@open-mercato/core 0.9.1-develop.7513.1.ae2715553f → 0.9.1-develop.7516.1.176184247d

package/dist/modules/warranty_claims/commands/shared.js

@@ -1,10 +1,11 @@
 import { randomUUID } from "crypto";
-import { assertFound } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, assertFound } from "@open-mercato/shared/lib/crud/errors";
 import { invalidateCrudCache } from "@open-mercato/shared/lib/crud/cache";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
 import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
 import { emitCrudSideEffects, flushCrudSideEffects } from "@open-mercato/shared/lib/commands/helpers";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import {
   WarrantyClaim,
   WarrantyClaimEvent,
@@ -26,6 +27,10 @@ async function enforceWarrantyClaimOptimisticLock(ctx, record, resourceKind = WA
     request: ctx.request ?? null
   });
 }
+async function throwUndoRefusal(key, fallback) {
+  const { translate } = await resolveTranslations();
+  throw new CrudHttpError(409, { error: translate(key, fallback), code: key });
+}
 async function loadScopedClaim(em, id, scope, options = {}) {
   return findOneWithDecryption(
     em,
@@ -157,6 +162,7 @@ export {
   extractUndoPayload,
   loadScopedClaim,
   reconcileVendorRecoverySourceClaim,
-  requireScopedClaim
+  requireScopedClaim,
+  throwUndoRefusal
 };
 //# sourceMappingURL=shared.js.map

package/dist/modules/warranty_claims/commands/shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/warranty_claims/commands/shared.ts"],
-  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAI3B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function throwUndoRefusal(key: string, fallback: string): Promise<never> {\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(409, { error: translate(key, fallback), code: key })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAI3B,SAAS,eAAe,mBAAmB;AAC3C,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,iBAAiB,KAAa,UAAkC;AACpF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAC7E;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
   "names": ["assertFound"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.9.1-develop.7513.1.ae2715553f",
+  "version": "0.9.1-develop.7516.1.176184247d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -264,16 +264,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/shared": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/ui": "0.9.1-develop.7513.1.ae2715553f",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7516.1.176184247d",
+    "@open-mercato/shared": "0.9.1-develop.7516.1.176184247d",
+    "@open-mercato/ui": "0.9.1-develop.7516.1.176184247d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/shared": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/ui": "0.9.1-develop.7513.1.ae2715553f",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7516.1.176184247d",
+    "@open-mercato/shared": "0.9.1-develop.7516.1.176184247d",
+    "@open-mercato/ui": "0.9.1-develop.7516.1.176184247d",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/communication_channels/lib/send-as-user.ts

@@ -39,6 +39,10 @@ export type SendAsUserInput = {
    * derives `threadId` from the parent), so a CRM reply continues the existing
    * conversation instead of starting a new thread. Optional — omitted for new
    * threads.
+   *
+   * Not authorized here: the facade serves more than one surface, and each owns
+   * what "may reply to" means. The caller MUST have established that the actor
+   * can read this message under its own read rule before passing it.
    */
   parentMessageId?: string
   /**

package/src/modules/customers/api/people/[id]/emails/route.ts

@@ -12,8 +12,11 @@ import {
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { isOrganizationReadAccessAllowed } from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveAuthActorId } from '../../../../lib/interactionRequestContext'
 import { CustomerEntity } from '../../../../data/entities'
+import { listGrantsForViewerOnPerson, listSharedChannelIds } from '../../../../lib/conversationShares'
+import { isMessageOnPersonEmailHistory } from '../../../../lib/personEmailThreads'
 import type { SendAsUserService } from '@open-mercato/core/modules/communication_channels/lib/send-as-user'
 
 export const metadata = {
@@ -40,6 +43,29 @@ const composeSchema = z
   })
   .strict()
 
+type RbacService = {
+  userHasAllFeatures: (
+    userId: string,
+    required: string[],
+    scope: { tenantId: string | null; organizationId: string | null },
+  ) => Promise<boolean>
+}
+
+async function callerHasFeature(
+  container: { resolve: (name: string) => unknown },
+  userId: string,
+  feature: string,
+  scope: { tenantId: string; organizationId: string | null },
+): Promise<boolean> {
+  try {
+    const rbac = container.resolve('rbacService') as RbacService | undefined
+    if (typeof rbac?.userHasAllFeatures !== 'function') return false
+    return await rbac.userHasAllFeatures(userId, [feature], scope)
+  } catch {
+    return false
+  }
+}
+
 type RouteContext = {
   params: Promise<{ id: string }> | { id: string }
 }
@@ -96,6 +122,46 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
     return NextResponse.json({ error: 'Person not found' }, { status: 404 })
   }
 
+  // A reply parent decides which thread the sent email joins, so it must be an
+  // email this caller could see on this Person's Emails tab — the same feature,
+  // anchor and visibility rule as `GET .../email-threads`, including conversation
+  // shares and shared team mailboxes. Anything else answers like an unknown id.
+  if (body.parentMessageId) {
+    const viewerUserId = auth.isApiKey ? null : auth.sub ?? null
+    const shareScope = { tenantId: auth.tenantId as string, organizationId }
+    const canViewPeople = await callerHasFeature(container, userId, 'customers.people.view', shareScope)
+    const [sharedConversations, sharedChannelIds] = canViewPeople
+      ? await Promise.all([
+          listGrantsForViewerOnPerson(em, shareScope, viewerUserId, personId),
+          listSharedChannelIds(em, shareScope, viewerUserId),
+        ])
+      : [[], []]
+    const parentVisible =
+      canViewPeople &&
+      (await isMessageOnPersonEmailHistory(em, {
+        personId,
+        tenantId: auth.tenantId as string,
+        organizationId,
+        viewerUserId,
+        userFeatures: undefined,
+        sharedConversations,
+        sharedChannelIds,
+        messageId: body.parentMessageId,
+      }))
+    if (!parentVisible) {
+      const { translate } = await resolveTranslations()
+      return NextResponse.json(
+        {
+          error: translate(
+            'customers.email.errors.parentMessageNotFound',
+            'The email you are replying to was not found',
+          ),
+        },
+        { status: 404 },
+      )
+    }
+  }
+
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId,
@@ -178,7 +244,7 @@ export const openApi = {
         { status: 400, description: 'Invalid person id' },
         { status: 401, description: 'Unauthorized' },
         { status: 403, description: 'Missing customers.email.compose feature or mutation guard rejection' },
-        { status: 404, description: 'Person or channel not found' },
+        { status: 404, description: 'Person or channel not found, or the reply parent is not an email the caller can see on this Person' },
         { status: 409, description: 'Channel not connected' },
         { status: 422, description: 'Invalid request body' },
         { status: 500, description: 'Send failed' },

package/src/modules/customers/i18n/de.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Von einem Kollegen geteilt",
   "customers.email.errors.deliveryFailed": "Zustellung fehlgeschlagen – nicht gesendet",
   "customers.email.errors.flipFailed": "Aktualisierung der Sichtbarkeit fehlgeschlagen",
+  "customers.email.errors.parentMessageNotFound": "Die E-Mail, auf die Sie antworten, wurde nicht gefunden",
   "customers.email.errors.sendFailed": "Senden fehlgeschlagen",
   "customers.email.sync.button": "Synchronisieren",
   "customers.email.sync.failed": "Postfach konnte nicht synchronisiert werden",

package/src/modules/customers/i18n/en.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Shared by a teammate",
   "customers.email.errors.deliveryFailed": "Delivery failed — not sent",
   "customers.email.errors.flipFailed": "Visibility update failed",
+  "customers.email.errors.parentMessageNotFound": "The email you are replying to was not found",
   "customers.email.errors.sendFailed": "Send failed",
   "customers.email.sync.button": "Sync",
   "customers.email.sync.failed": "Failed to sync mailbox",

package/src/modules/customers/i18n/es.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Compartido por un compañero",
   "customers.email.errors.deliveryFailed": "Error de entrega: no enviado",
   "customers.email.errors.flipFailed": "Error al actualizar la visibilidad",
+  "customers.email.errors.parentMessageNotFound": "No se encontró el correo al que está respondiendo",
   "customers.email.errors.sendFailed": "Error al enviar",
   "customers.email.sync.button": "Sincronizar",
   "customers.email.sync.failed": "No se pudo sincronizar el buzón",

package/src/modules/customers/i18n/ko.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "동료가 공유",
   "customers.email.errors.deliveryFailed": "전송 실패 — 발송되지 않음",
   "customers.email.errors.flipFailed": "공개 범위 업데이트 실패",
+  "customers.email.errors.parentMessageNotFound": "답장하려는 이메일을 찾을 수 없습니다",
   "customers.email.errors.sendFailed": "전송 실패",
   "customers.email.sync.button": "동기화",
   "customers.email.sync.failed": "메일함 동기화에 실패했습니다",

package/src/modules/customers/i18n/pl.json

@@ -1691,6 +1691,7 @@
   "customers.email.conversationShare.sharedByTeammate": "Udostępnione przez współpracownika",
   "customers.email.errors.deliveryFailed": "Dostarczanie nie powiodło się – nie wysłano",
   "customers.email.errors.flipFailed": "Aktualizacja widoczności nieudana",
+  "customers.email.errors.parentMessageNotFound": "Nie znaleziono e-maila, na który odpowiadasz",
   "customers.email.errors.sendFailed": "Wysyłanie nieudane",
   "customers.email.sync.button": "Synchronizuj",
   "customers.email.sync.failed": "Nie udało się zsynchronizować skrzynki",

package/src/modules/customers/lib/personEmailThreads.ts

@@ -378,3 +378,64 @@ export async function buildPersonEmailThreads(
   threads.sort((a, b) => b.lastMessageAt.localeCompare(a.lastMessageAt))
   return threads.slice(0, maxThreads)
 }
+
+export type PersonEmailMessageAccessOptions = Pick<
+  BuildPersonEmailThreadsOptions,
+  'personId' | 'tenantId' | 'organizationId' | 'viewerUserId' | 'userFeatures' | 'sharedConversations' | 'sharedChannelIds'
+> & {
+  /** Open Mercato `messages.message` id the caller wants to reply to. */
+  messageId: string
+}
+
+/**
+ * Whether `messageId` is on this Person's email history as the viewer sees it —
+ * i.e. whether {@link buildPersonEmailThreads} would show it to them.
+ *
+ * Walks the same anchor (email `CustomerInteraction` → `MessageChannelLink` →
+ * message) with the same scope and the same visibility predicate, so a reply
+ * from the Person page can only name a parent the Emails tab could have shown:
+ * the viewer's own mail, shared or legacy mail, a conversation shared for THIS
+ * Person, or a shared team mailbox. Callers remain responsible for resolving the
+ * Person in scope first.
+ */
+export async function isMessageOnPersonEmailHistory(
+  em: EntityManager,
+  opts: PersonEmailMessageAccessOptions,
+): Promise<boolean> {
+  const { personId, tenantId, organizationId, messageId } = opts
+  const dscope = { tenantId, organizationId: organizationId ?? null }
+
+  const linkWhere: JsonRecord = { messageId, tenantId }
+  if (organizationId) linkWhere.organizationId = organizationId
+  const links = (await findWithDecryption(
+    em,
+    'MessageChannelLink' as never,
+    linkWhere as never,
+    undefined,
+    dscope,
+  )) as JsonRecord[]
+  const linkIds = links
+    .map((link) => (typeof link.id === 'string' ? (link.id as string) : null))
+    .filter((value): value is string => !!value)
+  if (linkIds.length === 0) return false
+
+  const interactionWhere: JsonRecord = {
+    entity: personId,
+    interactionType: 'email',
+    deletedAt: null,
+    tenantId,
+    externalMessageId: { $in: linkIds },
+  }
+  if (organizationId) interactionWhere.organizationId = organizationId
+  Object.assign(
+    interactionWhere,
+    buildEmailVisibilityMikroFilter({
+      currentUserId: opts.viewerUserId,
+      userFeatures: opts.userFeatures,
+      sharedConversations: opts.sharedConversations,
+      sharedChannelIds: opts.sharedChannelIds,
+    }),
+  )
+  const visible = await em.count(CustomerInteraction, interactionWhere as never)
+  return visible > 0
+}

package/src/modules/messages/api/[id]/route.ts

@@ -16,9 +16,9 @@ import { getMessageTypeOrDefault } from '../../lib/message-types-registry'
 import { attachOperationMetadataHeader } from '../../lib/operationMetadata'
 import {
   canPostToChannelThread,
-  hasChannelThreadReadAccess,
   hasOrganizationAccess,
   resolveMessageContext,
+  resolveMessageReadAccess,
 } from '../../lib/routeHelpers'
 import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMutationGuards } from '../guards'
 import {
@@ -103,13 +103,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
     return Response.json({ error: 'Access denied' }, { status: 403 })
   }
 
-  const recipient = await em.findOne(MessageRecipient, {
-    messageId: params.id,
-    recipientUserId: scope.userId,
-    deletedAt: null,
-  })
-
-  const isSender = message.senderUserId === scope.userId
+  const { recipient, isSender, hasChannelThreadAccess } = await resolveMessageReadAccess(ctx, scope, message)
   const isRecipient = Boolean(recipient)
 
   // #5535: a message that arrived over a communication channel has the channel
@@ -126,7 +120,6 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   // `requireAuth` only so that a participant can always read their own message.
   // The gate goes through RBAC, not through `ctx.auth.features` — the session JWT
   // carries no `features` claim at all, so reading it would deny everyone.
-  const hasChannelThreadAccess = await hasChannelThreadReadAccess(ctx, scope, message)
 
   if (!isSender && !isRecipient && !hasChannelThreadAccess) {
     return Response.json({ error: 'Access denied' }, { status: 403 })

package/src/modules/messages/api/route.ts

@@ -12,7 +12,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
-import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { User } from '../../auth/data/entities'
 import { Message, MessageObject } from '../data/entities'
@@ -36,6 +36,7 @@ import { attachOperationMetadataHeader } from '../lib/operationMetadata'
 import {
   canPostToChannelThread,
   canUseChannelThreadFallback,
+  resolveReplyParentMessage,
   canUseMessageEmailFeature,
   resolveMessageContext,
 } from '../lib/routeHelpers'
@@ -46,6 +47,7 @@ import { MessageCommandExecuteResult } from '../commands/shared'
 import {
   composeMessageRequestSchema as composeSchema,
   composeResponseSchema,
+  errorResponseSchema,
   listMessagesSchema as listSchema,
   messageListItemSchema,
 } from './openapi'
@@ -510,6 +512,35 @@ export async function POST(req: Request) {
     }
   }
 
+  // A parent decides which conversation the new message joins, so it is held to
+  // the same rule as reading it: knowing a message id is not enough to thread
+  // onto someone else's conversation. Checked on the parent the client sent, for
+  // drafts and every visibility, before any guard, delegation or write runs.
+  let replyParent: Message | null = null
+  if (input.parentMessageId) {
+    const resolution = await resolveReplyParentMessage(
+      ctx,
+      { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null, userId: scope.userId },
+      input.parentMessageId,
+    )
+    if (resolution.status === 'not_found') {
+      const { translate } = await resolveTranslations()
+      return Response.json(
+        {
+          error: translate(
+            'messages.errors.parentMessageNotFound',
+            'The message you are replying to was not found',
+          ),
+        },
+        { status: 404 },
+      )
+    }
+    if (resolution.status === 'forbidden') {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
+    replyParent = resolution.message
+  }
+
   // #5535: composing on a channel conversation without naming a parent message
   // used to open a brand-new thread. A fresh thread has no `ChannelThreadMapping`,
   // so the outbound bridge had nothing to route on and the operator got a 201 for
@@ -555,27 +586,14 @@ export async function POST(req: Request) {
   // derives the thread from that parent alone — so a public, non-draft message
   // could be threaded onto a channel-linked conversation and delivered to the
   // external correspondent without any channel-access check. A tenant-wide
-  // channel accepts delivery from any sender, so `messages.compose` plus a known
-  // message id was enough. Apply the same check to the thread the command will
-  // actually derive. An internal thread, a thread outside the caller's scope,
-  // and an absent hub all resolve to `null` and keep the pre-existing rule.
+  // channel accepts delivery from any sender, so reading a message is not
+  // enough to post onto its thread. Apply the same check to the thread the
+  // command will actually derive. An internal thread and an absent hub resolve
+  // to `null` and keep the pre-existing rule.
   // Both channel branches also require `messages.view`, like reply and forward:
   // the hub grants every shared channel regardless of features (#6432).
-  if (isPublicVisibility && !input.isDraft && input.parentMessageId) {
-    const em = ctx.container.resolve('em') as EntityManager
-    const parentMessage = await findOneWithDecryption(
-      em,
-      Message,
-      {
-        id: input.parentMessageId,
-        tenantId: scope.tenantId,
-        organizationId: scope.organizationId,
-        deletedAt: null,
-      },
-      undefined,
-      { tenantId: scope.tenantId, organizationId: scope.organizationId },
-    )
-    const parentThreadId = parentMessage?.threadId ?? input.parentMessageId
+  if (isPublicVisibility && !input.isDraft && replyParent) {
+    const parentThreadId = replyParent.threadId ?? replyParent.id
     if (!(await canPostToChannelThread(ctx, scope, parentThreadId))) {
       return Response.json({ error: 'Access denied' }, { status: 403 })
     }
@@ -711,6 +729,10 @@ export const openApi: OpenApiRouteDoc = {
           schema: composeResponseSchema,
         },
       ],
+      errors: [
+        { status: 403, description: 'Access denied, including a parentMessageId the caller cannot read', schema: errorResponseSchema },
+        { status: 404, description: 'parentMessageId is unknown, deleted, or outside the caller organization', schema: errorResponseSchema },
+      ],
     },
   },
 }

package/src/modules/messages/commands/messages.ts

@@ -266,6 +266,13 @@ async function buildComposeResultFromExisting(
   }
 }
 
+/**
+ * `parentMessageId` is trusted: the thread is derived from it without a read
+ * check, because the acting `userId` is itself an input and server-side callers
+ * (channel ingest) pass parents the actor is not a participant of. Every surface
+ * that accepts a parent from a caller MUST resolve it against its own read rule
+ * first (`resolveReplyParentMessage` for the messages API).
+ */
 const composeMessageCommand: CommandHandler<unknown, { id: string; threadId: string | null; externalEmail: string | null; isDraft: boolean; recipientUserIds: string[]; deduplicated?: boolean }> = {
   id: 'messages.messages.compose',
   async execute(rawInput, ctx) {

package/src/modules/messages/i18n/de.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Bitte gib eine gültige externe E-Mail ein.",
   "messages.errors.noRecipients": "Füge mindestens einen Empfänger hinzu.",
   "messages.errors.noSubject": "Bitte Betreff eingeben.",
+  "messages.errors.parentMessageNotFound": "Die Nachricht, auf die Sie antworten, wurde nicht gefunden",
   "messages.errors.sendFailed": "Nachricht konnte nicht gesendet werden.",
   "messages.errors.senderDraftSendUnsupported": "Das Senden eines gespeicherten Entwurfs über ein verbundenes Postfach wird noch nicht unterstützt.",
   "messages.errors.senderPayloadUnsupported": "Der Versand aus dem eigenen Postfach unterstützt noch keine Anhänge oder verknüpften Datensätze.",

package/src/modules/messages/i18n/en.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Please enter a valid external email.",
   "messages.errors.noRecipients": "Please add at least one recipient.",
   "messages.errors.noSubject": "Please enter a subject.",
+  "messages.errors.parentMessageNotFound": "The message you are replying to was not found",
   "messages.errors.sendFailed": "Failed to send message.",
   "messages.errors.senderDraftSendUnsupported": "Sending a saved draft through a connected mailbox is not supported yet.",
   "messages.errors.senderPayloadUnsupported": "Sending from your own mailbox does not support attachments or linked records yet.",

package/src/modules/messages/i18n/es.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Introduce un correo externo válido.",
   "messages.errors.noRecipients": "Añade al menos un destinatario.",
   "messages.errors.noSubject": "Introduce un asunto.",
+  "messages.errors.parentMessageNotFound": "No se encontró el mensaje al que está respondiendo",
   "messages.errors.sendFailed": "No se pudo enviar el mensaje.",
   "messages.errors.senderDraftSendUnsupported": "Enviar un borrador guardado desde un buzón conectado todavía no es compatible.",
   "messages.errors.senderPayloadUnsupported": "El envío desde tu propio buzón todavía no admite adjuntos ni registros vinculados.",

package/src/modules/messages/i18n/ko.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "유효한 외부 이메일을 입력하세요.",
   "messages.errors.noRecipients": "수신자를 하나 이상 추가하세요.",
   "messages.errors.noSubject": "제목을 입력하세요.",
+  "messages.errors.parentMessageNotFound": "답장하려는 메시지를 찾을 수 없습니다",
   "messages.errors.sendFailed": "메시지 전송에 실패했습니다.",
   "messages.errors.senderDraftSendUnsupported": "저장된 초안을 연결된 메일함으로 보내는 기능은 아직 지원되지 않습니다.",
   "messages.errors.senderPayloadUnsupported": "본인 메일함에서 보내기는 아직 첨부 파일이나 연결된 레코드를 지원하지 않습니다.",

package/src/modules/messages/i18n/pl.json

@@ -130,6 +130,7 @@
   "messages.errors.noExternalEmail": "Wpisz poprawny zewnętrzny adres e-mail.",
   "messages.errors.noRecipients": "Dodaj przynajmniej jednego odbiorcę.",
   "messages.errors.noSubject": "Wpisz temat.",
+  "messages.errors.parentMessageNotFound": "Nie znaleziono wiadomości, na którą odpowiadasz",
   "messages.errors.sendFailed": "Nie udało się wysłać wiadomości.",
   "messages.errors.senderDraftSendUnsupported": "Wysyłka zapisanego szkicu przez połączoną skrzynkę nie jest jeszcze obsługiwana.",
   "messages.errors.senderPayloadUnsupported": "Wysyłka z własnej skrzynki nie obsługuje jeszcze załączników ani powiązanych rekordów.",