@open-mercato/core 0.10.1-develop.7749.1.ea3edf75e3 → 0.10.1-develop.7752.1.fd7c06569b

package/dist/modules/warranty_claims/commands/shared.js

@@ -1,4 +1,5 @@
 import { randomUUID } from "crypto";
+import { LockMode } from "@mikro-orm/core";
 import { CrudHttpError, assertFound } from "@open-mercato/shared/lib/crud/errors";
 import { invalidateCrudCache } from "@open-mercato/shared/lib/crud/cache";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
@@ -44,6 +45,33 @@ async function requireScopedClaim(em, id, scope, options = {}, notFoundMessage =
   const claim = await loadScopedClaim(em, id, scope, options);
   return assertFound(claim, notFoundMessage);
 }
+async function assertUniqueClaimLineNumbers(lineNumbers) {
+  const usedNumbers = /* @__PURE__ */ new Set();
+  for (const lineNo of lineNumbers) {
+    if (usedNumbers.has(lineNo)) {
+      const { translate } = await resolveTranslations();
+      const code = "warranty_claims.errors.duplicateLineNo";
+      throw new CrudHttpError(409, {
+        error: translate(code, "Another line on this claim already uses that line number. Remove the line that uses this number, then retry."),
+        code
+      });
+    }
+    usedNumbers.add(lineNo);
+  }
+}
+async function assertClaimLineNumberAvailable(em, claim, lineNo, excludedLineId, allowCurrentNumber = false) {
+  const scope = { tenantId: claim.tenantId, organizationId: claim.organizationId };
+  await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE });
+  const siblings = await findWithDecryption(
+    em,
+    WarrantyClaimLine,
+    { claim: claim.id, lineNo, deletedAt: null, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    {},
+    scope
+  );
+  if (allowCurrentNumber && siblings.some((line) => line.id === excludedLineId)) return;
+  await assertUniqueClaimLineNumbers([lineNo, ...siblings.filter((line) => line.id !== excludedLineId).map((line) => line.lineNo)]);
+}
 function appendClaimEvent(em, claim, kind, input = {}) {
   const event = em.create(WarrantyClaimEvent, {
     id: randomUUID(),
@@ -154,7 +182,9 @@ export {
   WARRANTY_CLAIM_LINE_RESOURCE_KIND,
   WARRANTY_CLAIM_RESOURCE_KIND,
   appendClaimEvent,
+  assertClaimLineNumberAvailable,
   assertFound2 as assertFound,
+  assertUniqueClaimLineNumbers,
   enforceWarrantyClaimOptimisticLock,
   ensureOrganizationScope,
   ensureSameScope,

package/dist/modules/warranty_claims/commands/shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/warranty_claims/commands/shared.ts"],
-  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function throwUndoRefusal(key: string, fallback: string): Promise<never> {\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(409, { error: translate(key, fallback), code: key })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAI3B,SAAS,eAAe,mBAAmB;AAC3C,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,iBAAiB,KAAa,UAAkC;AACpF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAC7E;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport { LockMode, type FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function throwUndoRefusal(key: string, fallback: string): Promise<never> {\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(409, { error: translate(key, fallback), code: key })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport async function assertUniqueClaimLineNumbers(lineNumbers: Iterable<number>): Promise<void> {\n  const usedNumbers = new Set<number>()\n  for (const lineNo of lineNumbers) {\n    if (usedNumbers.has(lineNo)) {\n      const { translate } = await resolveTranslations()\n      const code = 'warranty_claims.errors.duplicateLineNo'\n      throw new CrudHttpError(409, {\n        error: translate(code, 'Another line on this claim already uses that line number. Remove the line that uses this number, then retry.'),\n        code,\n      })\n    }\n    usedNumbers.add(lineNo)\n  }\n}\n\nexport async function assertClaimLineNumberAvailable(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  lineNo: number,\n  excludedLineId?: string,\n  allowCurrentNumber = false,\n): Promise<void> {\n  const scope = { tenantId: claim.tenantId, organizationId: claim.organizationId }\n  await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE })\n  const siblings = await findWithDecryption(\n    em,\n    WarrantyClaimLine,\n    { claim: claim.id, lineNo, deletedAt: null, tenantId: scope.tenantId, organizationId: scope.organizationId },\n    {},\n    scope,\n  )\n  if (allowCurrentNumber && siblings.some((line) => line.id === excludedLineId)) return\n  await assertUniqueClaimLineNumbers([lineNo, ...siblings.filter((line) => line.id !== excludedLineId).map((line) => line.lineNo)])\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAC3B,SAAS,gBAAqC;AAG9C,SAAS,eAAe,mBAAmB;AAC3C,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,iBAAiB,KAAa,UAAkC;AACpF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAC7E;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEA,eAAsB,6BAA6B,aAA8C;AAC/F,QAAM,cAAc,oBAAI,IAAY;AACpC,aAAW,UAAU,aAAa;AAChC,QAAI,YAAY,IAAI,MAAM,GAAG;AAC3B,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,YAAM,OAAO;AACb,YAAM,IAAI,cAAc,KAAK;AAAA,QAC3B,OAAO,UAAU,MAAM,8GAA8G;AAAA,QACrI;AAAA,MACF,CAAC;AAAA,IACH;AACA,gBAAY,IAAI,MAAM;AAAA,EACxB;AACF;AAEA,eAAsB,+BACpB,IACA,OACA,QACA,gBACA,qBAAqB,OACN;AACf,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,mBAAmB,IAAI,MAAM,IAAI,OAAO,EAAE,UAAU,SAAS,kBAAkB,CAAC;AACtF,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,EAAE,OAAO,MAAM,IAAI,QAAQ,WAAW,MAAM,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IAC3G,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,sBAAsB,SAAS,KAAK,CAAC,SAAS,KAAK,OAAO,cAAc,EAAG;AAC/E,QAAM,6BAA6B,CAAC,QAAQ,GAAG,SAAS,OAAO,CAAC,SAAS,KAAK,OAAO,cAAc,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;AAClI;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
   "names": ["assertFound"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7749.1.ea3edf75e3",
+  "version": "0.10.1-develop.7752.1.fd7c06569b",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7749.1.ea3edf75e3",
-    "@open-mercato/shared": "0.10.1-develop.7749.1.ea3edf75e3",
-    "@open-mercato/ui": "0.10.1-develop.7749.1.ea3edf75e3",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/shared": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/ui": "0.10.1-develop.7752.1.fd7c06569b",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7749.1.ea3edf75e3",
-    "@open-mercato/shared": "0.10.1-develop.7749.1.ea3edf75e3",
-    "@open-mercato/ui": "0.10.1-develop.7749.1.ea3edf75e3",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/shared": "0.10.1-develop.7752.1.fd7c06569b",
+    "@open-mercato/ui": "0.10.1-develop.7752.1.fd7c06569b",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/api_keys/services/principalService.ts

@@ -3,6 +3,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { ApiKeyPrincipalService, PrincipalScope } from '@open-mercato/shared/lib/auth/principal-service'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { ApiKey } from '../data/entities'
+import { resolveApiKeyRoleIds } from './sessionKeyRoles'
 
 function normalizeIds(ids: unknown): string[] {
   if (!Array.isArray(ids)) return []
@@ -24,10 +25,10 @@ export class DefaultApiKeyPrincipalService implements ApiKeyPrincipalService {
         deletedAt: null,
         $or: [{ organizationId: null }, { organizationId: scope.organizationId }],
       } as FilterQuery<ApiKey>,
-      { fields: ['rolesJson', 'expiresAt'] as const },
+      { fields: ['rolesJson', 'expiresAt', 'tenantId', 'sessionTokenHash', 'sessionUserId', 'sessionSecretEncrypted', 'opencodeSessionId'] as const },
       scope,
     )
     if (!apiKey || (apiKey.expiresAt && apiKey.expiresAt.getTime() <= Date.now())) return []
-    return normalizeIds(apiKey.rolesJson)
+    return normalizeIds(await resolveApiKeyRoleIds(this.em, apiKey, scope.tenantId))
   }
 }

package/src/modules/api_keys/services/sessionKeyRoles.ts

@@ -0,0 +1,35 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { ApiKey } from '../data/entities'
+import { UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export function isSessionBoundApiKey(key: ApiKey): boolean {
+  return Boolean(key.sessionTokenHash || key.sessionUserId || key.sessionSecretEncrypted || key.opencodeSessionId)
+}
+
+export async function resolveApiKeyRoleIds(
+  em: EntityManager,
+  key: ApiKey,
+  tenantId: string | null = key.tenantId ?? null,
+): Promise<string[]> {
+  const issuedRoleIds = Array.isArray(key.rolesJson)
+    ? key.rolesJson.filter((roleId): roleId is string => typeof roleId === 'string' && roleId.length > 0)
+    : []
+  if (!isSessionBoundApiKey(key)) return issuedRoleIds
+  const ownerId = key.sessionUserId?.trim()
+  if (!ownerId || !tenantId || tenantId !== key.tenantId || !issuedRoleIds.length) return []
+
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    {
+      user: { id: ownerId, tenantId, deletedAt: null },
+      role: { id: { $in: issuedRoleIds }, tenantId, deletedAt: null },
+      deletedAt: null,
+    },
+    { populate: ['role'] },
+    { tenantId, organizationId: null },
+  )
+  const currentRoleIds = new Set(links.map((link) => typeof link.role === 'string' ? link.role : link.role.id))
+  return issuedRoleIds.filter((roleId) => currentRoleIds.has(roleId))
+}

package/src/modules/auth/cli.ts

@@ -4,6 +4,7 @@ import { OM_LOG_LEVEL_ENV, resetLogLevelCache } from '@open-mercato/shared/lib/l
 import { resetServerLoggerCache } from '@open-mercato/shared/lib/logger'
 import { hash } from 'bcryptjs'
 import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EventBus } from '@open-mercato/events/types'
 import { User, Role, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
@@ -407,13 +408,19 @@ const addOrganization: ModuleCli = {
       return
     }
     const { resolve } = await createRequestContainer()
-    const em = resolve('em') as any
-    // Create tenant implicitly for simplicity
-    const tenant = em.create(Tenant, { name: `${name} Tenant` })
+    const em = resolve('em') as EntityManager
+    const eventBus = resolve('eventBus') as EventBus
+    const tenant = em.create(Tenant, { name: `${name} Tenant` }, { partial: true })
     await em.persist(tenant).flush()
-    const org = em.create(Organization, { name, tenant, logoPreserveAspectRatio: false })
+    await eventBus.emit('directory.tenant.created', {
+      id: String(tenant.id), tenantId: null, organizationId: null,
+    }, { persistent: true, tenantId: null, organizationId: null, rethrowHandlerErrors: true })
+    const org = em.create(Organization, { name, tenant, logoPreserveAspectRatio: false }, { partial: true })
     await em.persist(org).flush()
     await rebuildHierarchyForTenant(em, String(tenant.id))
+    await eventBus.emit('directory.organization.created', {
+      id: String(org.id), tenantId: String(tenant.id), organizationId: String(org.id),
+    }, { persistent: true, tenantId: String(tenant.id), organizationId: String(org.id), rethrowHandlerErrors: true })
     console.log('Organization created with id', org.id, 'in tenant', tenant.id)
   },
 }

package/src/modules/auth/services/rbacService.ts

@@ -3,6 +3,7 @@ import type { CacheStrategy } from '@open-mercato/cache'
 import { getCurrentCacheTenant, runWithCacheTenant } from '@open-mercato/cache'
 import { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
+import { isSessionBoundApiKey, resolveApiKeyRoleIds } from '@open-mercato/core/modules/api_keys/services/sessionKeyRoles'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
@@ -443,7 +444,7 @@ export class RbacService {
     organizations: string[] | null
   }> {
     const cacheKey = this.getCacheKey(userId, scope)
-    const cached = await this.getFromCache(cacheKey)
+    const cached = userId.startsWith('api_key:') ? null : await this.getFromCache(cacheKey)
     if (cached) return cached
 
     // Direct user-level super-admin grants and unrestricted role-level
@@ -467,8 +468,13 @@ export class RbacService {
         await this.setCache(cacheKey, result, userId, scope)
         return result
       }
+      const cacheable = !isSessionBoundApiKey(key)
+      if (cacheable) {
+        const cachedKeyAcl = await this.getFromCache(cacheKey)
+        if (cachedKeyAcl) return cachedKeyAcl
+      }
       const tenantId = scope.tenantId || key.tenantId || null
-      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []
+      const roleIds = await resolveApiKeyRoleIds(em, key, tenantId)
       const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0
         ? key.organizationId.trim()
         : null
@@ -534,7 +540,7 @@ export class RbacService {
       // bypass the key or role organization bounds.
       if (isSuper && organizations !== null && !features.includes('*')) features.push('*')
       const result = { isSuperAdmin: isSuper && organizations === null, features, organizations }
-      await this.setCache(cacheKey, result, userId, scope)
+      if (cacheable) await this.setCache(cacheKey, result, userId, scope)
       return result
     }
 
@@ -645,7 +651,7 @@ export class RbacService {
         return { isSuperAdmin: false, features: [], organizations: null }
       }
       const tenantId = scope.tenantId || key.tenantId || null
-      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []
+      const roleIds = await resolveApiKeyRoleIds(em, key, tenantId)
       const keyOrganizationId = typeof key.organizationId === 'string' && key.organizationId.trim().length > 0
         ? key.organizationId.trim()
         : null
@@ -1009,12 +1015,16 @@ export class RbacService {
     tenantId: string,
   ): Promise<FeatureOrganizationGrants> {
     const cacheKey = `rbac:feature-organizations:${userId}:${tenantId}`
-    if (this.cache) {
+    const key = userId.startsWith('api_key:')
+      ? await this.em.fork().findOne(ApiKey, { id: userId.slice('api_key:'.length), deletedAt: null })
+      : undefined
+    const cacheable = key === undefined || (key !== null && !isSessionBoundApiKey(key))
+    if (this.cache && cacheable) {
       const cached = await this.cache.get(cacheKey)
       if (isFeatureOrganizationGrants(cached)) return cached
     }
-    const grants = await this.queryFeatureOrganizationGrants(userId, tenantId)
-    if (this.cache) {
+    const grants = await this.queryFeatureOrganizationGrants(userId, tenantId, key)
+    if (this.cache && cacheable) {
       await this.cache.set(cacheKey, grants, {
         ttl: this.cacheTtlMs,
         tags: this.buildCacheTags(userId, { tenantId, organizationId: null }),
@@ -1026,11 +1036,14 @@ export class RbacService {
   private async queryFeatureOrganizationGrants(
     userId: string,
     tenantId: string,
+    knownApiKey?: ApiKey | null,
   ): Promise<FeatureOrganizationGrants> {
     const em = this.em.fork()
     if (userId.startsWith('api_key:')) {
       const apiKeyId = userId.slice('api_key:'.length)
-      const key = await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })
+      const key = knownApiKey === undefined
+        ? await em.findOne(ApiKey, { id: apiKeyId, deletedAt: null })
+        : knownApiKey
       if (
         !key
         || (key.expiresAt && key.expiresAt.getTime() < Date.now())
@@ -1039,7 +1052,7 @@ export class RbacService {
         return { kind: 'none' }
       }
 
-      const roleIds = Array.isArray(key.rolesJson) ? key.rolesJson.filter(Boolean) : []
+      const roleIds = await resolveApiKeyRoleIds(em, key, tenantId)
       if (!roleIds.length) return { kind: 'none' }
       const roleAcls = await em.find(RoleAcl, {
         tenantId,

package/src/modules/business_rules/lib/action-executor.ts

@@ -10,6 +10,7 @@ import {
 import type { RbacService } from '../../auth/services/rbacService'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { OpenMercatoEndpointOption } from './openmercato-call-options-types'
+import { resolveApiKeyRoleIds } from '@open-mercato/core/modules/api_keys/services/sessionKeyRoles'
 
 /**
  * Action definition
@@ -519,9 +520,7 @@ async function handleCallOpenMercato(
     throw new Error('CALL_OPEN_MERCATO action requires an active API key profile in scope')
   }
 
-  const roleIds = Array.isArray(apiKeyProfile.rolesJson)
-    ? apiKeyProfile.rolesJson.filter((roleId): roleId is string => typeof roleId === 'string' && roleId.length > 0)
-    : []
+  const roleIds = await resolveApiKeyRoleIds(em, apiKeyProfile, tenantId)
   if (roleIds.length === 0) {
     throw new Error('CALL_OPEN_MERCATO action requires an API key profile with at least one role')
   }

package/src/modules/directory/utils/organizationScope.ts

@@ -2,6 +2,8 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { FilterQuery } from '@mikro-orm/core'
 import type { AwilixContainer } from 'awilix'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
+import { isSessionBoundApiKey } from '@open-mercato/core/modules/api_keys/services/sessionKeyRoles'
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
@@ -504,9 +506,14 @@ export async function resolveOrganizationScopeForRequest({
   }
 
   const resolveScope = async (): Promise<OrganizationScope> => {
-    if (cache && cacheKey && typeof cache.get === 'function') {
+    let crossRequestCache = cache
+    if (crossRequestCache && userId?.startsWith('api_key:')) {
+      const key = await em.findOne(ApiKey, { id: userId.slice('api_key:'.length), deletedAt: null })
+      if (!key || isSessionBoundApiKey(key)) crossRequestCache = null
+    }
+    if (crossRequestCache && cacheKey && typeof crossRequestCache.get === 'function') {
       try {
-        const cached = await cache.get(cacheKey)
+        const cached = await crossRequestCache.get(cacheKey)
         if (isValidCachedScope(cached)) return cached
       } catch (err) {
         logger.warn('Cache read failed', { err })
@@ -521,9 +528,9 @@ export async function resolveOrganizationScopeForRequest({
       tenantId: effectiveTenantId,
     })
 
-    if (cache && cacheKey && userId && typeof cache.set === 'function') {
+    if (crossRequestCache && cacheKey && userId && typeof crossRequestCache.set === 'function') {
       try {
-        await cache.set(cacheKey, baseScope, {
+        await crossRequestCache.set(cacheKey, baseScope, {
           ttl: ttlMs,
           tags: buildOrgScopeCacheTags({ userId, effectiveTenantId }),
         })

package/src/modules/entities/subscribers/seed-tenant-encryption-maps-retry.ts

@@ -0,0 +1,12 @@
+import type { ResolverContext } from './seed-organization-encryption-maps'
+import seedTenantEncryptionMaps from './seed-tenant-encryption-maps'
+
+export const metadata = {
+  event: 'directory.tenant.created',
+  persistent: true,
+  id: 'entities:seed-tenant-encryption-maps-retry',
+}
+
+export default function retryHandle(payload: unknown, ctx: ResolverContext): Promise<void> {
+  return seedTenantEncryptionMaps(payload, ctx)
+}

package/src/modules/entities/subscribers/seed-tenant-encryption-maps.ts

@@ -0,0 +1,38 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
+import type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { getModules } from '@open-mercato/shared/lib/modules/registry'
+import { upsertEncryptionMaps, invalidateEncryptionMapScopes } from '@open-mercato/core/modules/entities/lib/encryption-maps'
+import type { ResolverContext } from './seed-organization-encryption-maps'
+
+const logger = createLogger('entities')
+
+export const metadata = {
+  event: 'directory.tenant.created',
+  persistent: false,
+  id: 'entities:seed-tenant-encryption-maps',
+}
+
+export default async function handle(payload: unknown, ctx: ResolverContext): Promise<void> {
+  if (!isTenantDataEncryptionEnabled()) return
+  if (!payload || typeof payload !== 'object' || !('id' in payload)) return
+  const tenantId = typeof payload.id === 'string' ? payload.id : null
+  if (!tenantId) return
+
+  const em = ctx.resolve<EntityManager>('em').fork()
+  await upsertEncryptionMaps(em, tenantId, null, getModules(), () => {}, async (scope) => {
+    try {
+      const encryptionService = ctx.resolve<Pick<TenantDataEncryptionService, 'invalidateMap'>>('tenantEncryptionService')
+      await invalidateEncryptionMapScopes(encryptionService, [scope])
+    } catch (err) {
+      logger.warn('Tenant encryption maps seeded but cache invalidation failed', { tenantId, err })
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'entities',
+        code: 'entities.tenant_encryption_map_invalidation_failed',
+        attributes: { tenantId },
+      })
+    }
+  })
+}

package/src/modules/warranty_claims/commands/claim-lines.ts

@@ -39,6 +39,8 @@ import {
   WARRANTY_CLAIM_LINE_RESOURCE_KIND,
   WARRANTY_CLAIM_RESOURCE_KIND,
   appendClaimEvent,
+  assertClaimLineNumberAvailable,
+  assertUniqueClaimLineNumbers,
   enforceWarrantyClaimOptimisticLock,
   ensureOrganizationScope,
   ensureTenantScope,
@@ -455,6 +457,11 @@ async function loadLineSnapshot(
   return line ? snapshotLine(line) : null
 }
 
+async function assertLineSnapshotNumberAvailable(em: EntityManager, claim: WarrantyClaim, snapshot: LineSnapshot): Promise<void> {
+  if (!snapshot.deletedAt) await assertClaimLineNumberAvailable(em, claim, snapshot.lineNo, snapshot.id, true)
+  else await requireScopedClaim(em, claim.id, { tenantId: claim.tenantId, organizationId: claim.organizationId }, { lockMode: LockMode.PESSIMISTIC_WRITE })
+}
+
 function restoreLineFromSnapshot(line: WarrantyClaimLine, snapshot: LineSnapshot): void {
   line.lineNo = snapshot.lineNo
   line.productId = snapshot.productId
@@ -694,6 +701,7 @@ const createClaimLineCommand: CommandHandler<ClaimLineCreateInput, { lineId: str
           }]]]), { currentClaimId: claim.id })
         }
         nextLineNo = input.lineNo ?? existingLines.reduce((max, entry) => Math.max(max, entry.lineNo), 0) + 1
+        await assertUniqueClaimLineNumbers([nextLineNo, ...existingLines.filter((line) => line.lineNo === nextLineNo).map((line) => line.lineNo)])
       },
       () => {
         line = em.create(WarrantyClaimLine, buildLineCreateData(claim, input, nextLineNo))
@@ -760,9 +768,9 @@ const updateClaimLineCommand: CommandHandler<ClaimLineUpdateInput, { lineId: str
     const guardsClaimedQty = hasOwn(input, 'qtyClaimed') || hasOwn(input, 'orderLineId')
     await withAtomicFlush(em, [
       async () => {
-        if (!guardsClaimedQty && !effectiveOrderLineId) return
         await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true })
         assertParentMutable(claim)
+        if (input.lineNo !== undefined) await assertClaimLineNumberAvailable(em, claim, input.lineNo, line.id)
         if (effectiveOrderLineId && (claim.orderId || effectiveOrderLineId !== (line.orderLineId ?? null))) {
           await validateClaimReferences(ctx, scope, {
             lineOrderRefs: [{
@@ -815,6 +823,7 @@ const updateClaimLineCommand: CommandHandler<ClaimLineUpdateInput, { lineId: str
     await withAtomicFlush(em, [
       async () => {
         state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+        await assertLineSnapshotNumberAvailable(em, state.claim, before)
       },
       () => restoreLineFromSnapshot(state.line, before),
       () => recomputeClaimRollups(em, state.claim),
@@ -845,6 +854,9 @@ const deleteClaimLineCommand: CommandHandler<LineDeleteInput, { lineId: string;
     assertParentMutable(claim)
     await enforceWarrantyClaimOptimisticLock(ctx, line, WARRANTY_CLAIM_LINE_RESOURCE_KIND)
     await withAtomicFlush(em, [
+      async () => {
+        await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE })
+      },
       () => {
         line.deletedAt = new Date()
         line.updatedAt = new Date()
@@ -871,6 +883,7 @@ const deleteClaimLineCommand: CommandHandler<LineDeleteInput, { lineId: string;
     await withAtomicFlush(em, [
       async () => {
         state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+        await assertLineSnapshotNumberAvailable(em, state.claim, before)
       },
       () => {
         restoreLineFromSnapshot(state.line, before)
@@ -907,6 +920,9 @@ const receiveClaimLineCommand: CommandHandler<ClaimLineReceiveInput, { lineId: s
     const shouldQuarantine = Boolean(effectiveSettings.quarantineGrades?.includes(grade))
 
     await withAtomicFlush(em, [
+      async () => {
+        await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE })
+      },
       () => {
         line.conditionGrade = grade
         if (input.inspectionNotes !== undefined) line.inspectionNotes = input.inspectionNotes ?? null
@@ -973,6 +989,7 @@ const receiveClaimLineCommand: CommandHandler<ClaimLineReceiveInput, { lineId: s
     await withAtomicFlush(em, [
       async () => {
         state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+        await assertLineSnapshotNumberAvailable(em, state.claim, before)
       },
       () => restoreLineFromSnapshot(state.line, before),
       () => recomputeClaimRollups(em, state.claim),
@@ -1002,6 +1019,9 @@ const releaseClaimLineQuarantineCommand: CommandHandler<ClaimLineReleaseQuaranti
     await enforceWarrantyClaimOptimisticLock(ctx, line, WARRANTY_CLAIM_LINE_RESOURCE_KIND, input.updatedAt ?? undefined)
 
     await withAtomicFlush(em, [
+      async () => {
+        await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE })
+      },
       () => {
         line.quarantineStatus = 'released'
         line.updatedAt = new Date()
@@ -1038,6 +1058,7 @@ const releaseClaimLineQuarantineCommand: CommandHandler<ClaimLineReleaseQuaranti
     await withAtomicFlush(em, [
       async () => {
         state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+        await assertLineSnapshotNumberAvailable(em, state.claim, before)
       },
       () => restoreLineFromSnapshot(state.line, before),
       () => recomputeClaimRollups(em, state.claim),
@@ -1067,6 +1088,9 @@ const setClaimLineAssessmentCommand: CommandHandler<LineSetAssessmentInput, { li
     await enforceWarrantyClaimOptimisticLock(ctx, line, WARRANTY_CLAIM_LINE_RESOURCE_KIND, input.updatedAt ?? undefined)
 
     await withAtomicFlush(em, [
+      async () => {
+        await requireScopedClaim(em, claim.id, scope, { lockMode: LockMode.PESSIMISTIC_WRITE })
+      },
       () => {
         line.assessmentPayload = input.assessmentPayload
         line.updatedAt = new Date()
@@ -1102,6 +1126,7 @@ const setClaimLineAssessmentCommand: CommandHandler<LineSetAssessmentInput, { li
     await withAtomicFlush(em, [
       async () => {
         state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+        await assertLineSnapshotNumberAvailable(em, state.claim, before)
       },
       () => restoreLineFromSnapshot(state.line, before),
       () => recomputeClaimRollups(em, state.claim),

package/src/modules/warranty_claims/commands/claims.ts

@@ -64,6 +64,7 @@ import type { WarrantyEntitlementInput, WarrantyEntitlementResolver } from '../s
 import {
   WARRANTY_CLAIM_RESOURCE_KIND,
   appendClaimEvent,
+  assertUniqueClaimLineNumbers,
   enforceWarrantyClaimOptimisticLock,
   ensureOrganizationScope,
   ensureTenantScope,
@@ -675,9 +676,25 @@ async function assertUndoSnapshotCurrent(ctx: CommandRuntimeContext, after: Clai
 
 async function restoreSnapshot(em: EntityManager, before: ClaimSnapshot, after: ClaimSnapshot): Promise<WarrantyClaim> {
   const { claim, lines } = await requireCurrentUndoSnapshot(em, after)
-  restoreClaimDelta(claim, before, after)
   const beforeLinesById = new Map((Array.isArray(before.lines) ? before.lines : []).map((line) => [line.id, line]))
   const afterLinesById = new Map((Array.isArray(after.lines) ? after.lines : []).map((line) => [line.id, line]))
+  const projectedLines = []
+  for (const line of lines) {
+    const beforeLine = beforeLinesById.get(line.id)
+    const afterLine = afterLinesById.get(line.id)
+    if (!beforeLine || !afterLine) return throwClaimUndoConflict()
+    const deletedAt = beforeLine.deletedAt !== afterLine.deletedAt ? beforeLine.deletedAt : line.deletedAt
+    const lineNo = beforeLine.lineNo !== afterLine.lineNo ? beforeLine.lineNo : line.lineNo
+    projectedLines.push({ id: line.id, lineNo, deletedAt, changesNumber: Boolean(line.deletedAt) || lineNo !== line.lineNo })
+  }
+  for (const projected of projectedLines) {
+    if (projected.deletedAt || !projected.changesNumber) continue
+    await assertUniqueClaimLineNumbers([
+      projected.lineNo,
+      ...projectedLines.filter((line) => !line.deletedAt && line.id !== projected.id && line.lineNo === projected.lineNo).map((line) => line.lineNo),
+    ])
+  }
+  restoreClaimDelta(claim, before, after)
   for (const line of lines) {
     const beforeLine = beforeLinesById.get(line.id)
     const afterLine = afterLinesById.get(line.id)
@@ -1511,6 +1528,7 @@ const createClaimCommand: CommandHandler<ClaimCreateInput, { claimId: string }>
   isUndoable: true,
   async execute(rawInput, ctx) {
     const input = parseCommandInput(claimCreateSchema, rawInput)
+    await assertUniqueClaimLineNumbers((input.lines ?? []).map((line, index) => line.lineNo ?? index + 1))
     const scope = resolveScope(ctx, input)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     await validateClaimReferences(ctx, scope, {