QACpC,QAAQ,QAAQ,SAAS,QAAQ,OAAO,YAAY,IAAI;AAAA,QACxD,QAAQ,IAAI;AAAA,QACZ,UAAU,QAAQ,YAAY;AAAA,MAChC;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACnE,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C;AAEA,MAAI,SAAS,UAAU;AACrB,QAAI;AACF,YAAM;AAAA,QAAmB,MAAM;AAAA,QAAU,MACvC,MAAM,IAAI,UAAU,SAAS;AAAA,UAC3B,KAAK;AAAA,UACL,MAAM;AAAA,YACJ;AAAA,YACA,MAAM;AAAA,YACN,CAAC,MAAM,cAAc;AAAA,UACvB;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF,SAAS,OAAO;AACd,qBAAe,oCAAoC;AAAA,QACjD,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAAA,MAC9D,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO,SAAS,KAAK,OAAO;AAC9B;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,qBAAqB,MAAM,IAAI;AAE7C,QAAM,qBAAqB,MAAM,eAAe;AAChD,QAAM,eAAe,qBAAqB,OAAO,MAAM;AACvD,MAAI,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AAClE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI,MAAM,SAAS,QAAQ;AACzB,UAAM,wBAAwB,8BAA8B,MAAM,MAAM,MAAM,OAAO;AACrF,QAAI,uBAAuB;AACzB,aAAO,SAAS,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,6BAA6B;AAAA,IACjF,OAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACD,QAAM,EAAE,IAAI,WAAW,UAAU,iBAAiB,IAAI;AAEtD,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,WAAW,UAAU,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,qBAAqB;AAAA,YACpC,MAAM,EAAE,OAAO;AAAA,YACf,UAAU,EAAE,OAAO;AAAA,YACnB,OAAO,EAAE,OAAO;AAAA,YAChB,YAAY,EAAE,OAAO;AAAA,UACvB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { type Kysely, sql } from 'kysely'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'\nimport { User } from '../../auth/data/entities'\nimport { Message, MessageObject } from '../data/entities'\nimport { composeMessageSchema, listMessagesSchema } from '../data/validators'\nimport { MESSAGE_ATTACHMENT_ENTITY_ID } from '../lib/constants'\nimport { getMessageType } from '../lib/message-types-registry'\nimport { validateMessageObjectsForType } from '../lib/object-validation'\nimport { attachOperationMetadataHeader } from '../lib/operationMetadata'\nimport { canUseMessageEmailFeature, resolveMessageContext } from '../lib/routeHelpers'\nimport { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from './guards'\nimport { findMessageIdsBySearchTokens } from '../lib/searchLookup'\nimport { MessageCommandExecuteResult } from '../commands/shared'\nimport {\n  composeMessageSchema as composeSchema,\n  composeResponseSchema,\n  listMessagesSchema as listSchema,\n  messageListItemSchema,\n} from './openapi'\n\ntype MessageCommandExecuteResultWithThreadId = MessageCommandExecuteResult & {\n  threadId: string\n}\n\nconst NO_MATCH_ID = '00000000-0000-0000-0000-000000000000'\n\nfunction getDb(em: EntityManager): Kysely<any> {\n  return em.getKysely<any>()\n}\n\ntype MessageListScopeRow = {\n  id: string\n  sender_user_id: string\n  is_draft: boolean\n  recipient_status: string | null\n  read_at: string | null\n}\n\ntype AttachmentCountRow = {\n  record_id: string\n  count: string | number\n}\n\ntype RecipientCountRow = {\n  message_id: string\n  count: string | number\n}\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },\n}\n\nexport async function GET(req: Request) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n  const url = new URL(req.url)\n  const params = Object.fromEntries(url.searchParams)\n  const input = listMessagesSchema.parse(params)\n  const db = getDb(em) as any\n\n  const searchIds = input.search\n    ? await findMessageIdsBySearchTokens({\n        em,\n        query: input.search,\n        tenantId: scope.tenantId ?? null,\n        organizationId: scope.organizationId,\n      })\n    : undefined\n\n  const buildBaseQuery = () => {\n    let q: any = db\n      .selectFrom('messages as m')\n      .where('m.tenant_id', '=', scope.tenantId)\n      .where('m.deleted_at', 'is', null)\n\n    if (scope.organizationId) {\n      q = q.where('m.organization_id', '=', scope.organizationId)\n    } else {\n      q = q.where('m.organization_id', 'is', null)\n    }\n\n    const joinRecipient = () => {\n      q = q.leftJoin('message_recipients as r', (jb: any) => jb\n        .onRef('m.id', '=', 'r.message_id')\n        .on('r.recipient_user_id', '=', scope.userId))\n    }\n\n    switch (input.folder) {\n      case 'inbox':\n        joinRecipient()\n        q = q\n          .where('r.message_id', 'is not', null)\n          .where('r.deleted_at', 'is', null)\n          .where('r.archived_at', 'is', null)\n          .where('m.is_draft', '=', false)\n        break\n      case 'archived':\n        joinRecipient()\n        q = q\n          .where('r.message_id', 'is not', null)\n          .where('r.deleted_at', 'is', null)\n          .where('r.archived_at', 'is not', null)\n        break\n      case 'sent':\n        q = q\n          .where('m.sender_user_id', '=', scope.userId)\n          .where('m.is_draft', '=', false)\n        joinRecipient()\n        break\n      case 'drafts':\n        q = q\n          .where('m.sender_user_id', '=', scope.userId)\n          .where('m.is_draft', '=', true)\n        joinRecipient()\n        break\n      case 'all':\n        joinRecipient()\n        q = q.where((eb: any) => eb.or([\n          eb('m.sender_user_id', '=', scope.userId),\n          eb('r.message_id', 'is not', null),\n        ]))\n        break\n      default: {\n        const unsupportedFolder: never = input.folder\n        throw new Error(`Unsupported folder: ${String(unsupportedFolder)}`)\n      }\n    }\n\n    if (input.status) q = q.where('r.status', '=', input.status)\n    if (input.type) q = q.where('m.type', '=', input.type)\n    if (input.visibility) q = q.where('m.visibility', '=', input.visibility)\n    if (input.sourceEntityType) q = q.where('m.source_entity_type', '=', input.sourceEntityType)\n    if (input.sourceEntityId) q = q.where('m.source_entity_id', '=', input.sourceEntityId)\n    if (input.externalEmail) q = q.where('m.external_email_hash', 'in', lookupHashCandidates(input.externalEmail))\n    if (input.senderId) q = q.where('m.sender_user_id', '=', input.senderId)\n\n    if (input.search) {\n      if (!searchIds || searchIds.length === 0) {\n        q = q.where('m.id', '=', NO_MATCH_ID)\n      } else {\n        q = q.where('m.id', 'in', searchIds)\n      }\n    }\n\n    if (input.since) q = q.where('m.sent_at', '>', new Date(input.since))\n\n    if (input.hasObjects !== undefined) {\n      const existsFn = (eb: any) => eb.exists(\n        eb.selectFrom('message_objects')\n          .select(sql<number>`1`.as('one'))\n          .whereRef('message_objects.message_id', '=', 'm.id')\n      )\n      const notExistsFn = (eb: any) => eb.not(eb.exists(\n        eb.selectFrom('message_objects')\n          .select(sql<number>`1`.as('one'))\n          .whereRef('message_objects.message_id', '=', 'm.id')\n      ))\n      q = input.hasObjects ? q.where(existsFn) : q.where(notExistsFn)\n    }\n\n    if (input.hasAttachments !== undefined) {\n      const existsFn = (eb: any) => eb.exists(\n        eb.selectFrom('attachments')\n          .select(sql<number>`1`.as('one'))\n          .where('attachments.entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n          .where(sql<boolean>`attachments.record_id = m.id::text`)\n      )\n      const notExistsFn = (eb: any) => eb.not(eb.exists(\n        eb.selectFrom('attachments')\n          .select(sql<number>`1`.as('one'))\n          .where('attachments.entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n          .where(sql<boolean>`attachments.record_id = m.id::text`)\n      ))\n      q = input.hasAttachments ? q.where(existsFn) : q.where(notExistsFn)\n    }\n\n    if (input.hasActions !== undefined) {\n      q = input.hasActions\n        ? q.where('m.action_data', 'is not', null)\n        : q.where('m.action_data', 'is', null)\n    }\n\n    return q\n  }\n\n  // Audited for #3386 rollout (P3): sort is on m.sent_at (a plain timestamp \u2014\n  // not in the messages:message encryption map whose encrypted fields are:\n  // subject, body, external_email, external_name, action_data, action_result).\n  // The handler already uses the correct two-phase shape: Kysely SQL\n  // ORDER BY + LIMIT/OFFSET produces a bounded page of IDs, then\n  // findWithDecryption is called only for those IDs \u2014 never for the full\n  // result set. The #3278 unbounded-decrypt hazard does not apply here.\n  // Covered by __tests__/list.test.ts.\n  const countResult = await buildBaseQuery()\n    .select(sql<number>`count(*)`.as('count'))\n    .executeTakeFirst() as { count: string | number } | undefined\n  const total = Number(countResult?.count ?? 0)\n\n  const offset = (input.page - 1) * input.pageSize\n  const scopeRows = await buildBaseQuery()\n    .select([\n      'm.id',\n      'm.sender_user_id',\n      'm.is_draft',\n      'r.status as recipient_status',\n      'r.read_at',\n    ])\n    .orderBy('m.sent_at', 'desc')\n    .offset(offset)\n    .limit(input.pageSize)\n    .execute()\n\n  const typedRows = scopeRows as MessageListScopeRow[]\n  const messageIds = typedRows.map((row) => row.id)\n\n  const messageEntities = messageIds.length > 0\n    ? await findWithDecryption(\n        em,\n        Message,\n        { id: { $in: messageIds } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const messagesById = new Map<string, Message>()\n  for (const message of messageEntities) {\n    messagesById.set(message.id, message)\n  }\n\n  const objects = messageIds.length > 0\n    ? await em.find(MessageObject, { messageId: { $in: messageIds } })\n    : []\n\n  const objectsByMessage = objects.reduce((acc, obj) => {\n    if (!acc[obj.messageId]) acc[obj.messageId] = []\n    acc[obj.messageId].push(obj)\n    return acc\n  }, {} as Record<string, MessageObject[]>)\n\n  const attachmentCounts: AttachmentCountRow[] = messageIds.length > 0\n    ? await (getDb(em) as any)\n        .selectFrom('attachments')\n        .select(['record_id', sql<string>`count(*)`.as('count')])\n        .where('entity_id', '=', MESSAGE_ATTACHMENT_ENTITY_ID)\n        .where('record_id', 'in', messageIds)\n        .groupBy('record_id')\n        .execute()\n    : []\n\n  const attachmentCountByMessage = attachmentCounts.reduce((acc: Record<string, number>, row) => {\n    acc[row.record_id] = Number(row.count)\n    return acc\n  }, {})\n\n  const recipientCounts: RecipientCountRow[] = messageIds.length > 0\n    ? await (getDb(em) as any)\n        .selectFrom('message_recipients')\n        .select(['message_id', sql<string>`count(*)`.as('count')])\n        .where('message_id', 'in', messageIds)\n        .where('deleted_at', 'is', null)\n        .groupBy('message_id')\n        .execute()\n    : []\n\n  const recipientCountByMessage = recipientCounts.reduce((acc: Record<string, number>, row) => {\n    acc[row.message_id] = Number(row.count)\n    return acc\n  }, {})\n\n  const senderUserIds = Array.from(new Set(typedRows.map((row) => row.sender_user_id).filter(Boolean)))\n  const senderUsers = senderUserIds.length > 0\n    ? await findWithDecryption(\n        em,\n        User,\n        { id: { $in: senderUserIds } },\n        undefined,\n        { tenantId: scope.tenantId, organizationId: scope.organizationId }\n      )\n    : []\n\n  const senderMetaById = new Map<string, { name: string | null; email: string | null }>()\n  senderUsers.forEach((user) => {\n    const name = typeof user.name === 'string' && user.name.trim().length ? user.name.trim() : null\n    senderMetaById.set(user.id, { name, email: user.email ?? null })\n  })\n\n  return Response.json({\n    items: typedRows\n      .map((row) => {\n        const message = messagesById.get(row.id)\n        if (!message) return null\n        const body = typeof message.body === 'string' ? message.body : ''\n        const bodyPreview = body.substring(0, 150) + (body.length > 150 ? '...' : '')\n        const actionData = message.actionData ?? null\n        return {\n          ...(senderMetaById.get(row.sender_user_id)\n            ? {\n                senderName: senderMetaById.get(row.sender_user_id)?.name ?? null,\n                senderEmail: senderMetaById.get(row.sender_user_id)?.email ?? null,\n              }\n            : { senderName: null, senderEmail: null }),\n          id: message.id,\n          type: message.type,\n          visibility: message.visibility ?? null,\n          sourceEntityType: message.sourceEntityType ?? null,\n          sourceEntityId: message.sourceEntityId ?? null,\n          externalEmail: message.externalEmail ?? null,\n          externalName: message.externalName ?? null,\n          subject: message.subject,\n          bodyPreview,\n          senderUserId: message.senderUserId,\n          priority: message.priority,\n          status: row.recipient_status ?? (row.is_draft ? 'draft' : 'sent'),\n          hasObjects: (objectsByMessage[message.id] || []).length > 0,\n          objectCount: (objectsByMessage[message.id] || []).length,\n          hasAttachments: (attachmentCountByMessage[message.id] || 0) > 0,\n          attachmentCount: attachmentCountByMessage[message.id] || 0,\n          recipientCount: recipientCountByMessage[message.id] || 0,\n          hasActions:\n            Boolean(actionData?.actions?.length)\n            || Boolean(getMessageType(message.type)?.defaultActions?.length)\n            || (objectsByMessage[message.id] || []).some((item) => item.actionRequired && Boolean(item.actionType)),\n          actionTaken: message.actionTaken ?? null,\n          sentAt: message.sentAt ? message.sentAt.toISOString() : null,\n          readAt: row.read_at,\n          threadId: message.threadId ?? null,\n        }\n      })\n      .filter((item): item is NonNullable<typeof item> => item !== null),\n    page: input.page,\n    pageSize: input.pageSize,\n    total,\n    totalPages: Math.ceil(total / input.pageSize),\n  })\n}\n\nexport async function POST(req: Request) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const body = await req.json().catch(() => ({}))\n  const input = composeMessageSchema.parse(body)\n\n  const isPublicVisibility = input.visibility === 'public'\n  const sendViaEmail = isPublicVisibility ? true : input.sendViaEmail\n  if (sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {\n    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })\n  }\n\n  if (input.objects?.length) {\n    const objectValidationError = validateMessageObjectsForType(input.type, input.objects)\n    if (objectValidationError) {\n      return Response.json({ error: objectValidationError }, { status: 400 })\n    }\n  }\n\n  const guardResult = await runMessageMutationGuards(\n    ctx.container,\n    {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: 'messages.message',\n      resourceId: null,\n      operation: 'create',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: input as Record<string, unknown>,\n    },\n    resolveUserFeatures(ctx.auth),\n  )\n  if (!guardResult.ok) {\n    return Response.json(\n      guardResult.errorBody ?? { error: 'Operation blocked by guard' },\n      { status: guardResult.errorStatus ?? 422 },\n    )\n  }\n\n  const { result, logEntry } = await commandBus.execute('messages.messages.compose', {\n    input: {\n      ...input,\n      sendViaEmail,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n  const { id: messageId, threadId: responseThreadId } = result as unknown as MessageCommandExecuteResultWithThreadId\n\n  const response = Response.json({ id: messageId, threadId: responseThreadId }, { status: 201 })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n  })\n  await runMessageMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: 'messages.message',\n    resourceId: messageId,\n    operation: 'create',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List messages',\n      query: listSchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Message list',\n          schema: z.object({\n            items: z.array(messageListItemSchema),\n            page: z.number(),\n            pageSize: z.number(),\n            total: z.number(),\n            totalPages: z.number(),\n          }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Compose a message',\n      requestBody: {\n        schema: composeSchema,\n      },\n      responses: [\n        {\n          status: 201,\n          description: 'Message created',\n          schema: composeResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAsB,WAAW;AAGjC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,SAAS,qBAAqB;AACvC,SAAS,sBAAsB,0BAA0B;AACzD,SAAS,oCAAoC;AAC7C,SAAS,sBAAsB;AAC/B,SAAS,qCAAqC;AAC9C,SAAS,qCAAqC;AAC9C,SAAS,2BAA2B,6BAA6B;AACjE,SAAS,qBAAqB,qCAAqC,gCAAgC;AACnG,SAAS,oCAAoC;AAE7C;AAAA,EACE,wBAAwB;AAAA,EACxB;AAAA,EACA,sBAAsB;AAAA,EACtB;AAAA,OACK;AAMP,MAAM,cAAc;AAEpB,SAAS,MAAM,IAAgC;AAC7C,SAAO,GAAG,UAAe;AAC3B;AAoBO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AACrC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,OAAO,YAAY,IAAI,YAAY;AAClD,QAAM,QAAQ,mBAAmB,MAAM,MAAM;AAC7C,QAAM,KAAK,MAAM,EAAE;AAEnB,QAAM,YAAY,MAAM,SACpB,MAAM,6BAA6B;AAAA,IACjC;AAAA,IACA,OAAO,MAAM;AAAA,IACb,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,EACxB,CAAC,IACD;AAEJ,QAAM,iBAAiB,MAAM;AAC3B,QAAI,IAAS,GACV,WAAW,eAAe,EAC1B,MAAM,eAAe,KAAK,MAAM,QAAQ,EACxC,MAAM,gBAAgB,MAAM,IAAI;AAEnC,QAAI,MAAM,gBAAgB;AACxB,UAAI,EAAE,MAAM,qBAAqB,KAAK,MAAM,cAAc;AAAA,IAC5D,OAAO;AACL,UAAI,EAAE,MAAM,qBAAqB,MAAM,IAAI;AAAA,IAC7C;AAEA,UAAM,gBAAgB,MAAM;AAC1B,UAAI,EAAE,SAAS,2BAA2B,CAAC,OAAY,GACpD,MAAM,QAAQ,KAAK,cAAc,EACjC,GAAG,uBAAuB,KAAK,MAAM,MAAM,CAAC;AAAA,IACjD;AAEA,YAAQ,MAAM,QAAQ;AAAA,MACpB,KAAK;AACH,sBAAc;AACd,YAAI,EACD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,gBAAgB,MAAM,IAAI,EAChC,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,cAAc,KAAK,KAAK;AACjC;AAAA,MACF,KAAK;AACH,sBAAc;AACd,YAAI,EACD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,gBAAgB,MAAM,IAAI,EAChC,MAAM,iBAAiB,UAAU,IAAI;AACxC;AAAA,MACF,KAAK;AACH,YAAI,EACD,MAAM,oBAAoB,KAAK,MAAM,MAAM,EAC3C,MAAM,cAAc,KAAK,KAAK;AACjC,sBAAc;AACd;AAAA,MACF,KAAK;AACH,YAAI,EACD,MAAM,oBAAoB,KAAK,MAAM,MAAM,EAC3C,MAAM,cAAc,KAAK,IAAI;AAChC,sBAAc;AACd;AAAA,MACF,KAAK;AACH,sBAAc;AACd,YAAI,EAAE,MAAM,CAAC,OAAY,GAAG,GAAG;AAAA,UAC7B,GAAG,oBAAoB,KAAK,MAAM,MAAM;AAAA,UACxC,GAAG,gBAAgB,UAAU,IAAI;AAAA,QACnC,CAAC,CAAC;AACF;AAAA,MACF,SAAS;AACP,cAAM,oBAA2B,MAAM;AACvC,cAAM,IAAI,MAAM,uBAAuB,OAAO,iBAAiB,CAAC,EAAE;AAAA,MACpE;AAAA,IACF;AAEA,QAAI,MAAM,OAAQ,KAAI,EAAE,MAAM,YAAY,KAAK,MAAM,MAAM;AAC3D,QAAI,MAAM,KAAM,KAAI,EAAE,MAAM,UAAU,KAAK,MAAM,IAAI;AACrD,QAAI,MAAM,WAAY,KAAI,EAAE,MAAM,gBAAgB,KAAK,MAAM,UAAU;AACvE,QAAI,MAAM,iBAAkB,KAAI,EAAE,MAAM,wBAAwB,KAAK,MAAM,gBAAgB;AAC3F,QAAI,MAAM,eAAgB,KAAI,EAAE,MAAM,sBAAsB,KAAK,MAAM,cAAc;AACrF,QAAI,MAAM,cAAe,KAAI,EAAE,MAAM,yBAAyB,MAAM,qBAAqB,MAAM,aAAa,CAAC;AAC7G,QAAI,MAAM,SAAU,KAAI,EAAE,MAAM,oBAAoB,KAAK,MAAM,QAAQ;AAEvE,QAAI,MAAM,QAAQ;AAChB,UAAI,CAAC,aAAa,UAAU,WAAW,GAAG;AACxC,YAAI,EAAE,MAAM,QAAQ,KAAK,WAAW;AAAA,MACtC,OAAO;AACL,YAAI,EAAE,MAAM,QAAQ,MAAM,SAAS;AAAA,MACrC;AAAA,IACF;AAEA,QAAI,MAAM,MAAO,KAAI,EAAE,MAAM,aAAa,KAAK,IAAI,KAAK,MAAM,KAAK,CAAC;AAEpE,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,WAAW,CAAC,OAAY,GAAG;AAAA,QAC/B,GAAG,WAAW,iBAAiB,EAC5B,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,SAAS,8BAA8B,KAAK,MAAM;AAAA,MACvD;AACA,YAAM,cAAc,CAAC,OAAY,GAAG,IAAI,GAAG;AAAA,QACzC,GAAG,WAAW,iBAAiB,EAC5B,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,SAAS,8BAA8B,KAAK,MAAM;AAAA,MACvD,CAAC;AACD,UAAI,MAAM,aAAa,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,WAAW;AAAA,IAChE;AAEA,QAAI,MAAM,mBAAmB,QAAW;AACtC,YAAM,WAAW,CAAC,OAAY,GAAG;AAAA,QAC/B,GAAG,WAAW,aAAa,EACxB,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,yBAAyB,KAAK,4BAA4B,EAChE,MAAM,uCAAgD;AAAA,MAC3D;AACA,YAAM,cAAc,CAAC,OAAY,GAAG,IAAI,GAAG;AAAA,QACzC,GAAG,WAAW,aAAa,EACxB,OAAO,OAAe,GAAG,KAAK,CAAC,EAC/B,MAAM,yBAAyB,KAAK,4BAA4B,EAChE,MAAM,uCAAgD;AAAA,MAC3D,CAAC;AACD,UAAI,MAAM,iBAAiB,EAAE,MAAM,QAAQ,IAAI,EAAE,MAAM,WAAW;AAAA,IACpE;AAEA,QAAI,MAAM,eAAe,QAAW;AAClC,UAAI,MAAM,aACN,EAAE,MAAM,iBAAiB,UAAU,IAAI,IACvC,EAAE,MAAM,iBAAiB,MAAM,IAAI;AAAA,IACzC;AAEA,WAAO;AAAA,EACT;AAUA,QAAM,cAAc,MAAM,eAAe,EACtC,OAAO,cAAsB,GAAG,OAAO,CAAC,EACxC,iBAAiB;AACpB,QAAM,QAAQ,OAAO,aAAa,SAAS,CAAC;AAE5C,QAAM,UAAU,MAAM,OAAO,KAAK,MAAM;AACxC,QAAM,YAAY,MAAM,eAAe,EACpC,OAAO;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC,EACA,QAAQ,aAAa,MAAM,EAC3B,OAAO,MAAM,EACb,MAAM,MAAM,QAAQ,EACpB,QAAQ;AAEX,QAAM,YAAY;AAClB,QAAM,aAAa,UAAU,IAAI,CAAC,QAAQ,IAAI,EAAE;AAEhD,QAAM,kBAAkB,WAAW,SAAS,IACxC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE;AAAA,IAC1B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,eAAe,oBAAI,IAAqB;AAC9C,aAAW,WAAW,iBAAiB;AACrC,iBAAa,IAAI,QAAQ,IAAI,OAAO;AAAA,EACtC;AAEA,QAAM,UAAU,WAAW,SAAS,IAChC,MAAM,GAAG,KAAK,eAAe,EAAE,WAAW,EAAE,KAAK,WAAW,EAAE,CAAC,IAC/D,CAAC;AAEL,QAAM,mBAAmB,QAAQ,OAAO,CAAC,KAAK,QAAQ;AACpD,QAAI,CAAC,IAAI,IAAI,SAAS,EAAG,KAAI,IAAI,SAAS,IAAI,CAAC;AAC/C,QAAI,IAAI,SAAS,EAAE,KAAK,GAAG;AAC3B,WAAO;AAAA,EACT,GAAG,CAAC,CAAoC;AAExC,QAAM,mBAAyC,WAAW,SAAS,IAC/D,MAAO,MAAM,EAAE,EACZ,WAAW,aAAa,EACxB,OAAO,CAAC,aAAa,cAAsB,GAAG,OAAO,CAAC,CAAC,EACvD,MAAM,aAAa,KAAK,4BAA4B,EACpD,MAAM,aAAa,MAAM,UAAU,EACnC,QAAQ,WAAW,EACnB,QAAQ,IACX,CAAC;AAEL,QAAM,2BAA2B,iBAAiB,OAAO,CAAC,KAA6B,QAAQ;AAC7F,QAAI,IAAI,SAAS,IAAI,OAAO,IAAI,KAAK;AACrC,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,kBAAuC,WAAW,SAAS,IAC7D,MAAO,MAAM,EAAE,EACZ,WAAW,oBAAoB,EAC/B,OAAO,CAAC,cAAc,cAAsB,GAAG,OAAO,CAAC,CAAC,EACxD,MAAM,cAAc,MAAM,UAAU,EACpC,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ,YAAY,EACpB,QAAQ,IACX,CAAC;AAEL,QAAM,0BAA0B,gBAAgB,OAAO,CAAC,KAA6B,QAAQ;AAC3F,QAAI,IAAI,UAAU,IAAI,OAAO,IAAI,KAAK;AACtC,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AAEL,QAAM,gBAAgB,MAAM,KAAK,IAAI,IAAI,UAAU,IAAI,CAAC,QAAQ,IAAI,cAAc,EAAE,OAAO,OAAO,CAAC,CAAC;AACpG,QAAM,cAAc,cAAc,SAAS,IACvC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,cAAc,EAAE;AAAA,IAC7B;AAAA,IACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE,IACA,CAAC;AAEL,QAAM,iBAAiB,oBAAI,IAA2D;AACtF,cAAY,QAAQ,CAAC,SAAS;AAC5B,UAAM,OAAO,OAAO,KAAK,SAAS,YAAY,KAAK,KAAK,KAAK,EAAE,SAAS,KAAK,KAAK,KAAK,IAAI;AAC3F,mBAAe,IAAI,KAAK,IAAI,EAAE,MAAM,OAAO,KAAK,SAAS,KAAK,CAAC;AAAA,EACjE,CAAC;AAED,SAAO,SAAS,KAAK;AAAA,IACnB,OAAO,UACJ,IAAI,CAAC,QAAQ;AACZ,YAAM,UAAU,aAAa,IAAI,IAAI,EAAE;AACvC,UAAI,CAAC,QAAS,QAAO;AACrB,YAAM,OAAO,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AAC/D,YAAM,cAAc,KAAK,UAAU,GAAG,GAAG,KAAK,KAAK,SAAS,MAAM,QAAQ;AAC1E,YAAM,aAAa,QAAQ,cAAc;AACzC,aAAO;AAAA,QACL,GAAI,eAAe,IAAI,IAAI,cAAc,IACrC;AAAA,UACE,YAAY,eAAe,IAAI,IAAI,cAAc,GAAG,QAAQ;AAAA,UAC5D,aAAa,eAAe,IAAI,IAAI,cAAc,GAAG,SAAS;AAAA,QAChE,IACA,EAAE,YAAY,MAAM,aAAa,KAAK;AAAA,QAC1C,IAAI,QAAQ;AAAA,QACZ,MAAM,QAAQ;AAAA,QACd,YAAY,QAAQ,cAAc;AAAA,QAClC,kBAAkB,QAAQ,oBAAoB;AAAA,QAC9C,gBAAgB,QAAQ,kBAAkB;AAAA,QAC1C,eAAe,QAAQ,iBAAiB;AAAA,QACxC,cAAc,QAAQ,gBAAgB;AAAA,QACtC,SAAS,QAAQ;AAAA,QACjB;AAAA,QACA,cAAc,QAAQ;AAAA,QACtB,UAAU,QAAQ;AAAA,QAClB,QAAQ,IAAI,qBAAqB,IAAI,WAAW,UAAU;AAAA,QAC1D,aAAa,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG,SAAS;AAAA,QAC1D,cAAc,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG;AAAA,QAClD,iBAAiB,yBAAyB,QAAQ,EAAE,KAAK,KAAK;AAAA,QAC9D,iBAAiB,yBAAyB,QAAQ,EAAE,KAAK;AAAA,QACzD,gBAAgB,wBAAwB,QAAQ,EAAE,KAAK;AAAA,QACvD,YACE,QAAQ,YAAY,SAAS,MAAM,KAChC,QAAQ,eAAe,QAAQ,IAAI,GAAG,gBAAgB,MAAM,MAC3D,iBAAiB,QAAQ,EAAE,KAAK,CAAC,GAAG,KAAK,CAAC,SAAS,KAAK,kBAAkB,QAAQ,KAAK,UAAU,CAAC;AAAA,QACxG,aAAa,QAAQ,eAAe;AAAA,QACpC,QAAQ,QAAQ,SAAS,QAAQ,OAAO,YAAY,IAAI;AAAA,QACxD,QAAQ,IAAI;AAAA,QACZ,UAAU,QAAQ,YAAY;AAAA,MAChC;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAA2C,SAAS,IAAI;AAAA,IACnE,MAAM,MAAM;AAAA,IACZ,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,KAAK,KAAK,QAAQ,MAAM,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,qBAAqB,MAAM,IAAI;AAE7C,QAAM,qBAAqB,MAAM,eAAe;AAChD,QAAM,eAAe,qBAAqB,OAAO,MAAM;AACvD,MAAI,gBAAgB,CAAE,MAAM,0BAA0B,KAAK,KAAK,GAAI;AAClE,WAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AAEA,MAAI,MAAM,SAAS,QAAQ;AACzB,UAAM,wBAAwB,8BAA8B,MAAM,MAAM,MAAM,OAAO;AACrF,QAAI,uBAAuB;AACzB,aAAO,SAAS,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxE;AAAA,EACF;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB,IAAI;AAAA,IACJ;AAAA,MACE,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,IACnB;AAAA,IACA,oBAAoB,IAAI,IAAI;AAAA,EAC9B;AACA,MAAI,CAAC,YAAY,IAAI;AACnB,WAAO,SAAS;AAAA,MACd,YAAY,aAAa,EAAE,OAAO,6BAA6B;AAAA,MAC/D,EAAE,QAAQ,YAAY,eAAe,IAAI;AAAA,IAC3C;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,6BAA6B;AAAA,IACjF,OAAO;AAAA,MACL,GAAG;AAAA,MACH;AAAA,MACA,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AACD,QAAM,EAAE,IAAI,WAAW,UAAU,iBAAiB,IAAI;AAEtD,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,WAAW,UAAU,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC7F,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY;AAAA,EACd,CAAC;AACD,QAAM,oCAAoC,YAAY,uBAAuB;AAAA,IAC3E,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,EACtB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,qBAAqB;AAAA,YACpC,MAAM,EAAE,OAAO;AAAA,YACf,UAAU,EAAE,OAAO;AAAA,YACnB,OAAO,EAAE,OAAO;AAAA,YAChB,YAAY,EAAE,OAAO;AAAA,UACvB,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/messages/components/ComposeMessagePageClient.js CHANGED Viewed

@@ -1,7 +1,6 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import { useRouter } from "next/navigation";
-import { extensionPoints } from "@open-mercato/core/modules/messages/extension-points";
 import { MessageComposer } from "@open-mercato/ui/backend/messages";
 import { InjectionSpot } from "@open-mercato/ui/backend/injection/InjectionSpot";
 function ComposeMessagePageClient() {
@@ -10,7 +9,7 @@ function ComposeMessagePageClient() {
     /* @__PURE__ */ jsx(
       InjectionSpot,
       {
-        spotId: extensionPoints.hosts.composeFields.spotId,
+        spotId: "crud-form:messages:message:fields",
         context: { form: "compose" },
         data: {}
       }

package/dist/modules/messages/components/ComposeMessagePageClient.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/messages/components/ComposeMessagePageClient.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport { useRouter } from 'next/navigation'\nimport { extensionPoints } from '@open-mercato/core/modules/messages/extension-points'\nimport { MessageComposer } from '@open-mercato/ui/backend/messages'\n// UMES extension surface \u2014 compose page injection spot (SPEC-045d \u00A79.3a).\n// Channel provider packages inject \"composer capabilities\" widgets here\n// (character limit warnings, channel format selector, attachment scoping, etc.).\nimport { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'\n\nexport function ComposeMessagePageClient() {\n  const router = useRouter()\n\n  return (\n    <div className=\"space-y-4\">\n      {/*\n        Standalone widget mount above the composer \u2014 NOT CrudForm field\n        resolution. This page is not a CrudForm, so the `crud-form:*:fields`\n        field-event pipeline (onFieldChange, value transformers, etc.) does\n        not apply here. Provider packages render composer-capability widgets\n        (character-limit warnings, channel format selectors, attachment\n        scoping) into this spot purely as additional UI siblings.\n      */}\n      <InjectionSpot\n        spotId={extensionPoints.hosts.composeFields.spotId}\n        context={{ form: 'compose' }}\n        data={{}}\n      />\n      <MessageComposer\n        inline\n        variant=\"compose\"\n        onCancel={() => {\n          router.push('/backend/messages')\n        }}\n        onSuccess={(result) => {\n          router.push('/backend/messages')\n        }}\n      />\n    </div>\n  )\n}\n"],
-  "mappings": ";AAcI,SASE,KATF;AAZJ,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAChC,SAAS,uBAAuB;AAIhC,SAAS,qBAAqB;AAEvB,SAAS,2BAA2B;AACzC,QAAM,SAAS,UAAU;AAEzB,SACE,qBAAC,SAAI,WAAU,aASb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,QAAQ,gBAAgB,MAAM,cAAc;AAAA,QAC5C,SAAS,EAAE,MAAM,UAAU;AAAA,QAC3B,MAAM,CAAC;AAAA;AAAA,IACT;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,QAAM;AAAA,QACN,SAAQ;AAAA,QACR,UAAU,MAAM;AACd,iBAAO,KAAK,mBAAmB;AAAA,QACjC;AAAA,QACA,WAAW,CAAC,WAAW;AACrB,iBAAO,KAAK,mBAAmB;AAAA,QACjC;AAAA;AAAA,IACF;AAAA,KACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport { useRouter } from 'next/navigation'\nimport { MessageComposer } from '@open-mercato/ui/backend/messages'\n// UMES extension surface \u2014 compose page injection spot (SPEC-045d \u00A79.3a).\n// Channel provider packages inject \"composer capabilities\" widgets here\n// (character limit warnings, channel format selector, attachment scoping, etc.).\nimport { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'\n\nexport function ComposeMessagePageClient() {\n  const router = useRouter()\n\n  return (\n    <div className=\"space-y-4\">\n      {/*\n        Standalone widget mount above the composer \u2014 NOT CrudForm field\n        resolution. This page is not a CrudForm, so the `crud-form:*:fields`\n        field-event pipeline (onFieldChange, value transformers, etc.) does\n        not apply here. Provider packages render composer-capability widgets\n        (character-limit warnings, channel format selectors, attachment\n        scoping) into this spot purely as additional UI siblings.\n      */}\n      <InjectionSpot\n        spotId=\"crud-form:messages:message:fields\"\n        context={{ form: 'compose' }}\n        data={{}}\n      />\n      <MessageComposer\n        inline\n        variant=\"compose\"\n        onCancel={() => {\n          router.push('/backend/messages')\n        }}\n        onSuccess={(result) => {\n          router.push('/backend/messages')\n        }}\n      />\n    </div>\n  )\n}\n"],
+  "mappings": ";AAaI,SASE,KATF;AAXJ,SAAS,iBAAiB;AAC1B,SAAS,uBAAuB;AAIhC,SAAS,qBAAqB;AAEvB,SAAS,2BAA2B;AACzC,QAAM,SAAS,UAAU;AAEzB,SACE,qBAAC,SAAI,WAAU,aASb;AAAA;AAAA,MAAC;AAAA;AAAA,QACC,QAAO;AAAA,QACP,SAAS,EAAE,MAAM,UAAU;AAAA,QAC3B,MAAM,CAAC;AAAA;AAAA,IACT;AAAA,IACA;AAAA,MAAC;AAAA;AAAA,QACC,QAAM;AAAA,QACN,SAAQ;AAAA,QACR,UAAU,MAAM;AACd,iBAAO,KAAK,mBAAmB;AAAA,QACjC;AAAA,QACA,WAAW,CAAC,WAAW;AACrB,iBAAO,KAAK,mBAAmB;AAAA,QACjC;AAAA;AAAA,IACF;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/messages/components/MessageDetailPageClient.js CHANGED Viewed

@@ -1,7 +1,6 @@
 "use client";
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
-import { extensionPoints } from "@open-mercato/core/modules/messages/extension-points";
 import { MessageComposer } from "@open-mercato/ui/backend/messages";
 import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
 import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
@@ -73,7 +72,7 @@ function MessageConversationDetailItem({
         /* @__PURE__ */ jsx(
           InjectionSpot,
           {
-            spotId: extensionPoints.hosts.detailBodyAfter.spotId,
+            spotId: "detail:messages:message:body:after",
             context: { messageId },
             data: state.detail
           }
@@ -82,7 +81,7 @@ function MessageConversationDetailItem({
         /* @__PURE__ */ jsx(
           InjectionSpot,
           {
-            spotId: extensionPoints.hosts.detailSidebar.spotId,
+            spotId: "detail:messages:message:sidebar",
             context: { messageId, userFeatures },
             data: state.detail
           }