@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.8.1-develop.7441.1.b42958b98c

package/dist/modules/warranty_claims/api/events/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/events/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimEvent } from '../../data/entities'\nimport { commentClaimInputSchema, type CommentClaimInput } from '../../data/validators'\nimport { requireScopedClaim, WARRANTY_CLAIM_RESOURCE_KIND, type WarrantyClaimScope } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst eventListQuerySchema = z.object({\n  claimId: z.string().uuid(),\n})\n\ntype EventRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value\n  const record = toRecord(value)\n  return typeof record.id === 'string' ? record.id : null\n}\n\nfunction toIso(value: unknown): string | null {\n  if (value instanceof Date) return value.toISOString()\n  if (typeof value === 'string') {\n    const date = new Date(value)\n    return Number.isNaN(date.getTime()) ? value : date.toISOString()\n  }\n  return null\n}\n\nfunction serializeEvent(event: WarrantyClaimEvent) {\n  return {\n    id: event.id,\n    claimId: relationId(event.claim),\n    kind: event.kind,\n    visibility: event.visibility,\n    body: event.body ?? null,\n    payload: event.payload ?? null,\n    actorUserId: event.actorUserId ?? null,\n    actorCustomerId: event.actorCustomerId ?? null,\n    createdAt: toIso(event.createdAt),\n  }\n}\n\nasync function resolveEventContext(req: Request): Promise<EventRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationId,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nasync function runCommentGuard(\n  req: Request,\n  context: EventRouteContext,\n  input: CommentClaimInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveEventContext(req)\n    const url = new URL(req.url)\n    const query = eventListQuerySchema.parse({ claimId: url.searchParams.get('claimId') ?? undefined })\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    const events = await findWithDecryption(\n      context.em,\n      WarrantyClaimEvent,\n      { claim: claim.id, tenantId: context.scope.tenantId, organizationId: context.scope.organizationId },\n      { orderBy: { createdAt: 'ASC' } },\n      context.scope,\n    )\n    return NextResponse.json({ items: events.map(serializeEvent) })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.events.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.notFound', 'Warranty claim not found.') }, { status: 404 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveEventContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const parsed = commentClaimInputSchema.parse(payload)\n    const input: CommentClaimInput = { ...parsed, actorCustomerId: undefined }\n    const guarded = await runCommentGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload\n      ? { ...commentClaimInputSchema.parse(guarded.modifiedPayload), actorCustomerId: undefined }\n      : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<CommentClaimInput, { claimId: string }>(\n      'warranty_claims.claim.comment',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.claimId })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.events.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nconst eventSchema = z.object({\n  id: z.string().uuid(),\n  claimId: z.string().uuid().nullable(),\n  kind: z.string(),\n  visibility: z.string(),\n  body: z.string().nullable(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  actorUserId: z.string().uuid().nullable(),\n  actorCustomerId: z.string().uuid().nullable(),\n  createdAt: z.string().nullable(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim timeline events',\n  methods: {\n    GET: {\n      summary: 'List timeline events for a claim',\n      query: eventListQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Timeline events',\n          schema: z.object({ items: z.array(eventSchema) }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Append a staff comment to a claim timeline',\n      requestBody: { contentType: 'application/json', schema: commentClaimInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Comment appended',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,0BAA0B;AAEnC,SAAS,0BAA0B;AACnC,SAAS,+BAAuD;AAChE,SAAS,oBAAoB,oCAA6D;AAC1F,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAWM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAAA,EAC1E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACrD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,SAAS,WAAW,MAAM,KAAK;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,MAAM,MAAM,SAAS;AAAA,EAClC;AACF;AAEA,eAAe,oBAAoB,KAA0C;AAC3E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB;AAAA,MACxB,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,gBACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,qBAAqB,MAAM,EAAE,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK,OAAU,CAAC;AAClG,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,UAAM,SAAS,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,OAAO,MAAM,IAAI,UAAU,QAAQ,MAAM,UAAU,gBAAgB,QAAQ,MAAM,eAAe;AAAA,MAClG,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC,QAAQ;AAAA,IACV;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,IAAI,cAAc,EAAE,CAAC;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,wBAAwB,MAAM,OAAO;AACpD,UAAM,QAA2B,EAAE,GAAG,QAAQ,iBAAiB,OAAU;AACzE,UAAM,UAAU,MAAM,gBAAgB,KAAK,SAAS,KAAK;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,EAAE,GAAG,wBAAwB,MAAM,QAAQ,eAAe,GAAG,iBAAiB,OAAU,IACxF;AAEJ,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,QAAQ,CAAC;AAAA,EACzF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,OAAO;AAAA,EACrB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MAChF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimEvent } from '../../data/entities'\nimport { commentClaimInputSchema, type CommentClaimInput } from '../../data/validators'\nimport { requireScopedClaim, WARRANTY_CLAIM_RESOURCE_KIND, type WarrantyClaimScope } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst eventListQuerySchema = z.object({\n  claimId: z.string().uuid(),\n})\n\ntype EventRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction relationId(value: unknown): string | null {\n  if (typeof value === 'string') return value\n  const record = toRecord(value)\n  return typeof record.id === 'string' ? record.id : null\n}\n\nfunction toIso(value: unknown): string | null {\n  if (value instanceof Date) return value.toISOString()\n  if (typeof value === 'string') {\n    const date = new Date(value)\n    return Number.isNaN(date.getTime()) ? value : date.toISOString()\n  }\n  return null\n}\n\nfunction serializeEvent(event: WarrantyClaimEvent) {\n  return {\n    id: event.id,\n    claimId: relationId(event.claim),\n    kind: event.kind,\n    visibility: event.visibility,\n    body: event.body ?? null,\n    payload: event.payload ?? null,\n    actorUserId: event.actorUserId ?? null,\n    actorCustomerId: event.actorCustomerId ?? null,\n    createdAt: toIso(event.createdAt),\n  }\n}\n\nasync function resolveEventContext(req: Request): Promise<EventRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope,\n      selectedOrganizationId: organizationId,\n      organizationIds: organizationScope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nasync function runCommentGuard(\n  req: Request,\n  context: EventRouteContext,\n  input: CommentClaimInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveEventContext(req)\n    const url = new URL(req.url)\n    const query = eventListQuerySchema.parse({ claimId: url.searchParams.get('claimId') ?? undefined })\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    const events = await findWithDecryption(\n      context.em,\n      WarrantyClaimEvent,\n      { claim: claim.id, tenantId: context.scope.tenantId, organizationId: context.scope.organizationId },\n      { orderBy: { createdAt: 'ASC' } },\n      context.scope,\n    )\n    return NextResponse.json({ items: events.map(serializeEvent) })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.events.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.notFound', 'Warranty claim not found.') }, { status: 404 })\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveEventContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const parsed = commentClaimInputSchema.parse(payload)\n    const input: CommentClaimInput = { ...parsed, actorCustomerId: undefined }\n    const guarded = await runCommentGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload\n      ? { ...commentClaimInputSchema.parse(guarded.modifiedPayload), actorCustomerId: undefined }\n      : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<CommentClaimInput, { claimId: string }>(\n      'warranty_claims.claim.comment',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.claimId })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.events.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nconst eventSchema = z.object({\n  id: z.string().uuid(),\n  claimId: z.string().uuid().nullable(),\n  kind: z.string(),\n  visibility: z.string(),\n  body: z.string().nullable(),\n  payload: z.record(z.string(), z.unknown()).nullable(),\n  actorUserId: z.string().uuid().nullable(),\n  actorCustomerId: z.string().uuid().nullable(),\n  createdAt: z.string().nullable(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim timeline events',\n  methods: {\n    GET: {\n      summary: 'List timeline events for a claim',\n      query: eventListQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Timeline events',\n          schema: z.object({ items: z.array(eventSchema) }),\n        },\n      ],\n    },\n    POST: {\n      summary: 'Append a staff comment to a claim timeline',\n      requestBody: { contentType: 'application/json', schema: commentClaimInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Comment appended',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,0BAA0B;AAEnC,SAAS,0BAA0B;AACnC,SAAS,+BAAuD;AAChE,SAAS,oBAAoB,oCAA6D;AAC1F,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC;AAWM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAAA,EAC1E,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,OAAO,OAAO,OAAO,WAAW,OAAO,KAAK;AACrD;AAEA,SAAS,MAAM,OAA+B;AAC5C,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,WAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AAAA,EACjE;AACA,SAAO;AACT;AAEA,SAAS,eAAe,OAA2B;AACjD,SAAO;AAAA,IACL,IAAI,MAAM;AAAA,IACV,SAAS,WAAW,MAAM,KAAK;AAAA,IAC/B,MAAM,MAAM;AAAA,IACZ,YAAY,MAAM;AAAA,IAClB,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,MAAM,MAAM,SAAS;AAAA,EAClC;AACF;AAEA,eAAe,oBAAoB,KAA0C;AAC3E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,MACA,wBAAwB;AAAA,MACxB,iBAAiB,mBAAmB,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAC9E,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,gBACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,qBAAqB,MAAM,EAAE,SAAS,IAAI,aAAa,IAAI,SAAS,KAAK,OAAU,CAAC;AAClG,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,UAAM,SAAS,MAAM;AAAA,MACnB,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,OAAO,MAAM,IAAI,UAAU,QAAQ,MAAM,UAAU,gBAAgB,QAAQ,MAAM,eAAe;AAAA,MAClG,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC,QAAQ;AAAA,IACV;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,OAAO,IAAI,cAAc,EAAE,CAAC;AAAA,EAChE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,qCAAqC,EAAE,IAAI,CAAC;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChI;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,wBAAwB,MAAM,OAAO;AACpD,UAAM,QAA2B,EAAE,GAAG,QAAQ,iBAAiB,OAAU;AACzE,UAAM,UAAU,MAAM,gBAAgB,KAAK,SAAS,KAAK;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,EAAE,GAAG,wBAAwB,MAAM,QAAQ,eAAe,GAAG,iBAAiB,OAAU,IACxF;AAEJ,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,QAAQ,CAAC;AAAA,EACzF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACpC,MAAM,EAAE,OAAO;AAAA,EACf,YAAY,EAAE,OAAO;AAAA,EACrB,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EACpD,aAAa,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACxC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,EAAE,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,wBAAwB;AAAA,MAChF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/external/claims/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
 import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
@@ -51,7 +52,7 @@ async function resolveActionContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }

package/dist/modules/warranty_claims/api/external/claims/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/warranty_claims/api/external/claims/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport {\n  checkRateLimit,\n  RATE_LIMIT_ERROR_FALLBACK,\n  RATE_LIMIT_ERROR_KEY,\n} from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaim, WarrantyClaimEvent, WarrantyClaimLine } from '../../../data/entities'\nimport {\n  externalClaimIntakeSchema,\n  externalClaimLookupQuerySchema,\n  type ClaimCreateInput,\n  type ExternalClaimIntakeInput,\n  type ExternalClaimLookupQuery,\n} from '../../../data/validators'\nimport { resolveEffectiveWarrantyClaimSettings } from '../../../lib/settings'\nimport {\n  buildExternalClaimCreateInput,\n  createAndSubmitExternalClaim,\n  createExternalIntakeDeps,\n  resolveExternalReferences,\n  resolveSkuProduct,\n  type ExternalIntakeCommandBus,\n} from '../../../lib/externalIntake'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  em: EntityManager\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.external.submit'] },\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.external.view'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  if (value instanceof Date) return value.toISOString()\n  const date = new Date(value)\n  return Number.isNaN(date.getTime()) ? value : date.toISOString()\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const commandAuth = auth.isApiKey === true && typeof auth.keyId === 'string' && auth.keyId.length > 0\n    ? { ...auth, sub: auth.keyId }\n    : auth\n  return {\n    ctx: {\n      container,\n      auth: commandAuth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    em: (container.resolve('em') as EntityManager).fork(),\n    translate,\n  }\n}\n\nasync function runCreateGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: null,\n      operation: 'create',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nasync function loadClaimByExternalRef(\n  context: ActionRouteContext,\n  externalRef: string,\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    context.em,\n    WarrantyClaim,\n    {\n      externalRef,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      deletedAt: null,\n    },\n    {},\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadClaimByLookup(\n  context: ActionRouteContext,\n  query: ExternalClaimLookupQuery,\n): Promise<WarrantyClaim | null> {\n  const where: Record<string, unknown> = {\n    tenantId: context.tenantId,\n    organizationId: context.organizationId,\n    deletedAt: null,\n  }\n  if (query.id) where.id = query.id\n  else if (query.claimNumber) where.claimNumber = query.claimNumber\n  else if (query.externalRef) where.externalRef = query.externalRef\n  return findOneWithDecryption(\n    context.em,\n    WarrantyClaim,\n    where,\n    {},\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadClaimLines(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<WarrantyClaimLine[]> {\n  return findWithDecryption(\n    context.em,\n    WarrantyClaimLine,\n    {\n      claim: claimId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      deletedAt: null,\n    },\n    { orderBy: { lineNo: 'ASC' } },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadCustomerVisibleEvents(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<WarrantyClaimEvent[]> {\n  return findWithDecryption(\n    context.em,\n    WarrantyClaimEvent,\n    {\n      claim: claimId,\n      visibility: 'customer',\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    { orderBy: { createdAt: 'ASC' } },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nfunction serializeSubmitResponse(claim: WarrantyClaim, lines: WarrantyClaimLine[]) {\n  return {\n    ok: true,\n    id: claim.id,\n    claimNumber: claim.claimNumber,\n    status: claim.status,\n    externalRef: claim.externalRef ?? null,\n    lines: lines.map((line) => ({\n      id: line.id,\n      warrantyStatus: line.warrantyStatus ?? null,\n    })),\n  }\n}\n\nfunction serializeLookupResponse(\n  claim: WarrantyClaim,\n  lines: WarrantyClaimLine[],\n  events: WarrantyClaimEvent[],\n) {\n  return {\n    ok: true,\n    claim: {\n      id: claim.id,\n      claimNumber: claim.claimNumber,\n      externalRef: claim.externalRef ?? null,\n      status: claim.status,\n      claimType: claim.claimType,\n      channel: claim.channel,\n      priority: claim.priority,\n      createdAt: toIso(claim.createdAt),\n      updatedAt: toIso(claim.updatedAt),\n      submittedAt: toIso(claim.submittedAt),\n      resolvedAt: toIso(claim.resolvedAt),\n      closedAt: toIso(claim.closedAt),\n      totalClaimedAmount: claim.totalClaimedAmount ?? null,\n      totalApprovedAmount: claim.totalApprovedAmount ?? null,\n      currencyCode: claim.currencyCode ?? null,\n      resolutionSummary: claim.resolutionSummary ?? null,\n    },\n    lines: lines.map((line) => ({\n      id: line.id,\n      lineNo: line.lineNo,\n      productId: line.productId ?? null,\n      sku: line.sku ?? null,\n      productName: line.productName ?? null,\n      serialNumber: line.serialNumber ?? null,\n      qtyClaimed: line.qtyClaimed ?? null,\n      qtyApproved: line.qtyApproved ?? null,\n      lineStatus: line.lineStatus,\n      disposition: line.disposition ?? null,\n      warrantyStatus: line.warrantyStatus ?? null,\n    })),\n    events: events.map((event) => ({\n      id: event.id,\n      kind: event.kind,\n      body: event.body ?? null,\n      createdAt: toIso(event.createdAt),\n    })),\n  }\n}\n\nasync function submitResponseForClaim(\n  context: ActionRouteContext,\n  claim: WarrantyClaim,\n  status: 200 | 201,\n) {\n  const lines = await loadClaimLines(context, claim.id)\n  return NextResponse.json(serializeSubmitResponse(claim, lines), { status })\n}\n\n\nfunction resolveEncryptionService(context: ActionRouteContext): TenantDataEncryptionService | null {\n  try {\n    return context.ctx.container.resolve<TenantDataEncryptionService>('tenantEncryptionService')\n  } catch {\n    return null\n  }\n}\n\nasync function resolveLineProducts(\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<ExternalClaimIntakeInput> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const deps = createExternalIntakeDeps(context.em, context.translate, scope, resolveEncryptionService(context))\n  const lines = await Promise.all(input.lines.map(async (line) => {\n    if (line.productId || !line.sku) return line\n    const product = await resolveSkuProduct(deps, line.sku)\n    if (!product) return line\n    return {\n      ...line,\n      productId: product.productId,\n      productName: line.productName ?? product.productName,\n    }\n  }))\n  return { ...input, lines }\n}\n\nasync function buildCreateInput(\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<ClaimCreateInput> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const deps = createExternalIntakeDeps(context.em, context.translate, scope, resolveEncryptionService(context))\n  const resolvedReferences = await resolveExternalReferences(deps, input)\n  const effectiveInput = await resolveLineProducts(context, input)\n  const settings = await resolveEffectiveWarrantyClaimSettings(context.em, scope)\n  return buildExternalClaimCreateInput(effectiveInput, resolvedReferences, settings, scope)\n}\n\n// Headless intake is authenticated but otherwise unbounded: each accepted request\n// burns a claim number and fans out events, notifications, and search indexing, and\n// the caller-chosen `externalRef` defeats the idempotency dedupe. Throttle per API key.\nconst externalIntakeRateLimitConfig = readEndpointRateLimitConfig('WARRANTY_EXTERNAL_INTAKE', {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'warranty_claims:external_intake',\n})\n\nasync function enforceExternalIntakeRateLimit(\n  context: ActionRouteContext,\n): Promise<NextResponse | null> {\n  let rateLimiterService: RateLimiterService | null = null\n  try {\n    rateLimiterService = context.ctx.container.resolve('rateLimiterService') as RateLimiterService\n  } catch {\n    return null\n  }\n  if (!rateLimiterService) return null\n  const principal = context.ctx.auth?.sub ?? 'anonymous'\n  return checkRateLimit(\n    rateLimiterService,\n    externalIntakeRateLimitConfig,\n    `${context.tenantId}:${principal}`,\n    context.translate(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n  )\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const throttled = await enforceExternalIntakeRateLimit(context)\n    if (throttled) return throttled\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const input = externalClaimIntakeSchema.parse(payload)\n\n    const existing = await loadClaimByExternalRef(context, input.externalRef)\n    if (existing) return submitResponseForClaim(context, existing, 200)\n\n    const guarded = await runCreateGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload\n      ? externalClaimIntakeSchema.parse(guarded.modifiedPayload)\n      : input\n    const createInput = await buildCreateInput(context, guardedInput)\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const execution = await createAndSubmitExternalClaim({\n      commandBus: commandBus as unknown as ExternalIntakeCommandBus,\n      commandCtx: context.ctx,\n      createInput,\n      scope: { tenantId: context.tenantId, organizationId: context.organizationId },\n      externalRef: guardedInput.externalRef,\n      loadExistingByExternalRef: async (externalRef) => {\n        const existingClaim = await loadClaimByExternalRef(context, externalRef)\n        return existingClaim ? { id: existingClaim.id, status: existingClaim.status } : null\n      },\n      saveFailedError: () => new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }),\n    })\n    if (execution.outcome === 'existing') {\n      const winner = await loadClaimByExternalRef(context, guardedInput.externalRef)\n      if (winner) return submitResponseForClaim(context, winner, 200)\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') })\n    }\n    const claimId = execution.claimId\n\n    await guarded.runAfterSuccess()\n\n    const claim = await findOneWithDecryption(\n      context.em,\n      WarrantyClaim,\n      {\n        id: claimId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        deletedAt: null,\n      },\n      {},\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n    )\n    if (!claim) {\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') })\n    }\n    return submitResponseForClaim(context, claim, 201)\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.external.claims.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const url = new URL(req.url)\n    const query = externalClaimLookupQuerySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await loadClaimByLookup(context, query)\n    if (!claim) {\n      return NextResponse.json(\n        { error: context.translate('warranty_claims.errors.notFound', 'Claim not found.') },\n        { status: 404 },\n      )\n    }\n    const [lines, events] = await Promise.all([\n      loadClaimLines(context, claim.id),\n      loadCustomerVisibleEvents(context, claim.id),\n    ])\n    return NextResponse.json(serializeLookupResponse(claim, lines, events))\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.external.claims.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nconst submitLineSchema = z.object({\n  id: z.string().uuid(),\n  warrantyStatus: z.string().nullable(),\n})\n\nconst submitResponseSchema = z.object({\n  ok: z.literal(true),\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  status: z.string(),\n  externalRef: z.string().nullable(),\n  lines: z.array(submitLineSchema),\n})\n\nconst lookupClaimSchema = z.object({\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  externalRef: z.string().nullable(),\n  status: z.string(),\n  claimType: z.string(),\n  channel: z.string(),\n  priority: z.string(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  submittedAt: z.string().nullable(),\n  resolvedAt: z.string().nullable(),\n  closedAt: z.string().nullable(),\n  totalClaimedAmount: z.string().nullable(),\n  totalApprovedAmount: z.string().nullable(),\n  currencyCode: z.string().nullable(),\n  resolutionSummary: z.string().nullable(),\n})\n\nconst lookupLineSchema = z.object({\n  id: z.string().uuid(),\n  lineNo: z.number().int(),\n  productId: z.string().uuid().nullable(),\n  sku: z.string().nullable(),\n  productName: z.string().nullable(),\n  serialNumber: z.string().nullable(),\n  qtyClaimed: z.string().nullable(),\n  qtyApproved: z.string().nullable(),\n  lineStatus: z.string(),\n  disposition: z.string().nullable(),\n  warrantyStatus: z.string().nullable(),\n})\n\nconst lookupEventSchema = z.object({\n  id: z.string().uuid(),\n  kind: z.string(),\n  body: z.string().nullable(),\n  createdAt: z.string().nullable(),\n})\n\nconst lookupResponseSchema = z.object({\n  ok: z.literal(true),\n  claim: lookupClaimSchema,\n  lines: z.array(lookupLineSchema),\n  events: z.array(lookupEventSchema),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims External',\n  summary: 'External warranty claim intake',\n  methods: {\n    POST: {\n      summary: 'Submit an external warranty claim intake',\n      requestBody: { contentType: 'application/json', schema: externalClaimIntakeSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Claim created and submitted',\n          schema: submitResponseSchema,\n        },\n        {\n          status: 200,\n          description: 'Existing idempotent claim',\n          schema: submitResponseSchema,\n        },\n      ],\n    },\n    GET: {\n      summary: 'Get an external claim status by id, claim number, or external reference',\n      query: externalClaimLookupQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'External claim status',\n          schema: lookupResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,eAAe,oBAAoB,yBAAyB;AACrE;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,6CAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAoC;AAE7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAUtC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAChF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AACjE;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,cAAc,KAAK,aAAa,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IAChG,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAC3B;AACJ,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,eACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,uBACb,SACA,aAC+B;AAC/B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,kBACb,SACA,OAC+B;AAC/B,QAAM,QAAiC;AAAA,IACrC,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,WAAW;AAAA,EACb;AACA,MAAI,MAAM,GAAI,OAAM,KAAK,MAAM;AAAA,WACtB,MAAM,YAAa,OAAM,cAAc,MAAM;AAAA,WAC7C,MAAM,YAAa,OAAM,cAAc,MAAM;AACtD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,eACb,SACA,SAC8B;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,IAC7B,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,0BACb,SACA,SAC+B;AAC/B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,IAChC,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,SAAS,wBAAwB,OAAsB,OAA4B;AACjF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,QAAQ,MAAM;AAAA,IACd,aAAa,MAAM,eAAe;AAAA,IAClC,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,wBACP,OACA,OACA,QACA;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,IAAI,MAAM;AAAA,MACV,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM,eAAe;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,aAAa,MAAM,MAAM,WAAW;AAAA,MACpC,YAAY,MAAM,MAAM,UAAU;AAAA,MAClC,UAAU,MAAM,MAAM,QAAQ;AAAA,MAC9B,oBAAoB,MAAM,sBAAsB;AAAA,MAChD,qBAAqB,MAAM,uBAAuB;AAAA,MAClD,cAAc,MAAM,gBAAgB;AAAA,MACpC,mBAAmB,MAAM,qBAAqB;AAAA,IAChD;AAAA,IACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,aAAa;AAAA,MAC7B,KAAK,KAAK,OAAO;AAAA,MACjB,aAAa,KAAK,eAAe;AAAA,MACjC,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK,eAAe;AAAA,MACjC,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,MAC7B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM,QAAQ;AAAA,MACpB,WAAW,MAAM,MAAM,SAAS;AAAA,IAClC,EAAE;AAAA,EACJ;AACF;AAEA,eAAe,uBACb,SACA,OACA,QACA;AACA,QAAM,QAAQ,MAAM,eAAe,SAAS,MAAM,EAAE;AACpD,SAAO,aAAa,KAAK,wBAAwB,OAAO,KAAK,GAAG,EAAE,OAAO,CAAC;AAC5E;AAGA,SAAS,yBAAyB,SAAiE;AACjG,MAAI;AACF,WAAO,QAAQ,IAAI,UAAU,QAAqC,yBAAyB;AAAA,EAC7F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,oBACb,SACA,OACmC;AACnC,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,OAAO,yBAAyB,QAAQ,IAAI,QAAQ,WAAW,OAAO,yBAAyB,OAAO,CAAC;AAC7G,QAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,OAAO,SAAS;AAC9D,QAAI,KAAK,aAAa,CAAC,KAAK,IAAK,QAAO;AACxC,UAAM,UAAU,MAAM,kBAAkB,MAAM,KAAK,GAAG;AACtD,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW,QAAQ;AAAA,MACnB,aAAa,KAAK,eAAe,QAAQ;AAAA,IAC3C;AAAA,EACF,CAAC,CAAC;AACF,SAAO,EAAE,GAAG,OAAO,MAAM;AAC3B;AAEA,eAAe,iBACb,SACA,OAC2B;AAC3B,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,OAAO,yBAAyB,QAAQ,IAAI,QAAQ,WAAW,OAAO,yBAAyB,OAAO,CAAC;AAC7G,QAAM,qBAAqB,MAAM,0BAA0B,MAAM,KAAK;AACtE,QAAM,iBAAiB,MAAM,oBAAoB,SAAS,KAAK;AAC/D,QAAM,WAAW,MAAM,sCAAsC,QAAQ,IAAI,KAAK;AAC9E,SAAO,8BAA8B,gBAAgB,oBAAoB,UAAU,KAAK;AAC1F;AAKA,MAAM,gCAAgC,4BAA4B,4BAA4B;AAAA,EAC5F,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb,CAAC;AAED,eAAe,+BACb,SAC8B;AAC9B,MAAI,qBAAgD;AACpD,MAAI;AACF,yBAAqB,QAAQ,IAAI,UAAU,QAAQ,oBAAoB;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,mBAAoB,QAAO;AAChC,QAAM,YAAY,QAAQ,IAAI,MAAM,OAAO;AAC3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,QAAQ,QAAQ,IAAI,SAAS;AAAA,IAChC,QAAQ,UAAU,sBAAsB,yBAAyB;AAAA,EACnE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,YAAY,MAAM,+BAA+B,OAAO;AAC9D,QAAI,UAAW,QAAO;AACtB,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,QAAQ,0BAA0B,MAAM,OAAO;AAErD,UAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,WAAW;AACxE,QAAI,SAAU,QAAO,uBAAuB,SAAS,UAAU,GAAG;AAElE,UAAM,UAAU,MAAM,eAAe,KAAK,SAAS,KAAK;AACxD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,0BAA0B,MAAM,QAAQ,eAAe,IACvD;AACJ,UAAM,cAAc,MAAM,iBAAiB,SAAS,YAAY;AAEhE,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,YAAY,MAAM,6BAA6B;AAAA,MACnD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,OAAO,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,MAC5E,aAAa,aAAa;AAAA,MAC1B,2BAA2B,OAAO,gBAAgB;AAChD,cAAM,gBAAgB,MAAM,uBAAuB,SAAS,WAAW;AACvE,eAAO,gBAAgB,EAAE,IAAI,cAAc,IAAI,QAAQ,cAAc,OAAO,IAAI;AAAA,MAClF;AAAA,MACA,iBAAiB,MAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IACnJ,CAAC;AACD,QAAI,UAAU,YAAY,YAAY;AACpC,YAAM,SAAS,MAAM,uBAAuB,SAAS,aAAa,WAAW;AAC7E,UAAI,OAAQ,QAAO,uBAAuB,SAAS,QAAQ,GAAG;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IAClI;AACA,UAAM,UAAU,UAAU;AAE1B,UAAM,QAAQ,gBAAgB;AAE9B,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,WAAW;AAAA,MACb;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,IACvE;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IAClI;AACA,WAAO,uBAAuB,SAAS,OAAO,GAAG;AAAA,EACnD,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACvF,UAAM,QAAQ,MAAM,kBAAkB,SAAS,KAAK;AACpD,QAAI,CAAC,OAAO;AACV,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,QAAQ,UAAU,mCAAmC,kBAAkB,EAAE;AAAA,QAClF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,CAAC,OAAO,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,MACxC,eAAe,SAAS,MAAM,EAAE;AAAA,MAChC,0BAA0B,SAAS,MAAM,EAAE;AAAA,IAC7C,CAAC;AACD,WAAO,aAAa,KAAK,wBAAwB,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,QAAQ,EAAE,MAAM,iBAAiB;AACnC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport {\n  checkRateLimit,\n  RATE_LIMIT_ERROR_FALLBACK,\n  RATE_LIMIT_ERROR_KEY,\n} from '@open-mercato/shared/lib/ratelimit/helpers'\nimport type { RateLimiterService } from '@open-mercato/shared/lib/ratelimit/service'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaim, WarrantyClaimEvent, WarrantyClaimLine } from '../../../data/entities'\nimport {\n  externalClaimIntakeSchema,\n  externalClaimLookupQuerySchema,\n  type ClaimCreateInput,\n  type ExternalClaimIntakeInput,\n  type ExternalClaimLookupQuery,\n} from '../../../data/validators'\nimport { resolveEffectiveWarrantyClaimSettings } from '../../../lib/settings'\nimport {\n  buildExternalClaimCreateInput,\n  createAndSubmitExternalClaim,\n  createExternalIntakeDeps,\n  resolveExternalReferences,\n  resolveSkuProduct,\n  type ExternalIntakeCommandBus,\n} from '../../../lib/externalIntake'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'\nimport type { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  em: EntityManager\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.external.submit'] },\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.external.view'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  if (value instanceof Date) return value.toISOString()\n  const date = new Date(value)\n  return Number.isNaN(date.getTime()) ? value : date.toISOString()\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const commandAuth = auth.isApiKey === true && typeof auth.keyId === 'string' && auth.keyId.length > 0\n    ? { ...auth, sub: auth.keyId }\n    : auth\n  return {\n    ctx: {\n      container,\n      auth: commandAuth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    em: (container.resolve('em') as EntityManager).fork(),\n    translate,\n  }\n}\n\nasync function runCreateGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: null,\n      operation: 'create',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nasync function loadClaimByExternalRef(\n  context: ActionRouteContext,\n  externalRef: string,\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    context.em,\n    WarrantyClaim,\n    {\n      externalRef,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      deletedAt: null,\n    },\n    {},\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadClaimByLookup(\n  context: ActionRouteContext,\n  query: ExternalClaimLookupQuery,\n): Promise<WarrantyClaim | null> {\n  const where: Record<string, unknown> = {\n    tenantId: context.tenantId,\n    organizationId: context.organizationId,\n    deletedAt: null,\n  }\n  if (query.id) where.id = query.id\n  else if (query.claimNumber) where.claimNumber = query.claimNumber\n  else if (query.externalRef) where.externalRef = query.externalRef\n  return findOneWithDecryption(\n    context.em,\n    WarrantyClaim,\n    where,\n    {},\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadClaimLines(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<WarrantyClaimLine[]> {\n  return findWithDecryption(\n    context.em,\n    WarrantyClaimLine,\n    {\n      claim: claimId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n      deletedAt: null,\n    },\n    { orderBy: { lineNo: 'ASC' } },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nasync function loadCustomerVisibleEvents(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<WarrantyClaimEvent[]> {\n  return findWithDecryption(\n    context.em,\n    WarrantyClaimEvent,\n    {\n      claim: claimId,\n      visibility: 'customer',\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    { orderBy: { createdAt: 'ASC' } },\n    { tenantId: context.tenantId, organizationId: context.organizationId },\n  )\n}\n\nfunction serializeSubmitResponse(claim: WarrantyClaim, lines: WarrantyClaimLine[]) {\n  return {\n    ok: true,\n    id: claim.id,\n    claimNumber: claim.claimNumber,\n    status: claim.status,\n    externalRef: claim.externalRef ?? null,\n    lines: lines.map((line) => ({\n      id: line.id,\n      warrantyStatus: line.warrantyStatus ?? null,\n    })),\n  }\n}\n\nfunction serializeLookupResponse(\n  claim: WarrantyClaim,\n  lines: WarrantyClaimLine[],\n  events: WarrantyClaimEvent[],\n) {\n  return {\n    ok: true,\n    claim: {\n      id: claim.id,\n      claimNumber: claim.claimNumber,\n      externalRef: claim.externalRef ?? null,\n      status: claim.status,\n      claimType: claim.claimType,\n      channel: claim.channel,\n      priority: claim.priority,\n      createdAt: toIso(claim.createdAt),\n      updatedAt: toIso(claim.updatedAt),\n      submittedAt: toIso(claim.submittedAt),\n      resolvedAt: toIso(claim.resolvedAt),\n      closedAt: toIso(claim.closedAt),\n      totalClaimedAmount: claim.totalClaimedAmount ?? null,\n      totalApprovedAmount: claim.totalApprovedAmount ?? null,\n      currencyCode: claim.currencyCode ?? null,\n      resolutionSummary: claim.resolutionSummary ?? null,\n    },\n    lines: lines.map((line) => ({\n      id: line.id,\n      lineNo: line.lineNo,\n      productId: line.productId ?? null,\n      sku: line.sku ?? null,\n      productName: line.productName ?? null,\n      serialNumber: line.serialNumber ?? null,\n      qtyClaimed: line.qtyClaimed ?? null,\n      qtyApproved: line.qtyApproved ?? null,\n      lineStatus: line.lineStatus,\n      disposition: line.disposition ?? null,\n      warrantyStatus: line.warrantyStatus ?? null,\n    })),\n    events: events.map((event) => ({\n      id: event.id,\n      kind: event.kind,\n      body: event.body ?? null,\n      createdAt: toIso(event.createdAt),\n    })),\n  }\n}\n\nasync function submitResponseForClaim(\n  context: ActionRouteContext,\n  claim: WarrantyClaim,\n  status: 200 | 201,\n) {\n  const lines = await loadClaimLines(context, claim.id)\n  return NextResponse.json(serializeSubmitResponse(claim, lines), { status })\n}\n\n\nfunction resolveEncryptionService(context: ActionRouteContext): TenantDataEncryptionService | null {\n  try {\n    return context.ctx.container.resolve<TenantDataEncryptionService>('tenantEncryptionService')\n  } catch {\n    return null\n  }\n}\n\nasync function resolveLineProducts(\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<ExternalClaimIntakeInput> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const deps = createExternalIntakeDeps(context.em, context.translate, scope, resolveEncryptionService(context))\n  const lines = await Promise.all(input.lines.map(async (line) => {\n    if (line.productId || !line.sku) return line\n    const product = await resolveSkuProduct(deps, line.sku)\n    if (!product) return line\n    return {\n      ...line,\n      productId: product.productId,\n      productName: line.productName ?? product.productName,\n    }\n  }))\n  return { ...input, lines }\n}\n\nasync function buildCreateInput(\n  context: ActionRouteContext,\n  input: ExternalClaimIntakeInput,\n): Promise<ClaimCreateInput> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const deps = createExternalIntakeDeps(context.em, context.translate, scope, resolveEncryptionService(context))\n  const resolvedReferences = await resolveExternalReferences(deps, input)\n  const effectiveInput = await resolveLineProducts(context, input)\n  const settings = await resolveEffectiveWarrantyClaimSettings(context.em, scope)\n  return buildExternalClaimCreateInput(effectiveInput, resolvedReferences, settings, scope)\n}\n\n// Headless intake is authenticated but otherwise unbounded: each accepted request\n// burns a claim number and fans out events, notifications, and search indexing, and\n// the caller-chosen `externalRef` defeats the idempotency dedupe. Throttle per API key.\nconst externalIntakeRateLimitConfig = readEndpointRateLimitConfig('WARRANTY_EXTERNAL_INTAKE', {\n  points: 60,\n  duration: 60,\n  keyPrefix: 'warranty_claims:external_intake',\n})\n\nasync function enforceExternalIntakeRateLimit(\n  context: ActionRouteContext,\n): Promise<NextResponse | null> {\n  let rateLimiterService: RateLimiterService | null = null\n  try {\n    rateLimiterService = context.ctx.container.resolve('rateLimiterService') as RateLimiterService\n  } catch {\n    return null\n  }\n  if (!rateLimiterService) return null\n  const principal = context.ctx.auth?.sub ?? 'anonymous'\n  return checkRateLimit(\n    rateLimiterService,\n    externalIntakeRateLimitConfig,\n    `${context.tenantId}:${principal}`,\n    context.translate(RATE_LIMIT_ERROR_KEY, RATE_LIMIT_ERROR_FALLBACK),\n  )\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const throttled = await enforceExternalIntakeRateLimit(context)\n    if (throttled) return throttled\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const input = externalClaimIntakeSchema.parse(payload)\n\n    const existing = await loadClaimByExternalRef(context, input.externalRef)\n    if (existing) return submitResponseForClaim(context, existing, 200)\n\n    const guarded = await runCreateGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload\n      ? externalClaimIntakeSchema.parse(guarded.modifiedPayload)\n      : input\n    const createInput = await buildCreateInput(context, guardedInput)\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const execution = await createAndSubmitExternalClaim({\n      commandBus: commandBus as unknown as ExternalIntakeCommandBus,\n      commandCtx: context.ctx,\n      createInput,\n      scope: { tenantId: context.tenantId, organizationId: context.organizationId },\n      externalRef: guardedInput.externalRef,\n      loadExistingByExternalRef: async (externalRef) => {\n        const existingClaim = await loadClaimByExternalRef(context, externalRef)\n        return existingClaim ? { id: existingClaim.id, status: existingClaim.status } : null\n      },\n      saveFailedError: () => new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }),\n    })\n    if (execution.outcome === 'existing') {\n      const winner = await loadClaimByExternalRef(context, guardedInput.externalRef)\n      if (winner) return submitResponseForClaim(context, winner, 200)\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') })\n    }\n    const claimId = execution.claimId\n\n    await guarded.runAfterSuccess()\n\n    const claim = await findOneWithDecryption(\n      context.em,\n      WarrantyClaim,\n      {\n        id: claimId,\n        tenantId: context.tenantId,\n        organizationId: context.organizationId,\n        deletedAt: null,\n      },\n      {},\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n    )\n    if (!claim) {\n      throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') })\n    }\n    return submitResponseForClaim(context, claim, 201)\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.external.claims.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const url = new URL(req.url)\n    const query = externalClaimLookupQuerySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await loadClaimByLookup(context, query)\n    if (!claim) {\n      return NextResponse.json(\n        { error: context.translate('warranty_claims.errors.notFound', 'Claim not found.') },\n        { status: 404 },\n      )\n    }\n    const [lines, events] = await Promise.all([\n      loadClaimLines(context, claim.id),\n      loadCustomerVisibleEvents(context, claim.id),\n    ])\n    return NextResponse.json(serializeLookupResponse(claim, lines, events))\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.external.claims.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nconst submitLineSchema = z.object({\n  id: z.string().uuid(),\n  warrantyStatus: z.string().nullable(),\n})\n\nconst submitResponseSchema = z.object({\n  ok: z.literal(true),\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  status: z.string(),\n  externalRef: z.string().nullable(),\n  lines: z.array(submitLineSchema),\n})\n\nconst lookupClaimSchema = z.object({\n  id: z.string().uuid(),\n  claimNumber: z.string(),\n  externalRef: z.string().nullable(),\n  status: z.string(),\n  claimType: z.string(),\n  channel: z.string(),\n  priority: z.string(),\n  createdAt: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n  submittedAt: z.string().nullable(),\n  resolvedAt: z.string().nullable(),\n  closedAt: z.string().nullable(),\n  totalClaimedAmount: z.string().nullable(),\n  totalApprovedAmount: z.string().nullable(),\n  currencyCode: z.string().nullable(),\n  resolutionSummary: z.string().nullable(),\n})\n\nconst lookupLineSchema = z.object({\n  id: z.string().uuid(),\n  lineNo: z.number().int(),\n  productId: z.string().uuid().nullable(),\n  sku: z.string().nullable(),\n  productName: z.string().nullable(),\n  serialNumber: z.string().nullable(),\n  qtyClaimed: z.string().nullable(),\n  qtyApproved: z.string().nullable(),\n  lineStatus: z.string(),\n  disposition: z.string().nullable(),\n  warrantyStatus: z.string().nullable(),\n})\n\nconst lookupEventSchema = z.object({\n  id: z.string().uuid(),\n  kind: z.string(),\n  body: z.string().nullable(),\n  createdAt: z.string().nullable(),\n})\n\nconst lookupResponseSchema = z.object({\n  ok: z.literal(true),\n  claim: lookupClaimSchema,\n  lines: z.array(lookupLineSchema),\n  events: z.array(lookupEventSchema),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims External',\n  summary: 'External warranty claim intake',\n  methods: {\n    POST: {\n      summary: 'Submit an external warranty claim intake',\n      requestBody: { contentType: 'application/json', schema: externalClaimIntakeSchema },\n      responses: [\n        {\n          status: 201,\n          description: 'Claim created and submitted',\n          schema: submitResponseSchema,\n        },\n        {\n          status: 200,\n          description: 'Existing idempotent claim',\n          schema: submitResponseSchema,\n        },\n      ],\n    },\n    GET: {\n      summary: 'Get an external claim status by id, claim number, or external reference',\n      query: externalClaimLookupQuerySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'External claim status',\n          schema: lookupResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,mCAAmC;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAGP,SAAS,eAAe,oBAAoB,yBAAyB;AACrE;AAAA,EACE;AAAA,EACA;AAAA,OAIK;AACP,SAAS,6CAA6C;AACtD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,oCAAoC;AAE7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAUtC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAChF,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,+BAA+B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,iBAAiB,KAAM,QAAO,MAAM,YAAY;AACpD,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,QAAQ,KAAK,YAAY;AACjE;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,cAAc,KAAK,aAAa,QAAQ,OAAO,KAAK,UAAU,YAAY,KAAK,MAAM,SAAS,IAChG,EAAE,GAAG,MAAM,KAAK,KAAK,MAAM,IAC3B;AACJ,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA,MAAM;AAAA,MACN,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,IACpD;AAAA,EACF;AACF;AAEA,eAAe,eACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,uBACb,SACA,aAC+B;AAC/B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,kBACb,SACA,OAC+B;AAC/B,QAAM,QAAiC;AAAA,IACrC,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,WAAW;AAAA,EACb;AACA,MAAI,MAAM,GAAI,OAAM,KAAK,MAAM;AAAA,WACtB,MAAM,YAAa,OAAM,cAAc,MAAM;AAAA,WAC7C,MAAM,YAAa,OAAM,cAAc,MAAM;AACtD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,eACb,SACA,SAC8B;AAC9B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB,WAAW;AAAA,IACb;AAAA,IACA,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,IAC7B,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,eAAe,0BACb,SACA,SAC+B;AAC/B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,MACE,OAAO;AAAA,MACP,YAAY;AAAA,MACZ,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,IAChC,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,EACvE;AACF;AAEA,SAAS,wBAAwB,OAAsB,OAA4B;AACjF,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,IAAI,MAAM;AAAA,IACV,aAAa,MAAM;AAAA,IACnB,QAAQ,MAAM;AAAA,IACd,aAAa,MAAM,eAAe;AAAA,IAClC,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,EACJ;AACF;AAEA,SAAS,wBACP,OACA,OACA,QACA;AACA,SAAO;AAAA,IACL,IAAI;AAAA,IACJ,OAAO;AAAA,MACL,IAAI,MAAM;AAAA,MACV,aAAa,MAAM;AAAA,MACnB,aAAa,MAAM,eAAe;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,WAAW,MAAM;AAAA,MACjB,SAAS,MAAM;AAAA,MACf,UAAU,MAAM;AAAA,MAChB,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,WAAW,MAAM,MAAM,SAAS;AAAA,MAChC,aAAa,MAAM,MAAM,WAAW;AAAA,MACpC,YAAY,MAAM,MAAM,UAAU;AAAA,MAClC,UAAU,MAAM,MAAM,QAAQ;AAAA,MAC9B,oBAAoB,MAAM,sBAAsB;AAAA,MAChD,qBAAqB,MAAM,uBAAuB;AAAA,MAClD,cAAc,MAAM,gBAAgB;AAAA,MACpC,mBAAmB,MAAM,qBAAqB;AAAA,IAChD;AAAA,IACA,OAAO,MAAM,IAAI,CAAC,UAAU;AAAA,MAC1B,IAAI,KAAK;AAAA,MACT,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK,aAAa;AAAA,MAC7B,KAAK,KAAK,OAAO;AAAA,MACjB,aAAa,KAAK,eAAe;AAAA,MACjC,cAAc,KAAK,gBAAgB;AAAA,MACnC,YAAY,KAAK,cAAc;AAAA,MAC/B,aAAa,KAAK,eAAe;AAAA,MACjC,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK,eAAe;AAAA,MACjC,gBAAgB,KAAK,kBAAkB;AAAA,IACzC,EAAE;AAAA,IACF,QAAQ,OAAO,IAAI,CAAC,WAAW;AAAA,MAC7B,IAAI,MAAM;AAAA,MACV,MAAM,MAAM;AAAA,MACZ,MAAM,MAAM,QAAQ;AAAA,MACpB,WAAW,MAAM,MAAM,SAAS;AAAA,IAClC,EAAE;AAAA,EACJ;AACF;AAEA,eAAe,uBACb,SACA,OACA,QACA;AACA,QAAM,QAAQ,MAAM,eAAe,SAAS,MAAM,EAAE;AACpD,SAAO,aAAa,KAAK,wBAAwB,OAAO,KAAK,GAAG,EAAE,OAAO,CAAC;AAC5E;AAGA,SAAS,yBAAyB,SAAiE;AACjG,MAAI;AACF,WAAO,QAAQ,IAAI,UAAU,QAAqC,yBAAyB;AAAA,EAC7F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAe,oBACb,SACA,OACmC;AACnC,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,OAAO,yBAAyB,QAAQ,IAAI,QAAQ,WAAW,OAAO,yBAAyB,OAAO,CAAC;AAC7G,QAAM,QAAQ,MAAM,QAAQ,IAAI,MAAM,MAAM,IAAI,OAAO,SAAS;AAC9D,QAAI,KAAK,aAAa,CAAC,KAAK,IAAK,QAAO;AACxC,UAAM,UAAU,MAAM,kBAAkB,MAAM,KAAK,GAAG;AACtD,QAAI,CAAC,QAAS,QAAO;AACrB,WAAO;AAAA,MACL,GAAG;AAAA,MACH,WAAW,QAAQ;AAAA,MACnB,aAAa,KAAK,eAAe,QAAQ;AAAA,IAC3C;AAAA,EACF,CAAC,CAAC;AACF,SAAO,EAAE,GAAG,OAAO,MAAM;AAC3B;AAEA,eAAe,iBACb,SACA,OAC2B;AAC3B,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,OAAO,yBAAyB,QAAQ,IAAI,QAAQ,WAAW,OAAO,yBAAyB,OAAO,CAAC;AAC7G,QAAM,qBAAqB,MAAM,0BAA0B,MAAM,KAAK;AACtE,QAAM,iBAAiB,MAAM,oBAAoB,SAAS,KAAK;AAC/D,QAAM,WAAW,MAAM,sCAAsC,QAAQ,IAAI,KAAK;AAC9E,SAAO,8BAA8B,gBAAgB,oBAAoB,UAAU,KAAK;AAC1F;AAKA,MAAM,gCAAgC,4BAA4B,4BAA4B;AAAA,EAC5F,QAAQ;AAAA,EACR,UAAU;AAAA,EACV,WAAW;AACb,CAAC;AAED,eAAe,+BACb,SAC8B;AAC9B,MAAI,qBAAgD;AACpD,MAAI;AACF,yBAAqB,QAAQ,IAAI,UAAU,QAAQ,oBAAoB;AAAA,EACzE,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI,CAAC,mBAAoB,QAAO;AAChC,QAAM,YAAY,QAAQ,IAAI,MAAM,OAAO;AAC3C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,GAAG,QAAQ,QAAQ,IAAI,SAAS;AAAA,IAChC,QAAQ,UAAU,sBAAsB,yBAAyB;AAAA,EACnE;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,YAAY,MAAM,+BAA+B,OAAO;AAC9D,QAAI,UAAW,QAAO;AACtB,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,QAAQ,0BAA0B,MAAM,OAAO;AAErD,UAAM,WAAW,MAAM,uBAAuB,SAAS,MAAM,WAAW;AACxE,QAAI,SAAU,QAAO,uBAAuB,SAAS,UAAU,GAAG;AAElE,UAAM,UAAU,MAAM,eAAe,KAAK,SAAS,KAAK;AACxD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,0BAA0B,MAAM,QAAQ,eAAe,IACvD;AACJ,UAAM,cAAc,MAAM,iBAAiB,SAAS,YAAY;AAEhE,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,YAAY,MAAM,6BAA6B;AAAA,MACnD;AAAA,MACA,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,OAAO,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,MAC5E,aAAa,aAAa;AAAA,MAC1B,2BAA2B,OAAO,gBAAgB;AAChD,cAAM,gBAAgB,MAAM,uBAAuB,SAAS,WAAW;AACvE,eAAO,gBAAgB,EAAE,IAAI,cAAc,IAAI,QAAQ,cAAc,OAAO,IAAI;AAAA,MAClF;AAAA,MACA,iBAAiB,MAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IACnJ,CAAC;AACD,QAAI,UAAU,YAAY,YAAY;AACpC,YAAM,SAAS,MAAM,uBAAuB,SAAS,aAAa,WAAW;AAC7E,UAAI,OAAQ,QAAO,uBAAuB,SAAS,QAAQ,GAAG;AAC9D,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IAClI;AACA,UAAM,UAAU,UAAU;AAE1B,UAAM,QAAQ,gBAAgB;AAE9B,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ;AAAA,QACxB,WAAW;AAAA,MACb;AAAA,MACA,CAAC;AAAA,MACD,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,IACvE;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,sCAAsC,+BAA+B,EAAE,CAAC;AAAA,IAClI;AACA,WAAO,uBAAuB,SAAS,OAAO,GAAG;AAAA,EACnD,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,+BAA+B,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACvF,UAAM,QAAQ,MAAM,kBAAkB,SAAS,KAAK;AACpD,QAAI,CAAC,OAAO;AACV,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,QAAQ,UAAU,mCAAmC,kBAAkB,EAAE;AAAA,QAClF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,CAAC,OAAO,MAAM,IAAI,MAAM,QAAQ,IAAI;AAAA,MACxC,eAAe,SAAS,MAAM,EAAE;AAAA,MAChC,0BAA0B,SAAS,MAAM,EAAE;AAAA,IAC7C,CAAC;AACD,WAAO,aAAa,KAAK,wBAAwB,OAAO,OAAO,MAAM,CAAC;AAAA,EACxE,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,8CAA8C,EAAE,IAAI,CAAC;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEA,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,QAAQ,EAAE,OAAO;AAAA,EACjB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EAAE,MAAM,gBAAgB;AACjC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,aAAa,EAAE,OAAO;AAAA,EACtB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,QAAQ,EAAE,OAAO;AAAA,EACjB,WAAW,EAAE,OAAO;AAAA,EACpB,SAAS,EAAE,OAAO;AAAA,EAClB,UAAU,EAAE,OAAO;AAAA,EACnB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,oBAAoB,EAAE,OAAO,EAAE,SAAS;AAAA,EACxC,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,mBAAmB,EAAE,OAAO,EAAE,SAAS;AACzC,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,QAAQ,EAAE,OAAO,EAAE,IAAI;AAAA,EACvB,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACtC,KAAK,EAAE,OAAO,EAAE,SAAS;AAAA,EACzB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,YAAY,EAAE,OAAO,EAAE,SAAS;AAAA,EAChC,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,YAAY,EAAE,OAAO;AAAA,EACrB,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,gBAAgB,EAAE,OAAO,EAAE,SAAS;AACtC,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO;AAAA,EACP,OAAO,EAAE,MAAM,gBAAgB;AAAA,EAC/B,QAAQ,EAAE,MAAM,iBAAiB;AACnC,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,0BAA0B;AAAA,MAClF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/receiving/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -44,7 +45,7 @@ async function resolveActionContext(req, translate) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required.") });
   }

package/dist/modules/warranty_claims/api/receiving/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/receiving/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  claimConditionGradeSchema,\n  claimLineReceiveSchema,\n  claimLineReleaseQuarantineSchema,\n  type ClaimLineReceiveInput,\n  type ClaimLineReleaseQuarantineInput,\n} from '../../data/validators'\nimport { WARRANTY_CLAIM_LINE_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReceivingAction =\n  | { kind: 'receive'; input: ClaimLineReceiveInput }\n  | { kind: 'release'; input: ClaimLineReleaseQuarantineInput }\n\nconst uuid = z.string().uuid()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst receiveBodySchema = z\n  .object({\n    lineId: uuid,\n    conditionGrade: claimConditionGradeSchema,\n    inspectionNotes: z.string().trim().max(4000).optional(),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\nconst releaseBodySchema = z\n  .object({\n    lineId: uuid,\n    action: z.literal('release'),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\nconst receivingBodySchema = z.union([releaseBodySchema, receiveBodySchema])\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.receiving.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReceivingAction(payload: Record<string, unknown>, context: ActionRouteContext): ReceivingAction {\n  const releaseBody = releaseBodySchema.safeParse(payload)\n  if (releaseBody.success) {\n    const scopedPayload = withScopedPayload({\n      id: releaseBody.data.lineId,\n      updatedAt: releaseBody.data.updatedAt,\n    }, context.ctx, context.translate)\n    return { kind: 'release', input: claimLineReleaseQuarantineSchema.parse(scopedPayload) }\n  }\n  const body = receiveBodySchema.parse(payload)\n  const scopedPayload = withScopedPayload({\n    id: body.lineId,\n    conditionGrade: body.conditionGrade,\n    inspectionNotes: body.inspectionNotes,\n    updatedAt: body.updatedAt,\n  }, context.ctx, context.translate)\n  return { kind: 'receive', input: claimLineReceiveSchema.parse(scopedPayload) }\n}\n\nfunction toGuardedAction(kind: ReceivingAction['kind'], payload: Record<string, unknown>): ReceivingAction {\n  if (kind === 'release') {\n    return { kind, input: claimLineReleaseQuarantineSchema.parse(payload) }\n  }\n  return { kind, input: claimLineReceiveSchema.parse(payload) }\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  action: ReceivingAction,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_LINE_RESOURCE_KIND,\n      resourceId: action.input.id,\n      operation: 'custom',\n      mutationPayload: { ...action.input },\n    },\n  })\n}\n\nasync function executeReceivingAction(\n  commandBus: CommandBus,\n  action: ReceivingAction,\n  ctx: CommandRuntimeContext,\n  translate: ActionRouteContext['translate'],\n): Promise<{ lineId: string; claimId: string }> {\n  if (action.kind === 'release') {\n    const { result } = await commandBus.execute<ClaimLineReleaseQuarantineInput, { lineId: string; claimId: string }>(\n      'warranty_claims.claim_line.release_quarantine',\n      { input: action.input, ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    return result\n  }\n  const { result } = await commandBus.execute<ClaimLineReceiveInput, { lineId: string; claimId: string }>(\n    'warranty_claims.claim_line.receive',\n    { input: action.input, ctx },\n  )\n  if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n  return result\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const action = toReceivingAction(payload, context)\n    const guarded = await runGuard(req, context, action)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandAction = guarded.modifiedPayload ? toGuardedAction(action.kind, guarded.modifiedPayload) : action\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const result = await executeReceivingAction(commandBus, commandAction, context.ctx, translate)\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, lineId: result.lineId, claimId: result.claimId })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.receiving.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Receive or release a warranty claim line',\n  methods: {\n    POST: {\n      summary: 'Grade a received line or release its quarantine hold',\n      requestBody: { contentType: 'application/json', schema: receivingBodySchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Receiving action applied',\n          schema: z.object({\n            ok: z.boolean(),\n            lineId: z.string().uuid(),\n            claimId: z.string().uuid(),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAa7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACtD,WAAW;AACb,CAAC,EACA,OAAO;AAEV,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ,EAAE,QAAQ,SAAS;AAAA,EAC3B,WAAW;AACb,CAAC,EACA,OAAO;AAEV,MAAM,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,iBAAiB,CAAC;AAEnE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACnF;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,SAAkC,SAA8C;AACzG,QAAM,cAAc,kBAAkB,UAAU,OAAO;AACvD,MAAI,YAAY,SAAS;AACvB,UAAMA,iBAAgB,kBAAkB;AAAA,MACtC,IAAI,YAAY,KAAK;AAAA,MACrB,WAAW,YAAY,KAAK;AAAA,IAC9B,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,WAAO,EAAE,MAAM,WAAW,OAAO,iCAAiC,MAAMA,cAAa,EAAE;AAAA,EACzF;AACA,QAAM,OAAO,kBAAkB,MAAM,OAAO;AAC5C,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,iBAAiB,KAAK;AAAA,IACtB,WAAW,KAAK;AAAA,EAClB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,EAAE,MAAM,WAAW,OAAO,uBAAuB,MAAM,aAAa,EAAE;AAC/E;AAEA,SAAS,gBAAgB,MAA+B,SAAmD;AACzG,MAAI,SAAS,WAAW;AACtB,WAAO,EAAE,MAAM,OAAO,iCAAiC,MAAM,OAAO,EAAE;AAAA,EACxE;AACA,SAAO,EAAE,MAAM,OAAO,uBAAuB,MAAM,OAAO,EAAE;AAC9D;AAEA,eAAe,SACb,KACA,SACA,QACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO,MAAM;AAAA,MACzB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,OAAO,MAAM;AAAA,IACrC;AAAA,EACF,CAAC;AACH;AAEA,eAAe,uBACb,YACA,QACA,KACA,WAC8C;AAC9C,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7B;AACA,QAAI,CAACA,QAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,WAAOA;AAAA,EACT;AACA,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,IAClC;AAAA,IACA,EAAE,OAAO,OAAO,OAAO,IAAI;AAAA,EAC7B;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,kBAAkB,SAAS,OAAO;AACjD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,MAAM;AACnD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,gBAAgB,QAAQ,kBAAkB,gBAAgB,OAAO,MAAM,QAAQ,eAAe,IAAI;AAExG,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,SAAS,MAAM,uBAAuB,YAAY,eAAe,QAAQ,KAAK,SAAS;AAE7F,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ,CAAC;AAAA,EACvF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC5E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ;AAAA,YACd,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,YACxB,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,UAC3B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  claimConditionGradeSchema,\n  claimLineReceiveSchema,\n  claimLineReleaseQuarantineSchema,\n  type ClaimLineReceiveInput,\n  type ClaimLineReleaseQuarantineInput,\n} from '../../data/validators'\nimport { WARRANTY_CLAIM_LINE_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReceivingAction =\n  | { kind: 'receive'; input: ClaimLineReceiveInput }\n  | { kind: 'release'; input: ClaimLineReleaseQuarantineInput }\n\nconst uuid = z.string().uuid()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst receiveBodySchema = z\n  .object({\n    lineId: uuid,\n    conditionGrade: claimConditionGradeSchema,\n    inspectionNotes: z.string().trim().max(4000).optional(),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\nconst releaseBodySchema = z\n  .object({\n    lineId: uuid,\n    action: z.literal('release'),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\nconst receivingBodySchema = z.union([releaseBodySchema, receiveBodySchema])\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.receiving.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReceivingAction(payload: Record<string, unknown>, context: ActionRouteContext): ReceivingAction {\n  const releaseBody = releaseBodySchema.safeParse(payload)\n  if (releaseBody.success) {\n    const scopedPayload = withScopedPayload({\n      id: releaseBody.data.lineId,\n      updatedAt: releaseBody.data.updatedAt,\n    }, context.ctx, context.translate)\n    return { kind: 'release', input: claimLineReleaseQuarantineSchema.parse(scopedPayload) }\n  }\n  const body = receiveBodySchema.parse(payload)\n  const scopedPayload = withScopedPayload({\n    id: body.lineId,\n    conditionGrade: body.conditionGrade,\n    inspectionNotes: body.inspectionNotes,\n    updatedAt: body.updatedAt,\n  }, context.ctx, context.translate)\n  return { kind: 'receive', input: claimLineReceiveSchema.parse(scopedPayload) }\n}\n\nfunction toGuardedAction(kind: ReceivingAction['kind'], payload: Record<string, unknown>): ReceivingAction {\n  if (kind === 'release') {\n    return { kind, input: claimLineReleaseQuarantineSchema.parse(payload) }\n  }\n  return { kind, input: claimLineReceiveSchema.parse(payload) }\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  action: ReceivingAction,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_LINE_RESOURCE_KIND,\n      resourceId: action.input.id,\n      operation: 'custom',\n      mutationPayload: { ...action.input },\n    },\n  })\n}\n\nasync function executeReceivingAction(\n  commandBus: CommandBus,\n  action: ReceivingAction,\n  ctx: CommandRuntimeContext,\n  translate: ActionRouteContext['translate'],\n): Promise<{ lineId: string; claimId: string }> {\n  if (action.kind === 'release') {\n    const { result } = await commandBus.execute<ClaimLineReleaseQuarantineInput, { lineId: string; claimId: string }>(\n      'warranty_claims.claim_line.release_quarantine',\n      { input: action.input, ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    return result\n  }\n  const { result } = await commandBus.execute<ClaimLineReceiveInput, { lineId: string; claimId: string }>(\n    'warranty_claims.claim_line.receive',\n    { input: action.input, ctx },\n  )\n  if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n  return result\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const action = toReceivingAction(payload, context)\n    const guarded = await runGuard(req, context, action)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandAction = guarded.modifiedPayload ? toGuardedAction(action.kind, guarded.modifiedPayload) : action\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const result = await executeReceivingAction(commandBus, commandAction, context.ctx, translate)\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, lineId: result.lineId, claimId: result.claimId })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.receiving.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Receive or release a warranty claim line',\n  methods: {\n    POST: {\n      summary: 'Grade a received line or release its quarantine hold',\n      requestBody: { contentType: 'application/json', schema: receivingBodySchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Receiving action applied',\n          schema: z.object({\n            ok: z.boolean(),\n            lineId: z.string().uuid(),\n            claimId: z.string().uuid(),\n          }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,yCAAyC;AAClD,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAa7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,gBAAgB;AAAA,EAChB,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACtD,WAAW;AACb,CAAC,EACA,OAAO;AAEV,MAAM,oBAAoB,EACvB,OAAO;AAAA,EACN,QAAQ;AAAA,EACR,QAAQ,EAAE,QAAQ,SAAS;AAAA,EAC3B,WAAW;AACb,CAAC,EACA,OAAO;AAEV,MAAM,sBAAsB,EAAE,MAAM,CAAC,mBAAmB,iBAAiB,CAAC;AAEnE,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kCAAkC,EAAE;AACnF;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,SAAkC,SAA8C;AACzG,QAAM,cAAc,kBAAkB,UAAU,OAAO;AACvD,MAAI,YAAY,SAAS;AACvB,UAAMA,iBAAgB,kBAAkB;AAAA,MACtC,IAAI,YAAY,KAAK;AAAA,MACrB,WAAW,YAAY,KAAK;AAAA,IAC9B,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,WAAO,EAAE,MAAM,WAAW,OAAO,iCAAiC,MAAMA,cAAa,EAAE;AAAA,EACzF;AACA,QAAM,OAAO,kBAAkB,MAAM,OAAO;AAC5C,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,KAAK;AAAA,IACT,gBAAgB,KAAK;AAAA,IACrB,iBAAiB,KAAK;AAAA,IACtB,WAAW,KAAK;AAAA,EAClB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,EAAE,MAAM,WAAW,OAAO,uBAAuB,MAAM,aAAa,EAAE;AAC/E;AAEA,SAAS,gBAAgB,MAA+B,SAAmD;AACzG,MAAI,SAAS,WAAW;AACtB,WAAO,EAAE,MAAM,OAAO,iCAAiC,MAAM,OAAO,EAAE;AAAA,EACxE;AACA,SAAO,EAAE,MAAM,OAAO,uBAAuB,MAAM,OAAO,EAAE;AAC9D;AAEA,eAAe,SACb,KACA,SACA,QACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,OAAO,MAAM;AAAA,MACzB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,OAAO,MAAM;AAAA,IACrC;AAAA,EACF,CAAC;AACH;AAEA,eAAe,uBACb,YACA,QACA,KACA,WAC8C;AAC9C,MAAI,OAAO,SAAS,WAAW;AAC7B,UAAM,EAAE,QAAAC,QAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,OAAO,OAAO,IAAI;AAAA,IAC7B;AACA,QAAI,CAACA,QAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,WAAOA;AAAA,EACT;AACA,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,IAClC;AAAA,IACA,EAAE,OAAO,OAAO,OAAO,IAAI;AAAA,EAC7B;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,SAAO;AACT;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,kBAAkB,SAAS,OAAO;AACjD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,MAAM;AACnD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,gBAAgB,QAAQ,kBAAkB,gBAAgB,OAAO,MAAM,QAAQ,eAAe,IAAI;AAExG,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,SAAS,MAAM,uBAAuB,YAAY,eAAe,QAAQ,KAAK,SAAS;AAE7F,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,QAAQ,OAAO,QAAQ,SAAS,OAAO,QAAQ,CAAC;AAAA,EACvF,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,yCAAyC,EAAE,IAAI,CAAC;AAC7D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,oBAAoB;AAAA,MAC5E,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ;AAAA,YACd,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,YACxB,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,UAC3B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["scopedPayload", "result"]
 }

package/dist/modules/warranty_claims/api/replacement-order/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -40,7 +41,7 @@ async function resolveActionContext(req, translate) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required.") });
   }

package/dist/modules/warranty_claims/api/replacement-order/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/replacement-order/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  claimCreateReplacementOrderSchema,\n  type ClaimCreateReplacementOrderInput,\n} from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReplacementOrderCommandResult = {\n  claimId: string\n  replacementOrderId: string\n  replacementOrderUpdatedAt: string | null\n  skippedLineIds: string[]\n  pricing: 'zero' | 'original'\n}\n\nconst replacementOrderRequestSchema = z\n  .object({\n    claimId: z.string().uuid(),\n    pricing: z.enum(['zero', 'original']).optional(),\n    updatedAt: z.string().datetime().nullable().optional(),\n  })\n  .strict()\n\ntype ReplacementOrderRequest = z.infer<typeof replacementOrderRequestSchema>\n\nconst replacementOrderResponseSchema = z.object({\n  replacementOrderId: z.string().uuid(),\n  skippedLineIds: z.array(z.string().uuid()),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.orders.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReplacementOrderRequest(payload: Record<string, unknown>): ReplacementOrderRequest {\n  return replacementOrderRequestSchema.parse(payload)\n}\n\nfunction toCommandInput(\n  input: ReplacementOrderRequest,\n  context: ActionRouteContext,\n): ClaimCreateReplacementOrderInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    pricing: input.pricing,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimCreateReplacementOrderSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ReplacementOrderRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toReplacementOrderRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload\n      ? toReplacementOrderRequest(guarded.modifiedPayload)\n      : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<ClaimCreateReplacementOrderInput, ReplacementOrderCommandResult>(\n      'warranty_claims.claim.create_replacement_order',\n      { input: toCommandInput(guardedInput, context), ctx: context.ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    await guarded.runAfterSuccess()\n    return NextResponse.json({\n      replacementOrderId: result.replacementOrderId,\n      skippedLineIds: result.skippedLineIds,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.replacement-order.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create a replacement sales order from a warranty claim',\n  methods: {\n    POST: {\n      summary: 'Create and link a replacement order from eligible replace-disposition claim lines',\n      description: 'Zero pricing is the default. Original pricing copies the source order lines\\' pre-discount unit prices.',\n      requestBody: { contentType: 'application/json', schema: replacementOrderRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Replacement order created and linked; ineligible or unresolvable claim lines are reported as skipped',\n          schema: replacementOrderResponseSchema,\n        },\n        { status: 400, description: 'Invalid request or claim is not eligible for replacement-order creation', schema: errorResponseSchema },\n        { status: 401, description: 'Authentication required', schema: errorResponseSchema },\n        { status: 403, description: 'Insufficient permissions', schema: errorResponseSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAiB7C,MAAM,gCAAgC,EACnC,OAAO;AAAA,EACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,SAAS;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AACvD,CAAC,EACA,OAAO;AAIV,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC3C,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,qBAAqB,EAAE;AACtG;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,SAA2D;AAC5F,SAAO,8BAA8B,MAAM,OAAO;AACpD;AAEA,SAAS,eACP,OACA,SACkC;AAClC,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,kCAAkC,MAAM,aAAa;AAC9D;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,0BAA0B,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AACpF,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,0BAA0B,QAAQ,eAAe,IACjD;AACJ,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,eAAe,cAAc,OAAO,GAAG,KAAK,QAAQ,IAAI;AAAA,IACnE;AACA,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK;AAAA,MACvB,oBAAoB,OAAO;AAAA,MAC3B,gBAAgB,OAAO;AAAA,IACzB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,iDAAiD,EAAE,IAAI,CAAC;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MACtF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,2EAA2E,QAAQ,oBAAoB;AAAA,QACnI,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  claimCreateReplacementOrderSchema,\n  type ClaimCreateReplacementOrderInput,\n} from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReplacementOrderCommandResult = {\n  claimId: string\n  replacementOrderId: string\n  replacementOrderUpdatedAt: string | null\n  skippedLineIds: string[]\n  pricing: 'zero' | 'original'\n}\n\nconst replacementOrderRequestSchema = z\n  .object({\n    claimId: z.string().uuid(),\n    pricing: z.enum(['zero', 'original']).optional(),\n    updatedAt: z.string().datetime().nullable().optional(),\n  })\n  .strict()\n\ntype ReplacementOrderRequest = z.infer<typeof replacementOrderRequestSchema>\n\nconst replacementOrderResponseSchema = z.object({\n  replacementOrderId: z.string().uuid(),\n  skippedLineIds: z.array(z.string().uuid()),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.orders.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReplacementOrderRequest(payload: Record<string, unknown>): ReplacementOrderRequest {\n  return replacementOrderRequestSchema.parse(payload)\n}\n\nfunction toCommandInput(\n  input: ReplacementOrderRequest,\n  context: ActionRouteContext,\n): ClaimCreateReplacementOrderInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    pricing: input.pricing,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimCreateReplacementOrderSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ReplacementOrderRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toReplacementOrderRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload\n      ? toReplacementOrderRequest(guarded.modifiedPayload)\n      : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<ClaimCreateReplacementOrderInput, ReplacementOrderCommandResult>(\n      'warranty_claims.claim.create_replacement_order',\n      { input: toCommandInput(guardedInput, context), ctx: context.ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    await guarded.runAfterSuccess()\n    return NextResponse.json({\n      replacementOrderId: result.replacementOrderId,\n      skippedLineIds: result.skippedLineIds,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.replacement-order.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create a replacement sales order from a warranty claim',\n  methods: {\n    POST: {\n      summary: 'Create and link a replacement order from eligible replace-disposition claim lines',\n      description: 'Zero pricing is the default. Original pricing copies the source order lines\\' pre-discount unit prices.',\n      requestBody: { contentType: 'application/json', schema: replacementOrderRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Replacement order created and linked; ineligible or unresolvable claim lines are reported as skipped',\n          schema: replacementOrderResponseSchema,\n        },\n        { status: 400, description: 'Invalid request or claim is not eligible for replacement-order creation', schema: errorResponseSchema },\n        { status: 401, description: 'Authentication required', schema: errorResponseSchema },\n        { status: 403, description: 'Insufficient permissions', schema: errorResponseSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,OAEK;AACP,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAiB7C,MAAM,gCAAgC,EACnC,OAAO;AAAA,EACN,SAAS,EAAE,OAAO,EAAE,KAAK;AAAA,EACzB,SAAS,EAAE,KAAK,CAAC,QAAQ,UAAU,CAAC,EAAE,SAAS;AAAA,EAC/C,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AACvD,CAAC,EACA,OAAO;AAIV,MAAM,iCAAiC,EAAE,OAAO;AAAA,EAC9C,oBAAoB,EAAE,OAAO,EAAE,KAAK;AAAA,EACpC,gBAAgB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC;AAC3C,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,qBAAqB,EAAE;AACtG;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,0BAA0B,SAA2D;AAC5F,SAAO,8BAA8B,MAAM,OAAO;AACpD;AAEA,SAAS,eACP,OACA,SACkC;AAClC,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,kCAAkC,MAAM,aAAa;AAC9D;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,0BAA0B,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AACpF,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBACzB,0BAA0B,QAAQ,eAAe,IACjD;AACJ,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,eAAe,cAAc,OAAO,GAAG,KAAK,QAAQ,IAAI;AAAA,IACnE;AACA,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK;AAAA,MACvB,oBAAoB,OAAO;AAAA,MAC3B,gBAAgB,OAAO;AAAA,IACzB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,iDAAiD,EAAE,IAAI,CAAC;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa,EAAE,aAAa,oBAAoB,QAAQ,8BAA8B;AAAA,MACtF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,2EAA2E,QAAQ,oBAAoB;AAAA,QACnI,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/return-label/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -52,7 +53,7 @@ async function resolveActionContext(req, translate) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required.") });
   }

package/dist/modules/warranty_claims/api/return-label/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/return-label/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { WarrantyClaim, WarrantyClaimLine } from '../../data/entities'\nimport { claimSetReturnLabelSchema, type ClaimSetReturnLabelInput } from '../../data/validators'\nimport type { WarrantyReturnLabelProvider } from '../../services/returnLabelProvider'\nimport {\n  WARRANTY_CLAIM_RESOURCE_KIND,\n  enforceWarrantyClaimOptimisticLock,\n  requireScopedClaim,\n} from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReturnLabelCreatedResponse = {\n  status: 'created'\n  labelUrl: string | null\n  trackingNumber: string | null\n  carrier: string | null\n}\ntype ReturnLabelCommandResult = Omit<ReturnLabelCreatedResponse, 'status'> & { claimId: string }\n\nconst uuid = z.string().uuid()\nconst returnLabelText = (max: number) => z.string().trim().min(1).max(max).optional()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst returnLabelRequestSchema = z\n  .object({\n    claimId: uuid,\n    manual: z.boolean().optional(),\n    labelUrl: returnLabelText(2048),\n    trackingNumber: returnLabelText(191),\n    carrier: returnLabelText(120),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\ntype ReturnLabelRequest = z.infer<typeof returnLabelRequestSchema>\n\nconst returnLabelResponseSchema = z.discriminatedUnion('status', [\n  z.object({\n    status: z.literal('created'),\n    labelUrl: z.string().nullable(),\n    trackingNumber: z.string().nullable(),\n    carrier: z.string().nullable(),\n  }),\n  z.object({ status: z.literal('notConfigured') }),\n])\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReturnLabelRequest(payload: Record<string, unknown>): ReturnLabelRequest {\n  return returnLabelRequestSchema.parse({\n    claimId: payload.claimId ?? payload.id,\n    manual: payload.manual,\n    labelUrl: payload.labelUrl,\n    trackingNumber: payload.trackingNumber,\n    carrier: payload.carrier,\n    updatedAt: payload.updatedAt,\n  })\n}\n\nfunction isManualRequest(input: ReturnLabelRequest): boolean {\n  return input.manual === true\n    || input.labelUrl !== undefined\n    || input.trackingNumber !== undefined\n    || input.carrier !== undefined\n}\n\nfunction toSetReturnLabelInput(\n  input: ReturnLabelRequest,\n  context: ActionRouteContext,\n): ClaimSetReturnLabelInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    labelUrl: input.labelUrl,\n    trackingNumber: input.trackingNumber,\n    carrier: input.carrier,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimSetReturnLabelSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ReturnLabelRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nasync function loadClaimAndLines(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<{ claim: WarrantyClaim; lines: WarrantyClaimLine[] }> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const em = (context.ctx.container.resolve('em') as EntityManager).fork()\n  const claim = await requireScopedClaim(em, claimId, scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n  const lines = await findWithDecryption(\n    em,\n    WarrantyClaimLine,\n    { claim: claim.id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  return { claim, lines }\n}\n\nfunction assertGeneratableStatus(claim: WarrantyClaim, translate: ActionRouteContext['translate']): void {\n  if (claim.status !== 'approved' && claim.status !== 'awaiting_return') {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.returnLabelInvalidStatus', 'Return labels can only be created for approved claims that are awaiting return.') })\n  }\n}\n\nasync function executeSetReturnLabel(\n  commandBus: CommandBus,\n  input: ClaimSetReturnLabelInput,\n  ctx: CommandRuntimeContext,\n  translate: ActionRouteContext['translate'],\n): Promise<ReturnLabelCreatedResponse> {\n  const { result } = await commandBus.execute<ClaimSetReturnLabelInput, ReturnLabelCommandResult>(\n    'warranty_claims.claim.set_return_label',\n    { input, ctx },\n  )\n  if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n  return {\n    status: 'created',\n    labelUrl: result.labelUrl,\n    trackingNumber: result.trackingNumber,\n    carrier: result.carrier,\n  }\n}\n\nexport function firstTranslatableIssueKey(err: z.ZodError): string {\n  const keyed = err.issues.find(\n    (issue) => typeof issue.message === 'string' && issue.message.startsWith('warranty_claims.'),\n  )?.message\n  return keyed ?? 'warranty_claims.errors.invalidInput'\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toReturnLabelRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload ? toReturnLabelRequest(guarded.modifiedPayload) : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n\n    if (isManualRequest(guardedInput)) {\n      const response = await executeSetReturnLabel(\n        commandBus,\n        toSetReturnLabelInput(guardedInput, context),\n        context.ctx,\n        translate,\n      )\n      await guarded.runAfterSuccess()\n      return NextResponse.json(response)\n    }\n\n    const { claim, lines } = await loadClaimAndLines(context, guardedInput.claimId)\n    assertGeneratableStatus(claim, translate)\n    await enforceWarrantyClaimOptimisticLock(\n      context.ctx,\n      claim,\n      WARRANTY_CLAIM_RESOURCE_KIND,\n      guardedInput.updatedAt ?? undefined,\n    )\n\n    const provider = context.ctx.container.resolve<WarrantyReturnLabelProvider>('warrantyReturnLabelProvider')\n    const result = await provider.createReturnLabel(\n      { claim, lines },\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n      context.ctx.container,\n    )\n\n    if (result.status === 'notConfigured') {\n      return NextResponse.json({ status: 'notConfigured' })\n    }\n\n    const response = await executeSetReturnLabel(\n      commandBus,\n      toSetReturnLabelInput({\n        ...guardedInput,\n        labelUrl: result.labelUrl,\n        trackingNumber: result.trackingNumber,\n        carrier: result.carrier,\n      }, context),\n      context.ctx,\n      translate,\n    )\n    await guarded.runAfterSuccess()\n    return NextResponse.json(response)\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate(firstTranslatableIssueKey(err), 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.return-label.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create or record a return label for a warranty claim',\n  methods: {\n    POST: {\n      summary: 'Generate a carrier return label or record manual label details',\n      requestBody: { contentType: 'application/json', schema: returnLabelRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Return label created or provider not configured',\n          schema: returnLabelResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,0BAA0B;AACnC,SAAwB,yBAAyB;AACjD,SAAS,iCAAgE;AAEzE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAiB7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,kBAAkB,CAAC,QAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpF,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,2BAA2B,EAC9B,OAAO;AAAA,EACN,SAAS;AAAA,EACT,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,UAAU,gBAAgB,IAAI;AAAA,EAC9B,gBAAgB,gBAAgB,GAAG;AAAA,EACnC,SAAS,gBAAgB,GAAG;AAAA,EAC5B,WAAW;AACb,CAAC,EACA,OAAO;AAIV,MAAM,4BAA4B,EAAE,mBAAmB,UAAU;AAAA,EAC/D,EAAE,OAAO;AAAA,IACP,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,IACpC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC;AAAA,EACD,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,eAAe,EAAE,CAAC;AACjD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAsD;AAClF,SAAO,yBAAyB,MAAM;AAAA,IACpC,SAAS,QAAQ,WAAW,QAAQ;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,SAAO,MAAM,WAAW,QACnB,MAAM,aAAa,UACnB,MAAM,mBAAmB,UACzB,MAAM,YAAY;AACzB;AAEA,SAAS,sBACP,OACA,SAC0B;AAC1B,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,0BAA0B,MAAM,aAAa;AACtD;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,kBACb,SACA,SAC+D;AAC/D,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,KAAM,QAAQ,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACvE,QAAM,QAAQ,MAAM,mBAAmB,IAAI,SAAS,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AACvI,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,OAAO,MAAM,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnG,CAAC;AAAA,IACD;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;AAEA,SAAS,wBAAwB,OAAsB,WAAkD;AACvG,MAAI,MAAM,WAAW,cAAc,MAAM,WAAW,mBAAmB;AACrE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,mDAAmD,iFAAiF,EAAE,CAAC;AAAA,EACzL;AACF;AAEA,eAAe,sBACb,YACA,OACA,KACA,WACqC;AACrC,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,IAClC;AAAA,IACA,EAAE,OAAO,IAAI;AAAA,EACf;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,SAAS,OAAO;AAAA,EAClB;AACF;AAEO,SAAS,0BAA0B,KAAyB;AACjE,QAAM,QAAQ,IAAI,OAAO;AAAA,IACvB,CAAC,UAAU,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,kBAAkB;AAAA,EAC7F,GAAG;AACH,SAAO,SAAS;AAClB;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,qBAAqB,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,qBAAqB,QAAQ,eAAe,IAAI;AAC/F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAE7D,QAAI,gBAAgB,YAAY,GAAG;AACjC,YAAMA,YAAW,MAAM;AAAA,QACrB;AAAA,QACA,sBAAsB,cAAc,OAAO;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,MACF;AACA,YAAM,QAAQ,gBAAgB;AAC9B,aAAO,aAAa,KAAKA,SAAQ;AAAA,IACnC;AAEA,UAAM,EAAE,OAAO,MAAM,IAAI,MAAM,kBAAkB,SAAS,aAAa,OAAO;AAC9E,4BAAwB,OAAO,SAAS;AACxC,UAAM;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa,aAAa;AAAA,IAC5B;AAEA,UAAM,WAAW,QAAQ,IAAI,UAAU,QAAqC,6BAA6B;AACzG,UAAM,SAAS,MAAM,SAAS;AAAA,MAC5B,EAAE,OAAO,MAAM;AAAA,MACf,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,MACrE,QAAQ,IAAI;AAAA,IACd;AAEA,QAAI,OAAO,WAAW,iBAAiB;AACrC,aAAO,aAAa,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AAAA,IACtD;AAEA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,sBAAsB;AAAA,QACpB,GAAG;AAAA,QACH,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,MAClB,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK,QAAQ;AAAA,EACnC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0BAA0B,GAAG,GAAG,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AACA,WAAO,MAAM,4CAA4C,EAAE,IAAI,CAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACjF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { WarrantyClaim, WarrantyClaimLine } from '../../data/entities'\nimport { claimSetReturnLabelSchema, type ClaimSetReturnLabelInput } from '../../data/validators'\nimport type { WarrantyReturnLabelProvider } from '../../services/returnLabelProvider'\nimport {\n  WARRANTY_CLAIM_RESOURCE_KIND,\n  enforceWarrantyClaimOptimisticLock,\n  requireScopedClaim,\n} from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype ReturnLabelCreatedResponse = {\n  status: 'created'\n  labelUrl: string | null\n  trackingNumber: string | null\n  carrier: string | null\n}\ntype ReturnLabelCommandResult = Omit<ReturnLabelCreatedResponse, 'status'> & { claimId: string }\n\nconst uuid = z.string().uuid()\nconst returnLabelText = (max: number) => z.string().trim().min(1).max(max).optional()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst returnLabelRequestSchema = z\n  .object({\n    claimId: uuid,\n    manual: z.boolean().optional(),\n    labelUrl: returnLabelText(2048),\n    trackingNumber: returnLabelText(191),\n    carrier: returnLabelText(120),\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\ntype ReturnLabelRequest = z.infer<typeof returnLabelRequestSchema>\n\nconst returnLabelResponseSchema = z.discriminatedUnion('status', [\n  z.object({\n    status: z.literal('created'),\n    labelUrl: z.string().nullable(),\n    trackingNumber: z.string().nullable(),\n    carrier: z.string().nullable(),\n  }),\n  z.object({ status: z.literal('notConfigured') }),\n])\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toReturnLabelRequest(payload: Record<string, unknown>): ReturnLabelRequest {\n  return returnLabelRequestSchema.parse({\n    claimId: payload.claimId ?? payload.id,\n    manual: payload.manual,\n    labelUrl: payload.labelUrl,\n    trackingNumber: payload.trackingNumber,\n    carrier: payload.carrier,\n    updatedAt: payload.updatedAt,\n  })\n}\n\nfunction isManualRequest(input: ReturnLabelRequest): boolean {\n  return input.manual === true\n    || input.labelUrl !== undefined\n    || input.trackingNumber !== undefined\n    || input.carrier !== undefined\n}\n\nfunction toSetReturnLabelInput(\n  input: ReturnLabelRequest,\n  context: ActionRouteContext,\n): ClaimSetReturnLabelInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    labelUrl: input.labelUrl,\n    trackingNumber: input.trackingNumber,\n    carrier: input.carrier,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimSetReturnLabelSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: ReturnLabelRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nasync function loadClaimAndLines(\n  context: ActionRouteContext,\n  claimId: string,\n): Promise<{ claim: WarrantyClaim; lines: WarrantyClaimLine[] }> {\n  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }\n  const em = (context.ctx.container.resolve('em') as EntityManager).fork()\n  const claim = await requireScopedClaim(em, claimId, scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n  const lines = await findWithDecryption(\n    em,\n    WarrantyClaimLine,\n    { claim: claim.id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  return { claim, lines }\n}\n\nfunction assertGeneratableStatus(claim: WarrantyClaim, translate: ActionRouteContext['translate']): void {\n  if (claim.status !== 'approved' && claim.status !== 'awaiting_return') {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.returnLabelInvalidStatus', 'Return labels can only be created for approved claims that are awaiting return.') })\n  }\n}\n\nasync function executeSetReturnLabel(\n  commandBus: CommandBus,\n  input: ClaimSetReturnLabelInput,\n  ctx: CommandRuntimeContext,\n  translate: ActionRouteContext['translate'],\n): Promise<ReturnLabelCreatedResponse> {\n  const { result } = await commandBus.execute<ClaimSetReturnLabelInput, ReturnLabelCommandResult>(\n    'warranty_claims.claim.set_return_label',\n    { input, ctx },\n  )\n  if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n  return {\n    status: 'created',\n    labelUrl: result.labelUrl,\n    trackingNumber: result.trackingNumber,\n    carrier: result.carrier,\n  }\n}\n\nexport function firstTranslatableIssueKey(err: z.ZodError): string {\n  const keyed = err.issues.find(\n    (issue) => typeof issue.message === 'string' && issue.message.startsWith('warranty_claims.'),\n  )?.message\n  return keyed ?? 'warranty_claims.errors.invalidInput'\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toReturnLabelRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload ? toReturnLabelRequest(guarded.modifiedPayload) : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n\n    if (isManualRequest(guardedInput)) {\n      const response = await executeSetReturnLabel(\n        commandBus,\n        toSetReturnLabelInput(guardedInput, context),\n        context.ctx,\n        translate,\n      )\n      await guarded.runAfterSuccess()\n      return NextResponse.json(response)\n    }\n\n    const { claim, lines } = await loadClaimAndLines(context, guardedInput.claimId)\n    assertGeneratableStatus(claim, translate)\n    await enforceWarrantyClaimOptimisticLock(\n      context.ctx,\n      claim,\n      WARRANTY_CLAIM_RESOURCE_KIND,\n      guardedInput.updatedAt ?? undefined,\n    )\n\n    const provider = context.ctx.container.resolve<WarrantyReturnLabelProvider>('warrantyReturnLabelProvider')\n    const result = await provider.createReturnLabel(\n      { claim, lines },\n      { tenantId: context.tenantId, organizationId: context.organizationId },\n      context.ctx.container,\n    )\n\n    if (result.status === 'notConfigured') {\n      return NextResponse.json({ status: 'notConfigured' })\n    }\n\n    const response = await executeSetReturnLabel(\n      commandBus,\n      toSetReturnLabelInput({\n        ...guardedInput,\n        labelUrl: result.labelUrl,\n        trackingNumber: result.trackingNumber,\n        carrier: result.carrier,\n      }, context),\n      context.ctx,\n      translate,\n    )\n    await guarded.runAfterSuccess()\n    return NextResponse.json(response)\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate(firstTranslatableIssueKey(err), 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.return-label.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create or record a return label for a warranty claim',\n  methods: {\n    POST: {\n      summary: 'Generate a carrier return label or record manual label details',\n      requestBody: { contentType: 'application/json', schema: returnLabelRequestSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Return label created or provider not configured',\n          schema: returnLabelResponseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,0BAA0B;AACnC,SAAwB,yBAAyB;AACjD,SAAS,iCAAgE;AAEzE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAiB7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,kBAAkB,CAAC,QAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AACpF,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,2BAA2B,EAC9B,OAAO;AAAA,EACN,SAAS;AAAA,EACT,QAAQ,EAAE,QAAQ,EAAE,SAAS;AAAA,EAC7B,UAAU,gBAAgB,IAAI;AAAA,EAC9B,gBAAgB,gBAAgB,GAAG;AAAA,EACnC,SAAS,gBAAgB,GAAG;AAAA,EAC5B,WAAW;AACb,CAAC,EACA,OAAO;AAIV,MAAM,4BAA4B,EAAE,mBAAmB,UAAU;AAAA,EAC/D,EAAE,OAAO;AAAA,IACP,QAAQ,EAAE,QAAQ,SAAS;AAAA,IAC3B,UAAU,EAAE,OAAO,EAAE,SAAS;AAAA,IAC9B,gBAAgB,EAAE,OAAO,EAAE,SAAS;AAAA,IACpC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,CAAC;AAAA,EACD,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,eAAe,EAAE,CAAC;AACjD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAsD;AAClF,SAAO,yBAAyB,MAAM;AAAA,IACpC,SAAS,QAAQ,WAAW,QAAQ;AAAA,IACpC,QAAQ,QAAQ;AAAA,IAChB,UAAU,QAAQ;AAAA,IAClB,gBAAgB,QAAQ;AAAA,IACxB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,gBAAgB,OAAoC;AAC3D,SAAO,MAAM,WAAW,QACnB,MAAM,aAAa,UACnB,MAAM,mBAAmB,UACzB,MAAM,YAAY;AACzB;AAEA,SAAS,sBACP,OACA,SAC0B;AAC1B,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,SAAS,MAAM;AAAA,IACf,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,0BAA0B,MAAM,aAAa;AACtD;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAe,kBACb,SACA,SAC+D;AAC/D,QAAM,QAAQ,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AACnF,QAAM,KAAM,QAAQ,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AACvE,QAAM,QAAQ,MAAM,mBAAmB,IAAI,SAAS,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AACvI,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,OAAO,MAAM,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnG,CAAC;AAAA,IACD;AAAA,EACF;AACA,SAAO,EAAE,OAAO,MAAM;AACxB;AAEA,SAAS,wBAAwB,OAAsB,WAAkD;AACvG,MAAI,MAAM,WAAW,cAAc,MAAM,WAAW,mBAAmB;AACrE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,mDAAmD,iFAAiF,EAAE,CAAC;AAAA,EACzL;AACF;AAEA,eAAe,sBACb,YACA,OACA,KACA,WACqC;AACrC,QAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,IAClC;AAAA,IACA,EAAE,OAAO,IAAI;AAAA,EACf;AACA,MAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,UAAU,OAAO;AAAA,IACjB,gBAAgB,OAAO;AAAA,IACvB,SAAS,OAAO;AAAA,EAClB;AACF;AAEO,SAAS,0BAA0B,KAAyB;AACjE,QAAM,QAAQ,IAAI,OAAO;AAAA,IACvB,CAAC,UAAU,OAAO,MAAM,YAAY,YAAY,MAAM,QAAQ,WAAW,kBAAkB;AAAA,EAC7F,GAAG;AACH,SAAO,SAAS;AAClB;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,qBAAqB,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,qBAAqB,QAAQ,eAAe,IAAI;AAC/F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAE7D,QAAI,gBAAgB,YAAY,GAAG;AACjC,YAAMA,YAAW,MAAM;AAAA,QACrB;AAAA,QACA,sBAAsB,cAAc,OAAO;AAAA,QAC3C,QAAQ;AAAA,QACR;AAAA,MACF;AACA,YAAM,QAAQ,gBAAgB;AAC9B,aAAO,aAAa,KAAKA,SAAQ;AAAA,IACnC;AAEA,UAAM,EAAE,OAAO,MAAM,IAAI,MAAM,kBAAkB,SAAS,aAAa,OAAO;AAC9E,4BAAwB,OAAO,SAAS;AACxC,UAAM;AAAA,MACJ,QAAQ;AAAA,MACR;AAAA,MACA;AAAA,MACA,aAAa,aAAa;AAAA,IAC5B;AAEA,UAAM,WAAW,QAAQ,IAAI,UAAU,QAAqC,6BAA6B;AACzG,UAAM,SAAS,MAAM,SAAS;AAAA,MAC5B,EAAE,OAAO,MAAM;AAAA,MACf,EAAE,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,eAAe;AAAA,MACrE,QAAQ,IAAI;AAAA,IACd;AAEA,QAAI,OAAO,WAAW,iBAAiB;AACrC,aAAO,aAAa,KAAK,EAAE,QAAQ,gBAAgB,CAAC;AAAA,IACtD;AAEA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA,sBAAsB;AAAA,QACpB,GAAG;AAAA,QACH,UAAU,OAAO;AAAA,QACjB,gBAAgB,OAAO;AAAA,QACvB,SAAS,OAAO;AAAA,MAClB,GAAG,OAAO;AAAA,MACV,QAAQ;AAAA,MACR;AAAA,IACF;AACA,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK,QAAQ;AAAA,EACnC,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,0BAA0B,GAAG,GAAG,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjH;AACA,WAAO,MAAM,4CAA4C,EAAE,IAAI,CAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,yBAAyB;AAAA,MACjF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["response"]
 }

package/dist/modules/warranty_claims/api/risk/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
@@ -39,7 +40,7 @@ async function resolveRiskContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }