@open-mercato/core 0.6.8-develop.7051.1.2e20648fd5 → 0.6.8-develop.7056.1.1a563a270d

package/dist/modules/messages/lib/channel-sender-identity.js

@@ -0,0 +1,26 @@
+const NON_EMAIL_SENDER_CHANNEL_TYPES = /* @__PURE__ */ new Set([
+  "discord",
+  "slack",
+  "teams",
+  "telegram",
+  "signal",
+  "whatsapp",
+  "messenger",
+  "instagram",
+  "sms",
+  "push"
+]);
+function channelTypeRequiresExternalEmail(channelType) {
+  if (typeof channelType !== "string") return true;
+  const normalized = channelType.trim().toLowerCase();
+  if (!normalized) return true;
+  return !NON_EMAIL_SENDER_CHANNEL_TYPES.has(normalized);
+}
+function listNonEmailSenderChannelTypes() {
+  return Array.from(NON_EMAIL_SENDER_CHANNEL_TYPES).sort((left, right) => left.localeCompare(right));
+}
+export {
+  channelTypeRequiresExternalEmail,
+  listNonEmailSenderChannelTypes
+};
+//# sourceMappingURL=channel-sender-identity.js.map

package/dist/modules/messages/lib/channel-sender-identity.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/messages/lib/channel-sender-identity.ts"],
+  "sourcesContent": ["/**\n * How the hub decides whether an external correspondent must be identified by an\n * email address.\n *\n * Background (#4975): `composeMessageSchema` used to require `externalEmail` for\n * every non-draft message with `visibility: 'public'` \u2014 which is every message\n * from an external sender. That assumption holds only for email-typed channels.\n * A Discord sender is a snowflake and has no address at all, so inbound Discord\n * failed validation deterministically and the ingest job died in the queue while\n * the channel still reported `Connected`.\n *\n * Variant A of the spec's \u00A7 Open decision \u2014 hub sender-identity contract makes\n * the requirement conditional on the originating channel type, and **fails\n * closed**: only a channel type this list positively recognizes as non-email\n * waives the requirement. An unrecognized, empty or absent channel type keeps\n * the pre-existing behaviour, so no current caller changes and a typo'd or\n * caller-asserted type cannot quietly switch a validation rule off.\n *\n * For these channels the sender identity is not lost \u2014 it is carried by\n * `ExternalMessage.sender_identifier` and joined 1:1 to the platform message\n * through `MessageChannelLink`.\n *\n * Adding a channel type here is additive and non-breaking: it only widens the\n * set of inputs the hub accepts.\n */\nconst NON_EMAIL_SENDER_CHANNEL_TYPES = new Set([\n  'discord',\n  'slack',\n  'teams',\n  'telegram',\n  'signal',\n  'whatsapp',\n  'messenger',\n  'instagram',\n  'sms',\n  'push',\n])\n\n/**\n * True when a message originating from `channelType` must carry an\n * `externalEmail` to be composed with `visibility: 'public'`.\n *\n * Fail-closed by design \u2014 see the note above.\n */\nexport function channelTypeRequiresExternalEmail(channelType?: string | null): boolean {\n  if (typeof channelType !== 'string') return true\n  const normalized = channelType.trim().toLowerCase()\n  if (!normalized) return true\n  return !NON_EMAIL_SENDER_CHANNEL_TYPES.has(normalized)\n}\n\n/** The recognized non-email channel types, for tests and diagnostics. */\nexport function listNonEmailSenderChannelTypes(): string[] {\n  return Array.from(NON_EMAIL_SENDER_CHANNEL_TYPES).sort((left, right) => left.localeCompare(right))\n}\n"],
+  "mappings": "AAyBA,MAAM,iCAAiC,oBAAI,IAAI;AAAA,EAC7C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAQM,SAAS,iCAAiC,aAAsC;AACrF,MAAI,OAAO,gBAAgB,SAAU,QAAO;AAC5C,QAAM,aAAa,YAAY,KAAK,EAAE,YAAY;AAClD,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,CAAC,+BAA+B,IAAI,UAAU;AACvD;AAGO,SAAS,iCAA2C;AACzD,SAAO,MAAM,KAAK,8BAA8B,EAAE,KAAK,CAAC,MAAM,UAAU,KAAK,cAAc,KAAK,CAAC;AACnG;",
+  "names": []
+}

package/dist/modules/messages/lib/composeSourceChannelType.js

@@ -0,0 +1,41 @@
+import { z } from "zod";
+const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = "communication_channels.external_conversation";
+const composeSourceHintSchema = z.object({
+  sourceEntityType: z.string().optional(),
+  sourceEntityId: z.string().uuid().optional(),
+  parentMessageId: z.string().uuid().optional()
+});
+function composeRequiresChannelTypeResolution(body) {
+  if (!body || typeof body !== "object") return false;
+  const raw = body;
+  if (raw.visibility !== "public") return false;
+  if (raw.isDraft === true) return false;
+  const externalEmail = raw.externalEmail;
+  return !(typeof externalEmail === "string" && externalEmail.trim().length > 0);
+}
+function tryResolveChannelTypeService(container) {
+  try {
+    return container.resolve("communicationChannelsResolveChannelType");
+  } catch {
+    return void 0;
+  }
+}
+async function resolveComposeSourceChannelType(container, scope, hint) {
+  const externalConversationId = hint.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE ? hint.sourceEntityId ?? null : null;
+  const messageId = hint.parentMessageId ?? null;
+  if (!externalConversationId && !messageId) return void 0;
+  const resolveChannelType = tryResolveChannelTypeService(container);
+  if (!resolveChannelType) return void 0;
+  const channelType = await resolveChannelType(container, scope, {
+    externalConversationId,
+    messageId
+  });
+  return channelType ?? void 0;
+}
+export {
+  EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE,
+  composeRequiresChannelTypeResolution,
+  composeSourceHintSchema,
+  resolveComposeSourceChannelType
+};
+//# sourceMappingURL=composeSourceChannelType.js.map

package/dist/modules/messages/lib/composeSourceChannelType.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/messages/lib/composeSourceChannelType.ts"],
+  "sourcesContent": ["import { z } from 'zod'\n\n/**\n * Entity type a channel-backed conversation is exposed under on a message's\n * `sourceEntityType`. Written by `communication_channels`' inbound ingest.\n */\nconst EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'\n\n/**\n * The only parts of a compose body this resolution needs. Read defensively from\n * the raw request body, before the body is validated, because the validation\n * outcome itself depends on the answer (#4975).\n */\nexport const composeSourceHintSchema = z.object({\n  sourceEntityType: z.string().optional(),\n  sourceEntityId: z.string().uuid().optional(),\n  parentMessageId: z.string().uuid().optional(),\n})\n\nexport type ComposeSourceHint = z.infer<typeof composeSourceHintSchema>\n\n/**\n * Whether the compose validator can consult a resolved channel type at all.\n *\n * `sourceChannelType` is read in exactly one branch \u2014 a non-draft, public\n * message that carries no address. Every internal reply, every draft and every\n * public message that already supplies an address ignores it, so resolving it\n * for them is a DI resolve plus a database round-trip whose answer is\n * discarded. Mirrors `refineComposeMessage` and reads the raw body defensively,\n * because this runs before validation. Skipping resolution yields `undefined`,\n * which is already the fail-closed value.\n */\nexport function composeRequiresChannelTypeResolution(body: unknown): boolean {\n  if (!body || typeof body !== 'object') return false\n  const raw = body as Record<string, unknown>\n  if (raw.visibility !== 'public') return false\n  if (raw.isDraft === true) return false\n  const externalEmail = raw.externalEmail\n  return !(typeof externalEmail === 'string' && externalEmail.trim().length > 0)\n}\n\ntype ResolveChannelTypeService = (\n  container: ContainerLike,\n  scope: { tenantId: string; organizationId: string | null },\n  reference: { externalConversationId?: string | null; messageId?: string | null },\n) => Promise<string | null>\n\ntype ContainerLike = { resolve: <T = unknown>(name: string) => T }\n\nfunction tryResolveChannelTypeService(\n  container: ContainerLike,\n): ResolveChannelTypeService | undefined {\n  try {\n    return container.resolve<ResolveChannelTypeService>('communicationChannelsResolveChannelType')\n  } catch {\n    // `communication_channels` is optional: without it no message can originate\n    // from a channel, so \"unknown\" is both correct and fail-closed.\n    return undefined\n  }\n}\n\n/**\n * Resolve the channel type a compose request originates from, server-side.\n *\n * Never derived from the request body's own `sourceChannelType` \u2014 that would let\n * any caller waive the `externalEmail` requirement by asserting a channel type.\n * It is looked up from the conversation the message is being composed on, or\n * from the parent message it replies to.\n *\n * Returns `undefined` when nothing can be established, which the compose\n * validator treats as \"unknown\" and therefore keeps the pre-#4975 rule.\n */\nexport async function resolveComposeSourceChannelType(\n  container: ContainerLike,\n  scope: { tenantId: string; organizationId: string | null },\n  hint: ComposeSourceHint,\n): Promise<string | undefined> {\n  const externalConversationId =\n    hint.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE\n      ? hint.sourceEntityId ?? null\n      : null\n  const messageId = hint.parentMessageId ?? null\n  if (!externalConversationId && !messageId) return undefined\n\n  const resolveChannelType = tryResolveChannelTypeService(container)\n  if (!resolveChannelType) return undefined\n\n  const channelType = await resolveChannelType(container, scope, {\n    externalConversationId,\n    messageId,\n  })\n  return channelType ?? undefined\n}\n\nexport { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE }\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAMlB,MAAM,2CAA2C;AAO1C,MAAM,0BAA0B,EAAE,OAAO;AAAA,EAC9C,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC9C,CAAC;AAeM,SAAS,qCAAqC,MAAwB;AAC3E,MAAI,CAAC,QAAQ,OAAO,SAAS,SAAU,QAAO;AAC9C,QAAM,MAAM;AACZ,MAAI,IAAI,eAAe,SAAU,QAAO;AACxC,MAAI,IAAI,YAAY,KAAM,QAAO;AACjC,QAAM,gBAAgB,IAAI;AAC1B,SAAO,EAAE,OAAO,kBAAkB,YAAY,cAAc,KAAK,EAAE,SAAS;AAC9E;AAUA,SAAS,6BACP,WACuC;AACvC,MAAI;AACF,WAAO,UAAU,QAAmC,yCAAyC;AAAA,EAC/F,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAaA,eAAsB,gCACpB,WACA,OACA,MAC6B;AAC7B,QAAM,yBACJ,KAAK,qBAAqB,2CACtB,KAAK,kBAAkB,OACvB;AACN,QAAM,YAAY,KAAK,mBAAmB;AAC1C,MAAI,CAAC,0BAA0B,CAAC,UAAW,QAAO;AAElD,QAAM,qBAAqB,6BAA6B,SAAS;AACjE,MAAI,CAAC,mBAAoB,QAAO;AAEhC,QAAM,cAAc,MAAM,mBAAmB,WAAW,OAAO;AAAA,IAC7D;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO,eAAe;AACxB;",
+  "names": []
+}

package/dist/modules/warranty_claims/api/assignees/route.js

@@ -31,12 +31,12 @@ function parseRequestedIds(raw) {
   return [...deduped].slice(0, MAX_ASSIGNEE_LOOKUP_IDS);
 }
 async function GET(req) {
+  const { translate } = await resolveTranslations();
   try {
     const url = new URL(req.url);
     const parsedQuery = querySchema.parse(Object.fromEntries(url.searchParams));
     const container = await createRequestContainer();
     const auth = await getAuthFromRequest(req);
-    const { translate } = await resolveTranslations();
     if (!auth || !auth.tenantId) {
       throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
     }
@@ -63,10 +63,10 @@ async function GET(req) {
       return NextResponse.json(error.body, { status: error.status });
     }
     if (error instanceof z.ZodError) {
-      return NextResponse.json({ error: "warranty_claims.errors.invalidInput" }, { status: 400 });
+      return NextResponse.json({ error: translate("warranty_claims.errors.invalidInput", "Invalid input") }, { status: 400 });
     }
     logger.error("[warranty_claims] Failed to resolve assignee display names", { error });
-    return NextResponse.json({ error: "warranty_claims.errors.load_failed" }, { status: 500 });
+    return NextResponse.json({ error: translate("warranty_claims.errors.load_failed", "Failed to load warranty claim data.") }, { status: 500 });
   }
 }
 const openApi = {

package/dist/modules/warranty_claims/api/assignees/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/assignees/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveAssigneeDisplayNames } from '../../lib/assigneeNames'\n\nconst logger = createLogger('warranty_claims')\n\nexport const MAX_ASSIGNEE_LOOKUP_IDS = 100\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nconst querySchema = z.object({\n  ids: z.string().min(1),\n}).strict()\n\nconst responseSchema = z.object({\n  items: z.array(z.object({\n    id: z.string(),\n    name: z.string().nullable(),\n  })),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nexport function parseRequestedIds(raw: string): string[] {\n  const deduped = new Set<string>()\n  for (const value of parseCommaSeparatedList(raw)) {\n    if (UUID_REGEX.test(value)) deduped.add(value)\n  }\n  return [...deduped].slice(0, MAX_ASSIGNEE_LOOKUP_IDS)\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    const parsedQuery = querySchema.parse(Object.fromEntries(url.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    const { translate } = await resolveTranslations()\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope.tenantId ?? auth.tenantId\n    if (!tenantId) {\n      throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const requestedIds = parseRequestedIds(parsedQuery.ids)\n    if (!requestedIds.length) return NextResponse.json({ items: [] })\n\n    const displayNames = await resolveAssigneeDisplayNames({\n      container,\n      tenantId,\n      organizationId: scope.selectedId,\n      organizationIds: scope.filterIds,\n    }, requestedIds)\n    const items = requestedIds.flatMap((id) => {\n      const name = displayNames.get(id)\n      return name ? [{ id, name }] : []\n    })\n    return NextResponse.json({ items })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })\n    }\n    logger.error('[warranty_claims] Failed to resolve assignee display names', { error })\n    return NextResponse.json({ error: 'warranty_claims.errors.load_failed' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim assignee display names',\n  methods: {\n    GET: {\n      summary: 'Resolve assignee user ids to display names',\n      description: `Resolves up to ${MAX_ASSIGNEE_LOOKUP_IDS} explicitly supplied user ids to their display name, scoped to the caller's tenant and selected or visible organizations. Requires \\`ids\\`; it cannot enumerate the user directory, and it returns neither role assignments nor organization membership.`,\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Assignee display names',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,mCAAmC;AAE5C,MAAM,SAAS,aAAa,iBAAiB;AAEtC,MAAM,0BAA0B;AAEvC,MAAM,aAAa;AAEnB,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAEV,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,IACtB,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,CAAC;AACJ,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEO,SAAS,kBAAkB,KAAuB;AACvD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,wBAAwB,GAAG,GAAG;AAChD,QAAI,WAAW,KAAK,KAAK,EAAG,SAAQ,IAAI,KAAK;AAAA,EAC/C;AACA,SAAO,CAAC,GAAG,OAAO,EAAE,MAAM,GAAG,uBAAuB;AACtD;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAC1E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,MAAM,YAAY,KAAK;AACxC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,eAAe,kBAAkB,YAAY,GAAG;AACtD,QAAI,CAAC,aAAa,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAEhE,UAAM,eAAe,MAAM,4BAA4B;AAAA,MACrD;AAAA,MACA;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,iBAAiB,MAAM;AAAA,IACzB,GAAG,YAAY;AACf,UAAM,QAAQ,aAAa,QAAQ,CAAC,OAAO;AACzC,YAAM,OAAO,aAAa,IAAI,EAAE;AAChC,aAAO,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,IAClC,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AACA,WAAO,MAAM,8DAA8D,EAAE,MAAM,CAAC;AACpF,WAAO,aAAa,KAAK,EAAE,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa,kBAAkB,uBAAuB;AAAA,MACtD,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveAssigneeDisplayNames } from '../../lib/assigneeNames'\n\nconst logger = createLogger('warranty_claims')\n\nexport const MAX_ASSIGNEE_LOOKUP_IDS = 100\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nconst querySchema = z.object({\n  ids: z.string().min(1),\n}).strict()\n\nconst responseSchema = z.object({\n  items: z.array(z.object({\n    id: z.string(),\n    name: z.string().nullable(),\n  })),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nexport function parseRequestedIds(raw: string): string[] {\n  const deduped = new Set<string>()\n  for (const value of parseCommaSeparatedList(raw)) {\n    if (UUID_REGEX.test(value)) deduped.add(value)\n  }\n  return [...deduped].slice(0, MAX_ASSIGNEE_LOOKUP_IDS)\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const url = new URL(req.url)\n    const parsedQuery = querySchema.parse(Object.fromEntries(url.searchParams))\n    const container = await createRequestContainer()\n    const auth = await getAuthFromRequest(req)\n    if (!auth || !auth.tenantId) {\n      throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n    const tenantId = scope.tenantId ?? auth.tenantId\n    if (!tenantId) {\n      throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n    }\n\n    const requestedIds = parseRequestedIds(parsedQuery.ids)\n    if (!requestedIds.length) return NextResponse.json({ items: [] })\n\n    const displayNames = await resolveAssigneeDisplayNames({\n      container,\n      tenantId,\n      organizationId: scope.selectedId,\n      organizationIds: scope.filterIds,\n    }, requestedIds)\n    const items = requestedIds.flatMap((id) => {\n      const name = displayNames.get(id)\n      return name ? [{ id, name }] : []\n    })\n    return NextResponse.json({ items })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('[warranty_claims] Failed to resolve assignee display names', { error })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim assignee display names',\n  methods: {\n    GET: {\n      summary: 'Resolve assignee user ids to display names',\n      description: `Resolves up to ${MAX_ASSIGNEE_LOOKUP_IDS} explicitly supplied user ids to their display name, scoped to the caller's tenant and selected or visible organizations. Requires \\`ids\\`; it cannot enumerate the user directory, and it returns neither role assignments nor organization membership.`,\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Assignee display names',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe,uBAAuB;AAC/C,SAAS,2BAA2B;AACpC,SAAS,+BAA+B;AAExC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,mCAAmC;AAE5C,MAAM,SAAS,aAAa,iBAAiB;AAEtC,MAAM,0BAA0B;AAEvC,MAAM,aAAa;AAEnB,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC;AACvB,CAAC,EAAE,OAAO;AAEV,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,OAAO,EAAE,MAAM,EAAE,OAAO;AAAA,IACtB,IAAI,EAAE,OAAO;AAAA,IACb,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,CAAC,CAAC;AACJ,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEO,SAAS,kBAAkB,KAAuB;AACvD,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,wBAAwB,GAAG,GAAG;AAChD,QAAI,WAAW,KAAK,KAAK,EAAG,SAAQ,IAAI,KAAK;AAAA,EAC/C;AACA,SAAO,CAAC,GAAG,OAAO,EAAE,MAAM,GAAG,uBAAuB;AACtD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,cAAc,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AAC1E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,UAAM,WAAW,MAAM,YAAY,KAAK;AACxC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,IAC1G;AAEA,UAAM,eAAe,kBAAkB,YAAY,GAAG;AACtD,QAAI,CAAC,aAAa,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,CAAC,EAAE,CAAC;AAEhE,UAAM,eAAe,MAAM,4BAA4B;AAAA,MACrD;AAAA,MACA;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,iBAAiB,MAAM;AAAA,IACzB,GAAG,YAAY;AACf,UAAM,QAAQ,aAAa,QAAQ,CAAC,OAAO;AACzC,YAAM,OAAO,aAAa,IAAI,EAAE;AAChC,aAAO,OAAO,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC;AAAA,IAClC,CAAC;AACD,WAAO,aAAa,KAAK,EAAE,MAAM,CAAC;AAAA,EACpC,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,8DAA8D,EAAE,MAAM,CAAC;AACpF,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,qCAAqC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa,kBAAkB,uBAAuB;AAAA,MACtD,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/portal/claims/route.js

@@ -99,12 +99,13 @@ function serializePortalClaim(claim, lines) {
   };
 }
 async function resolvePortalContext(req) {
+  const { translate } = await resolveTranslations();
   const auth = await getCustomerAuthFromRequest(req);
   if (!auth) {
-    return NextResponse.json({ ok: false, error: "warranty_claims.errors.unauthorized" }, { status: 401 });
+    return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.unauthorized", "Unauthorized") }, { status: 401 });
   }
   if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: "warranty_claims.errors.customerAccountNotLinked" }, { status: 403 });
+    return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.customerAccountNotLinked", "Customer account is not linked to a customer record") }, { status: 403 });
   }
   const container = await createRequestContainer();
   const em = container.resolve("em");
@@ -161,6 +162,7 @@ async function loadOwnedOrderLines(context, orderLineIds) {
   }
 }
 async function validatePortalOrderOwnership(context, input) {
+  const { translate } = await resolveTranslations();
   const orderLineIds = Array.from(new Set(input.lines.flatMap((line) => line.orderLineId ? [line.orderLineId] : [])));
   const orderLinesById = await loadOwnedOrderLines(context, orderLineIds);
   const orderIds = /* @__PURE__ */ new Set();
@@ -170,7 +172,7 @@ async function validatePortalOrderOwnership(context, input) {
   let resolvedOrder = input.orderId ? ordersById.get(input.orderId) ?? null : null;
   if (input.orderId) {
     if (!resolvedOrder) {
-      return NextResponse.json({ ok: false, error: "warranty_claims.errors.orderNotOwned" }, { status: 404 });
+      return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.orderNotOwned", "Order not found.") }, { status: 404 });
     }
   }
   for (const line of input.lines) {
@@ -178,10 +180,9 @@ async function validatePortalOrderOwnership(context, input) {
     const resolvedLine = orderLinesById.get(line.orderLineId);
     const lineOrder = resolvedLine ? ordersById.get(resolvedLine.orderId) : null;
     if (!resolvedLine || !lineOrder) {
-      return NextResponse.json({ ok: false, error: "warranty_claims.errors.orderLineMismatch" }, { status: 404 });
+      return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.orderLineMismatch", "Order line does not belong to the selected order") }, { status: 404 });
     }
     if (resolvedOrder && lineOrder.id !== resolvedOrder.id) {
-      const { translate } = await resolveTranslations();
       return NextResponse.json(
         { ok: false, error: translate("warranty_claims.errors.orderLineMismatch", "Order line does not belong to the selected order") },
         { status: 400 }
@@ -226,7 +227,8 @@ async function GET(req) {
     serialNumber: url.searchParams.get("serialNumber") ?? void 0
   });
   if (!query.success) {
-    return NextResponse.json({ ok: false, error: "warranty_claims.errors.invalidInput" }, { status: 400 });
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.invalidInput", "Invalid input") }, { status: 400 });
   }
   const { page, pageSize, search, status, stateGroup, serialNumber } = query.data;
   const where = buildPortalOwnedClaimWhere(context);
@@ -301,15 +303,16 @@ async function POST(req) {
   const contextOrResponse = await resolvePortalContext(req);
   if (contextOrResponse instanceof Response) return contextOrResponse;
   const context = contextOrResponse;
+  const { translate } = await resolveTranslations();
   let body;
   try {
     body = await req.json();
   } catch {
-    return NextResponse.json({ ok: false, error: "warranty_claims.errors.invalidInput" }, { status: 400 });
+    return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.invalidInput", "Invalid input") }, { status: 400 });
   }
   const parsed = portalIntakeInputSchema.safeParse(body);
   if (!parsed.success) {
-    return NextResponse.json({ ok: false, error: "warranty_claims.errors.invalidInput" }, { status: 400 });
+    return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.invalidInput", "Invalid input") }, { status: 400 });
   }
   const ownership = await validatePortalOrderOwnership(context, parsed.data);
   if (ownership instanceof Response) return ownership;
@@ -368,7 +371,7 @@ async function POST(req) {
     );
     const claimId = createResult.result?.claimId;
     if (typeof claimId !== "string") {
-      return NextResponse.json({ ok: false, error: "warranty_claims.errors.save_failed" }, { status: 500 });
+      return NextResponse.json({ ok: false, error: translate("warranty_claims.errors.save_failed", "Failed to save warranty claim.") }, { status: 500 });
     }
     try {
       await commandBus.execute(

package/dist/modules/warranty_claims/api/portal/claims/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/warranty_claims/api/portal/claims/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaim, WarrantyClaimLine } from '../../../data/entities'\nimport {\n  claimStatusSchema,\n  portalIntakeInputSchema,\n  type ClaimCreateInput,\n  type PortalIntakeInput,\n} from '../../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'\nimport { portalClaimStatusesForStateGroup } from '../../../lib/listSegments'\nimport { buildPortalOwnedClaimWhere } from '../../../lib/portalClaimAccess'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  POST: { requireAuth: false },\n}\n\nconst logger = createLogger('warranty_claims')\n\nconst emptyQueryValueToUndefined = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length ? trimmed : undefined\n}\n\nconst optionalTrimmedQueryString = (max: number) =>\n  z.preprocess(emptyQueryValueToUndefined, z.string().trim().min(1).max(max).optional())\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: optionalTrimmedQueryString(190),\n  status: z.preprocess(emptyQueryValueToUndefined, claimStatusSchema.optional()),\n  stateGroup: z.enum(['open', 'resolved']).optional(),\n  serialNumber: optionalTrimmedQueryString(191),\n})\n\ntype PortalContext = {\n  auth: CustomerAuthContext\n  customerId: string\n  tenantId: string\n  organizationId: string\n  em: EntityManager\n  commandCtx: CommandRuntimeContext\n}\n\ntype LineSummary = {\n  count: number\n  creditTotal: string\n  statuses: Record<string, number>\n}\n\ntype OrderValidationResult = {\n  orderId: string | null\n  currencyCode: string | null\n}\n\ntype PortalOrderLookup = {\n  id: string\n  currencyCode: string | null\n}\n\ntype PortalOrderLineLookup = {\n  id: string\n  orderId: string\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction stringField(record: Record<string, unknown>, key: string): string | null {\n  const value = record[key]\n  return typeof value === 'string' ? value : null\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  if (value instanceof Date) return value.toISOString()\n  const date = new Date(value)\n  return Number.isNaN(date.getTime()) ? value : date.toISOString()\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value\n  const record = toRecord(value)\n  return typeof record.id === 'string' ? record.id : null\n}\n\nconst CREDIT_SCALE = 10_000n\n\nfunction decimalUnits(value: unknown): bigint {\n  const normalized = typeof value === 'number'\n    ? (Number.isFinite(value) ? value.toFixed(4) : '')\n    : typeof value === 'string' ? value.trim() : ''\n  const match = /^([+-]?)(\\d+)(?:\\.(\\d+))?$/.exec(normalized)\n  if (!match) return 0n\n  const [, sign, whole, fraction = ''] = match\n  let units = BigInt(whole) * CREDIT_SCALE + BigInt(fraction.slice(0, 4).padEnd(4, '0'))\n  if (fraction.length > 4 && fraction[4] >= '5') units += 1n\n  return sign === '-' ? -units : units\n}\n\nfunction decimalString(value: bigint): string {\n  const sign = value < 0n ? '-' : ''\n  const absolute = value < 0n ? -value : value\n  const whole = absolute / CREDIT_SCALE\n  const fraction = String(absolute % CREDIT_SCALE).padStart(4, '0').replace(/0+$/, '')\n  return `${sign}${whole}${fraction ? `.${fraction}` : ''}`\n}\n\nfunction summarizeLines(lines: WarrantyClaimLine[]): LineSummary {\n  let creditTotal = 0n\n  const statuses: Record<string, number> = {}\n  for (const line of lines) {\n    creditTotal += decimalUnits(line.creditAmount)\n    statuses[line.lineStatus] = (statuses[line.lineStatus] ?? 0) + 1\n  }\n  return {\n    count: lines.length,\n    creditTotal: decimalString(creditTotal),\n    statuses,\n  }\n}\n\nfunction serializePortalClaim(claim: WarrantyClaim, lines: WarrantyClaimLine[]) {\n  return {\n    id: claim.id,\n    claimNumber: claim.claimNumber,\n    claimType: claim.claimType,\n    status: claim.status,\n    orderId: claim.orderId ?? null,\n    orderNumber: claim.orderNumber ?? null,\n    reasonCode: claim.reasonCode ?? null,\n    resolutionSummary: claim.resolutionSummary ?? null,\n    createdAt: toIso(claim.createdAt),\n    updatedAt: toIso(claim.updatedAt),\n    lines: summarizeLines(lines),\n  }\n}\n\nasync function resolvePortalContext(req: Request): Promise<PortalContext | Response> {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })\n  }\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const commandAuth: NonNullable<AuthContext> = {\n    sub: auth.sub,\n    sid: auth.sid,\n    tenantId: auth.tenantId,\n    orgId: auth.orgId,\n    email: auth.email,\n    customerEntityId: auth.customerEntityId ?? null,\n    personEntityId: auth.personEntityId ?? null,\n  }\n  return {\n    auth,\n    customerId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    em,\n    commandCtx: {\n      container,\n      auth: commandAuth,\n      organizationScope: null,\n      selectedOrganizationId: auth.orgId,\n      organizationIds: [auth.orgId],\n      request: req,\n    },\n  }\n}\n\ntype PortalSalesDb = {\n  sales_orders: {\n    id: string\n    currency_code: string\n    customer_entity_id: string | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n  sales_order_lines: {\n    id: string\n    order_id: string\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n}\n\nfunction isMissingSalesTableError(err: unknown): boolean {\n  if (typeof err !== 'object' || err === null) return false\n  const candidate = err as { code?: unknown; message?: unknown }\n  return candidate.code === '42P01'\n    || (typeof candidate.message === 'string'\n      && candidate.message.includes('does not exist')\n      && (candidate.message.includes('sales_orders') || candidate.message.includes('sales_order_lines')))\n}\n\nasync function loadOwnedOrders(\n  context: PortalContext,\n  orderIds: string[],\n): Promise<Map<string, PortalOrderLookup>> {\n  if (orderIds.length === 0) return new Map()\n  try {\n    const db = context.em.fork().getKysely<PortalSalesDb>()\n    const rows = await db\n      .selectFrom('sales_orders')\n      .select(['id', 'currency_code'])\n      .where('id', 'in', orderIds)\n      .where('tenant_id', '=', context.tenantId)\n      .where('organization_id', '=', context.organizationId)\n      .where('customer_entity_id', '=', context.customerId)\n      .where('deleted_at', 'is', null)\n      .execute()\n    return new Map(rows.map((row) => [row.id, { id: row.id, currencyCode: row.currency_code ?? null }]))\n  } catch (err) {\n    if (isMissingSalesTableError(err)) return new Map()\n    throw err\n  }\n}\n\nasync function loadOwnedOrderLines(\n  context: PortalContext,\n  orderLineIds: string[],\n): Promise<Map<string, PortalOrderLineLookup>> {\n  if (orderLineIds.length === 0) return new Map()\n  try {\n    const db = context.em.fork().getKysely<PortalSalesDb>()\n    const rows = await db\n      .selectFrom('sales_order_lines')\n      .select(['id', 'order_id'])\n      .where('id', 'in', orderLineIds)\n      .where('tenant_id', '=', context.tenantId)\n      .where('organization_id', '=', context.organizationId)\n      .where('deleted_at', 'is', null)\n      .execute()\n    return new Map(rows.map((row) => [row.id, { id: row.id, orderId: row.order_id }]))\n  } catch (err) {\n    if (isMissingSalesTableError(err)) return new Map()\n    throw err\n  }\n}\n\nasync function validatePortalOrderOwnership(\n  context: PortalContext,\n  input: PortalIntakeInput,\n): Promise<OrderValidationResult | Response> {\n  const orderLineIds = Array.from(new Set(input.lines.flatMap((line) => line.orderLineId ? [line.orderLineId] : [])))\n  const orderLinesById = await loadOwnedOrderLines(context, orderLineIds)\n  const orderIds = new Set<string>()\n  if (input.orderId) orderIds.add(input.orderId)\n  for (const orderLine of orderLinesById.values()) orderIds.add(orderLine.orderId)\n  const ordersById = await loadOwnedOrders(context, Array.from(orderIds))\n  let resolvedOrder = input.orderId ? (ordersById.get(input.orderId) ?? null) : null\n  if (input.orderId) {\n    if (!resolvedOrder) {\n      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderNotOwned' }, { status: 404 })\n    }\n  }\n\n  for (const line of input.lines) {\n    if (!line.orderLineId) continue\n    const resolvedLine = orderLinesById.get(line.orderLineId)\n    const lineOrder = resolvedLine ? ordersById.get(resolvedLine.orderId) : null\n    if (!resolvedLine || !lineOrder) {\n      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderLineMismatch' }, { status: 404 })\n    }\n    if (resolvedOrder && lineOrder.id !== resolvedOrder.id) {\n      const { translate } = await resolveTranslations()\n      return NextResponse.json(\n        { ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') },\n        { status: 400 },\n      )\n    }\n    if (!resolvedOrder) resolvedOrder = lineOrder\n  }\n\n  return {\n    orderId: resolvedOrder?.id ?? input.orderId ?? null,\n    currencyCode: resolvedOrder?.currencyCode ?? null,\n  }\n}\n\nasync function runPortalCreateGuard(\n  req: Request,\n  context: PortalContext,\n  mutationPayload: Record<string, unknown>,\n): Promise<RouteMutationGuardResult> {\n  return runRouteMutationGuards({\n    container: context.commandCtx.container,\n    req,\n    auth: {\n      userId: context.auth.sub,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userFeatures: [],\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: null,\n      operation: 'create',\n      mutationPayload,\n    },\n  })\n}\n\nexport async function GET(req: Request) {\n  const contextOrResponse = await resolvePortalContext(req)\n  if (contextOrResponse instanceof Response) return contextOrResponse\n  const context = contextOrResponse\n  const url = new URL(req.url)\n  const query = listQuerySchema.safeParse({\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    stateGroup: url.searchParams.get('stateGroup') ?? undefined,\n    serialNumber: url.searchParams.get('serialNumber') ?? undefined,\n  })\n  if (!query.success) {\n    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })\n  }\n  const { page, pageSize, search, status, stateGroup, serialNumber } = query.data\n  const where = buildPortalOwnedClaimWhere(context)\n  if (status) where.status = status\n  else if (stateGroup) where.status = { $in: portalClaimStatusesForStateGroup(stateGroup) }\n  if (search) {\n    const pattern = `%${escapeLikePattern(search)}%`\n    where.$or = [\n      { claimNumber: { $ilike: pattern } },\n      { orderNumber: { $ilike: pattern } },\n    ]\n  }\n  if (serialNumber) {\n    const matchingLines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      {\n        serialNumber,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        deletedAt: null,\n        claim: buildPortalOwnedClaimWhere(context),\n      },\n      {},\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n    )\n    const matchingClaimIds = Array.from(new Set(\n      matchingLines.map((line) => relationId(line.claim)).filter((id): id is string => Boolean(id)),\n    ))\n    if (matchingClaimIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 1 })\n    }\n    where.id = { $in: matchingClaimIds }\n  }\n  const total = await context.em.count(WarrantyClaim, where)\n  const claims = await findWithDecryption(\n    context.em,\n    WarrantyClaim,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: pageSize,\n      offset: (page - 1) * pageSize,\n    },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n  const claimIds = claims.map((claim) => claim.id)\n  const lines = claimIds.length\n    ? await findWithDecryption(\n        context.em,\n        WarrantyClaimLine,\n        { claim: { $in: claimIds }, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },\n        {},\n        { tenantId: context.tenantId, organizationId: context.organizationId },\n      )\n    : []\n  const linesByClaim = new Map<string, WarrantyClaimLine[]>()\n  for (const line of lines) {\n    const claimId = relationId(line.claim)\n    if (!claimId) continue\n    const bucket = linesByClaim.get(claimId) ?? []\n    bucket.push(line)\n    linesByClaim.set(claimId, bucket)\n  }\n  return NextResponse.json({\n    items: claims.map((claim) => serializePortalClaim(claim, linesByClaim.get(claim.id) ?? [])),\n    total,\n    page,\n    pageSize,\n    totalPages: Math.max(1, Math.ceil(total / pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const contextOrResponse = await resolvePortalContext(req)\n  if (contextOrResponse instanceof Response) return contextOrResponse\n  const context = contextOrResponse\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })\n  }\n  const parsed = portalIntakeInputSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })\n  }\n  const ownership = await validatePortalOrderOwnership(context, parsed.data)\n  if (ownership instanceof Response) return ownership\n\n  const createInput: ClaimCreateInput = {\n    organizationId: context.organizationId,\n    tenantId: context.tenantId,\n    claimType: 'warranty',\n    channel: 'portal',\n    priority: 'normal',\n    customerId: context.customerId,\n    customerName: context.auth.displayName || null,\n    orderId: ownership.orderId,\n    // A resolved order supplies its own number; otherwise persist the typed reference (WQA-002).\n    orderNumber: ownership.orderId ? null : (parsed.data.orderReference ?? null),\n    reasonCode: parsed.data.reasonCode,\n    notes: parsed.data.notes ?? null,\n    currencyCode: ownership.currencyCode,\n    lines: parsed.data.lines.map((line, index) => ({\n      lineNo: index + 1,\n      orderLineId: line.orderLineId ?? null,\n      productId: line.productId ?? null,\n      productName: line.productName ?? null,\n      sku: line.sku ?? null,\n      serialNumber: line.serialNumber ?? null,\n      faultCode: line.faultCode ?? null,\n      faultDescription: line.faultDescription,\n      qtyClaimed: line.qtyClaimed ?? 1,\n      // Carry warranty metadata so order-backed portal lines keep their entitlement basis\n      // instead of persisting warrantyStatus='unknown' (WQA-004 / LINE-06).\n      purchaseDate: line.purchaseDate ?? null,\n      warrantyMonths: line.warrantyMonths ?? null,\n    })),\n  }\n\n  const guarded = await runPortalCreateGuard(req, context, { ...createInput })\n  if (!guarded.ok) {\n    return guarded.response\n  }\n  const effectiveInput: ClaimCreateInput = guarded.modifiedPayload\n    ? {\n        ...createInput,\n        ...guarded.modifiedPayload,\n        tenantId: createInput.tenantId,\n        organizationId: createInput.organizationId,\n        customerId: createInput.customerId,\n        channel: createInput.channel,\n        claimType: createInput.claimType,\n        orderId: createInput.orderId,\n        orderNumber: createInput.orderNumber,\n        currencyCode: createInput.currencyCode,\n        lines: createInput.lines,\n      }\n    : createInput\n\n  const commandBus = context.commandCtx.container.resolve('commandBus') as CommandBus\n  try {\n    const createResult = await commandBus.execute<ClaimCreateInput, { claimId: string }>(\n      'warranty_claims.claim.create',\n      { input: effectiveInput, ctx: context.commandCtx },\n    )\n    const claimId = createResult.result?.claimId\n    if (typeof claimId !== 'string') {\n      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.save_failed' }, { status: 500 })\n    }\n    try {\n      await commandBus.execute<{ id: string; actorCustomerId: string }, { claimId: string }>(\n        'warranty_claims.claim.submit',\n        { input: { id: claimId, actorCustomerId: context.customerId }, ctx: context.commandCtx },\n      )\n    } catch (submitError) {\n      try {\n        await commandBus.execute<{ id: string }, { claimId: string }>(\n          'warranty_claims.claim.delete',\n          { input: { id: claimId }, ctx: context.commandCtx },\n        )\n      } catch (compensationError) {\n        logger.error('warranty_claims.portal.claim.submit compensation failed \u2014 orphaned draft claim', {\n          err: compensationError,\n          claimId,\n          customerId: context.customerId,\n          tenantId: context.tenantId,\n          organizationId: context.organizationId,\n        })\n      }\n      throw submitError\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n}\n\nconst lineSummarySchema = z.object({\n  count: z.number().int().nonnegative(),\n  creditTotal: z.string(),\n  statuses: z.record(z.string(), z.number().int().nonnegative()),\n})\n\nconst portalClaimSchema = z.object({\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  claimType: z.string(),\n  status: z.string(),\n  orderId: z.string().uuid().nullable(),\n  orderNumber: z.string().nullable(),\n  reasonCode: z.string().nullable(),\n  resolutionSummary: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  lines: lineSummarySchema,\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims Portal',\n  summary: 'Customer portal warranty claims',\n  methods: {\n    GET: {\n      summary: 'List the authenticated customer account claims',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Customer claims',\n          schema: z.object({\n            items: z.array(portalClaimSchema),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Submit a customer portal claim intake',\n      requestBody: { contentType: 'application/json', schema: portalIntakeInputSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Claim created and submitted',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAEvC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,8BAA6D;AACtE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,kCAA4D;AAErE,SAAS,eAAe,yBAAyB;AACjD;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,oCAAoC;AAC7C,SAAS,wCAAwC;AACjD,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,6BAA6B,CAAC,UAA4B;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,MAAM,6BAA6B,CAAC,QAClC,EAAE,WAAW,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,CAAC;AAEvF,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC5D,QAAQ,2BAA2B,GAAG;AAAA,EACtC,QAAQ,EAAE,WAAW,4BAA4B,kBAAkB,SAAS,CAAC;AAAA,EAC7E,YAAY,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,2BAA2B,GAAG;AAC9C,CAAC;AAgCD,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,YAAY,QAAiC,KAA4B;AAChF,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AACjE;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACrD;AAEA,MAAM,eAAe;AAErB,SAAS,aAAa,OAAwB;AAC5C,QAAM,aAAa,OAAO,UAAU,WAC/B,OAAO,SAAS,KAAK,IAAI,MAAM,QAAQ,CAAC,IAAI,KAC7C,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC/C,QAAM,QAAQ,6BAA6B,KAAK,UAAU;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,CAAC,EAAE,MAAM,OAAO,WAAW,EAAE,IAAI;AACvC,MAAI,QAAQ,OAAO,KAAK,IAAI,eAAe,OAAO,SAAS,MAAM,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC;AACrF,MAAI,SAAS,SAAS,KAAK,SAAS,CAAC,KAAK,IAAK,UAAS;AACxD,SAAO,SAAS,MAAM,CAAC,QAAQ;AACjC;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,OAAO,QAAQ,KAAK,MAAM;AAChC,QAAM,WAAW,QAAQ,KAAK,CAAC,QAAQ;AACvC,QAAM,QAAQ,WAAW;AACzB,QAAM,WAAW,OAAO,WAAW,YAAY,EAAE,SAAS,GAAG,GAAG,EAAE,QAAQ,OAAO,EAAE;AACnF,SAAO,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,IAAI,QAAQ,KAAK,EAAE;AACzD;AAEA,SAAS,eAAe,OAAyC;AAC/D,MAAI,cAAc;AAClB,QAAM,WAAmC,CAAC;AAC1C,aAAW,QAAQ,OAAO;AACxB,mBAAe,aAAa,KAAK,YAAY;AAC7C,aAAS,KAAK,UAAU,KAAK,SAAS,KAAK,UAAU,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,aAAa,cAAc,WAAW;AAAA,IACtC;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,OAAsB,OAA4B;AAC9E,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,cAAc;AAAA,IAChC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,OAAO,eAAe,KAAK;AAAA,EAC7B;AACF;AAEA,eAAe,qBAAqB,KAAiD;AACnF,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AACA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kDAAkD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnH;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAwC;AAAA,IAC5C,KAAK,KAAK;AAAA,IACV,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,gBAAgB,KAAK,kBAAkB;AAAA,EACzC;AACA,SAAO;AAAA,IACL;AAAA,IACA,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,MACV;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,KAAK;AAAA,MAC7B,iBAAiB,CAAC,KAAK,KAAK;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAoBA,SAAS,yBAAyB,KAAuB;AACvD,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,YAAY;AAClB,SAAO,UAAU,SAAS,WACpB,OAAO,UAAU,YAAY,YAC5B,UAAU,QAAQ,SAAS,gBAAgB,MAC1C,UAAU,QAAQ,SAAS,cAAc,KAAK,UAAU,QAAQ,SAAS,mBAAmB;AACtG;AAEA,eAAe,gBACb,SACA,UACyC;AACzC,MAAI,SAAS,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC1C,MAAI;AACF,UAAM,KAAK,QAAQ,GAAG,KAAK,EAAE,UAAyB;AACtD,UAAM,OAAO,MAAM,GAChB,WAAW,cAAc,EACzB,OAAO,CAAC,MAAM,eAAe,CAAC,EAC9B,MAAM,MAAM,MAAM,QAAQ,EAC1B,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,mBAAmB,KAAK,QAAQ,cAAc,EACpD,MAAM,sBAAsB,KAAK,QAAQ,UAAU,EACnD,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ;AACX,WAAO,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,cAAc,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAAA,EACrG,SAAS,KAAK;AACZ,QAAI,yBAAyB,GAAG,EAAG,QAAO,oBAAI,IAAI;AAClD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,oBACb,SACA,cAC6C;AAC7C,MAAI,aAAa,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC9C,MAAI;AACF,UAAM,KAAK,QAAQ,GAAG,KAAK,EAAE,UAAyB;AACtD,UAAM,OAAO,MAAM,GAChB,WAAW,mBAAmB,EAC9B,OAAO,CAAC,MAAM,UAAU,CAAC,EACzB,MAAM,MAAM,MAAM,YAAY,EAC9B,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,mBAAmB,KAAK,QAAQ,cAAc,EACpD,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ;AACX,WAAO,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,QAAI,yBAAyB,GAAG,EAAG,QAAO,oBAAI,IAAI;AAClD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,6BACb,SACA,OAC2C;AAC3C,QAAM,eAAe,MAAM,KAAK,IAAI,IAAI,MAAM,MAAM,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;AAClH,QAAM,iBAAiB,MAAM,oBAAoB,SAAS,YAAY;AACtE,QAAM,WAAW,oBAAI,IAAY;AACjC,MAAI,MAAM,QAAS,UAAS,IAAI,MAAM,OAAO;AAC7C,aAAW,aAAa,eAAe,OAAO,EAAG,UAAS,IAAI,UAAU,OAAO;AAC/E,QAAM,aAAa,MAAM,gBAAgB,SAAS,MAAM,KAAK,QAAQ,CAAC;AACtE,MAAI,gBAAgB,MAAM,UAAW,WAAW,IAAI,MAAM,OAAO,KAAK,OAAQ;AAC9E,MAAI,MAAM,SAAS;AACjB,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxG;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI,CAAC,KAAK,YAAa;AACvB,UAAM,eAAe,eAAe,IAAI,KAAK,WAAW;AACxD,UAAM,YAAY,eAAe,WAAW,IAAI,aAAa,OAAO,IAAI;AACxE,QAAI,CAAC,gBAAgB,CAAC,WAAW;AAC/B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5G;AACA,QAAI,iBAAiB,UAAU,OAAO,cAAc,IAAI;AACtD,YAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,aAAO,aAAa;AAAA,QAClB,EAAE,IAAI,OAAO,OAAO,UAAU,4CAA4C,kDAAkD,EAAE;AAAA,QAC9H,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,CAAC,cAAe,iBAAgB;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,SAAS,eAAe,MAAM,MAAM,WAAW;AAAA,IAC/C,cAAc,eAAe,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,KACA,SACA,iBACmC;AACnC,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,QAAQ,KAAK;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,oBAAoB,MAAM,qBAAqB,GAAG;AACxD,MAAI,6BAA6B,SAAU,QAAO;AAClD,QAAM,UAAU;AAChB,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,gBAAgB,UAAU;AAAA,IACtC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,EACxD,CAAC;AACD,MAAI,CAAC,MAAM,SAAS;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AACA,QAAM,EAAE,MAAM,UAAU,QAAQ,QAAQ,YAAY,aAAa,IAAI,MAAM;AAC3E,QAAM,QAAQ,2BAA2B,OAAO;AAChD,MAAI,OAAQ,OAAM,SAAS;AAAA,WAClB,WAAY,OAAM,SAAS,EAAE,KAAK,iCAAiC,UAAU,EAAE;AACxF,MAAI,QAAQ;AACV,UAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,UAAM,MAAM;AAAA,MACV,EAAE,aAAa,EAAE,QAAQ,QAAQ,EAAE;AAAA,MACnC,EAAE,aAAa,EAAE,QAAQ,QAAQ,EAAE;AAAA,IACrC;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,gBAAgB,MAAM;AAAA,MAC1B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,WAAW;AAAA,QACX,OAAO,2BAA2B,OAAO;AAAA,MAC3C;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,IACvE;AACA,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAAA,MACtC,cAAc,IAAI,CAAC,SAAS,WAAW,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,OAAqB,QAAQ,EAAE,CAAC;AAAA,IAC9F,CAAC;AACD,QAAI,iBAAiB,WAAW,GAAG;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,KAAK,EAAE,KAAK,iBAAiB;AAAA,EACrC;AACA,QAAM,QAAQ,MAAM,QAAQ,GAAG,MAAM,eAAe,KAAK;AACzD,QAAM,SAAS,MAAM;AAAA,IACnB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO;AAAA,MACP,SAAS,OAAO,KAAK;AAAA,IACvB;AAAA,IACA,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACA,QAAM,WAAW,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE;AAC/C,QAAM,QAAQ,SAAS,SACnB,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,SAAS,GAAG,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,IAChH,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE,IACA,CAAC;AACL,QAAM,eAAe,oBAAI,IAAiC;AAC1D,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,KAAK;AACrC,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,aAAa,IAAI,OAAO,KAAK,CAAC;AAC7C,WAAO,KAAK,IAAI;AAChB,iBAAa,IAAI,SAAS,MAAM;AAAA,EAClC;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,IAAI,CAAC,UAAU,qBAAqB,OAAO,aAAa,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAAA,EACrD,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,oBAAoB,MAAM,qBAAqB,GAAG;AACxD,MAAI,6BAA6B,SAAU,QAAO;AAClD,QAAM,UAAU;AAChB,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AACA,QAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AACA,QAAM,YAAY,MAAM,6BAA6B,SAAS,OAAO,IAAI;AACzE,MAAI,qBAAqB,SAAU,QAAO;AAE1C,QAAM,cAAgC;AAAA,IACpC,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ,KAAK,eAAe;AAAA,IAC1C,SAAS,UAAU;AAAA;AAAA,IAEnB,aAAa,UAAU,UAAU,OAAQ,OAAO,KAAK,kBAAkB;AAAA,IACvE,YAAY,OAAO,KAAK;AAAA,IACxB,OAAO,OAAO,KAAK,SAAS;AAAA,IAC5B,cAAc,UAAU;AAAA,IACxB,OAAO,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,WAAW;AAAA,MAC7C,QAAQ,QAAQ;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,aAAa;AAAA,MAC7B,aAAa,KAAK,eAAe;AAAA,MACjC,KAAK,KAAK,OAAO;AAAA,MACjB,cAAc,KAAK,gBAAgB;AAAA,MACnC,WAAW,KAAK,aAAa;AAAA,MAC7B,kBAAkB,KAAK;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA;AAAA;AAAA,MAG/B,cAAc,KAAK,gBAAgB;AAAA,MACnC,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,EACJ;AAEA,QAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS,EAAE,GAAG,YAAY,CAAC;AAC3E,MAAI,CAAC,QAAQ,IAAI;AACf,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,iBAAmC,QAAQ,kBAC7C;AAAA,IACE,GAAG;AAAA,IACH,GAAG,QAAQ;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,gBAAgB,YAAY;AAAA,IAC5B,YAAY,YAAY;AAAA,IACxB,SAAS,YAAY;AAAA,IACrB,WAAW,YAAY;AAAA,IACvB,SAAS,YAAY;AAAA,IACrB,aAAa,YAAY;AAAA,IACzB,cAAc,YAAY;AAAA,IAC1B,OAAO,YAAY;AAAA,EACrB,IACA;AAEJ,QAAM,aAAa,QAAQ,WAAW,UAAU,QAAQ,YAAY;AACpE,MAAI;AACF,UAAM,eAAe,MAAM,WAAW;AAAA,MACpC;AAAA,MACA,EAAE,OAAO,gBAAgB,KAAK,QAAQ,WAAW;AAAA,IACnD;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,OAAO,YAAY,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qCAAqC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtG;AACA,QAAI;AACF,YAAM,WAAW;AAAA,QACf;AAAA,QACA,EAAE,OAAO,EAAE,IAAI,SAAS,iBAAiB,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW;AAAA,MACzF;AAAA,IACF,SAAS,aAAa;AACpB,UAAI;AACF,cAAM,WAAW;AAAA,UACf;AAAA,UACA,EAAE,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,QAAQ,WAAW;AAAA,QACpD;AAAA,MACF,SAAS,mBAAmB;AAC1B,eAAO,MAAM,uFAAkF;AAAA,UAC7F,KAAK;AAAA,UACL;AAAA,UACA,YAAY,QAAQ;AAAA,UACpB,UAAU,QAAQ;AAAA,UAClB,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,aAAa,EAAE,OAAO;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC;AAC/D,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO;AACT,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,iBAAiB;AAAA,YAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MAChF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaim, WarrantyClaimLine } from '../../../data/entities'\nimport {\n  claimStatusSchema,\n  portalIntakeInputSchema,\n  type ClaimCreateInput,\n  type PortalIntakeInput,\n} from '../../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'\nimport { portalClaimStatusesForStateGroup } from '../../../lib/listSegments'\nimport { buildPortalOwnedClaimWhere } from '../../../lib/portalClaimAccess'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  POST: { requireAuth: false },\n}\n\nconst logger = createLogger('warranty_claims')\n\nconst emptyQueryValueToUndefined = (value: unknown): unknown => {\n  if (typeof value !== 'string') return value\n  const trimmed = value.trim()\n  return trimmed.length ? trimmed : undefined\n}\n\nconst optionalTrimmedQueryString = (max: number) =>\n  z.preprocess(emptyQueryValueToUndefined, z.string().trim().min(1).max(max).optional())\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().int().min(1).default(1),\n  pageSize: z.coerce.number().int().min(1).max(100).default(20),\n  search: optionalTrimmedQueryString(190),\n  status: z.preprocess(emptyQueryValueToUndefined, claimStatusSchema.optional()),\n  stateGroup: z.enum(['open', 'resolved']).optional(),\n  serialNumber: optionalTrimmedQueryString(191),\n})\n\ntype PortalContext = {\n  auth: CustomerAuthContext\n  customerId: string\n  tenantId: string\n  organizationId: string\n  em: EntityManager\n  commandCtx: CommandRuntimeContext\n}\n\ntype LineSummary = {\n  count: number\n  creditTotal: string\n  statuses: Record<string, number>\n}\n\ntype OrderValidationResult = {\n  orderId: string | null\n  currencyCode: string | null\n}\n\ntype PortalOrderLookup = {\n  id: string\n  currencyCode: string | null\n}\n\ntype PortalOrderLineLookup = {\n  id: string\n  orderId: string\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction stringField(record: Record<string, unknown>, key: string): string | null {\n  const value = record[key]\n  return typeof value === 'string' ? value : null\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  if (value instanceof Date) return value.toISOString()\n  const date = new Date(value)\n  return Number.isNaN(date.getTime()) ? value : date.toISOString()\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value\n  const record = toRecord(value)\n  return typeof record.id === 'string' ? record.id : null\n}\n\nconst CREDIT_SCALE = 10_000n\n\nfunction decimalUnits(value: unknown): bigint {\n  const normalized = typeof value === 'number'\n    ? (Number.isFinite(value) ? value.toFixed(4) : '')\n    : typeof value === 'string' ? value.trim() : ''\n  const match = /^([+-]?)(\\d+)(?:\\.(\\d+))?$/.exec(normalized)\n  if (!match) return 0n\n  const [, sign, whole, fraction = ''] = match\n  let units = BigInt(whole) * CREDIT_SCALE + BigInt(fraction.slice(0, 4).padEnd(4, '0'))\n  if (fraction.length > 4 && fraction[4] >= '5') units += 1n\n  return sign === '-' ? -units : units\n}\n\nfunction decimalString(value: bigint): string {\n  const sign = value < 0n ? '-' : ''\n  const absolute = value < 0n ? -value : value\n  const whole = absolute / CREDIT_SCALE\n  const fraction = String(absolute % CREDIT_SCALE).padStart(4, '0').replace(/0+$/, '')\n  return `${sign}${whole}${fraction ? `.${fraction}` : ''}`\n}\n\nfunction summarizeLines(lines: WarrantyClaimLine[]): LineSummary {\n  let creditTotal = 0n\n  const statuses: Record<string, number> = {}\n  for (const line of lines) {\n    creditTotal += decimalUnits(line.creditAmount)\n    statuses[line.lineStatus] = (statuses[line.lineStatus] ?? 0) + 1\n  }\n  return {\n    count: lines.length,\n    creditTotal: decimalString(creditTotal),\n    statuses,\n  }\n}\n\nfunction serializePortalClaim(claim: WarrantyClaim, lines: WarrantyClaimLine[]) {\n  return {\n    id: claim.id,\n    claimNumber: claim.claimNumber,\n    claimType: claim.claimType,\n    status: claim.status,\n    orderId: claim.orderId ?? null,\n    orderNumber: claim.orderNumber ?? null,\n    reasonCode: claim.reasonCode ?? null,\n    resolutionSummary: claim.resolutionSummary ?? null,\n    createdAt: toIso(claim.createdAt),\n    updatedAt: toIso(claim.updatedAt),\n    lines: summarizeLines(lines),\n  }\n}\n\nasync function resolvePortalContext(req: Request): Promise<PortalContext | Response> {\n  const { translate } = await resolveTranslations()\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.customerAccountNotLinked', 'Customer account is not linked to a customer record') }, { status: 403 })\n  }\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const commandAuth: NonNullable<AuthContext> = {\n    sub: auth.sub,\n    sid: auth.sid,\n    tenantId: auth.tenantId,\n    orgId: auth.orgId,\n    email: auth.email,\n    customerEntityId: auth.customerEntityId ?? null,\n    personEntityId: auth.personEntityId ?? null,\n  }\n  return {\n    auth,\n    customerId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    em,\n    commandCtx: {\n      container,\n      auth: commandAuth,\n      organizationScope: null,\n      selectedOrganizationId: auth.orgId,\n      organizationIds: [auth.orgId],\n      request: req,\n    },\n  }\n}\n\ntype PortalSalesDb = {\n  sales_orders: {\n    id: string\n    currency_code: string\n    customer_entity_id: string | null\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n  sales_order_lines: {\n    id: string\n    order_id: string\n    tenant_id: string | null\n    organization_id: string | null\n    deleted_at: Date | null\n  }\n}\n\nfunction isMissingSalesTableError(err: unknown): boolean {\n  if (typeof err !== 'object' || err === null) return false\n  const candidate = err as { code?: unknown; message?: unknown }\n  return candidate.code === '42P01'\n    || (typeof candidate.message === 'string'\n      && candidate.message.includes('does not exist')\n      && (candidate.message.includes('sales_orders') || candidate.message.includes('sales_order_lines')))\n}\n\nasync function loadOwnedOrders(\n  context: PortalContext,\n  orderIds: string[],\n): Promise<Map<string, PortalOrderLookup>> {\n  if (orderIds.length === 0) return new Map()\n  try {\n    const db = context.em.fork().getKysely<PortalSalesDb>()\n    const rows = await db\n      .selectFrom('sales_orders')\n      .select(['id', 'currency_code'])\n      .where('id', 'in', orderIds)\n      .where('tenant_id', '=', context.tenantId)\n      .where('organization_id', '=', context.organizationId)\n      .where('customer_entity_id', '=', context.customerId)\n      .where('deleted_at', 'is', null)\n      .execute()\n    return new Map(rows.map((row) => [row.id, { id: row.id, currencyCode: row.currency_code ?? null }]))\n  } catch (err) {\n    if (isMissingSalesTableError(err)) return new Map()\n    throw err\n  }\n}\n\nasync function loadOwnedOrderLines(\n  context: PortalContext,\n  orderLineIds: string[],\n): Promise<Map<string, PortalOrderLineLookup>> {\n  if (orderLineIds.length === 0) return new Map()\n  try {\n    const db = context.em.fork().getKysely<PortalSalesDb>()\n    const rows = await db\n      .selectFrom('sales_order_lines')\n      .select(['id', 'order_id'])\n      .where('id', 'in', orderLineIds)\n      .where('tenant_id', '=', context.tenantId)\n      .where('organization_id', '=', context.organizationId)\n      .where('deleted_at', 'is', null)\n      .execute()\n    return new Map(rows.map((row) => [row.id, { id: row.id, orderId: row.order_id }]))\n  } catch (err) {\n    if (isMissingSalesTableError(err)) return new Map()\n    throw err\n  }\n}\n\nasync function validatePortalOrderOwnership(\n  context: PortalContext,\n  input: PortalIntakeInput,\n): Promise<OrderValidationResult | Response> {\n  const { translate } = await resolveTranslations()\n  const orderLineIds = Array.from(new Set(input.lines.flatMap((line) => line.orderLineId ? [line.orderLineId] : [])))\n  const orderLinesById = await loadOwnedOrderLines(context, orderLineIds)\n  const orderIds = new Set<string>()\n  if (input.orderId) orderIds.add(input.orderId)\n  for (const orderLine of orderLinesById.values()) orderIds.add(orderLine.orderId)\n  const ordersById = await loadOwnedOrders(context, Array.from(orderIds))\n  let resolvedOrder = input.orderId ? (ordersById.get(input.orderId) ?? null) : null\n  if (input.orderId) {\n    if (!resolvedOrder) {\n      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderNotOwned', 'Order not found.') }, { status: 404 })\n    }\n  }\n\n  for (const line of input.lines) {\n    if (!line.orderLineId) continue\n    const resolvedLine = orderLinesById.get(line.orderLineId)\n    const lineOrder = resolvedLine ? ordersById.get(resolvedLine.orderId) : null\n    if (!resolvedLine || !lineOrder) {\n      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') }, { status: 404 })\n    }\n    if (resolvedOrder && lineOrder.id !== resolvedOrder.id) {\n      return NextResponse.json(\n        { ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') },\n        { status: 400 },\n      )\n    }\n    if (!resolvedOrder) resolvedOrder = lineOrder\n  }\n\n  return {\n    orderId: resolvedOrder?.id ?? input.orderId ?? null,\n    currencyCode: resolvedOrder?.currencyCode ?? null,\n  }\n}\n\nasync function runPortalCreateGuard(\n  req: Request,\n  context: PortalContext,\n  mutationPayload: Record<string, unknown>,\n): Promise<RouteMutationGuardResult> {\n  return runRouteMutationGuards({\n    container: context.commandCtx.container,\n    req,\n    auth: {\n      userId: context.auth.sub,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      userFeatures: [],\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: null,\n      operation: 'create',\n      mutationPayload,\n    },\n  })\n}\n\nexport async function GET(req: Request) {\n  const contextOrResponse = await resolvePortalContext(req)\n  if (contextOrResponse instanceof Response) return contextOrResponse\n  const context = contextOrResponse\n  const url = new URL(req.url)\n  const query = listQuerySchema.safeParse({\n    page: url.searchParams.get('page') ?? undefined,\n    pageSize: url.searchParams.get('pageSize') ?? undefined,\n    search: url.searchParams.get('search') ?? undefined,\n    status: url.searchParams.get('status') ?? undefined,\n    stateGroup: url.searchParams.get('stateGroup') ?? undefined,\n    serialNumber: url.searchParams.get('serialNumber') ?? undefined,\n  })\n  if (!query.success) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n  }\n  const { page, pageSize, search, status, stateGroup, serialNumber } = query.data\n  const where = buildPortalOwnedClaimWhere(context)\n  if (status) where.status = status\n  else if (stateGroup) where.status = { $in: portalClaimStatusesForStateGroup(stateGroup) }\n  if (search) {\n    const pattern = `%${escapeLikePattern(search)}%`\n    where.$or = [\n      { claimNumber: { $ilike: pattern } },\n      { orderNumber: { $ilike: pattern } },\n    ]\n  }\n  if (serialNumber) {\n    const matchingLines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      {\n        serialNumber,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        deletedAt: null,\n        claim: buildPortalOwnedClaimWhere(context),\n      },\n      {},\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n    )\n    const matchingClaimIds = Array.from(new Set(\n      matchingLines.map((line) => relationId(line.claim)).filter((id): id is string => Boolean(id)),\n    ))\n    if (matchingClaimIds.length === 0) {\n      return NextResponse.json({ items: [], total: 0, page, pageSize, totalPages: 1 })\n    }\n    where.id = { $in: matchingClaimIds }\n  }\n  const total = await context.em.count(WarrantyClaim, where)\n  const claims = await findWithDecryption(\n    context.em,\n    WarrantyClaim,\n    where,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: pageSize,\n      offset: (page - 1) * pageSize,\n    },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n  const claimIds = claims.map((claim) => claim.id)\n  const lines = claimIds.length\n    ? await findWithDecryption(\n        context.em,\n        WarrantyClaimLine,\n        { claim: { $in: claimIds }, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },\n        {},\n        { tenantId: context.tenantId, organizationId: context.organizationId },\n      )\n    : []\n  const linesByClaim = new Map<string, WarrantyClaimLine[]>()\n  for (const line of lines) {\n    const claimId = relationId(line.claim)\n    if (!claimId) continue\n    const bucket = linesByClaim.get(claimId) ?? []\n    bucket.push(line)\n    linesByClaim.set(claimId, bucket)\n  }\n  return NextResponse.json({\n    items: claims.map((claim) => serializePortalClaim(claim, linesByClaim.get(claim.id) ?? [])),\n    total,\n    page,\n    pageSize,\n    totalPages: Math.max(1, Math.ceil(total / pageSize)),\n  })\n}\n\nexport async function POST(req: Request) {\n  const contextOrResponse = await resolvePortalContext(req)\n  if (contextOrResponse instanceof Response) return contextOrResponse\n  const context = contextOrResponse\n  const { translate } = await resolveTranslations()\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n  }\n  const parsed = portalIntakeInputSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n  }\n  const ownership = await validatePortalOrderOwnership(context, parsed.data)\n  if (ownership instanceof Response) return ownership\n\n  const createInput: ClaimCreateInput = {\n    organizationId: context.organizationId,\n    tenantId: context.tenantId,\n    claimType: 'warranty',\n    channel: 'portal',\n    priority: 'normal',\n    customerId: context.customerId,\n    customerName: context.auth.displayName || null,\n    orderId: ownership.orderId,\n    // A resolved order supplies its own number; otherwise persist the typed reference (WQA-002).\n    orderNumber: ownership.orderId ? null : (parsed.data.orderReference ?? null),\n    reasonCode: parsed.data.reasonCode,\n    notes: parsed.data.notes ?? null,\n    currencyCode: ownership.currencyCode,\n    lines: parsed.data.lines.map((line, index) => ({\n      lineNo: index + 1,\n      orderLineId: line.orderLineId ?? null,\n      productId: line.productId ?? null,\n      productName: line.productName ?? null,\n      sku: line.sku ?? null,\n      serialNumber: line.serialNumber ?? null,\n      faultCode: line.faultCode ?? null,\n      faultDescription: line.faultDescription,\n      qtyClaimed: line.qtyClaimed ?? 1,\n      // Carry warranty metadata so order-backed portal lines keep their entitlement basis\n      // instead of persisting warrantyStatus='unknown' (WQA-004 / LINE-06).\n      purchaseDate: line.purchaseDate ?? null,\n      warrantyMonths: line.warrantyMonths ?? null,\n    })),\n  }\n\n  const guarded = await runPortalCreateGuard(req, context, { ...createInput })\n  if (!guarded.ok) {\n    return guarded.response\n  }\n  const effectiveInput: ClaimCreateInput = guarded.modifiedPayload\n    ? {\n        ...createInput,\n        ...guarded.modifiedPayload,\n        tenantId: createInput.tenantId,\n        organizationId: createInput.organizationId,\n        customerId: createInput.customerId,\n        channel: createInput.channel,\n        claimType: createInput.claimType,\n        orderId: createInput.orderId,\n        orderNumber: createInput.orderNumber,\n        currencyCode: createInput.currencyCode,\n        lines: createInput.lines,\n      }\n    : createInput\n\n  const commandBus = context.commandCtx.container.resolve('commandBus') as CommandBus\n  try {\n    const createResult = await commandBus.execute<ClaimCreateInput, { claimId: string }>(\n      'warranty_claims.claim.create',\n      { input: effectiveInput, ctx: context.commandCtx },\n    )\n    const claimId = createResult.result?.claimId\n    if (typeof claimId !== 'string') {\n      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n    }\n    try {\n      await commandBus.execute<{ id: string; actorCustomerId: string }, { claimId: string }>(\n        'warranty_claims.claim.submit',\n        { input: { id: claimId, actorCustomerId: context.customerId }, ctx: context.commandCtx },\n      )\n    } catch (submitError) {\n      try {\n        await commandBus.execute<{ id: string }, { claimId: string }>(\n          'warranty_claims.claim.delete',\n          { input: { id: claimId }, ctx: context.commandCtx },\n        )\n      } catch (compensationError) {\n        logger.error('warranty_claims.portal.claim.submit compensation failed \u2014 orphaned draft claim', {\n          err: compensationError,\n          claimId,\n          customerId: context.customerId,\n          tenantId: context.tenantId,\n          organizationId: context.organizationId,\n        })\n      }\n      throw submitError\n    }\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId }, { status: 201 })\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    throw err\n  }\n}\n\nconst lineSummarySchema = z.object({\n  count: z.number().int().nonnegative(),\n  creditTotal: z.string(),\n  statuses: z.record(z.string(), z.number().int().nonnegative()),\n})\n\nconst portalClaimSchema = z.object({\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  claimType: z.string(),\n  status: z.string(),\n  orderId: z.string().uuid().nullable(),\n  orderNumber: z.string().nullable(),\n  reasonCode: z.string().nullable(),\n  resolutionSummary: z.string().nullable(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  lines: lineSummarySchema,\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims Portal',\n  summary: 'Customer portal warranty claims',\n  methods: {\n    GET: {\n      summary: 'List the authenticated customer account claims',\n      query: listQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Customer claims',\n          schema: z.object({\n            items: z.array(portalClaimSchema),\n            total: z.number().int().nonnegative(),\n            page: z.number().int().min(1),\n            pageSize: z.number().int().min(1),\n            totalPages: z.number().int().min(1),\n          }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Submit a customer portal claim intake',\n      requestBody: { contentType: 'application/json', schema: portalIntakeInputSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Claim created and submitted',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AAEvC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAClC,SAAS,8BAA6D;AACtE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,kCAA4D;AAErE,SAAS,eAAe,yBAAyB;AACjD;AAAA,EACE;AAAA,EACA;AAAA,OAGK;AACP,SAAS,oCAAoC;AAC7C,SAAS,wCAAwC;AACjD,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,MAAM,EAAE,aAAa,MAAM;AAC7B;AAEA,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,6BAA6B,CAAC,UAA4B;AAC9D,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,QAAQ,SAAS,UAAU;AACpC;AAEA,MAAM,6BAA6B,CAAC,QAClC,EAAE,WAAW,4BAA4B,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS,CAAC;AAEvF,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EAC9C,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EAC5D,QAAQ,2BAA2B,GAAG;AAAA,EACtC,QAAQ,EAAE,WAAW,4BAA4B,kBAAkB,SAAS,CAAC;AAAA,EAC7E,YAAY,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,SAAS;AAAA,EAClD,cAAc,2BAA2B,GAAG;AAC9C,CAAC;AAgCD,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,YAAY,QAAiC,KAA4B;AAChF,QAAM,QAAQ,OAAO,GAAG;AACxB,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AACjE;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACrD;AAEA,MAAM,eAAe;AAErB,SAAS,aAAa,OAAwB;AAC5C,QAAM,aAAa,OAAO,UAAU,WAC/B,OAAO,SAAS,KAAK,IAAI,MAAM,QAAQ,CAAC,IAAI,KAC7C,OAAO,UAAU,WAAW,MAAM,KAAK,IAAI;AAC/C,QAAM,QAAQ,6BAA6B,KAAK,UAAU;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,CAAC,EAAE,MAAM,OAAO,WAAW,EAAE,IAAI;AACvC,MAAI,QAAQ,OAAO,KAAK,IAAI,eAAe,OAAO,SAAS,MAAM,GAAG,CAAC,EAAE,OAAO,GAAG,GAAG,CAAC;AACrF,MAAI,SAAS,SAAS,KAAK,SAAS,CAAC,KAAK,IAAK,UAAS;AACxD,SAAO,SAAS,MAAM,CAAC,QAAQ;AACjC;AAEA,SAAS,cAAc,OAAuB;AAC5C,QAAM,OAAO,QAAQ,KAAK,MAAM;AAChC,QAAM,WAAW,QAAQ,KAAK,CAAC,QAAQ;AACvC,QAAM,QAAQ,WAAW;AACzB,QAAM,WAAW,OAAO,WAAW,YAAY,EAAE,SAAS,GAAG,GAAG,EAAE,QAAQ,OAAO,EAAE;AACnF,SAAO,GAAG,IAAI,GAAG,KAAK,GAAG,WAAW,IAAI,QAAQ,KAAK,EAAE;AACzD;AAEA,SAAS,eAAe,OAAyC;AAC/D,MAAI,cAAc;AAClB,QAAM,WAAmC,CAAC;AAC1C,aAAW,QAAQ,OAAO;AACxB,mBAAe,aAAa,KAAK,YAAY;AAC7C,aAAS,KAAK,UAAU,KAAK,SAAS,KAAK,UAAU,KAAK,KAAK;AAAA,EACjE;AACA,SAAO;AAAA,IACL,OAAO,MAAM;AAAA,IACb,aAAa,cAAc,WAAW;AAAA,IACtC;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,OAAsB,OAA4B;AAC9E,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,WAAW,MAAM;AAAA,IACjB,QAAQ,MAAM;AAAA,IACd,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,YAAY,MAAM,cAAc;AAAA,IAChC,mBAAmB,MAAM,qBAAqB;AAAA,IAC9C,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,WAAW,MAAM,MAAM,SAAS;AAAA,IAChC,OAAO,eAAe,KAAK;AAAA,EAC7B;AACF;AAEA,eAAe,qBAAqB,KAAiD;AACnF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,uCAAuC,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AACA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,mDAAmD,qDAAqD,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrL;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,cAAwC;AAAA,IAC5C,KAAK,KAAK;AAAA,IACV,KAAK,KAAK;AAAA,IACV,UAAU,KAAK;AAAA,IACf,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,gBAAgB,KAAK,kBAAkB;AAAA,EACzC;AACA,SAAO;AAAA,IACL;AAAA,IACA,YAAY,KAAK;AAAA,IACjB,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB;AAAA,IACA,YAAY;AAAA,MACV;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB,KAAK;AAAA,MAC7B,iBAAiB,CAAC,KAAK,KAAK;AAAA,MAC5B,SAAS;AAAA,IACX;AAAA,EACF;AACF;AAoBA,SAAS,yBAAyB,KAAuB;AACvD,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO;AACpD,QAAM,YAAY;AAClB,SAAO,UAAU,SAAS,WACpB,OAAO,UAAU,YAAY,YAC5B,UAAU,QAAQ,SAAS,gBAAgB,MAC1C,UAAU,QAAQ,SAAS,cAAc,KAAK,UAAU,QAAQ,SAAS,mBAAmB;AACtG;AAEA,eAAe,gBACb,SACA,UACyC;AACzC,MAAI,SAAS,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC1C,MAAI;AACF,UAAM,KAAK,QAAQ,GAAG,KAAK,EAAE,UAAyB;AACtD,UAAM,OAAO,MAAM,GAChB,WAAW,cAAc,EACzB,OAAO,CAAC,MAAM,eAAe,CAAC,EAC9B,MAAM,MAAM,MAAM,QAAQ,EAC1B,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,mBAAmB,KAAK,QAAQ,cAAc,EACpD,MAAM,sBAAsB,KAAK,QAAQ,UAAU,EACnD,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ;AACX,WAAO,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,cAAc,IAAI,iBAAiB,KAAK,CAAC,CAAC,CAAC;AAAA,EACrG,SAAS,KAAK;AACZ,QAAI,yBAAyB,GAAG,EAAG,QAAO,oBAAI,IAAI;AAClD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,oBACb,SACA,cAC6C;AAC7C,MAAI,aAAa,WAAW,EAAG,QAAO,oBAAI,IAAI;AAC9C,MAAI;AACF,UAAM,KAAK,QAAQ,GAAG,KAAK,EAAE,UAAyB;AACtD,UAAM,OAAO,MAAM,GAChB,WAAW,mBAAmB,EAC9B,OAAO,CAAC,MAAM,UAAU,CAAC,EACzB,MAAM,MAAM,MAAM,YAAY,EAC9B,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,mBAAmB,KAAK,QAAQ,cAAc,EACpD,MAAM,cAAc,MAAM,IAAI,EAC9B,QAAQ;AACX,WAAO,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,SAAS,IAAI,SAAS,CAAC,CAAC,CAAC;AAAA,EACnF,SAAS,KAAK;AACZ,QAAI,yBAAyB,GAAG,EAAG,QAAO,oBAAI,IAAI;AAClD,UAAM;AAAA,EACR;AACF;AAEA,eAAe,6BACb,SACA,OAC2C;AAC3C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,eAAe,MAAM,KAAK,IAAI,IAAI,MAAM,MAAM,QAAQ,CAAC,SAAS,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,CAAC,CAAC,CAAC;AAClH,QAAM,iBAAiB,MAAM,oBAAoB,SAAS,YAAY;AACtE,QAAM,WAAW,oBAAI,IAAY;AACjC,MAAI,MAAM,QAAS,UAAS,IAAI,MAAM,OAAO;AAC7C,aAAW,aAAa,eAAe,OAAO,EAAG,UAAS,IAAI,UAAU,OAAO;AAC/E,QAAM,aAAa,MAAM,gBAAgB,SAAS,MAAM,KAAK,QAAQ,CAAC;AACtE,MAAI,gBAAgB,MAAM,UAAW,WAAW,IAAI,MAAM,OAAO,KAAK,OAAQ;AAC9E,MAAI,MAAM,SAAS;AACjB,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,kBAAkB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACvI;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI,CAAC,KAAK,YAAa;AACvB,UAAM,eAAe,eAAe,IAAI,KAAK,WAAW;AACxD,UAAM,YAAY,eAAe,WAAW,IAAI,aAAa,OAAO,IAAI;AACxE,QAAI,CAAC,gBAAgB,CAAC,WAAW;AAC/B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,4CAA4C,kDAAkD,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3K;AACA,QAAI,iBAAiB,UAAU,OAAO,cAAc,IAAI;AACtD,aAAO,aAAa;AAAA,QAClB,EAAE,IAAI,OAAO,OAAO,UAAU,4CAA4C,kDAAkD,EAAE;AAAA,QAC9H,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,QAAI,CAAC,cAAe,iBAAgB;AAAA,EACtC;AAEA,SAAO;AAAA,IACL,SAAS,eAAe,MAAM,MAAM,WAAW;AAAA,IAC/C,cAAc,eAAe,gBAAgB;AAAA,EAC/C;AACF;AAEA,eAAe,qBACb,KACA,SACA,iBACmC;AACnC,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,WAAW;AAAA,IAC9B;AAAA,IACA,MAAM;AAAA,MACJ,QAAQ,QAAQ,KAAK;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,cAAc,CAAC;AAAA,IACjB;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,oBAAoB,MAAM,qBAAqB,GAAG;AACxD,MAAI,6BAA6B,SAAU,QAAO;AAClD,QAAM,UAAU;AAChB,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,QAAQ,gBAAgB,UAAU;AAAA,IACtC,MAAM,IAAI,aAAa,IAAI,MAAM,KAAK;AAAA,IACtC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,IAC9C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,QAAQ,IAAI,aAAa,IAAI,QAAQ,KAAK;AAAA,IAC1C,YAAY,IAAI,aAAa,IAAI,YAAY,KAAK;AAAA,IAClD,cAAc,IAAI,aAAa,IAAI,cAAc,KAAK;AAAA,EACxD,CAAC;AACD,MAAI,CAAC,MAAM,SAAS;AAClB,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnI;AACA,QAAM,EAAE,MAAM,UAAU,QAAQ,QAAQ,YAAY,aAAa,IAAI,MAAM;AAC3E,QAAM,QAAQ,2BAA2B,OAAO;AAChD,MAAI,OAAQ,OAAM,SAAS;AAAA,WAClB,WAAY,OAAM,SAAS,EAAE,KAAK,iCAAiC,UAAU,EAAE;AACxF,MAAI,QAAQ;AACV,UAAM,UAAU,IAAI,kBAAkB,MAAM,CAAC;AAC7C,UAAM,MAAM;AAAA,MACV,EAAE,aAAa,EAAE,QAAQ,QAAQ,EAAE;AAAA,MACnC,EAAE,aAAa,EAAE,QAAQ,QAAQ,EAAE;AAAA,IACrC;AAAA,EACF;AACA,MAAI,cAAc;AAChB,UAAM,gBAAgB,MAAM;AAAA,MAC1B,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,WAAW;AAAA,QACX,OAAO,2BAA2B,OAAO;AAAA,MAC3C;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,IACvE;AACA,UAAM,mBAAmB,MAAM,KAAK,IAAI;AAAA,MACtC,cAAc,IAAI,CAAC,SAAS,WAAW,KAAK,KAAK,CAAC,EAAE,OAAO,CAAC,OAAqB,QAAQ,EAAE,CAAC;AAAA,IAC9F,CAAC;AACD,QAAI,iBAAiB,WAAW,GAAG;AACjC,aAAO,aAAa,KAAK,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,MAAM,UAAU,YAAY,EAAE,CAAC;AAAA,IACjF;AACA,UAAM,KAAK,EAAE,KAAK,iBAAiB;AAAA,EACrC;AACA,QAAM,QAAQ,MAAM,QAAQ,GAAG,MAAM,eAAe,KAAK;AACzD,QAAM,SAAS,MAAM;AAAA,IACnB,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO;AAAA,MACP,SAAS,OAAO,KAAK;AAAA,IACvB;AAAA,IACA,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACA,QAAM,WAAW,OAAO,IAAI,CAAC,UAAU,MAAM,EAAE;AAC/C,QAAM,QAAQ,SAAS,SACnB,MAAM;AAAA,IACJ,QAAQ;AAAA,IACR;AAAA,IACA,EAAE,OAAO,EAAE,KAAK,SAAS,GAAG,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,IAChH,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE,IACA,CAAC;AACL,QAAM,eAAe,oBAAI,IAAiC;AAC1D,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,WAAW,KAAK,KAAK;AACrC,QAAI,CAAC,QAAS;AACd,UAAM,SAAS,aAAa,IAAI,OAAO,KAAK,CAAC;AAC7C,WAAO,KAAK,IAAI;AAChB,iBAAa,IAAI,SAAS,MAAM;AAAA,EAClC;AACA,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,OAAO,IAAI,CAAC,UAAU,qBAAqB,OAAO,aAAa,IAAI,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAAA,IAC1F;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAAA,EACrD,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,oBAAoB,MAAM,qBAAqB,GAAG;AACxD,MAAI,6BAA6B,SAAU,QAAO;AAClD,QAAM,UAAU;AAChB,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnI;AACA,QAAM,SAAS,wBAAwB,UAAU,IAAI;AACrD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnI;AACA,QAAM,YAAY,MAAM,6BAA6B,SAAS,OAAO,IAAI;AACzE,MAAI,qBAAqB,SAAU,QAAO;AAE1C,QAAM,cAAgC;AAAA,IACpC,gBAAgB,QAAQ;AAAA,IACxB,UAAU,QAAQ;AAAA,IAClB,WAAW;AAAA,IACX,SAAS;AAAA,IACT,UAAU;AAAA,IACV,YAAY,QAAQ;AAAA,IACpB,cAAc,QAAQ,KAAK,eAAe;AAAA,IAC1C,SAAS,UAAU;AAAA;AAAA,IAEnB,aAAa,UAAU,UAAU,OAAQ,OAAO,KAAK,kBAAkB;AAAA,IACvE,YAAY,OAAO,KAAK;AAAA,IACxB,OAAO,OAAO,KAAK,SAAS;AAAA,IAC5B,cAAc,UAAU;AAAA,IACxB,OAAO,OAAO,KAAK,MAAM,IAAI,CAAC,MAAM,WAAW;AAAA,MAC7C,QAAQ,QAAQ;AAAA,MAChB,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK,aAAa;AAAA,MAC7B,aAAa,KAAK,eAAe;AAAA,MACjC,KAAK,KAAK,OAAO;AAAA,MACjB,cAAc,KAAK,gBAAgB;AAAA,MACnC,WAAW,KAAK,aAAa;AAAA,MAC7B,kBAAkB,KAAK;AAAA,MACvB,YAAY,KAAK,cAAc;AAAA;AAAA;AAAA,MAG/B,cAAc,KAAK,gBAAgB;AAAA,MACnC,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,EACJ;AAEA,QAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS,EAAE,GAAG,YAAY,CAAC;AAC3E,MAAI,CAAC,QAAQ,IAAI;AACf,WAAO,QAAQ;AAAA,EACjB;AACA,QAAM,iBAAmC,QAAQ,kBAC7C;AAAA,IACE,GAAG;AAAA,IACH,GAAG,QAAQ;AAAA,IACX,UAAU,YAAY;AAAA,IACtB,gBAAgB,YAAY;AAAA,IAC5B,YAAY,YAAY;AAAA,IACxB,SAAS,YAAY;AAAA,IACrB,WAAW,YAAY;AAAA,IACvB,SAAS,YAAY;AAAA,IACrB,aAAa,YAAY;AAAA,IACzB,cAAc,YAAY;AAAA,IAC1B,OAAO,YAAY;AAAA,EACrB,IACA;AAEJ,QAAM,aAAa,QAAQ,WAAW,UAAU,QAAQ,YAAY;AACpE,MAAI;AACF,UAAM,eAAe,MAAM,WAAW;AAAA,MACpC;AAAA,MACA,EAAE,OAAO,gBAAgB,KAAK,QAAQ,WAAW;AAAA,IACnD;AACA,UAAM,UAAU,aAAa,QAAQ;AACrC,QAAI,OAAO,YAAY,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACnJ;AACA,QAAI;AACF,YAAM,WAAW;AAAA,QACf;AAAA,QACA,EAAE,OAAO,EAAE,IAAI,SAAS,iBAAiB,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW;AAAA,MACzF;AAAA,IACF,SAAS,aAAa;AACpB,UAAI;AACF,cAAM,WAAW;AAAA,UACf;AAAA,UACA,EAAE,OAAO,EAAE,IAAI,QAAQ,GAAG,KAAK,QAAQ,WAAW;AAAA,QACpD;AAAA,MACF,SAAS,mBAAmB;AAC1B,eAAO,MAAM,uFAAkF;AAAA,UAC7F,KAAK;AAAA,UACL;AAAA,UACA,YAAY,QAAQ;AAAA,UACpB,UAAU,QAAQ;AAAA,UAClB,gBAAgB,QAAQ;AAAA,QAC1B,CAAC;AAAA,MACH;AACA,YAAM;AAAA,IACR;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACjE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACpC,aAAa,EAAE,OAAO;AAAA,EACtB,UAAU,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC;AAC/D,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,WAAW,EAAE,OAAO;AAAA,EACpB,QAAQ,EAAE,OAAO;AAAA,EACjB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO;AACT,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,OAAO,EAAE,MAAM,iBAAiB;AAAA,YAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,YACpC,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAC5B,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,YAChC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,UACpC,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MAChF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7051.1.2e20648fd5",
+  "version": "0.6.8-develop.7056.1.1a563a270d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7051.1.2e20648fd5",
-    "@open-mercato/shared": "0.6.8-develop.7051.1.2e20648fd5",
-    "@open-mercato/ui": "0.6.8-develop.7051.1.2e20648fd5",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7056.1.1a563a270d",
+    "@open-mercato/shared": "0.6.8-develop.7056.1.1a563a270d",
+    "@open-mercato/ui": "0.6.8-develop.7056.1.1a563a270d",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7051.1.2e20648fd5",
-    "@open-mercato/shared": "0.6.8-develop.7051.1.2e20648fd5",
-    "@open-mercato/ui": "0.6.8-develop.7051.1.2e20648fd5",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7056.1.1a563a270d",
+    "@open-mercato/shared": "0.6.8-develop.7056.1.1a563a270d",
+    "@open-mercato/ui": "0.6.8-develop.7056.1.1a563a270d",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/communicationChannelsFixtures.ts

@@ -42,7 +42,18 @@ export async function isChannelSeedingAvailable(
 export async function seedConnectedChannel(
   request: APIRequestContext,
   token: string,
-  input: { displayName?: string; externalIdentifier?: string } = {},
+  input: {
+    displayName?: string;
+    externalIdentifier?: string;
+    /**
+     * `chat` connects the non-email stub instead: a channel whose senders carry
+     * an opaque handle and no address, and whose `externalIdentifier` is NULL —
+     * the shape a real Discord/Slack channel has. Use it for anything asserting
+     * the hub's sender-identity contract (#4975); the default `email` flavor
+     * cannot prove it, because it can only ever supply email-shaped data.
+     */
+    providerFlavor?: 'email' | 'chat';
+  } = {},
 ): Promise<string> {
   const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {
     token,
@@ -115,6 +126,63 @@ export async function seedInboundMessage(
  * Best-effort delete of a seeded channel via the owner-scoped DELETE route.
  * Safe to call with a null id in `finally`.
  */
+/**
+ * Ingest an inbound chat message through the REAL `ingest_inbound_message`
+ * command: the stub adapter normalizes the frame and the hub composes the
+ * platform message via `messages.messages.compose`.
+ *
+ * Unlike {@link seedInboundMessage}, nothing here is short-circuited — no row is
+ * inserted behind the compose path — so a hub contract the provider cannot
+ * satisfy fails the test instead of hiding behind seeded data. That bypass is
+ * exactly why CI was green while every real inbound Discord message was rejected
+ * (#4975).
+ *
+ * The sender is identified only by `senderIdentifier` (a Discord snowflake, a
+ * Slack member id, …). There is deliberately no way to pass an address.
+ */
+export async function ingestInboundChatMessage(
+  request: APIRequestContext,
+  token: string,
+  input: {
+    channelId: string;
+    senderIdentifier: string;
+    senderDisplayName?: string;
+    body?: string;
+    externalMessageId: string;
+    externalConversationId: string;
+  },
+): Promise<{
+  status: string;
+  messageId: string | null;
+  conversationId: string | null;
+  channelLinkId: string | null;
+  channelType: string | null;
+}> {
+  const response = await apiRequest(request, 'POST', TEST_SEED_PATH, {
+    token,
+    data: { action: 'ingest-inbound', ...input },
+  });
+  expect(
+    response.status(),
+    'POST /api/communication_channels/test-seed (ingest-inbound) should return 201 — ' +
+      'a non-201 here means the hub rejected a sender with no email address',
+  ).toBe(201);
+  const body = await readJsonSafe<{
+    status?: string;
+    messageId?: string | null;
+    conversationId?: string | null;
+    channelLinkId?: string | null;
+    channelType?: string | null;
+  }>(response);
+  return {
+    status: body?.status ?? 'unknown',
+    messageId: body?.messageId ?? null,
+    conversationId: body?.conversationId ?? null,
+    channelLinkId: body?.channelLinkId ?? null,
+    channelType: body?.channelType ?? null,
+  };
+}
+
 export async function deleteChannelIfExists(
   request: APIRequestContext,
   token: string | null,

package/src/modules/communication_channels/api/post/channels/[id]/test-send/route.ts

@@ -13,6 +13,10 @@ import {
   channelOrgScopeWhere,
 } from '../../../../../lib/access-control'
 import { refreshCredentialsIfNeeded } from '../../../../../lib/credential-refresh'
+import {
+  MAX_OUTBOUND_RECIPIENT_LENGTH,
+  validateOutboundRecipient,
+} from '../../../../../lib/outbound-recipient'
 import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
 
 type RbacServiceLike = {
@@ -33,8 +37,15 @@ export const metadata = {
   },
 }
 
+// `to` is deliberately NOT typed as an email here. The recipient shape depends
+// on the provider (an email address for Gmail/IMAP, a channel snowflake for
+// Discord), and the adapter is only known once the channel is loaded — so the
+// schema accepts any non-empty single-line string and `validateOutboundRecipient`
+// applies the provider-appropriate rules below, defaulting to email. The CR/LF
+// rejection stays at the schema level so a header-injection attempt is refused
+// before the request reaches the channel lookup or the mutation guard.
 const bodySchema = z.object({
-  to: z.string().email(),
+  to: z.string().min(1).max(MAX_OUTBOUND_RECIPIENT_LENGTH).regex(/^[^\r\n]*$/),
   subject: z.string().min(1).max(500).optional(),
   body: z.string().max(50_000).optional(),
 })
@@ -170,6 +181,11 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
     )
   }
 
+  const recipientCheck = validateOutboundRecipient(body.to, adapter.capabilities)
+  if (!recipientCheck.ok) {
+    return NextResponse.json({ error: recipientCheck.error }, { status: 422 })
+  }
+
   // Resolve credentials + optionally refresh.
   let credentials: Record<string, unknown> = {}
   let credentialsService: CredentialsServiceLike | null = null