Inbox injection endpoint: POST /api/messages + MCP inject_message (#12) (#18)

src/mesh/mesh.controller.ts

@@ -16,6 +16,18 @@ import {
 import type { DeviceInfo } from './mesh.service.js';
 import { MeshService } from './mesh.service.js';
 
+export class InjectMessageDto {
+  @ApiProperty({ description: 'Message text', example: 'external trigger' })
+  text!: string;
+  @ApiProperty({
+    required: false,
+    description:
+      'Sender node number (integer in 1..0xffffffff); omitted when the external source has no mesh identity.',
+    example: 987654321,
+  })
+  from?: number;
+}
+
 export class SendTextDto {
   @ApiProperty({ description: 'Message text', example: 'hello' })
   text!: string;
@@ -183,6 +195,28 @@ export class MeshController {
     return this.mesh.messages();
   }
 
+  @Post('messages')
+  @ApiOperation({
+    summary: 'Inject a synthetic inbound message into the history',
+    description:
+      'Synthetic inbox injection for external triggers: records an rx entry in the message history as if received on the mesh, so external systems can push messages to trigger communication later. NOT transmitted over RF — nothing is sent to the bridge or air. The record appears in GET /api/messages like any other rx message (dir "rx", channel 0). Returns { id } with a random uint32 packet id.',
+  })
+  @ApiResponse({
+    status: 200,
+    description: 'Record injected',
+    example: { id: 123456789 },
+  })
+  @ApiResponse({ status: 400, description: 'Invalid text or from' })
+  injectMessage(@Body() body: InjectMessageDto) {
+    try {
+      return this.mesh.injectMessage(body?.text, body?.from);
+    } catch (err) {
+      throw new BadRequestException(
+        err instanceof Error ? err.message : String(err),
+      );
+    }
+  }
+
   @Get('telemetry')
   @ApiOperation({
     summary: 'Telemetry history (last 100)',