@open-mercato/core 0.6.8-develop.6998.1.d2bc46c56c → 0.6.8-develop.7001.1.03608ab252

package/dist/modules/warranty_claims/lib/externalIntake.js

@@ -0,0 +1,233 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import { isPotentialEncryptedPayload } from "./decryptionSafety.js";
+function isMissingTableError(err) {
+  if (typeof err !== "object" || err === null) return false;
+  const candidate = err;
+  return candidate.code === "42P01" || typeof candidate.message === "string" && candidate.message.includes("does not exist");
+}
+function createExternalIntakeDeps(em, translate, scope, encryption) {
+  const scrubEncryptedCustomerName = (row) => {
+    if (!isPotentialEncryptedPayload(row.display_name) && !isPotentialEncryptedPayload(row.displayName)) return row;
+    return { ...row, display_name: null, displayName: null };
+  };
+  const decryptCustomerRow = async (row) => {
+    if (!encryption) return scrubEncryptedCustomerName(row);
+    try {
+      const decrypted = await encryption.decryptEntityPayload("customers:customer_entity", row, scope.tenantId, scope.organizationId);
+      return scrubEncryptedCustomerName(decrypted);
+    } catch {
+      return { ...row, display_name: null, displayName: null };
+    }
+  };
+  const lookupRows = async (table, where, select, limit) => {
+    const db = em.getKysely();
+    try {
+      let query = db.selectFrom(table).select(select).where("tenant_id", "=", scope.tenantId).where("organization_id", "=", scope.organizationId).where("deleted_at", "is", null);
+      for (const [column, value] of Object.entries(where)) {
+        query = query.where(column, "=", value);
+      }
+      const rows = await query.limit(limit).execute();
+      if (table === "customer_entities") {
+        return Promise.all(rows.map((row) => decryptCustomerRow(row)));
+      }
+      return rows;
+    } catch (err) {
+      if (isMissingTableError(err)) return null;
+      throw err;
+    }
+  };
+  return { lookupRows, translate };
+}
+function asRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function readString(row, ...keys) {
+  for (const key of keys) {
+    const value = row[key];
+    if (typeof value === "string" && value.trim().length > 0) return value.trim();
+  }
+  return null;
+}
+function readDate(row, ...keys) {
+  for (const key of keys) {
+    const value = row[key];
+    if (value instanceof Date && !Number.isNaN(value.getTime())) return value;
+    if (typeof value === "string" || typeof value === "number") {
+      const parsed = new Date(value);
+      if (!Number.isNaN(parsed.getTime())) return parsed;
+    }
+  }
+  return null;
+}
+function dateOnly(value) {
+  return new Date(Date.UTC(value.getUTCFullYear(), value.getUTCMonth(), value.getUTCDate()));
+}
+function customerDisplayName(row) {
+  if (!row) return null;
+  return readString(row, "display_name", "displayName", "name");
+}
+function productDisplayName(row) {
+  if (!row) return null;
+  return readString(row, "title", "name", "display_name", "displayName");
+}
+async function lookupCustomer(deps, customerId) {
+  const rows = await deps.lookupRows("customer_entities", { id: customerId }, ["id", "display_name"], 1);
+  if (rows === null) return void 0;
+  return rows[0] ?? null;
+}
+function orderNotFound(deps) {
+  return new CrudHttpError(400, {
+    error: deps.translate("warranty_claims.errors.orderNotFound", "Order not found")
+  });
+}
+function customerOrderMismatch(deps) {
+  return new CrudHttpError(400, {
+    error: deps.translate("warranty_claims.errors.customerOrderMismatch", "Customer does not match the order")
+  });
+}
+function invalidCustomerReference(deps) {
+  return new CrudHttpError(400, {
+    error: deps.translate("warranty_claims.errors.invalidReference", "The referenced customer could not be found.")
+  });
+}
+async function resolveExternalReferences(deps, input) {
+  let orderId = null;
+  let orderCustomerId = null;
+  let currencyCode = null;
+  let orderPlacedAt = null;
+  if (input.orderId || input.orderNumber) {
+    const where = input.orderId ? { id: input.orderId } : { order_number: input.orderNumber };
+    const rows = await deps.lookupRows(
+      "sales_orders",
+      where,
+      ["id", "customer_entity_id", "currency_code", "placed_at", "order_number"],
+      1
+    );
+    const order = rows?.[0] ?? null;
+    if (!order) throw orderNotFound(deps);
+    orderId = readString(order, "id");
+    if (!orderId) throw orderNotFound(deps);
+    orderCustomerId = readString(order, "customer_entity_id", "customerEntityId");
+    currencyCode = readString(order, "currency_code", "currencyCode");
+    orderPlacedAt = readDate(order, "placed_at", "placedAt");
+  }
+  let customerId = orderCustomerId;
+  let customerName = null;
+  if (orderCustomerId && input.customerId && input.customerId !== orderCustomerId) {
+    throw customerOrderMismatch(deps);
+  }
+  if (!orderCustomerId && input.customerId) {
+    const customer = await lookupCustomer(deps, input.customerId);
+    if (!customer) throw invalidCustomerReference(deps);
+    customerId = input.customerId;
+    customerName = customerDisplayName(customer);
+  } else if (orderCustomerId) {
+    const customer = await lookupCustomer(deps, orderCustomerId);
+    customerName = customerDisplayName(customer ?? null);
+  }
+  if (!customerId) {
+    customerName = input.contactName ?? null;
+  }
+  return {
+    orderId,
+    customerId,
+    customerName,
+    currencyCode,
+    orderPlacedAt
+  };
+}
+async function resolveSkuProduct(deps, sku) {
+  const normalizedSku = sku.trim();
+  if (!normalizedSku) return null;
+  const rows = await deps.lookupRows("catalog_products", { sku: normalizedSku }, ["id", "title", "sku"], 2);
+  if (!rows || rows.length !== 1) return null;
+  const productId = readString(rows[0], "id");
+  if (!productId) return null;
+  return { productId, productName: productDisplayName(rows[0]) };
+}
+function buildExternalClaimCreateInput(input, resolution, settings, scope) {
+  const orderPurchaseDate = resolution.orderPlacedAt ? dateOnly(resolution.orderPlacedAt) : null;
+  return {
+    organizationId: scope.organizationId,
+    tenantId: scope.tenantId,
+    claimType: "warranty",
+    channel: "api",
+    priority: "normal",
+    externalRef: input.externalRef,
+    contactEmail: input.contactEmail ?? null,
+    customerId: resolution.customerId,
+    customerName: resolution.customerName,
+    orderId: resolution.orderId,
+    reasonCode: input.reasonCode ?? null,
+    notes: input.notes ?? null,
+    currencyCode: resolution.currencyCode,
+    lines: input.lines.map((line, index) => ({
+      lineNo: index + 1,
+      productId: line.productId ?? null,
+      variantId: null,
+      sku: line.sku ?? null,
+      productName: line.productName ?? null,
+      orderLineId: null,
+      serialNumber: line.serialNumber ?? null,
+      purchaseDate: line.purchaseDate ?? orderPurchaseDate,
+      warrantyMonths: line.warrantyMonths ?? settings.defaultWarrantyMonths,
+      faultCode: line.faultCode ?? null,
+      faultDescription: line.faultDescription,
+      qtyClaimed: line.qtyClaimed ?? 1
+    }))
+  };
+}
+async function createAndSubmitExternalClaim(input) {
+  let claimId;
+  try {
+    const createResult = await input.commandBus.execute("warranty_claims.claim.create", {
+      input: input.createInput,
+      ctx: input.commandCtx
+    });
+    const createdClaimId = createResult.result?.claimId;
+    if (typeof createdClaimId !== "string") throw input.saveFailedError();
+    claimId = createdClaimId;
+  } catch (err) {
+    if (!isUniqueViolation(err)) throw err;
+    const existing = await input.loadExistingByExternalRef(input.externalRef);
+    if (!existing) throw err;
+    if (existing.status === "draft") {
+      const scopedInput2 = { id: existing.id, organizationId: input.scope.organizationId, tenantId: input.scope.tenantId };
+      try {
+        await input.commandBus.execute("warranty_claims.claim.submit", { input: scopedInput2, ctx: input.commandCtx });
+      } catch (submitError) {
+        const refreshed = await input.loadExistingByExternalRef(input.externalRef);
+        if (!refreshed || refreshed.status === "draft") throw submitError;
+      }
+    }
+    return { outcome: "existing" };
+  }
+  const scopedInput = { id: claimId, organizationId: input.scope.organizationId, tenantId: input.scope.tenantId };
+  try {
+    await input.commandBus.execute("warranty_claims.claim.submit", { input: scopedInput, ctx: input.commandCtx });
+  } catch (submitError) {
+    await input.commandBus.execute("warranty_claims.claim.delete", { input: scopedInput, ctx: input.commandCtx }).catch(() => void 0);
+    throw submitError;
+  }
+  return { outcome: "created", claimId };
+}
+function isUniqueViolation(err) {
+  const visited = /* @__PURE__ */ new Set();
+  const inspect = (value, depth) => {
+    if (depth > 4 || !value || typeof value !== "object" || visited.has(value)) return false;
+    visited.add(value);
+    const record = asRecord(value);
+    if (record.code === "23505" || record.sqlState === "23505") return true;
+    return inspect(record.driverError, depth + 1) || inspect(record.cause, depth + 1) || inspect(record.originalError, depth + 1) || inspect(record.original, depth + 1) || inspect(record.parent, depth + 1);
+  };
+  return inspect(err, 0);
+}
+export {
+  buildExternalClaimCreateInput,
+  createAndSubmitExternalClaim,
+  createExternalIntakeDeps,
+  isUniqueViolation,
+  resolveExternalReferences,
+  resolveSkuProduct
+};
+//# sourceMappingURL=externalIntake.js.map

package/dist/modules/warranty_claims/lib/externalIntake.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/externalIntake.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { isPotentialEncryptedPayload } from './decryptionSafety'\nimport type { ClaimCreateInput, ExternalClaimIntakeInput } from '../data/validators'\n\ntype Translate = (key: string, fallback?: string) => string\n\nexport type ExternalLookupTable = 'sales_orders' | 'customer_entities' | 'catalog_products'\n\nexport type ExternalLookupRows = (\n  table: ExternalLookupTable,\n  where: Record<string, string>,\n  select: string[],\n  limit: number,\n) => Promise<Array<Record<string, unknown>> | null>\n\ntype ExternalIntakeDeps = {\n  lookupRows: ExternalLookupRows\n  translate: Translate\n}\n\ntype ExternalLookupDb = {\n  sales_orders: {\n    id: string\n    order_number: string\n    customer_entity_id: string | null\n    currency_code: string\n    placed_at: Date | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n  customer_entities: {\n    id: string\n    display_name: string | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n  catalog_products: {\n    id: string\n    title: string | null\n    sku: string | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n}\n\nfunction isMissingTableError(err: unknown): boolean {\n  if (typeof err !== 'object' || err === null) return false\n  const candidate = err as { code?: unknown; message?: unknown }\n  return candidate.code === '42P01'\n    || (typeof candidate.message === 'string' && candidate.message.includes('does not exist'))\n}\n\nexport function createExternalIntakeDeps(\n  em: EntityManager,\n  translate: Translate,\n  scope: { tenantId: string; organizationId: string },\n  encryption?: TenantDataEncryptionService | null,\n): ExternalIntakeDeps {\n  const scrubEncryptedCustomerName = (row: Record<string, unknown>): Record<string, unknown> => {\n    if (!isPotentialEncryptedPayload(row.display_name) && !isPotentialEncryptedPayload(row.displayName)) return row\n    return { ...row, display_name: null, displayName: null }\n  }\n  const decryptCustomerRow = async (row: Record<string, unknown>): Promise<Record<string, unknown>> => {\n    if (!encryption) return scrubEncryptedCustomerName(row)\n    try {\n      const decrypted = await encryption.decryptEntityPayload('customers:customer_entity', row, scope.tenantId, scope.organizationId)\n      return scrubEncryptedCustomerName(decrypted)\n    } catch {\n      return { ...row, display_name: null, displayName: null }\n    }\n  }\n  const lookupRows: ExternalLookupRows = async (table, where, select, limit) => {\n    const db = em.getKysely<ExternalLookupDb>()\n    try {\n      let query = db\n        .selectFrom(table)\n        .select(select as never[])\n        .where('tenant_id' as never, '=', scope.tenantId as never)\n        .where('organization_id' as never, '=', scope.organizationId as never)\n        .where('deleted_at' as never, 'is', null)\n      for (const [column, value] of Object.entries(where)) {\n        query = query.where(column as never, '=', value as never)\n      }\n      const rows = (await query.limit(limit).execute()) as Array<Record<string, unknown>>\n      if (table === 'customer_entities') {\n        return Promise.all(rows.map((row) => decryptCustomerRow(row)))\n      }\n      return rows\n    } catch (err) {\n      if (isMissingTableError(err)) return null\n      throw err\n    }\n  }\n  return { lookupRows, translate }\n}\n\ntype ExternalScope = {\n  tenantId: string\n  organizationId: string\n}\n\nexport type ExternalResolutionResult = {\n  orderId: string | null\n  customerId: string | null\n  customerName: string | null\n  currencyCode: string | null\n  orderPlacedAt: Date | null\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction readString(row: Record<string, unknown>, ...keys: string[]): string | null {\n  for (const key of keys) {\n    const value = row[key]\n    if (typeof value === 'string' && value.trim().length > 0) return value.trim()\n  }\n  return null\n}\n\nfunction readDate(row: Record<string, unknown>, ...keys: string[]): Date | null {\n  for (const key of keys) {\n    const value = row[key]\n    if (value instanceof Date && !Number.isNaN(value.getTime())) return value\n    if (typeof value === 'string' || typeof value === 'number') {\n      const parsed = new Date(value)\n      if (!Number.isNaN(parsed.getTime())) return parsed\n    }\n  }\n  return null\n}\n\nfunction dateOnly(value: Date): Date {\n  return new Date(Date.UTC(value.getUTCFullYear(), value.getUTCMonth(), value.getUTCDate()))\n}\n\nfunction customerDisplayName(row: Record<string, unknown> | null): string | null {\n  if (!row) return null\n  return readString(row, 'display_name', 'displayName', 'name')\n}\n\nfunction productDisplayName(row: Record<string, unknown> | null): string | null {\n  if (!row) return null\n  return readString(row, 'title', 'name', 'display_name', 'displayName')\n}\n\nasync function lookupCustomer(\n  deps: ExternalIntakeDeps,\n  customerId: string,\n): Promise<Record<string, unknown> | null | undefined> {\n  const rows = await deps.lookupRows('customer_entities', { id: customerId }, ['id', 'display_name'], 1)\n  if (rows === null) return undefined\n  return rows[0] ?? null\n}\n\nfunction orderNotFound(deps: ExternalIntakeDeps): CrudHttpError {\n  return new CrudHttpError(400, {\n    error: deps.translate('warranty_claims.errors.orderNotFound', 'Order not found'),\n  })\n}\n\nfunction customerOrderMismatch(deps: ExternalIntakeDeps): CrudHttpError {\n  return new CrudHttpError(400, {\n    error: deps.translate('warranty_claims.errors.customerOrderMismatch', 'Customer does not match the order'),\n  })\n}\n\nfunction invalidCustomerReference(deps: ExternalIntakeDeps): CrudHttpError {\n  return new CrudHttpError(400, {\n    error: deps.translate('warranty_claims.errors.invalidReference', 'The referenced customer could not be found.'),\n  })\n}\n\nexport async function resolveExternalReferences(\n  deps: ExternalIntakeDeps,\n  input: ExternalClaimIntakeInput,\n): Promise<ExternalResolutionResult> {\n  let orderId: string | null = null\n  let orderCustomerId: string | null = null\n  let currencyCode: string | null = null\n  let orderPlacedAt: Date | null = null\n\n  if (input.orderId || input.orderNumber) {\n    const where: Record<string, string> = input.orderId\n      ? { id: input.orderId }\n      : { order_number: input.orderNumber as string }\n    const rows = await deps.lookupRows(\n      'sales_orders',\n      where,\n      ['id', 'customer_entity_id', 'currency_code', 'placed_at', 'order_number'],\n      1,\n    )\n    const order = rows?.[0] ?? null\n    if (!order) throw orderNotFound(deps)\n    orderId = readString(order, 'id')\n    if (!orderId) throw orderNotFound(deps)\n    orderCustomerId = readString(order, 'customer_entity_id', 'customerEntityId')\n    currencyCode = readString(order, 'currency_code', 'currencyCode')\n    orderPlacedAt = readDate(order, 'placed_at', 'placedAt')\n  }\n\n  let customerId = orderCustomerId\n  let customerName: string | null = null\n\n  if (orderCustomerId && input.customerId && input.customerId !== orderCustomerId) {\n    throw customerOrderMismatch(deps)\n  }\n\n  if (!orderCustomerId && input.customerId) {\n    const customer = await lookupCustomer(deps, input.customerId)\n    if (!customer) throw invalidCustomerReference(deps)\n    customerId = input.customerId\n    customerName = customerDisplayName(customer)\n  } else if (orderCustomerId) {\n    const customer = await lookupCustomer(deps, orderCustomerId)\n    customerName = customerDisplayName(customer ?? null)\n  }\n\n  if (!customerId) {\n    customerName = input.contactName ?? null\n  }\n\n  return {\n    orderId,\n    customerId,\n    customerName,\n    currencyCode,\n    orderPlacedAt,\n  }\n}\n\nexport async function resolveSkuProduct(\n  deps: ExternalIntakeDeps,\n  sku: string,\n): Promise<{ productId: string; productName: string | null } | null> {\n  const normalizedSku = sku.trim()\n  if (!normalizedSku) return null\n  const rows = await deps.lookupRows('catalog_products', { sku: normalizedSku }, ['id', 'title', 'sku'], 2)\n  if (!rows || rows.length !== 1) return null\n  const productId = readString(rows[0], 'id')\n  if (!productId) return null\n  return { productId, productName: productDisplayName(rows[0]) }\n}\n\nexport function buildExternalClaimCreateInput(\n  input: ExternalClaimIntakeInput,\n  resolution: ExternalResolutionResult,\n  settings: { defaultWarrantyMonths: number | null },\n  scope: ExternalScope,\n): ClaimCreateInput {\n  const orderPurchaseDate = resolution.orderPlacedAt ? dateOnly(resolution.orderPlacedAt) : null\n  return {\n    organizationId: scope.organizationId,\n    tenantId: scope.tenantId,\n    claimType: 'warranty',\n    channel: 'api',\n    priority: 'normal',\n    externalRef: input.externalRef,\n    contactEmail: input.contactEmail ?? null,\n    customerId: resolution.customerId,\n    customerName: resolution.customerName,\n    orderId: resolution.orderId,\n    reasonCode: input.reasonCode ?? null,\n    notes: input.notes ?? null,\n    currencyCode: resolution.currencyCode,\n    lines: input.lines.map((line, index) => ({\n      lineNo: index + 1,\n      productId: line.productId ?? null,\n      variantId: null,\n      sku: line.sku ?? null,\n      productName: line.productName ?? null,\n      orderLineId: null,\n      serialNumber: line.serialNumber ?? null,\n      purchaseDate: line.purchaseDate ?? orderPurchaseDate,\n      warrantyMonths: line.warrantyMonths ?? settings.defaultWarrantyMonths,\n      faultCode: line.faultCode ?? null,\n      faultDescription: line.faultDescription,\n      qtyClaimed: line.qtyClaimed ?? 1,\n    })),\n  }\n}\n\n\nexport type ExternalIntakeCommandBus = {\n  execute: (commandId: string, args: { input: unknown; ctx: unknown }) => Promise<{ result?: unknown }>\n}\n\nexport type ExternalIntakeExecution =\n  | { outcome: 'created'; claimId: string }\n  | { outcome: 'existing' }\n\ntype ExistingExternalClaim = {\n  id: string\n  status: string\n}\n\nexport async function createAndSubmitExternalClaim(input: {\n  commandBus: ExternalIntakeCommandBus\n  commandCtx: unknown\n  createInput: ClaimCreateInput\n  scope: ExternalScope\n  externalRef: string\n  loadExistingByExternalRef: (externalRef: string) => Promise<ExistingExternalClaim | null>\n  saveFailedError: () => Error\n}): Promise<ExternalIntakeExecution> {\n  let claimId: string\n  try {\n    const createResult = await input.commandBus.execute('warranty_claims.claim.create', {\n      input: input.createInput,\n      ctx: input.commandCtx,\n    })\n    const createdClaimId = (createResult.result as { claimId?: unknown } | undefined)?.claimId\n    if (typeof createdClaimId !== 'string') throw input.saveFailedError()\n    claimId = createdClaimId\n  } catch (err) {\n    if (!isUniqueViolation(err)) throw err\n    const existing = await input.loadExistingByExternalRef(input.externalRef)\n    if (!existing) throw err\n    if (existing.status === 'draft') {\n      const scopedInput = { id: existing.id, organizationId: input.scope.organizationId, tenantId: input.scope.tenantId }\n      try {\n        await input.commandBus.execute('warranty_claims.claim.submit', { input: scopedInput, ctx: input.commandCtx })\n      } catch (submitError) {\n        const refreshed = await input.loadExistingByExternalRef(input.externalRef)\n        if (!refreshed || refreshed.status === 'draft') throw submitError\n      }\n    }\n    return { outcome: 'existing' }\n  }\n  const scopedInput = { id: claimId, organizationId: input.scope.organizationId, tenantId: input.scope.tenantId }\n  try {\n    await input.commandBus.execute('warranty_claims.claim.submit', { input: scopedInput, ctx: input.commandCtx })\n  } catch (submitError) {\n    await input.commandBus\n      .execute('warranty_claims.claim.delete', { input: scopedInput, ctx: input.commandCtx })\n      .catch(() => undefined)\n    throw submitError\n  }\n  return { outcome: 'created', claimId }\n}\n\nexport function isUniqueViolation(err: unknown): boolean {\n  const visited = new Set<unknown>()\n  const inspect = (value: unknown, depth: number): boolean => {\n    if (depth > 4 || !value || typeof value !== 'object' || visited.has(value)) return false\n    visited.add(value)\n    const record = asRecord(value)\n    if (record.code === '23505' || record.sqlState === '23505') return true\n    return inspect(record.driverError, depth + 1)\n      || inspect(record.cause, depth + 1)\n      || inspect(record.originalError, depth + 1)\n      || inspect(record.original, depth + 1)\n      || inspect(record.parent, depth + 1)\n  }\n  return inspect(err, 0)\n}\n"],
+  "mappings": "AACA,SAAS,qBAAqB;AAE9B,SAAS,mCAAmC;AA+C5C,SAAS,oBAAoB,KAAuB;AAClD,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,YAAY;AAClB,SAAO,UAAU,SAAS,WACpB,OAAO,UAAU,YAAY,YAAY,UAAU,QAAQ,SAAS,gBAAgB;AAC5F;AAEO,SAAS,yBACd,IACA,WACA,OACA,YACoB;AACpB,QAAM,6BAA6B,CAAC,QAA0D;AAC5F,QAAI,CAAC,4BAA4B,IAAI,YAAY,KAAK,CAAC,4BAA4B,IAAI,WAAW,EAAG,QAAO;AAC5G,WAAO,EAAE,GAAG,KAAK,cAAc,MAAM,aAAa,KAAK;AAAA,EACzD;AACA,QAAM,qBAAqB,OAAO,QAAmE;AACnG,QAAI,CAAC,WAAY,QAAO,2BAA2B,GAAG;AACtD,QAAI;AACF,YAAM,YAAY,MAAM,WAAW,qBAAqB,6BAA6B,KAAK,MAAM,UAAU,MAAM,cAAc;AAC9H,aAAO,2BAA2B,SAAS;AAAA,IAC7C,QAAQ;AACN,aAAO,EAAE,GAAG,KAAK,cAAc,MAAM,aAAa,KAAK;AAAA,IACzD;AAAA,EACF;AACA,QAAM,aAAiC,OAAO,OAAO,OAAO,QAAQ,UAAU;AAC5E,UAAM,KAAK,GAAG,UAA4B;AAC1C,QAAI;AACF,UAAI,QAAQ,GACT,WAAW,KAAK,EAChB,OAAO,MAAiB,EACxB,MAAM,aAAsB,KAAK,MAAM,QAAiB,EACxD,MAAM,mBAA4B,KAAK,MAAM,cAAuB,EACpE,MAAM,cAAuB,MAAM,IAAI;AAC1C,iBAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,KAAK,GAAG;AACnD,gBAAQ,MAAM,MAAM,QAAiB,KAAK,KAAc;AAAA,MAC1D;AACA,YAAM,OAAQ,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ;AAC/C,UAAI,UAAU,qBAAqB;AACjC,eAAO,QAAQ,IAAI,KAAK,IAAI,CAAC,QAAQ,mBAAmB,GAAG,CAAC,CAAC;AAAA,MAC/D;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,UAAI,oBAAoB,GAAG,EAAG,QAAO;AACrC,YAAM;AAAA,IACR;AAAA,EACF;AACA,SAAO,EAAE,YAAY,UAAU;AACjC;AAeA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,WAAW,QAAiC,MAA+B;AAClF,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,EAAG,QAAO,MAAM,KAAK;AAAA,EAC9E;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAiC,MAA6B;AAC9E,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,iBAAiB,QAAQ,CAAC,OAAO,MAAM,MAAM,QAAQ,CAAC,EAAG,QAAO;AACpE,QAAI,OAAO,UAAU,YAAY,OAAO,UAAU,UAAU;AAC1D,YAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,UAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,IAC9C;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,OAAmB;AACnC,SAAO,IAAI,KAAK,KAAK,IAAI,MAAM,eAAe,GAAG,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,CAAC;AAC3F;AAEA,SAAS,oBAAoB,KAAoD;AAC/E,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,WAAW,KAAK,gBAAgB,eAAe,MAAM;AAC9D;AAEA,SAAS,mBAAmB,KAAoD;AAC9E,MAAI,CAAC,IAAK,QAAO;AACjB,SAAO,WAAW,KAAK,SAAS,QAAQ,gBAAgB,aAAa;AACvE;AAEA,eAAe,eACb,MACA,YACqD;AACrD,QAAM,OAAO,MAAM,KAAK,WAAW,qBAAqB,EAAE,IAAI,WAAW,GAAG,CAAC,MAAM,cAAc,GAAG,CAAC;AACrG,MAAI,SAAS,KAAM,QAAO;AAC1B,SAAO,KAAK,CAAC,KAAK;AACpB;AAEA,SAAS,cAAc,MAAyC;AAC9D,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,KAAK,UAAU,wCAAwC,iBAAiB;AAAA,EACjF,CAAC;AACH;AAEA,SAAS,sBAAsB,MAAyC;AACtE,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,KAAK,UAAU,gDAAgD,mCAAmC;AAAA,EAC3G,CAAC;AACH;AAEA,SAAS,yBAAyB,MAAyC;AACzE,SAAO,IAAI,cAAc,KAAK;AAAA,IAC5B,OAAO,KAAK,UAAU,2CAA2C,6CAA6C;AAAA,EAChH,CAAC;AACH;AAEA,eAAsB,0BACpB,MACA,OACmC;AACnC,MAAI,UAAyB;AAC7B,MAAI,kBAAiC;AACrC,MAAI,eAA8B;AAClC,MAAI,gBAA6B;AAEjC,MAAI,MAAM,WAAW,MAAM,aAAa;AACtC,UAAM,QAAgC,MAAM,UACxC,EAAE,IAAI,MAAM,QAAQ,IACpB,EAAE,cAAc,MAAM,YAAsB;AAChD,UAAM,OAAO,MAAM,KAAK;AAAA,MACtB;AAAA,MACA;AAAA,MACA,CAAC,MAAM,sBAAsB,iBAAiB,aAAa,cAAc;AAAA,MACzE;AAAA,IACF;AACA,UAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAI,CAAC,MAAO,OAAM,cAAc,IAAI;AACpC,cAAU,WAAW,OAAO,IAAI;AAChC,QAAI,CAAC,QAAS,OAAM,cAAc,IAAI;AACtC,sBAAkB,WAAW,OAAO,sBAAsB,kBAAkB;AAC5E,mBAAe,WAAW,OAAO,iBAAiB,cAAc;AAChE,oBAAgB,SAAS,OAAO,aAAa,UAAU;AAAA,EACzD;AAEA,MAAI,aAAa;AACjB,MAAI,eAA8B;AAElC,MAAI,mBAAmB,MAAM,cAAc,MAAM,eAAe,iBAAiB;AAC/E,UAAM,sBAAsB,IAAI;AAAA,EAClC;AAEA,MAAI,CAAC,mBAAmB,MAAM,YAAY;AACxC,UAAM,WAAW,MAAM,eAAe,MAAM,MAAM,UAAU;AAC5D,QAAI,CAAC,SAAU,OAAM,yBAAyB,IAAI;AAClD,iBAAa,MAAM;AACnB,mBAAe,oBAAoB,QAAQ;AAAA,EAC7C,WAAW,iBAAiB;AAC1B,UAAM,WAAW,MAAM,eAAe,MAAM,eAAe;AAC3D,mBAAe,oBAAoB,YAAY,IAAI;AAAA,EACrD;AAEA,MAAI,CAAC,YAAY;AACf,mBAAe,MAAM,eAAe;AAAA,EACtC;AAEA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,MACA,KACmE;AACnE,QAAM,gBAAgB,IAAI,KAAK;AAC/B,MAAI,CAAC,cAAe,QAAO;AAC3B,QAAM,OAAO,MAAM,KAAK,WAAW,oBAAoB,EAAE,KAAK,cAAc,GAAG,CAAC,MAAM,SAAS,KAAK,GAAG,CAAC;AACxG,MAAI,CAAC,QAAQ,KAAK,WAAW,EAAG,QAAO;AACvC,QAAM,YAAY,WAAW,KAAK,CAAC,GAAG,IAAI;AAC1C,MAAI,CAAC,UAAW,QAAO;AACvB,SAAO,EAAE,WAAW,aAAa,mBAAmB,KAAK,CAAC,CAAC,EAAE;AAC/D;AAEO,SAAS,8BACd,OACA,YACA,UACA,OACkB;AAClB,QAAM,oBAAoB,WAAW,gBAAgB,SAAS,WAAW,aAAa,IAAI;AAC1F,SAAO;AAAA,IACL,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,cAAc,MAAM,gBAAgB;AAAA,IACpC,YAAY,WAAW;AAAA,IACvB,cAAc,WAAW;AAAA,IACzB,SAAS,WAAW;AAAA,IACpB,YAAY,MAAM,cAAc;AAAA,IAChC,OAAO,MAAM,SAAS;AAAA,IACtB,cAAc,WAAW;AAAA,IACzB,OAAO,MAAM,MAAM,IAAI,CAAC,MAAM,WAAW;AAAA,MACvC,QAAQ,QAAQ;AAAA,MAChB,WAAW,KAAK,aAAa;AAAA,MAC7B,WAAW;AAAA,MACX,KAAK,KAAK,OAAO;AAAA,MACjB,aAAa,KAAK,eAAe;AAAA,MACjC,aAAa;AAAA,MACb,cAAc,KAAK,gBAAgB;AAAA,MACnC,cAAc,KAAK,gBAAgB;AAAA,MACnC,gBAAgB,KAAK,kBAAkB,SAAS;AAAA,MAChD,WAAW,KAAK,aAAa;AAAA,MAC7B,kBAAkB,KAAK;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA,IACjC,EAAE;AAAA,EACJ;AACF;AAgBA,eAAsB,6BAA6B,OAQd;AACnC,MAAI;AACJ,MAAI;AACF,UAAM,eAAe,MAAM,MAAM,WAAW,QAAQ,gCAAgC;AAAA,MAClF,OAAO,MAAM;AAAA,MACb,KAAK,MAAM;AAAA,IACb,CAAC;AACD,UAAM,iBAAkB,aAAa,QAA8C;AACnF,QAAI,OAAO,mBAAmB,SAAU,OAAM,MAAM,gBAAgB;AACpE,cAAU;AAAA,EACZ,SAAS,KAAK;AACZ,QAAI,CAAC,kBAAkB,GAAG,EAAG,OAAM;AACnC,UAAM,WAAW,MAAM,MAAM,0BAA0B,MAAM,WAAW;AACxE,QAAI,CAAC,SAAU,OAAM;AACrB,QAAI,SAAS,WAAW,SAAS;AAC/B,YAAMA,eAAc,EAAE,IAAI,SAAS,IAAI,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,MAAM,MAAM,SAAS;AAClH,UAAI;AACF,cAAM,MAAM,WAAW,QAAQ,gCAAgC,EAAE,OAAOA,cAAa,KAAK,MAAM,WAAW,CAAC;AAAA,MAC9G,SAAS,aAAa;AACpB,cAAM,YAAY,MAAM,MAAM,0BAA0B,MAAM,WAAW;AACzE,YAAI,CAAC,aAAa,UAAU,WAAW,QAAS,OAAM;AAAA,MACxD;AAAA,IACF;AACA,WAAO,EAAE,SAAS,WAAW;AAAA,EAC/B;AACA,QAAM,cAAc,EAAE,IAAI,SAAS,gBAAgB,MAAM,MAAM,gBAAgB,UAAU,MAAM,MAAM,SAAS;AAC9G,MAAI;AACF,UAAM,MAAM,WAAW,QAAQ,gCAAgC,EAAE,OAAO,aAAa,KAAK,MAAM,WAAW,CAAC;AAAA,EAC9G,SAAS,aAAa;AACpB,UAAM,MAAM,WACT,QAAQ,gCAAgC,EAAE,OAAO,aAAa,KAAK,MAAM,WAAW,CAAC,EACrF,MAAM,MAAM,MAAS;AACxB,UAAM;AAAA,EACR;AACA,SAAO,EAAE,SAAS,WAAW,QAAQ;AACvC;AAEO,SAAS,kBAAkB,KAAuB;AACvD,QAAM,UAAU,oBAAI,IAAa;AACjC,QAAM,UAAU,CAAC,OAAgB,UAA2B;AAC1D,QAAI,QAAQ,KAAK,CAAC,SAAS,OAAO,UAAU,YAAY,QAAQ,IAAI,KAAK,EAAG,QAAO;AACnF,YAAQ,IAAI,KAAK;AACjB,UAAM,SAAS,SAAS,KAAK;AAC7B,QAAI,OAAO,SAAS,WAAW,OAAO,aAAa,QAAS,QAAO;AACnE,WAAO,QAAQ,OAAO,aAAa,QAAQ,CAAC,KACvC,QAAQ,OAAO,OAAO,QAAQ,CAAC,KAC/B,QAAQ,OAAO,eAAe,QAAQ,CAAC,KACvC,QAAQ,OAAO,UAAU,QAAQ,CAAC,KAClC,QAAQ,OAAO,QAAQ,QAAQ,CAAC;AAAA,EACvC;AACA,SAAO,QAAQ,KAAK,CAAC;AACvB;",
+  "names": ["scopedInput"]
+}

package/dist/modules/warranty_claims/lib/grading.js

@@ -0,0 +1,21 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+function isRestockableGrade(grade) {
+  return grade === "A" || grade === "B";
+}
+function assertDispositionAllowedForGrade(grade, disposition) {
+  if (disposition === "restock" && (grade === "C" || grade === "D")) {
+    throw new CrudHttpError(400, { error: "warranty_claims.errors.dispositionGradeConflict" });
+  }
+}
+function suggestedDispositionForGrade(grade) {
+  if (grade === "A") return "restock";
+  if (grade === "B") return "repair";
+  if (grade === "C" || grade === "D") return "scrap";
+  return null;
+}
+export {
+  assertDispositionAllowedForGrade,
+  isRestockableGrade,
+  suggestedDispositionForGrade
+};
+//# sourceMappingURL=grading.js.map

package/dist/modules/warranty_claims/lib/grading.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/grading.ts"],
+  "sourcesContent": ["import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nexport type ConditionGrade = 'A' | 'B' | 'C' | 'D'\n\nexport function isRestockableGrade(grade: ConditionGrade | null | undefined): boolean {\n  return grade === 'A' || grade === 'B'\n}\n\nexport function assertDispositionAllowedForGrade(\n  grade: ConditionGrade | null | undefined,\n  disposition: string | null | undefined,\n): void {\n  if (disposition === 'restock' && (grade === 'C' || grade === 'D')) {\n    throw new CrudHttpError(400, { error: 'warranty_claims.errors.dispositionGradeConflict' })\n  }\n}\n\nexport function suggestedDispositionForGrade(grade: ConditionGrade | null | undefined): string | null {\n  if (grade === 'A') return 'restock'\n  if (grade === 'B') return 'repair'\n  if (grade === 'C' || grade === 'D') return 'scrap'\n  return null\n}\n"],
+  "mappings": "AAAA,SAAS,qBAAqB;AAIvB,SAAS,mBAAmB,OAAmD;AACpF,SAAO,UAAU,OAAO,UAAU;AACpC;AAEO,SAAS,iCACd,OACA,aACM;AACN,MAAI,gBAAgB,cAAc,UAAU,OAAO,UAAU,MAAM;AACjE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,kDAAkD,CAAC;AAAA,EAC3F;AACF;AAEO,SAAS,6BAA6B,OAAyD;AACpG,MAAI,UAAU,IAAK,QAAO;AAC1B,MAAI,UAAU,IAAK,QAAO;AAC1B,MAAI,UAAU,OAAO,UAAU,IAAK,QAAO;AAC3C,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/listSegments.js

@@ -0,0 +1,18 @@
+function vendorPolicySegmentQuery(segment) {
+  if (segment === "active") return { isActive: "true" };
+  if (segment === "inactive") return { isActive: "false" };
+  if (segment === "automatic") return { autoGenerateRecovery: "true" };
+  if (segment === "manual") return { autoGenerateRecovery: "false" };
+  return {};
+}
+function portalClaimStatusesForStateGroup(group) {
+  if (group === "open") {
+    return ["draft", "submitted", "in_review", "info_requested", "approved", "awaiting_return", "received", "inspecting"];
+  }
+  return ["resolved", "closed", "rejected", "cancelled"];
+}
+export {
+  portalClaimStatusesForStateGroup,
+  vendorPolicySegmentQuery
+};
+//# sourceMappingURL=listSegments.js.map

package/dist/modules/warranty_claims/lib/listSegments.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/listSegments.ts"],
+  "sourcesContent": ["import type { WarrantyClaimStatus } from '../data/validators'\n\nexport type VendorPolicySegment = 'all' | 'active' | 'automatic' | 'manual' | 'inactive'\nexport type PortalClaimStateGroup = 'open' | 'resolved'\n\nexport function vendorPolicySegmentQuery(segment: VendorPolicySegment): Record<string, string> {\n  if (segment === 'active') return { isActive: 'true' }\n  if (segment === 'inactive') return { isActive: 'false' }\n  if (segment === 'automatic') return { autoGenerateRecovery: 'true' }\n  if (segment === 'manual') return { autoGenerateRecovery: 'false' }\n  return {}\n}\n\nexport function portalClaimStatusesForStateGroup(group: PortalClaimStateGroup): WarrantyClaimStatus[] {\n  if (group === 'open') {\n    return ['draft', 'submitted', 'in_review', 'info_requested', 'approved', 'awaiting_return', 'received', 'inspecting']\n  }\n  return ['resolved', 'closed', 'rejected', 'cancelled']\n}\n"],
+  "mappings": "AAKO,SAAS,yBAAyB,SAAsD;AAC7F,MAAI,YAAY,SAAU,QAAO,EAAE,UAAU,OAAO;AACpD,MAAI,YAAY,WAAY,QAAO,EAAE,UAAU,QAAQ;AACvD,MAAI,YAAY,YAAa,QAAO,EAAE,sBAAsB,OAAO;AACnE,MAAI,YAAY,SAAU,QAAO,EAAE,sBAAsB,QAAQ;AACjE,SAAO,CAAC;AACV;AAEO,SAAS,iCAAiC,OAAqD;AACpG,MAAI,UAAU,QAAQ;AACpB,WAAO,CAAC,SAAS,aAAa,aAAa,kBAAkB,YAAY,mBAAmB,YAAY,YAAY;AAAA,EACtH;AACA,SAAO,CAAC,YAAY,UAAU,YAAY,WAAW;AACvD;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/orderOwnership.js

@@ -0,0 +1,25 @@
+import { CrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+function isMissingSalesOrdersTableError(err) {
+  if (typeof err !== "object" || err === null) return false;
+  const candidate = err;
+  return candidate.code === "42P01" || typeof candidate.message === "string" && candidate.message.includes("does not exist");
+}
+async function assertOrderBelongsToCustomer(em, scope, orderId, customerId) {
+  if (!orderId || !customerId) return;
+  const db = em.fork().getKysely();
+  let row;
+  try {
+    row = await db.selectFrom("sales_orders").select("customer_entity_id").where("id", "=", orderId).where("tenant_id", "=", scope.tenantId).where("organization_id", "=", scope.organizationId).where("deleted_at", "is", null).executeTakeFirst();
+  } catch (err) {
+    if (isMissingSalesOrdersTableError(err)) return;
+    throw err;
+  }
+  if (!row) return;
+  if (row.customer_entity_id && row.customer_entity_id !== customerId) {
+    throw new CrudHttpError(400, { error: "warranty_claims.errors.customerOrderMismatch" });
+  }
+}
+export {
+  assertOrderBelongsToCustomer
+};
+//# sourceMappingURL=orderOwnership.js.map

package/dist/modules/warranty_claims/lib/orderOwnership.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/orderOwnership.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\ntype SalesOrderOwnershipDb = {\n  sales_orders: {\n    id: string\n    customer_entity_id: string | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n}\n\nexport type OrderOwnershipScope = { tenantId: string; organizationId: string }\n\nfunction isMissingSalesOrdersTableError(err: unknown): boolean {\n  if (typeof err !== 'object' || err === null) return false\n  const candidate = err as { code?: unknown; message?: unknown }\n  return candidate.code === '42P01'\n    || (typeof candidate.message === 'string' && candidate.message.includes('does not exist'))\n}\n\n/**\n * Cross-customer integrity guard shared by staff claim writes and registrations.\n *\n * When a record references both a customer and a sales order, the order MUST belong to\n * that customer. Skips silently when either side is absent, when the sales module/table\n * is not present, or when the referenced order carries no customer \u2014 those cases cannot\n * prove a mismatch. Throws only on a definite mismatch (both non-null and different),\n * which is the leak reproduced in UI QA (WQA-001 / REG-03).\n */\nexport async function assertOrderBelongsToCustomer(\n  em: EntityManager,\n  scope: OrderOwnershipScope,\n  orderId: string | null | undefined,\n  customerId: string | null | undefined,\n): Promise<void> {\n  if (!orderId || !customerId) return\n  const db = em.fork().getKysely<SalesOrderOwnershipDb>()\n  let row: { customer_entity_id: string | null } | undefined\n  try {\n    row = await db\n      .selectFrom('sales_orders')\n      .select('customer_entity_id')\n      .where('id', '=', orderId)\n      .where('tenant_id', '=', scope.tenantId)\n      .where('organization_id', '=', scope.organizationId)\n      .where('deleted_at', 'is', null)\n      .executeTakeFirst()\n  } catch (err) {\n    if (isMissingSalesOrdersTableError(err)) return\n    throw err\n  }\n  if (!row) return\n  if (row.customer_entity_id && row.customer_entity_id !== customerId) {\n    throw new CrudHttpError(400, { error: 'warranty_claims.errors.customerOrderMismatch' })\n  }\n}\n"],
+  "mappings": "AACA,SAAS,qBAAqB;AAc9B,SAAS,+BAA+B,KAAuB;AAC7D,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,YAAY;AAClB,SAAO,UAAU,SAAS,WACpB,OAAO,UAAU,YAAY,YAAY,UAAU,QAAQ,SAAS,gBAAgB;AAC5F;AAWA,eAAsB,6BACpB,IACA,OACA,SACA,YACe;AACf,MAAI,CAAC,WAAW,CAAC,WAAY;AAC7B,QAAM,KAAK,GAAG,KAAK,EAAE,UAAiC;AACtD,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,GACT,WAAW,cAAc,EACzB,OAAO,oBAAoB,EAC3B,MAAM,MAAM,KAAK,OAAO,EACxB,MAAM,aAAa,KAAK,MAAM,QAAQ,EACtC,MAAM,mBAAmB,KAAK,MAAM,cAAc,EAClD,MAAM,cAAc,MAAM,IAAI,EAC9B,iBAAiB;AAAA,EACtB,SAAS,KAAK;AACZ,QAAI,+BAA+B,GAAG,EAAG;AACzC,UAAM;AAAA,EACR;AACA,MAAI,CAAC,IAAK;AACV,MAAI,IAAI,sBAAsB,IAAI,uBAAuB,YAAY;AACnE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,+CAA+C,CAAC;AAAA,EACxF;AACF;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/portalAttachmentUpload.js

@@ -0,0 +1,11 @@
+function resolvePortalAttachmentUploadService(container) {
+  try {
+    return container.resolve("attachmentScopedUploadService") ?? null;
+  } catch {
+    return null;
+  }
+}
+export {
+  resolvePortalAttachmentUploadService
+};
+//# sourceMappingURL=portalAttachmentUpload.js.map

package/dist/modules/warranty_claims/lib/portalAttachmentUpload.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/portalAttachmentUpload.ts"],
+  "sourcesContent": ["import type { ScopedAttachmentUploadService } from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'\n\nexport function resolvePortalAttachmentUploadService(\n  container: { resolve: <T = unknown>(name: string) => T },\n): ScopedAttachmentUploadService | null {\n  try {\n    return container.resolve<ScopedAttachmentUploadService>('attachmentScopedUploadService') ?? null\n  } catch {\n    return null\n  }\n}\n"],
+  "mappings": "AAEO,SAAS,qCACd,WACsC;AACtC,MAAI;AACF,WAAO,UAAU,QAAuC,+BAA+B,KAAK;AAAA,EAC9F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/portalAttachmentValidation.js

@@ -0,0 +1,108 @@
+const DEFAULT_ATTACHMENT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024;
+const ATTACHMENT_ACCEPT_TYPES = [
+  ".avif",
+  ".bmp",
+  ".csv",
+  ".docx",
+  ".gif",
+  ".jpeg",
+  ".jpg",
+  ".json",
+  ".md",
+  ".pdf",
+  ".png",
+  ".pptx",
+  ".txt",
+  ".webp",
+  ".xlsx",
+  ".zip",
+  "application/json",
+  "application/pdf",
+  "application/vnd.openxmlformats-officedocument.presentationml.presentation",
+  "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet",
+  "application/vnd.openxmlformats-officedocument.wordprocessingml.document",
+  "application/zip",
+  "image/avif",
+  "image/bmp",
+  "image/gif",
+  "image/jpeg",
+  "image/png",
+  "image/webp",
+  "text/csv",
+  "text/markdown",
+  "text/plain"
+].join(",");
+const BLOCKED_ATTACHMENT_MIME_TYPES = /* @__PURE__ */ new Set([
+  "application/xhtml+xml",
+  "application/xml",
+  "image/svg+xml",
+  "text/html",
+  "text/xml"
+]);
+const ACTIVE_CONTENT_ATTACHMENT_EXTENSIONS = /* @__PURE__ */ new Set([
+  "htm",
+  "html",
+  "svg",
+  "xhtml",
+  "xml"
+]);
+const DANGEROUS_EXECUTABLE_EXTENSIONS = /* @__PURE__ */ new Set([
+  "app",
+  "apk",
+  "bat",
+  "cmd",
+  "com",
+  "dll",
+  "exe",
+  "hta",
+  "htm",
+  "html",
+  "jar",
+  "js",
+  "jse",
+  "lnk",
+  "msi",
+  "pif",
+  "ps1",
+  "psm1",
+  "reg",
+  "scr",
+  "sh",
+  "vbe",
+  "vbs",
+  "wsf",
+  "wsh"
+]);
+function getFileExtensionSegments(fileName) {
+  const parts = fileName.trim().split(".").filter(Boolean);
+  if (parts.length < 2) return [];
+  return parts.slice(1).map((part) => part.toLowerCase().replace(/[^a-z0-9]/g, "")).filter(Boolean);
+}
+async function fileLooksLikeActiveContent(file) {
+  try {
+    const sniff = (await file.slice(0, 512).text()).trimStart().toLowerCase();
+    return sniff.startsWith("<svg") || sniff.startsWith("<?xml") || sniff.startsWith("<!doctype html") || sniff.startsWith("<html");
+  } catch {
+    return false;
+  }
+}
+async function validateAttachmentFile(file, t) {
+  if (file.size > DEFAULT_ATTACHMENT_MAX_UPLOAD_BYTES) {
+    return t("attachments.errors.maxUploadSize");
+  }
+  const extensionSegments = getFileExtensionSegments(file.name);
+  const mimeType = file.type.trim().toLowerCase();
+  if (extensionSegments.some((extension) => DANGEROUS_EXECUTABLE_EXTENSIONS.has(extension))) {
+    return t("attachments.errors.dangerousExecutable");
+  }
+  if (extensionSegments.some((extension) => ACTIVE_CONTENT_ATTACHMENT_EXTENSIONS.has(extension)) || mimeType && BLOCKED_ATTACHMENT_MIME_TYPES.has(mimeType) || await fileLooksLikeActiveContent(file)) {
+    return t("attachments.errors.activeContentBlocked");
+  }
+  return null;
+}
+export {
+  ATTACHMENT_ACCEPT_TYPES,
+  DEFAULT_ATTACHMENT_MAX_UPLOAD_BYTES,
+  validateAttachmentFile
+};
+//# sourceMappingURL=portalAttachmentValidation.js.map

package/dist/modules/warranty_claims/lib/portalAttachmentValidation.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/portalAttachmentValidation.ts"],
+  "sourcesContent": ["import type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'\n\nexport const DEFAULT_ATTACHMENT_MAX_UPLOAD_BYTES = 25 * 1024 * 1024\n\nexport const ATTACHMENT_ACCEPT_TYPES = [\n  '.avif',\n  '.bmp',\n  '.csv',\n  '.docx',\n  '.gif',\n  '.jpeg',\n  '.jpg',\n  '.json',\n  '.md',\n  '.pdf',\n  '.png',\n  '.pptx',\n  '.txt',\n  '.webp',\n  '.xlsx',\n  '.zip',\n  'application/json',\n  'application/pdf',\n  'application/vnd.openxmlformats-officedocument.presentationml.presentation',\n  'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',\n  'application/vnd.openxmlformats-officedocument.wordprocessingml.document',\n  'application/zip',\n  'image/avif',\n  'image/bmp',\n  'image/gif',\n  'image/jpeg',\n  'image/png',\n  'image/webp',\n  'text/csv',\n  'text/markdown',\n  'text/plain',\n].join(',')\n\nconst BLOCKED_ATTACHMENT_MIME_TYPES = new Set([\n  'application/xhtml+xml',\n  'application/xml',\n  'image/svg+xml',\n  'text/html',\n  'text/xml',\n])\n\nconst ACTIVE_CONTENT_ATTACHMENT_EXTENSIONS = new Set([\n  'htm',\n  'html',\n  'svg',\n  'xhtml',\n  'xml',\n])\n\nconst DANGEROUS_EXECUTABLE_EXTENSIONS = new Set([\n  'app',\n  'apk',\n  'bat',\n  'cmd',\n  'com',\n  'dll',\n  'exe',\n  'hta',\n  'htm',\n  'html',\n  'jar',\n  'js',\n  'jse',\n  'lnk',\n  'msi',\n  'pif',\n  'ps1',\n  'psm1',\n  'reg',\n  'scr',\n  'sh',\n  'vbe',\n  'vbs',\n  'wsf',\n  'wsh',\n])\n\nfunction getFileExtensionSegments(fileName: string): string[] {\n  const parts = fileName.trim().split('.').filter(Boolean)\n  if (parts.length < 2) return []\n  return parts.slice(1).map((part) => part.toLowerCase().replace(/[^a-z0-9]/g, '')).filter(Boolean)\n}\n\nasync function fileLooksLikeActiveContent(file: File): Promise<boolean> {\n  try {\n    const sniff = (await file.slice(0, 512).text()).trimStart().toLowerCase()\n    return sniff.startsWith('<svg') || sniff.startsWith('<?xml') || sniff.startsWith('<!doctype html') || sniff.startsWith('<html')\n  } catch {\n    return false\n  }\n}\n\nexport async function validateAttachmentFile(file: File, t: TranslateFn): Promise<string | null> {\n  if (file.size > DEFAULT_ATTACHMENT_MAX_UPLOAD_BYTES) {\n    return t('attachments.errors.maxUploadSize')\n  }\n  const extensionSegments = getFileExtensionSegments(file.name)\n  const mimeType = file.type.trim().toLowerCase()\n  if (extensionSegments.some((extension) => DANGEROUS_EXECUTABLE_EXTENSIONS.has(extension))) {\n    return t('attachments.errors.dangerousExecutable')\n  }\n  if (\n    extensionSegments.some((extension) => ACTIVE_CONTENT_ATTACHMENT_EXTENSIONS.has(extension)) ||\n    (mimeType && BLOCKED_ATTACHMENT_MIME_TYPES.has(mimeType)) ||\n    await fileLooksLikeActiveContent(file)\n  ) {\n    return t('attachments.errors.activeContentBlocked')\n  }\n  return null\n}\n"],
+  "mappings": "AAEO,MAAM,sCAAsC,KAAK,OAAO;AAExD,MAAM,0BAA0B;AAAA,EACrC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,EAAE,KAAK,GAAG;AAEV,MAAM,gCAAgC,oBAAI,IAAI;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,uCAAuC,oBAAI,IAAI;AAAA,EACnD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,kCAAkC,oBAAI,IAAI;AAAA,EAC9C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,SAAS,yBAAyB,UAA4B;AAC5D,QAAM,QAAQ,SAAS,KAAK,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO;AACvD,MAAI,MAAM,SAAS,EAAG,QAAO,CAAC;AAC9B,SAAO,MAAM,MAAM,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,EAAE,QAAQ,cAAc,EAAE,CAAC,EAAE,OAAO,OAAO;AAClG;AAEA,eAAe,2BAA2B,MAA8B;AACtE,MAAI;AACF,UAAM,SAAS,MAAM,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,GAAG,UAAU,EAAE,YAAY;AACxE,WAAO,MAAM,WAAW,MAAM,KAAK,MAAM,WAAW,OAAO,KAAK,MAAM,WAAW,gBAAgB,KAAK,MAAM,WAAW,OAAO;AAAA,EAChI,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,uBAAuB,MAAY,GAAwC;AAC/F,MAAI,KAAK,OAAO,qCAAqC;AACnD,WAAO,EAAE,kCAAkC;AAAA,EAC7C;AACA,QAAM,oBAAoB,yBAAyB,KAAK,IAAI;AAC5D,QAAM,WAAW,KAAK,KAAK,KAAK,EAAE,YAAY;AAC9C,MAAI,kBAAkB,KAAK,CAAC,cAAc,gCAAgC,IAAI,SAAS,CAAC,GAAG;AACzF,WAAO,EAAE,wCAAwC;AAAA,EACnD;AACA,MACE,kBAAkB,KAAK,CAAC,cAAc,qCAAqC,IAAI,SAAS,CAAC,KACxF,YAAY,8BAA8B,IAAI,QAAQ,KACvD,MAAM,2BAA2B,IAAI,GACrC;AACA,WAAO,EAAE,yCAAyC;AAAA,EACpD;AACA,SAAO;AACT;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/portalClaimAccess.js

@@ -0,0 +1,26 @@
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { WarrantyClaim } from "../data/entities.js";
+function buildPortalOwnedClaimWhere(scope, extra = {}) {
+  return {
+    ...extra,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    customerId: scope.customerId,
+    claimType: { $ne: "vendor_recovery" },
+    deletedAt: null
+  };
+}
+async function loadPortalOwnedClaim(em, scope, claimId) {
+  return findOneWithDecryption(
+    em,
+    WarrantyClaim,
+    buildPortalOwnedClaimWhere(scope, { id: claimId }),
+    {},
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  );
+}
+export {
+  buildPortalOwnedClaimWhere,
+  loadPortalOwnedClaim
+};
+//# sourceMappingURL=portalClaimAccess.js.map

package/dist/modules/warranty_claims/lib/portalClaimAccess.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/portalClaimAccess.ts"],
+  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { WarrantyClaim } from '../data/entities'\n\nexport type PortalClaimOwnerScope = {\n  tenantId: string\n  organizationId: string\n  customerId: string\n}\n\nexport function buildPortalOwnedClaimWhere(\n  scope: PortalClaimOwnerScope,\n  extra: Record<string, unknown> = {},\n): Record<string, unknown> & FilterQuery<WarrantyClaim> {\n  return {\n    ...extra,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    customerId: scope.customerId,\n    claimType: { $ne: 'vendor_recovery' },\n    deletedAt: null,\n  } as Record<string, unknown> & FilterQuery<WarrantyClaim>\n}\n\nexport async function loadPortalOwnedClaim(\n  em: EntityManager,\n  scope: PortalClaimOwnerScope,\n  claimId: string,\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    buildPortalOwnedClaimWhere(scope, { id: claimId }),\n    {},\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n}\n"],
+  "mappings": "AACA,SAAS,6BAA6B;AACtC,SAAS,qBAAqB;AAQvB,SAAS,2BACd,OACA,QAAiC,CAAC,GACoB;AACtD,SAAO;AAAA,IACL,GAAG;AAAA,IACH,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,YAAY,MAAM;AAAA,IAClB,WAAW,EAAE,KAAK,kBAAkB;AAAA,IACpC,WAAW;AAAA,EACb;AACF;AAEA,eAAsB,qBACpB,IACA,OACA,SAC+B;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,2BAA2B,OAAO,EAAE,IAAI,QAAQ,CAAC;AAAA,IACjD,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACF;",
+  "names": []
+}

package/dist/modules/warranty_claims/lib/quantity.js

@@ -0,0 +1,19 @@
+function parseQuantity(value) {
+  if (value === null || value === void 0) return null;
+  const parsed = typeof value === "number" ? value : value.trim().length ? Number(value) : Number.NaN;
+  return Number.isFinite(parsed) ? parsed : null;
+}
+function formatQuantity(value, fallback) {
+  const parsed = parseQuantity(value);
+  return parsed === null ? fallback : parsed.toLocaleString(void 0, { maximumFractionDigits: 4 });
+}
+function quantityInputValue(value) {
+  const parsed = parseQuantity(value);
+  return parsed === null ? "" : String(parsed);
+}
+export {
+  formatQuantity,
+  parseQuantity,
+  quantityInputValue
+};
+//# sourceMappingURL=quantity.js.map

package/dist/modules/warranty_claims/lib/quantity.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/warranty_claims/lib/quantity.ts"],
+  "sourcesContent": ["export function parseQuantity(value: string | number | null | undefined): number | null {\n  if (value === null || value === undefined) return null\n  const parsed = typeof value === 'number' ? value : value.trim().length ? Number(value) : Number.NaN\n  return Number.isFinite(parsed) ? parsed : null\n}\n\nexport function formatQuantity(value: string | number | null | undefined, fallback: string): string {\n  const parsed = parseQuantity(value)\n  return parsed === null ? fallback : parsed.toLocaleString(undefined, { maximumFractionDigits: 4 })\n}\n\nexport function quantityInputValue(value: string | number | null | undefined): string {\n  const parsed = parseQuantity(value)\n  return parsed === null ? '' : String(parsed)\n}\n"],
+  "mappings": "AAAO,SAAS,cAAc,OAA0D;AACtF,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,QAAM,SAAS,OAAO,UAAU,WAAW,QAAQ,MAAM,KAAK,EAAE,SAAS,OAAO,KAAK,IAAI,OAAO;AAChG,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEO,SAAS,eAAe,OAA2C,UAA0B;AAClG,QAAM,SAAS,cAAc,KAAK;AAClC,SAAO,WAAW,OAAO,WAAW,OAAO,eAAe,QAAW,EAAE,uBAAuB,EAAE,CAAC;AACnG;AAEO,SAAS,mBAAmB,OAAmD;AACpF,QAAM,SAAS,cAAc,KAAK;AAClC,SAAO,WAAW,OAAO,KAAK,OAAO,MAAM;AAC7C;",
+  "names": []
+}