@open-mercato/core 0.10.1-develop.7787.1.96c7cfc66f → 0.10.1-develop.7793.1.9e0c43fdde

package/dist/modules/warranty_claims/lib/replacementOrderUndo.js

@@ -0,0 +1,50 @@
+import { isDeepStrictEqual } from "node:util";
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+async function isInitialReplacementOrderApproval(ctx, scope, orderId, savedVersion, currentVersion) {
+  let logs;
+  try {
+    logs = ctx.container.resolve("actionLogService");
+  } catch {
+    return false;
+  }
+  if (!logs) return false;
+  const history = await logs.list({
+    ...scope,
+    resourceKind: "sales.order",
+    resourceId: orderId,
+    includeRelated: true,
+    after: new Date(savedVersion),
+    pageSize: 3
+  });
+  const entries = history.items;
+  if (history.total > 3 || entries.length !== history.total) return false;
+  const edits = entries.filter((entry2) => !(entry2.commandId === "sales.orders.create" && entry2.resourceKind === "sales.order" && entry2.resourceId === orderId && entry2.tenantId === scope.tenantId && entry2.organizationId === scope.organizationId));
+  if (edits.length !== 1) return false;
+  const entry = edits[0];
+  if (entry.commandId !== "sales.orders.update" || entry.executionState !== "done") return false;
+  if (entry.tenantId !== scope.tenantId || entry.organizationId !== scope.organizationId || entry.resourceKind !== "sales.order" || entry.resourceId !== orderId) return false;
+  const before = record(entry.snapshotBefore);
+  const after = record(entry.snapshotAfter);
+  const beforeOrder = record(before?.order);
+  const afterOrder = record(after?.order);
+  if (!beforeOrder || !afterOrder || beforeOrder.id !== orderId || afterOrder.id !== orderId) return false;
+  if (beforeOrder.updatedAt !== savedVersion || afterOrder.updatedAt !== currentVersion) return false;
+  if (beforeOrder.status !== null || beforeOrder.statusEntryId !== null || afterOrder.status !== "pending_approval") return false;
+  const comparableOrder = (order) => Object.fromEntries(
+    Object.entries(order).filter(([key]) => !["status", "statusEntryId", "updatedAt"].includes(key))
+  );
+  if (!isDeepStrictEqual(comparableOrder(beforeOrder), comparableOrder(afterOrder))) return false;
+  const input = record(record(entry.commandPayload)?.__redoInput);
+  if (!input || input.id !== orderId || typeof input.statusEntryId !== "string" || input.statusEntryId !== afterOrder.statusEntryId || Object.keys(input).some((key) => !["id", "statusEntryId"].includes(key))) return false;
+  const beforeNotes = before?.notes;
+  const afterNotes = after?.notes;
+  if (!Array.isArray(beforeNotes) || !Array.isArray(afterNotes) || afterNotes.length !== beforeNotes.length + 1) return false;
+  if (!beforeNotes.every((note) => afterNotes.some((candidate) => isDeepStrictEqual(note, candidate)))) return false;
+  return ["lines", "adjustments", "addresses", "tags", "shipments", "payments"].every((key) => Array.isArray(before?.[key]) && isDeepStrictEqual(before?.[key], after?.[key]));
+}
+export {
+  isInitialReplacementOrderApproval
+};
+//# sourceMappingURL=replacementOrderUndo.js.map

package/dist/modules/warranty_claims/lib/replacementOrderUndo.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/replacementOrderUndo.ts"],
+  "sourcesContent": ["import { isDeepStrictEqual } from 'node:util'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { WarrantyClaimScope } from '../commands/shared'\n\ntype OrderAuditEntry = NonNullable<Awaited<ReturnType<ActionLogService['findById']>>>\n\nfunction record(value: unknown): Record<string, unknown> | null {\n  return value !== null && typeof value === 'object' && !Array.isArray(value)\n    ? value as Record<string, unknown>\n    : null\n}\n\nexport async function isInitialReplacementOrderApproval(\n  ctx: CommandRuntimeContext,\n  scope: WarrantyClaimScope,\n  orderId: string,\n  savedVersion: string,\n  currentVersion: string,\n): Promise<boolean> {\n  let logs: ActionLogService\n  try {\n    logs = ctx.container.resolve<ActionLogService>('actionLogService')\n  } catch {\n    return false\n  }\n  if (!logs) return false\n  const history = await logs.list({\n    ...scope,\n    resourceKind: 'sales.order',\n    resourceId: orderId,\n    includeRelated: true,\n    after: new Date(savedVersion),\n    pageSize: 3,\n  })\n  const entries: OrderAuditEntry[] = history.items\n  if (history.total > 3 || entries.length !== history.total) return false\n  const edits = entries.filter((entry) => !(entry.commandId === 'sales.orders.create'\n    && entry.resourceKind === 'sales.order' && entry.resourceId === orderId\n    && entry.tenantId === scope.tenantId && entry.organizationId === scope.organizationId))\n  if (edits.length !== 1) return false\n  const entry = edits[0]\n  if (entry.commandId !== 'sales.orders.update' || entry.executionState !== 'done') return false\n  if (entry.tenantId !== scope.tenantId || entry.organizationId !== scope.organizationId\n    || entry.resourceKind !== 'sales.order' || entry.resourceId !== orderId) return false\n  const before = record(entry.snapshotBefore)\n  const after = record(entry.snapshotAfter)\n  const beforeOrder = record(before?.order)\n  const afterOrder = record(after?.order)\n  if (!beforeOrder || !afterOrder || beforeOrder.id !== orderId || afterOrder.id !== orderId) return false\n  if (beforeOrder.updatedAt !== savedVersion || afterOrder.updatedAt !== currentVersion) return false\n  if (beforeOrder.status !== null || beforeOrder.statusEntryId !== null || afterOrder.status !== 'pending_approval') return false\n  const comparableOrder = (order: Record<string, unknown>) => Object.fromEntries(\n    Object.entries(order).filter(([key]) => !['status', 'statusEntryId', 'updatedAt'].includes(key)),\n  )\n  if (!isDeepStrictEqual(comparableOrder(beforeOrder), comparableOrder(afterOrder))) return false\n  const input = record(record(entry.commandPayload)?.__redoInput)\n  if (!input || input.id !== orderId || typeof input.statusEntryId !== 'string'\n    || input.statusEntryId !== afterOrder.statusEntryId\n    || Object.keys(input).some((key) => !['id', 'statusEntryId'].includes(key))) return false\n  const beforeNotes = before?.notes\n  const afterNotes = after?.notes\n  if (!Array.isArray(beforeNotes) || !Array.isArray(afterNotes) || afterNotes.length !== beforeNotes.length + 1) return false\n  if (!beforeNotes.every((note) => afterNotes.some((candidate) => isDeepStrictEqual(note, candidate)))) return false\n  return ['lines', 'adjustments', 'addresses', 'tags', 'shipments', 'payments']\n    .every((key) => Array.isArray(before?.[key]) && isDeepStrictEqual(before?.[key], after?.[key]))\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAOlC,SAAS,OAAO,OAAgD;AAC9D,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IACtE,QACA;AACN;AAEA,eAAsB,kCACpB,KACA,OACA,SACA,cACA,gBACkB;AAClB,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,UAAU,QAA0B,kBAAkB;AAAA,EACnE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,KAAM,QAAO;AAClB,QAAM,UAAU,MAAM,KAAK,KAAK;AAAA,IAC9B,GAAG;AAAA,IACH,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,gBAAgB;AAAA,IAChB,OAAO,IAAI,KAAK,YAAY;AAAA,IAC5B,UAAU;AAAA,EACZ,CAAC;AACD,QAAM,UAA6B,QAAQ;AAC3C,MAAI,QAAQ,QAAQ,KAAK,QAAQ,WAAW,QAAQ,MAAO,QAAO;AAClE,QAAM,QAAQ,QAAQ,OAAO,CAACA,WAAU,EAAEA,OAAM,cAAc,yBACzDA,OAAM,iBAAiB,iBAAiBA,OAAM,eAAe,WAC7DA,OAAM,aAAa,MAAM,YAAYA,OAAM,mBAAmB,MAAM,eAAe;AACxF,MAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,QAAM,QAAQ,MAAM,CAAC;AACrB,MAAI,MAAM,cAAc,yBAAyB,MAAM,mBAAmB,OAAQ,QAAO;AACzF,MAAI,MAAM,aAAa,MAAM,YAAY,MAAM,mBAAmB,MAAM,kBACnE,MAAM,iBAAiB,iBAAiB,MAAM,eAAe,QAAS,QAAO;AAClF,QAAM,SAAS,OAAO,MAAM,cAAc;AAC1C,QAAM,QAAQ,OAAO,MAAM,aAAa;AACxC,QAAM,cAAc,OAAO,QAAQ,KAAK;AACxC,QAAM,aAAa,OAAO,OAAO,KAAK;AACtC,MAAI,CAAC,eAAe,CAAC,cAAc,YAAY,OAAO,WAAW,WAAW,OAAO,QAAS,QAAO;AACnG,MAAI,YAAY,cAAc,gBAAgB,WAAW,cAAc,eAAgB,QAAO;AAC9F,MAAI,YAAY,WAAW,QAAQ,YAAY,kBAAkB,QAAQ,WAAW,WAAW,mBAAoB,QAAO;AAC1H,QAAM,kBAAkB,CAAC,UAAmC,OAAO;AAAA,IACjE,OAAO,QAAQ,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,UAAU,iBAAiB,WAAW,EAAE,SAAS,GAAG,CAAC;AAAA,EACjG;AACA,MAAI,CAAC,kBAAkB,gBAAgB,WAAW,GAAG,gBAAgB,UAAU,CAAC,EAAG,QAAO;AAC1F,QAAM,QAAQ,OAAO,OAAO,MAAM,cAAc,GAAG,WAAW;AAC9D,MAAI,CAAC,SAAS,MAAM,OAAO,WAAW,OAAO,MAAM,kBAAkB,YAChE,MAAM,kBAAkB,WAAW,iBACnC,OAAO,KAAK,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,eAAe,EAAE,SAAS,GAAG,CAAC,EAAG,QAAO;AACtF,QAAM,cAAc,QAAQ;AAC5B,QAAM,aAAa,OAAO;AAC1B,MAAI,CAAC,MAAM,QAAQ,WAAW,KAAK,CAAC,MAAM,QAAQ,UAAU,KAAK,WAAW,WAAW,YAAY,SAAS,EAAG,QAAO;AACtH,MAAI,CAAC,YAAY,MAAM,CAAC,SAAS,WAAW,KAAK,CAAC,cAAc,kBAAkB,MAAM,SAAS,CAAC,CAAC,EAAG,QAAO;AAC7G,SAAO,CAAC,SAAS,eAAe,aAAa,QAAQ,aAAa,UAAU,EACzE,MAAM,CAAC,QAAQ,MAAM,QAAQ,SAAS,GAAG,CAAC,KAAK,kBAAkB,SAAS,GAAG,GAAG,QAAQ,GAAG,CAAC,CAAC;AAClG;",
+  "names": ["entry"]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7787.1.96c7cfc66f",
+  "version": "0.10.1-develop.7793.1.9e0c43fdde",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/shared": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/ui": "0.10.1-develop.7787.1.96c7cfc66f",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7793.1.9e0c43fdde",
+    "@open-mercato/shared": "0.10.1-develop.7793.1.9e0c43fdde",
+    "@open-mercato/ui": "0.10.1-develop.7793.1.9e0c43fdde",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/shared": "0.10.1-develop.7787.1.96c7cfc66f",
-    "@open-mercato/ui": "0.10.1-develop.7787.1.96c7cfc66f",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7793.1.9e0c43fdde",
+    "@open-mercato/shared": "0.10.1-develop.7793.1.9e0c43fdde",
+    "@open-mercato/ui": "0.10.1-develop.7793.1.9e0c43fdde",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/audit_logs/api/audit-logs/actions/redo/route.ts

@@ -5,7 +5,8 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
-import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
@@ -197,11 +198,10 @@ export async function POST(req: Request) {
     }
     return response
   } catch (err) {
-    // Same contract as undo: a domain refusal carries an already-localized body the
-    // operator can act on, so surface it instead of a generic message.
     if (isCrudHttpError(err)) {
       logger.warn('Redo rejected', { err })
-      return NextResponse.json(err.body, { status: err.status })
+      const { translate } = await resolveTranslations()
+      return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })
     }
     const interceptorRejection = getCommandInterceptorHttpRejection(err)
     if (interceptorRejection) {

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -5,7 +5,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
-import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
@@ -158,13 +158,10 @@ export async function POST(req: Request) {
     await commandBus.undo(undoToken, ctx)
     return NextResponse.json({ ok: true, logId: target.id })
   } catch (err) {
-    // A command can refuse an undo for a domain reason the operator can act on — e.g.
-    // reverting a role grant would drop a tenant below a protected role's active-holder
-    // floor. Those arrive as CrudHttpError with an already-localized body, so pass them
-    // through verbatim instead of flattening every failure to a generic message.
     if (isCrudHttpError(err)) {
       logger.warn('Undo rejected', { err, logId: target.id })
-      return NextResponse.json(err.body, { status: err.status })
+      const { translate } = await resolveTranslations()
+      return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })
     }
     // A beforeUndo interceptor that blocked with an explicit status is a deliberate business
     // rejection, not an undo failure — surface its status and message (issue #5045).

package/src/modules/entities/cli.ts

@@ -330,6 +330,12 @@ function normalizeKeyInput(value: string): string {
   return value.trim().replace(/(?:^['"]|['"]$)/g, '')
 }
 
+const OLD_ENCRYPTION_KEY_ENV = 'TENANT_DATA_ENCRYPTION_OLD_KEY'
+
+function failCli(message: string): never {
+  throw new Error(message)
+}
+
 class DerivedKeyKmsService implements KmsService {
   private root: Buffer
   constructor(secret: string) {
@@ -357,11 +363,6 @@ class DerivedKeyKmsService implements KmsService {
   }
 }
 
-function fingerprintDek(dek: TenantDek | null): string | null {
-  if (!dek?.key) return null
-  return crypto.createHash('sha256').update(dek.key).digest('hex').slice(0, 12)
-}
-
 function decryptWithOldKey(
   payload: string,
   dek: TenantDek | null,
@@ -405,22 +406,90 @@ interface EncryptionMapMeta {
   tenantId: string
 }
 
-function resolveMapMeta(
+// A map is only safe to act on when every mapped field resolves to a real column. The
+// distinction that matters for the exit code is whether skipping it could leave ciphertext
+// behind: a map that declares no fields, or that this command does not own, cannot — while a map
+// whose fields exist on paper but cannot be located is a reason to refuse the run.
+type EncryptionMapResolution =
+  | { status: 'ready'; mapMeta: EncryptionMapMeta }
+  | { status: 'nothing-to-process'; reason: string }
+  | { status: 'unresolvable'; reason: string }
+
+function classifyEncryptionMap(
   map: EncryptionMap,
   metaByEntityId: Map<string, any>,
-  warn: (msg: string) => void = () => {},
-): EncryptionMapMeta | null {
+): EncryptionMapResolution {
   const entityId = String(map.entityId)
+  const fields = Array.isArray(map.fieldsJson) ? map.fieldsJson : []
+  if (!fields.length) {
+    return { status: 'nothing-to-process', reason: 'the map declares no encrypted fields' }
+  }
+  // The "not this command's business" checks come before the consistency checks: a tenantless map
+  // is out of scope whether or not its entity still resolves, so testing scope first keeps an
+  // out-of-scope row from being reported as a blocking inconsistency.
+  const tenantId = map.tenantId ? String(map.tenantId) : null
+  if (!tenantId) {
+    // Documented behaviour (apps/docs/docs/user-guide/encryption.mdx, "Backfilling system-scoped
+    // records"): these commands walk encryption_maps and skip every row without a tenant, because
+    // a tenant key cannot open ciphertext sealed under a system key. That is
+    // `backfill-system-encryption`'s job, not this command's.
+    return {
+      status: 'nothing-to-process',
+      reason: 'the map has no tenant_id — use "mercato entities backfill-system-encryption" for system-scoped records',
+    }
+  }
   const meta = metaByEntityId.get(entityId)
   if (!meta) {
-    warn(`Skipping ${entityId}: metadata not found.`)
-    return null
+    return {
+      status: 'unresolvable',
+      reason: 'entity metadata is not registered in this app — is the module that owns it still enabled?',
+    }
   }
-  const fields = Array.isArray(map.fieldsJson) ? map.fieldsJson : []
-  if (!fields.length) return null
-  const tenantId = map.tenantId ? String(map.tenantId) : null
-  if (!tenantId) return null
-  return { entityId, meta, fields, tenantId }
+  if (!meta.tableName) {
+    return { status: 'unresolvable', reason: 'table metadata is missing' }
+  }
+  for (const rule of fields) {
+    if (!resolveProperty(meta, rule.field).columnName) {
+      return { status: 'unresolvable', reason: `mapped field "${rule.field}" was not found` }
+    }
+    if (rule.hashField && !resolveProperty(meta, rule.hashField).columnName) {
+      return { status: 'unresolvable', reason: `hash field "${rule.hashField}" was not found` }
+    }
+  }
+  return { status: 'ready', mapMeta: { entityId, meta, fields, tenantId } }
+}
+
+function resolveMapsOrFail(
+  maps: EncryptionMap[],
+  metaByEntityId: ReturnType<typeof buildEntityMetaRegistry>,
+): Array<{ map: EncryptionMap; mapMeta: EncryptionMapMeta }> {
+  const resolved: Array<{ map: EncryptionMap; mapMeta: EncryptionMapMeta }> = []
+  const unresolvable: string[] = []
+  for (const map of maps) {
+    const resolution = classifyEncryptionMap(map, metaByEntityId)
+    if (resolution.status === 'ready') {
+      resolved.push({ map, mapMeta: resolution.mapMeta })
+      continue
+    }
+    if (resolution.status === 'nothing-to-process') {
+      console.warn(`Skipping ${String(map.entityId)}: ${resolution.reason}.`)
+      continue
+    }
+    unresolvable.push(`  ${String(map.entityId)} (encryption_maps.id=${String(map.id)}): ${resolution.reason}`)
+  }
+  // Report every offending map at once: the operator has to clean up all of them before the
+  // command can run, and failing on the first one would make that an N-run guessing game.
+  if (unresolvable.length) {
+    failCli(
+      `${unresolvable.length} encryption map(s) in the selected scope cannot be processed, so this command would have `
+        + 'left their ciphertext untouched while reporting success. No rows were changed.\n'
+        + unresolvable.join('\n')
+        + '\nResolve each one before re-running: re-enable the module that owns the entity, or — once the entity\'s data '
+        + 'is confirmed gone — soft-delete the stale map row '
+        + '(UPDATE encryption_maps SET deleted_at = now() WHERE id = \'…\').',
+    )
+  }
+  return resolved
 }
 
 function formatValueForColumn(prop: any, value: unknown): unknown {
@@ -438,33 +507,46 @@ const rotateEncryptionKey: ModuleCli = {
     const args = parseArgs(rest)
     const tenantIdArg = (args.tenant as string) || (args.tenantId as string) || null
     const organizationIdArg = (args.org as string) || (args.organization as string) || (args.organizationId as string) || null
-    const oldKey = (args['old-key'] as string) || (args.oldKey as string) || null
+    const oldKeyArgument = (args['old-key'] as string) || (args.oldKey as string) || null
+    const oldKeyEnvironment = process.env[OLD_ENCRYPTION_KEY_ENV]
+      ? normalizeKeyInput(process.env[OLD_ENCRYPTION_KEY_ENV]!)
+      : null
+    if (
+      oldKeyArgument
+      && oldKeyEnvironment
+      && normalizeKeyInput(oldKeyArgument) !== oldKeyEnvironment
+    ) {
+      failCli(`--old-key and ${OLD_ENCRYPTION_KEY_ENV} contain different values. Remove --old-key and retry.`)
+    }
+    if (oldKeyArgument) {
+      console.warn(
+        `Passing key material through --old-key can expose it in shell history and process listings. Set ${OLD_ENCRYPTION_KEY_ENV} through your secret manager instead.`,
+      )
+    }
+    const oldKey = oldKeyEnvironment || oldKeyArgument
     const dryRun = Boolean(args['dry-run'] || args.dry)
     const debug = Boolean(args.debug)
     const rotate = Boolean(oldKey)
     if (rotate && !tenantIdArg) {
       console.warn(
-        '⚠️  Rotating with --old-key across all tenants. A single old key should normally target one tenant; consider --tenant.',
+        '⚠️  Rotating with one previous key across all tenants. A single previous key should normally target one tenant; consider --tenant.',
       )
     }
     if (!isTenantDataEncryptionEnabled()) {
-      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting.')
-      return
+      failCli('TENANT_DATA_ENCRYPTION is disabled; aborting.')
     }
 
     const { resolve } = await createRequestContainer()
     const em = resolve('em') as any
     const conn: any = em?.getConnection?.()
     if (!conn || typeof conn.execute !== 'function') {
-      console.error('Unable to access raw connection; aborting.')
-      return
+      failCli('Unable to access raw connection; aborting.')
     }
 
     const encryptionService = new TenantDataEncryptionService(em as any, { kms: createKmsService() })
     const oldKms = rotate && oldKey ? new DerivedKeyKmsService(oldKey) : null
     if (!encryptionService.isEnabled()) {
-      console.error('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')
-      return
+      failCli('Encryption service is not enabled (KMS unhealthy or no DEK). Aborting.')
     }
 
     if (debug) {
@@ -474,18 +556,6 @@ const rotateEncryptionKey: ModuleCli = {
         tenantId: tenantIdArg ?? null,
         organizationId: organizationIdArg ?? null,
       })
-      if (tenantIdArg) {
-        const [oldDek, newDek] = await Promise.all([
-          oldKms?.getTenantDek(tenantIdArg) ?? Promise.resolve(null),
-          encryptionService.getDek(tenantIdArg),
-        ])
-        console.log('[rotate-encryption-key] dek fingerprints', {
-          oldKey: fingerprintDek(oldDek),
-          currentKey: fingerprintDek(newDek),
-        })
-      } else {
-        console.log('[rotate-encryption-key] dek fingerprints skipped (no tenantId)')
-      }
     }
 
     const metaByEntityId = buildEntityMetaRegistry(em)
@@ -502,6 +572,7 @@ const rotateEncryptionKey: ModuleCli = {
       )
       return false
     })
+    const resolvedMaps = resolveMapsOrFail(maps, metaByEntityId)
     const customDocuments = await rotateCustomEntityDocuments(em, {
       encryptionService,
       oldKms,
@@ -516,7 +587,6 @@ const rotateEncryptionKey: ModuleCli = {
       if (!customDocuments) console.log('No encryption maps found for the selected scope.')
       return
     }
-
     const resolveScopes = async (tenantId: string, organizationId: string | null) => {
       if (organizationId) return [{ tenantId, organizationId }]
       const orgs = await em.find(Organization, { tenant: tenantId })
@@ -530,7 +600,7 @@ const rotateEncryptionKey: ModuleCli = {
 
     const oldDekCache = new Map<string, TenantDek | null>()
     // Rows this run could not rotate because their ciphertext opens under neither
-    // --old-key nor the current tenant key — surfaced in the closing summary so an
+    // the previous nor the current tenant key — surfaced in the closing summary so an
     // operator does not have to grep console.warn output for a batch of thousands.
     const unrecoverableRows: Array<{ entityId: string; field: string; rowId: unknown }> = []
     // A dry run must not provision key material. `encryptEntityPayload` creates and
@@ -635,7 +705,7 @@ const rotateEncryptionKey: ModuleCli = {
             if (rule.hashField) delete payload[rule.hashField]
             unrecoverableRows.push({ entityId, field: rule.field, rowId: row[pk] })
             console.warn(
-              `Skipping ${entityId}.${rule.field} for row ${row[pk]}: its ciphertext opens under neither --old-key nor the current tenant key. Re-run with the key that sealed it.`,
+              `Skipping ${entityId}.${rule.field} for row ${row[pk]}: its ciphertext opens under neither the previous nor the current tenant key. Re-run with the key that sealed it.`,
             )
           }
         }
@@ -693,9 +763,7 @@ const rotateEncryptionKey: ModuleCli = {
     }
 
     let total = 0
-    for (const map of maps) {
-      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)
-      if (!mapMeta) continue
+    for (const { map, mapMeta } of resolvedMaps) {
       const { entityId, meta, fields, tenantId } = mapMeta
       const scopes = await resolveScopes(tenantId, map.organizationId ? String(map.organizationId) : null)
       for (const scope of scopes) {
@@ -718,7 +786,7 @@ const rotateEncryptionKey: ModuleCli = {
       const maxListed = 20
       console.log(
         `\n⚠️  ${unrecoverableRows.length} field(s) could not be rotated — their ciphertext opens under neither `
-          + '--old-key nor the current tenant key, so they were left untouched. See '
+          + 'the previous nor the current tenant key, so they were left untouched. See '
           + '"Key management" in apps/docs/docs/architecture/data-encryption.mdx for how to resolve these manually.',
       )
       for (const row of unrecoverableRows.slice(0, maxListed)) {
@@ -727,6 +795,9 @@ const rotateEncryptionKey: ModuleCli = {
       if (unrecoverableRows.length > maxListed) {
         console.log(`  ... and ${unrecoverableRows.length - maxListed} more`)
       }
+      failCli(
+        `${unrecoverableRows.length} encrypted field(s) could not be rotated. The command left them untouched and did not complete successfully.`,
+      )
     }
   },
 }
@@ -747,18 +818,15 @@ const decryptDatabase: ModuleCli = {
     const debug = Boolean(args.debug)
 
     if (!tenantIdArg) {
-      console.error('--tenant <uuid> is required.')
-      return
+      failCli('--tenant <uuid> is required.')
     }
 
     if (!checkMode) {
       if (!confirm) {
-        console.error('--confirm <tenantUuid> is required (safety gate). Pass the exact tenant UUID to confirm the operation.')
-        return
+        failCli('--confirm <tenantUuid> is required (safety gate). Pass the exact tenant UUID to confirm the operation.')
       }
       if (confirm !== tenantIdArg) {
-        console.error(`--confirm value "${confirm}" does not match --tenant "${tenantIdArg}". Aborting.`)
-        return
+        failCli(`--confirm value "${confirm}" does not match --tenant "${tenantIdArg}". Aborting.`)
       }
     }
 
@@ -766,13 +834,11 @@ const decryptDatabase: ModuleCli = {
     const em = resolve('em') as any
     const conn: any = em?.getConnection?.()
     if (!conn || typeof conn.execute !== 'function') {
-      console.error('Unable to access raw database connection; aborting.')
-      return
+      failCli('Unable to access raw database connection; aborting.')
     }
 
     if (!checkMode && !isTenantDataEncryptionEnabled()) {
-      console.error('TENANT_DATA_ENCRYPTION is disabled; aborting. Data may already be decrypted.')
-      return
+      failCli('TENANT_DATA_ENCRYPTION is disabled; aborting. Data may already be decrypted.')
     }
 
     const metaByEntityId = buildEntityMetaRegistry(em)
@@ -811,6 +877,7 @@ const decryptDatabase: ModuleCli = {
       console.log('No active encryption maps found for the selected scope.')
       return
     }
+    const resolvedMaps = resolveMapsOrFail(maps, metaByEntityId)
 
     const kms = createKmsService()
     const dekCache = new Map<string, TenantDek | null>()
@@ -827,16 +894,22 @@ const decryptDatabase: ModuleCli = {
       console.log(`Active EncryptionMap records for scope: ${maps.length}`)
       let encryptedCandidatesSampled = 0
       let malformedPayloadCountSampled = 0
-      for (const map of maps) {
-        const mapMeta = resolveMapMeta(map, metaByEntityId)
-        if (!mapMeta) continue
+      // --check writes nothing, so an unreachable DEK is the diagnosis the operator came for,
+      // not a reason to abort mid-inspection. Report every uninspectable entity, inspect the
+      // rest, and let the closing gate below make the incomplete run exit non-zero.
+      const uninspectableEntityIds: string[] = []
+      const failedSampleScopes: string[] = []
+      for (const { map, mapMeta } of resolvedMaps) {
         const { entityId, meta, fields, tenantId } = mapMeta
         const dek = await getDek(tenantId).catch(() => null)
-        if (!dek) continue
+        if (!dek) {
+          console.warn(`⚠ No DEK available for tenant ${tenantId}; cannot inspect ${entityId}.`)
+          uninspectableEntityIds.push(entityId)
+          continue
+        }
         const scopes = await resolveDecryptScopes(tenantId, map.organizationId ? String(map.organizationId) : null)
         const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'
-        const tableName = meta?.tableName
-        if (!tableName) continue
+        const tableName = meta.tableName
         const schema = meta?.schema
         const qualifiedTable = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`
         const fieldCols = fields.flatMap((f: any) => {
@@ -845,10 +918,19 @@ const decryptDatabase: ModuleCli = {
         })
         const colList = Array.from(new Set([pk, ...fieldCols]))
         for (const scope of scopes) {
-          const sampleRows = await conn.execute(
-            `SELECT ${colList.map((c: string) => `"${c}"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? LIMIT 100`,
-            [scope.tenantId, scope.organizationId],
-          ).catch(() => [])
+          let sampleRows: unknown
+          try {
+            sampleRows = await conn.execute(
+              `SELECT ${colList.map((c: string) => `"${c}"`).join(', ')} FROM ${qualifiedTable} WHERE tenant_id = ? AND organization_id IS NOT DISTINCT FROM ? LIMIT 100`,
+              [scope.tenantId, scope.organizationId],
+            )
+          } catch (error: unknown) {
+            const scopeLabel = scope.organizationId ?? 'global'
+            const errorMessage = error instanceof Error ? error.message : String(error)
+            console.warn(`⚠ Could not sample ${entityId} for organization ${scopeLabel}: ${errorMessage}`)
+            failedSampleScopes.push(`${entityId} (organization_id=${scopeLabel})`)
+            continue
+          }
           for (const row of Array.isArray(sampleRows) ? sampleRows : []) {
             let rowHasEncrypted = false
             for (const fieldRule of fields) {
@@ -877,6 +959,18 @@ const decryptDatabase: ModuleCli = {
         console.log(`malformed payloads (sampled): ${malformedPayloadCountSampled}`)
       }
       console.log('not a proof of absence — run full command + rerun --check to confirm')
+      if (uninspectableEntityIds.length || failedSampleScopes.length) {
+        const unavailableDekSummary = uninspectableEntityIds.length
+          ? ` No DEK was available for ${uninspectableEntityIds.join(', ')}.`
+          : ''
+        const failedSampleSummary = failedSampleScopes.length
+          ? ` Sample queries failed for ${failedSampleScopes.join(', ')}.`
+          : ''
+        failCli(
+          `Encryption check incomplete.${unavailableDekSummary}${failedSampleSummary} `
+            + 'The counts above cover only successfully inspected scopes.',
+        )
+      }
       return
     }
 
@@ -888,21 +982,21 @@ const decryptDatabase: ModuleCli = {
     const malformedByLocation = new Map<string, number>()
     let totalEntitiesProcessed = 0
 
-    for (const map of maps) {
-      const mapMeta = resolveMapMeta(map, metaByEntityId, console.warn)
-      if (!mapMeta) continue
-      const { entityId, meta, fields, tenantId } = mapMeta
-      const dek = await getDek(tenantId)
+    const deksByTenantId = new Map<string, TenantDek>()
+    for (const { mapMeta } of resolvedMaps) {
+      if (deksByTenantId.has(mapMeta.tenantId)) continue
+      const dek = await getDek(mapMeta.tenantId)
       if (!dek) {
-        console.warn(`No DEK available for tenant ${tenantId}; skipping ${entityId}.`)
-        continue
+        failCli(`No DEK available for tenant ${mapMeta.tenantId}. No rows were changed.`)
       }
+      deksByTenantId.set(mapMeta.tenantId, dek)
+    }
+
+    for (const { map, mapMeta } of resolvedMaps) {
+      const { entityId, meta, fields, tenantId } = mapMeta
+      const dek = deksByTenantId.get(tenantId)!
       const pk = Array.isArray(meta?.primaryKeys) && meta.primaryKeys.length ? meta.primaryKeys[0] : 'id'
-      const tableName = meta?.tableName
-      if (!tableName) {
-        console.warn(`Skipping ${entityId}: table name not found.`)
-        continue
-      }
+      const tableName = meta.tableName
       const schema = meta?.schema
       const qualifiedTable = schema ? `"${schema}"."${tableName}"` : `"${tableName}"`
       const fieldCols = fields.flatMap((f: any) => {
@@ -1035,28 +1129,6 @@ const decryptDatabase: ModuleCli = {
       }
     }
 
-    if (deactivateMaps && !dryRun) {
-      let deactivateSql = `UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND deleted_at IS NULL`
-      const deactivateParams: unknown[] = [tenantIdArg]
-      if (organizationIdArg) {
-        deactivateSql += ` AND (organization_id = ? OR organization_id IS NULL)`
-        deactivateParams.push(organizationIdArg)
-      }
-      if (entityIdArg) {
-        deactivateSql += ` AND entity_id = ?`
-        deactivateParams.push(entityIdArg)
-      }
-      await conn.execute(deactivateSql, deactivateParams)
-      console.warn('⚠ Restart all application replicas — in-process map caches may still be active.')
-      if (isTenantDataEncryptionEnabled()) {
-        console.warn('⚠ Env TENANT_DATA_ENCRYPTION is still true — new writes will be re-encrypted until env is updated and replicas restarted.')
-      }
-    }
-
-    if (deactivateMaps && dryRun) {
-      console.log(`[dry-run] Would deactivate ${maps.length} EncryptionMap record(s).`)
-    }
-
     const prefix = dryRun ? '[dry-run] ' : ''
     console.log(`\n${prefix}Decryption summary:`)
     console.log(`  Rows fetched:        ${totalRowsFetched}`)
@@ -1079,6 +1151,31 @@ const decryptDatabase: ModuleCli = {
           console.log(`    ${loc}: ${count}`)
         }
       }
+      failCli(
+        `${totalMalformedPayloadCount} field value(s) could not be decrypted because their ciphertext was malformed. Encryption maps were left active.`,
+      )
+    }
+
+    if (deactivateMaps && !dryRun) {
+      let deactivateSql = `UPDATE encryption_maps SET is_active = false, deleted_at = now() WHERE tenant_id = ? AND deleted_at IS NULL`
+      const deactivateParams: unknown[] = [tenantIdArg]
+      if (organizationIdArg) {
+        deactivateSql += ` AND (organization_id = ? OR organization_id IS NULL)`
+        deactivateParams.push(organizationIdArg)
+      }
+      if (entityIdArg) {
+        deactivateSql += ` AND entity_id = ?`
+        deactivateParams.push(entityIdArg)
+      }
+      await conn.execute(deactivateSql, deactivateParams)
+      console.warn('⚠ Restart all application replicas — in-process map caches may still be active.')
+      if (isTenantDataEncryptionEnabled()) {
+        console.warn('⚠ Env TENANT_DATA_ENCRYPTION is still true — new writes will be re-encrypted until env is updated and replicas restarted.')
+      }
+    }
+
+    if (deactivateMaps && dryRun) {
+      console.log(`[dry-run] Would deactivate ${maps.length} EncryptionMap record(s).`)
     }
 
     if (!dryRun) {