@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/dist/modules/warranty_claims/api/risk/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/risk/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimLine } from '../../data/entities'\nimport { requireScopedClaim, type WarrantyClaimScope } from '../../commands/shared'\nimport { evaluateClaimRisk } from '../../lib/risk'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst querySchema = z.object({\n  claimId: z.string().uuid(),\n}).strict()\n\nconst riskSignalSchema = z.object({\n  id: z.enum(['duplicate_serial', 'duplicate_order_claim', 'outside_return_window', 'over_quantity_claim', 'repeat_claimer', 'value_velocity']),\n  level: z.enum(['low', 'medium', 'high']),\n  messageKey: z.string(),\n  params: z.record(z.string(), z.union([z.string(), z.number()])).optional(),\n  relatedClaimNumbers: z.array(z.string()).optional(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    level: z.enum(['none', 'low', 'medium', 'high']),\n    signals: z.array(riskSignalSchema),\n  }),\n})\n\ntype RiskRouteContext = {\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nasync function resolveRiskContext(req: Request): Promise<RiskRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveRiskContext(req)\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    const lines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      { claim: claim.id, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },\n      { orderBy: { lineNo: 'ASC' } },\n      context.scope,\n    )\n    const result = await evaluateClaimRisk(context.em, claim, lines)\n    return NextResponse.json({ ok: true, result })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.risk.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Evaluate warranty claim risk',\n  methods: {\n    GET: {\n      summary: 'Evaluate deterministic risk signals for a claim',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Risk assessment',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,0BAAmD;AAC5D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC,EAAE,OAAO;AAEV,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,KAAK,CAAC,oBAAoB,yBAAyB,yBAAyB,uBAAuB,kBAAkB,gBAAgB,CAAC;AAAA,EAC5I,OAAO,EAAE,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC;AAAA,EACvC,YAAY,EAAE,OAAO;AAAA,EACrB,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EACzE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACpD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,KAAK,CAAC,QAAQ,OAAO,UAAU,MAAM,CAAC;AAAA,IAC/C,SAAS,EAAE,MAAM,gBAAgB;AAAA,EACnC,CAAC;AACH,CAAC;AAUM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,eAAe,mBAAmB,KAAyC;AACzE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,mBAAmB,cAAc,KAAK,SAAS;AACtE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,mBAAmB,GAAG;AAC5C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACpE,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,OAAO,MAAM,IAAI,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,MACvG,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,MAC7B,QAAQ;AAAA,IACV;AACA,UAAM,SAAS,MAAM,kBAAkB,QAAQ,IAAI,OAAO,KAAK;AAC/D,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WarrantyClaimLine } from '../../data/entities'\nimport { requireScopedClaim, type WarrantyClaimScope } from '../../commands/shared'\nimport { evaluateClaimRisk } from '../../lib/risk'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nconst querySchema = z.object({\n  claimId: z.string().uuid(),\n}).strict()\n\nconst riskSignalSchema = z.object({\n  id: z.enum(['duplicate_serial', 'duplicate_order_claim', 'outside_return_window', 'over_quantity_claim', 'repeat_claimer', 'value_velocity']),\n  level: z.enum(['low', 'medium', 'high']),\n  messageKey: z.string(),\n  params: z.record(z.string(), z.union([z.string(), z.number()])).optional(),\n  relatedClaimNumbers: z.array(z.string()).optional(),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: z.object({\n    level: z.enum(['none', 'low', 'medium', 'high']),\n    signals: z.array(riskSignalSchema),\n  }),\n})\n\ntype RiskRouteContext = {\n  tenantId: string\n  organizationId: string\n  scope: WarrantyClaimScope\n  translate: (key: string, fallback?: string) => string\n  em: EntityManager\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nasync function resolveRiskContext(req: Request): Promise<RiskRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const organizationScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(organizationScope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const em = container.resolve('em') as EntityManager\n  return {\n    tenantId: auth.tenantId,\n    organizationId,\n    scope: { tenantId: auth.tenantId, organizationId },\n    translate,\n    em,\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const context = await resolveRiskContext(req)\n    const url = new URL(req.url)\n    const query = querySchema.parse(Object.fromEntries(url.searchParams))\n    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))\n    const lines = await findWithDecryption(\n      context.em,\n      WarrantyClaimLine,\n      { claim: claim.id, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },\n      { orderBy: { lineNo: 'ASC' } },\n      context.scope,\n    )\n    const result = await evaluateClaimRisk(context.em, claim, lines)\n    return NextResponse.json({ ok: true, result })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.risk.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Evaluate warranty claim risk',\n  methods: {\n    GET: {\n      summary: 'Evaluate deterministic risk signals for a claim',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Risk assessment',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAClD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,0BAAmD;AAC5D,SAAS,yBAAyB;AAClC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAE7C,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,SAAS,EAAE,OAAO,EAAE,KAAK;AAC3B,CAAC,EAAE,OAAO;AAEV,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,KAAK,CAAC,oBAAoB,yBAAyB,yBAAyB,uBAAuB,kBAAkB,gBAAgB,CAAC;AAAA,EAC5I,OAAO,EAAE,KAAK,CAAC,OAAO,UAAU,MAAM,CAAC;AAAA,EACvC,YAAY,EAAE,OAAO;AAAA,EACrB,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,SAAS;AAAA,EACzE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AACpD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ,EAAE,OAAO;AAAA,IACf,OAAO,EAAE,KAAK,CAAC,QAAQ,OAAO,UAAU,MAAM,CAAC;AAAA,IAC/C,SAAS,EAAE,MAAM,gBAAgB;AAAA,EACnC,CAAC;AACH,CAAC;AAUM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,eAAe,mBAAmB,KAAyC;AACzE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,oBAAoB,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACpG,QAAM,iBAAiB,kCAAkC,mBAAmB,IAAI,KAAK;AACrF,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,OAAO,EAAE,UAAU,KAAK,UAAU,eAAe;AAAA,IACjD;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,UAAU,MAAM,mBAAmB,GAAG;AAC5C,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACpE,UAAM,QAAQ,MAAM,mBAAmB,QAAQ,IAAI,MAAM,SAAS,QAAQ,OAAO,CAAC,GAAG,QAAQ,UAAU,mCAAmC,kBAAkB,CAAC;AAC7J,UAAM,QAAQ,MAAM;AAAA,MAClB,QAAQ;AAAA,MACR;AAAA,MACA,EAAE,OAAO,MAAM,IAAI,UAAU,QAAQ,UAAU,gBAAgB,QAAQ,gBAAgB,WAAW,KAAK;AAAA,MACvG,EAAE,SAAS,EAAE,QAAQ,MAAM,EAAE;AAAA,MAC7B,QAAQ;AAAA,IACV;AACA,UAAM,SAAS,MAAM,kBAAkB,QAAQ,IAAI,OAAO,KAAK;AAC/D,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,mCAAmC,EAAE,IAAI,CAAC;AACvD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/sales-return/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
 import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
@@ -39,7 +40,7 @@ async function resolveActionContext(req, translate) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required.") });
   }

package/dist/modules/warranty_claims/api/sales-return/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/sales-return/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { claimCreateSalesReturnSchema, type ClaimCreateSalesReturnInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype SalesReturnCommandResult = {\n  claimId: string\n  salesReturnId: string\n  salesReturnUpdatedAt: string | null\n  skippedLineIds: string[]\n}\n\nconst uuid = z.string().uuid()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst salesReturnRequestSchema = z\n  .object({\n    claimId: uuid,\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\ntype SalesReturnRequest = z.infer<typeof salesReturnRequestSchema>\n\nconst salesReturnResponseSchema = z.object({\n  salesReturnId: z.string(),\n  skippedLineIds: z.array(z.string()),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.returns.create'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toSalesReturnRequest(payload: Record<string, unknown>): SalesReturnRequest {\n  return salesReturnRequestSchema.parse({\n    claimId: payload.claimId ?? payload.id,\n    updatedAt: payload.updatedAt,\n  })\n}\n\nfunction toCommandInput(input: SalesReturnRequest, context: ActionRouteContext): ClaimCreateSalesReturnInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimCreateSalesReturnSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: SalesReturnRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toSalesReturnRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload ? toSalesReturnRequest(guarded.modifiedPayload) : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<ClaimCreateSalesReturnInput, SalesReturnCommandResult>(\n      'warranty_claims.claim.create_sales_return',\n      { input: toCommandInput(guardedInput, context), ctx: context.ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    await guarded.runAfterSuccess()\n    return NextResponse.json({ salesReturnId: result.salesReturnId, skippedLineIds: result.skippedLineIds })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.sales-return.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create a sales return from an approved warranty claim',\n  methods: {\n    POST: {\n      summary: 'Create a sales return document from the claim\\'s eligible lines and link it to the claim',\n      requestBody: {\n        contentType: 'application/json',\n        schema: salesReturnRequestSchema,\n        description: 'Use claimId to identify the warranty claim. The id field is also accepted as an alias for claimId.',\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Sales return created and linked; lines without an order-line reference are reported as skipped',\n          schema: salesReturnResponseSchema,\n        },\n        { status: 400, description: 'Invalid request or claim is not eligible for sales-return creation', schema: errorResponseSchema },\n        { status: 401, description: 'Authentication required', schema: errorResponseSchema },\n        { status: 403, description: 'Insufficient permissions', schema: errorResponseSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,oCAAsE;AAC/E,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAgB7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,2BAA2B,EAC9B,OAAO;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AACb,CAAC,EACA,OAAO;AAIV,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,sBAAsB,EAAE;AACvG;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAsD;AAClF,SAAO,yBAAyB,MAAM;AAAA,IACpC,SAAS,QAAQ,WAAW,QAAQ;AAAA,IACpC,WAAW,QAAQ;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,eAAe,OAA2B,SAA0D;AAC3G,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,6BAA6B,MAAM,aAAa;AACzD;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,qBAAqB,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,qBAAqB,QAAQ,eAAe,IAAI;AAC/F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,eAAe,cAAc,OAAO,GAAG,KAAK,QAAQ,IAAI;AAAA,IACnE;AACA,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,eAAe,OAAO,eAAe,gBAAgB,OAAO,eAAe,CAAC;AAAA,EACzG,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,4CAA4C,EAAE,IAAI,CAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,sEAAsE,QAAQ,oBAAoB;AAAA,QAC9H,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { claimCreateSalesReturnSchema, type ClaimCreateSalesReturnInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype SalesReturnCommandResult = {\n  claimId: string\n  salesReturnId: string\n  salesReturnUpdatedAt: string | null\n  skippedLineIds: string[]\n}\n\nconst uuid = z.string().uuid()\nconst optimisticLockTokenSchema = z.string().datetime().nullable().optional()\n\nconst salesReturnRequestSchema = z\n  .object({\n    claimId: uuid,\n    updatedAt: optimisticLockTokenSchema,\n  })\n  .strict()\n\ntype SalesReturnRequest = z.infer<typeof salesReturnRequestSchema>\n\nconst salesReturnResponseSchema = z.object({\n  salesReturnId: z.string(),\n  skippedLineIds: z.array(z.string()),\n})\n\nconst errorResponseSchema = z.object({\n  error: z.string(),\n})\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.returns.create'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(\n  req: Request,\n  translate: ActionRouteContext['translate'],\n): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toSalesReturnRequest(payload: Record<string, unknown>): SalesReturnRequest {\n  return salesReturnRequestSchema.parse({\n    claimId: payload.claimId ?? payload.id,\n    updatedAt: payload.updatedAt,\n  })\n}\n\nfunction toCommandInput(input: SalesReturnRequest, context: ActionRouteContext): ClaimCreateSalesReturnInput {\n  const scopedPayload = withScopedPayload({\n    id: input.claimId,\n    updatedAt: input.updatedAt,\n  }, context.ctx, context.translate)\n  return claimCreateSalesReturnSchema.parse(scopedPayload)\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: SalesReturnRequest,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.claimId,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const context = await resolveActionContext(req, translate)\n    const requestInput = toSalesReturnRequest(toRecord(await readJsonSafe(req, {})))\n    const guarded = await runGuard(req, context, requestInput)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const guardedInput = guarded.modifiedPayload ? toSalesReturnRequest(guarded.modifiedPayload) : requestInput\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<ClaimCreateSalesReturnInput, SalesReturnCommandResult>(\n      'warranty_claims.claim.create_sales_return',\n      { input: toCommandInput(guardedInput, context), ctx: context.ctx },\n    )\n    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })\n    await guarded.runAfterSuccess()\n    return NextResponse.json({ salesReturnId: result.salesReturnId, skippedLineIds: result.skippedLineIds })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.sales-return.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Create a sales return from an approved warranty claim',\n  methods: {\n    POST: {\n      summary: 'Create a sales return document from the claim\\'s eligible lines and link it to the claim',\n      requestBody: {\n        contentType: 'application/json',\n        schema: salesReturnRequestSchema,\n        description: 'Use claimId to identify the warranty claim. The id field is also accepted as an alias for claimId.',\n      },\n      responses: [\n        {\n          status: 200,\n          description: 'Sales return created and linked; lines without an order-line reference are reported as skipped',\n          schema: salesReturnResponseSchema,\n        },\n        { status: 400, description: 'Invalid request or claim is not eligible for sales-return creation', schema: errorResponseSchema },\n        { status: 401, description: 'Authentication required', schema: errorResponseSchema },\n        { status: 403, description: 'Insufficient permissions', schema: errorResponseSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AACpC,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,oCAAsE;AAC/E,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAgB7C,MAAM,OAAO,EAAE,OAAO,EAAE,KAAK;AAC7B,MAAM,4BAA4B,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS;AAE5E,MAAM,2BAA2B,EAC9B,OAAO;AAAA,EACN,SAAS;AAAA,EACT,WAAW;AACb,CAAC,EACA,OAAO;AAIV,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,eAAe,EAAE,OAAO;AAAA,EACxB,gBAAgB,EAAE,MAAM,EAAE,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,sBAAsB,EAAE;AACvG;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBACb,KACA,WAC6B;AAC7B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,mCAAmC,EAAE,CAAC;AAAA,EACxI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAsD;AAClF,SAAO,yBAAyB,MAAM;AAAA,IACpC,SAAS,QAAQ,WAAW,QAAQ;AAAA,IACpC,WAAW,QAAQ;AAAA,EACrB,CAAC;AACH;AAEA,SAAS,eAAe,OAA2B,SAA0D;AAC3G,QAAM,gBAAgB,kBAAkB;AAAA,IACtC,IAAI,MAAM;AAAA,IACV,WAAW,MAAM;AAAA,EACnB,GAAG,QAAQ,KAAK,QAAQ,SAAS;AACjC,SAAO,6BAA6B,MAAM,aAAa;AACzD;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,SAAS;AACzD,UAAM,eAAe,qBAAqB,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC,CAAC;AAC/E,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,YAAY;AACzD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,qBAAqB,QAAQ,eAAe,IAAI;AAC/F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,eAAe,cAAc,OAAO,GAAG,KAAK,QAAQ,IAAI;AAAA,IACnE;AACA,QAAI,CAAC,OAAQ,OAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,CAAC;AACtI,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK,EAAE,eAAe,OAAO,eAAe,gBAAgB,OAAO,eAAe,CAAC;AAAA,EACzG,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,4CAA4C,EAAE,IAAI,CAAC;AAChE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,gCAAgC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,QACR,aAAa;AAAA,MACf;AAAA,MACA,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA,EAAE,QAAQ,KAAK,aAAa,sEAAsE,QAAQ,oBAAoB;AAAA,QAC9H,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,oBAAoB;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/settings-general/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
@@ -40,7 +41,7 @@ async function resolveSettingsContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }

package/dist/modules/warranty_claims/api/settings-general/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/settings-general/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  warrantyClaimSettingsSaveSchema,\n  warrantyClaimSettingsUpdateSchema,\n  type WarrantyClaimSettingsSaveInput,\n} from '../../data/validators'\nimport {\n  loadWarrantyClaimSettings,\n  resolveEffectiveWarrantyClaimSettings,\n  type WarrantyClaimEffectiveSettings,\n} from '../../lib/settings'\nimport { WARRANTY_CLAIM_SETTINGS_RESOURCE_KIND, type SaveWarrantyClaimSettingsResult } from '../../commands/settings'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.settings.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['warranty_claims.settings.manage'] },\n}\n\ntype SettingsRouteContext = {\n  ctx: CommandRuntimeContext\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n  userId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype SettingsResponseResult = WarrantyClaimEffectiveSettings & {\n  returnWindowDays: number | null\n  updatedAt: string | null\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  const date = value instanceof Date ? value : new Date(value)\n  return Number.isNaN(date.getTime()) ? null : date.toISOString()\n}\n\nasync function resolveSettingsContext(req: Request): Promise<SettingsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return {\n    ctx,\n    em: container.resolve('em') as EntityManager,\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub ?? '',\n    translate,\n  }\n}\n\nasync function buildSettingsResult(\n  em: EntityManager,\n  scope: { tenantId: string; organizationId: string },\n): Promise<SettingsResponseResult> {\n  const record = await loadWarrantyClaimSettings(em, scope)\n  const effectiveSettings = await resolveEffectiveWarrantyClaimSettings(em, scope)\n  return {\n    ...effectiveSettings,\n    returnWindowDays: record?.returnWindowDays ?? null,\n    updatedAt: toIso(record?.updatedAt),\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const { em, tenantId, organizationId } = await resolveSettingsContext(req)\n    const result = await buildSettingsResult(em, { tenantId, organizationId })\n    return NextResponse.json({ ok: true, result })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    logger.error('warranty_claims.settings-general.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx, em, tenantId, organizationId, userId, translate } = await resolveSettingsContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const parsed = warrantyClaimSettingsUpdateSchema.parse(payload)\n    const parsedPayload: Record<string, unknown> = { ...parsed }\n    const existing = await loadWarrantyClaimSettings(em, { tenantId, organizationId })\n    const guarded = await runRouteMutationGuards({\n      container: ctx.container,\n      req,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: WARRANTY_CLAIM_SETTINGS_RESOURCE_KIND,\n        resourceId: existing?.id ?? null,\n        operation: existing ? 'update' : 'create',\n        mutationPayload: parsedPayload,\n      },\n    })\n    if (!guarded.ok) return guarded.response\n\n    const guardedPayload = guarded.modifiedPayload\n      ? warrantyClaimSettingsUpdateSchema.parse({ ...parsedPayload, ...guarded.modifiedPayload })\n      : parsed\n    const commandInput = warrantyClaimSettingsSaveSchema.parse(withScopedPayload({ ...guardedPayload }, ctx, translate))\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<\n      WarrantyClaimSettingsSaveInput,\n      SaveWarrantyClaimSettingsResult\n    >('warranty_claims.settings.save', { input: commandInput, ctx })\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({\n      ok: true,\n      result: {\n        slaHours: result.slaHours,\n        slaPauseOnInfoRequested: result.slaPauseOnInfoRequested,\n        slaAtRiskThresholdPct: result.slaAtRiskThresholdPct,\n        autoApproveEnabled: result.autoApproveEnabled,\n        autoApproveMaxAmount: result.autoApproveMaxAmount,\n        autoApproveCurrencyCode: result.autoApproveCurrencyCode,\n        autoApproveRequireInWarranty: result.autoApproveRequireInWarranty,\n        defaultWarrantyMonths: result.defaultWarrantyMonths,\n        businessHours: result.businessHours,\n        escalationTiers: result.escalationTiers,\n        adjudicationUseRules: result.adjudicationUseRules,\n        quarantineGrades: result.quarantineGrades,\n        returnLabelProvider: result.returnLabelProvider,\n        returnWindowDays: result.returnWindowDays,\n        updatedAt: result.updatedAt,\n      },\n    })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.settings-general.put failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nconst settingsResultSchema = z.object({\n  slaHours: z.number(),\n  slaPauseOnInfoRequested: z.boolean(),\n  slaAtRiskThresholdPct: z.number(),\n  autoApproveEnabled: z.boolean(),\n  autoApproveMaxAmount: z.number().nullable(),\n  autoApproveCurrencyCode: z.string().nullable(),\n  autoApproveRequireInWarranty: z.boolean(),\n  defaultWarrantyMonths: z.number().nullable(),\n  businessHours: z.record(z.string(), z.unknown()).nullable(),\n  escalationTiers: z.array(z.unknown()).nullable(),\n  adjudicationUseRules: z.boolean(),\n  quarantineGrades: z.array(z.string()).nullable(),\n  returnLabelProvider: z.string().nullable(),\n  returnWindowDays: z.number().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst settingsResponseSchema = z.object({\n  ok: z.boolean(),\n  result: settingsResultSchema,\n})\n\nconst settingsErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim general settings',\n  methods: {\n    GET: {\n      summary: 'Get warranty claim general settings',\n      responses: [\n        { status: 200, description: 'Current warranty claim general settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: settingsErrorSchema },\n        { status: 400, description: 'Invalid scope', schema: settingsErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update warranty claim general settings',\n      requestBody: {\n        contentType: 'application/json',\n        schema: warrantyClaimSettingsUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated warranty claim general settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: settingsErrorSchema },\n        { status: 400, description: 'Invalid payload', schema: settingsErrorSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: settingsErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6CAAmF;AAC5F,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAEtC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAgBA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,iBAAiB,OAAO,QAAQ,IAAI,KAAK,KAAK;AAC3D,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAK,YAAY;AAChE;AAEA,eAAe,uBAAuB,KAA6C;AACjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL;AAAA,IACA,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK,OAAO;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAe,oBACb,IACA,OACiC;AACjC,QAAM,SAAS,MAAM,0BAA0B,IAAI,KAAK;AACxD,QAAM,oBAAoB,MAAM,sCAAsC,IAAI,KAAK;AAC/E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,WAAW,MAAM,QAAQ,SAAS;AAAA,EACpC;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,UAAU,eAAe,IAAI,MAAM,uBAAuB,GAAG;AACzE,UAAM,SAAS,MAAM,oBAAoB,IAAI,EAAE,UAAU,eAAe,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,qCAAqC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7I;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,UAAU,gBAAgB,QAAQ,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACjG,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,kCAAkC,MAAM,OAAO;AAC9D,UAAM,gBAAyC,EAAE,GAAG,OAAO;AAC3D,UAAM,WAAW,MAAM,0BAA0B,IAAI,EAAE,UAAU,eAAe,CAAC;AACjF,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C,WAAW,IAAI;AAAA,MACf;AAAA,MACA,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY,UAAU,MAAM;AAAA,QAC5B,WAAW,WAAW,WAAW;AAAA,QACjC,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,UAAM,iBAAiB,QAAQ,kBAC3B,kCAAkC,MAAM,EAAE,GAAG,eAAe,GAAG,QAAQ,gBAAgB,CAAC,IACxF;AACJ,UAAM,eAAe,gCAAgC,MAAM,kBAAkB,EAAE,GAAG,eAAe,GAAG,KAAK,SAAS,CAAC;AACnH,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,iCAAiC,EAAE,OAAO,cAAc,IAAI,CAAC;AAE/D,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN,UAAU,OAAO;AAAA,QACjB,yBAAyB,OAAO;AAAA,QAChC,uBAAuB,OAAO;AAAA,QAC9B,oBAAoB,OAAO;AAAA,QAC3B,sBAAsB,OAAO;AAAA,QAC7B,yBAAyB,OAAO;AAAA,QAChC,8BAA8B,OAAO;AAAA,QACrC,uBAAuB,OAAO;AAAA,QAC9B,eAAe,OAAO;AAAA,QACtB,iBAAiB,OAAO;AAAA,QACxB,sBAAsB,OAAO;AAAA,QAC7B,kBAAkB,OAAO;AAAA,QACzB,qBAAqB,OAAO;AAAA,QAC5B,kBAAkB,OAAO;AAAA,QACzB,WAAW,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,UAAU,EAAE,OAAO;AAAA,EACnB,yBAAyB,EAAE,QAAQ;AAAA,EACnC,uBAAuB,EAAE,OAAO;AAAA,EAChC,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,8BAA8B,EAAE,QAAQ;AAAA,EACxC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC/C,sBAAsB,EAAE,QAAQ;AAAA,EAChC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC/C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ;AAAA,EACd,QAAQ;AACV,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  warrantyClaimSettingsSaveSchema,\n  warrantyClaimSettingsUpdateSchema,\n  type WarrantyClaimSettingsSaveInput,\n} from '../../data/validators'\nimport {\n  loadWarrantyClaimSettings,\n  resolveEffectiveWarrantyClaimSettings,\n  type WarrantyClaimEffectiveSettings,\n} from '../../lib/settings'\nimport { WARRANTY_CLAIM_SETTINGS_RESOURCE_KIND, type SaveWarrantyClaimSettingsResult } from '../../commands/settings'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.settings.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['warranty_claims.settings.manage'] },\n}\n\ntype SettingsRouteContext = {\n  ctx: CommandRuntimeContext\n  em: EntityManager\n  tenantId: string\n  organizationId: string\n  userId: string\n  translate: (key: string, fallback?: string) => string\n}\n\ntype SettingsResponseResult = WarrantyClaimEffectiveSettings & {\n  returnWindowDays: number | null\n  updatedAt: string | null\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nfunction toIso(value: Date | string | null | undefined): string | null {\n  if (!value) return null\n  const date = value instanceof Date ? value : new Date(value)\n  return Number.isNaN(date.getTime()) ? null : date.toISOString()\n}\n\nasync function resolveSettingsContext(req: Request): Promise<SettingsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  const ctx: CommandRuntimeContext = {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: organizationId,\n    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n    request: req,\n  }\n  return {\n    ctx,\n    em: container.resolve('em') as EntityManager,\n    tenantId: auth.tenantId,\n    organizationId,\n    userId: auth.sub ?? '',\n    translate,\n  }\n}\n\nasync function buildSettingsResult(\n  em: EntityManager,\n  scope: { tenantId: string; organizationId: string },\n): Promise<SettingsResponseResult> {\n  const record = await loadWarrantyClaimSettings(em, scope)\n  const effectiveSettings = await resolveEffectiveWarrantyClaimSettings(em, scope)\n  return {\n    ...effectiveSettings,\n    returnWindowDays: record?.returnWindowDays ?? null,\n    updatedAt: toIso(record?.updatedAt),\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const { em, tenantId, organizationId } = await resolveSettingsContext(req)\n    const result = await buildSettingsResult(em, { tenantId, organizationId })\n    return NextResponse.json({ ok: true, result })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    logger.error('warranty_claims.settings-general.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  try {\n    const { ctx, em, tenantId, organizationId, userId, translate } = await resolveSettingsContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const parsed = warrantyClaimSettingsUpdateSchema.parse(payload)\n    const parsedPayload: Record<string, unknown> = { ...parsed }\n    const existing = await loadWarrantyClaimSettings(em, { tenantId, organizationId })\n    const guarded = await runRouteMutationGuards({\n      container: ctx.container,\n      req,\n      auth: { userId, tenantId, organizationId },\n      input: {\n        resourceKind: WARRANTY_CLAIM_SETTINGS_RESOURCE_KIND,\n        resourceId: existing?.id ?? null,\n        operation: existing ? 'update' : 'create',\n        mutationPayload: parsedPayload,\n      },\n    })\n    if (!guarded.ok) return guarded.response\n\n    const guardedPayload = guarded.modifiedPayload\n      ? warrantyClaimSettingsUpdateSchema.parse({ ...parsedPayload, ...guarded.modifiedPayload })\n      : parsed\n    const commandInput = warrantyClaimSettingsSaveSchema.parse(withScopedPayload({ ...guardedPayload }, ctx, translate))\n    const commandBus = ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<\n      WarrantyClaimSettingsSaveInput,\n      SaveWarrantyClaimSettingsResult\n    >('warranty_claims.settings.save', { input: commandInput, ctx })\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({\n      ok: true,\n      result: {\n        slaHours: result.slaHours,\n        slaPauseOnInfoRequested: result.slaPauseOnInfoRequested,\n        slaAtRiskThresholdPct: result.slaAtRiskThresholdPct,\n        autoApproveEnabled: result.autoApproveEnabled,\n        autoApproveMaxAmount: result.autoApproveMaxAmount,\n        autoApproveCurrencyCode: result.autoApproveCurrencyCode,\n        autoApproveRequireInWarranty: result.autoApproveRequireInWarranty,\n        defaultWarrantyMonths: result.defaultWarrantyMonths,\n        businessHours: result.businessHours,\n        escalationTiers: result.escalationTiers,\n        adjudicationUseRules: result.adjudicationUseRules,\n        quarantineGrades: result.quarantineGrades,\n        returnLabelProvider: result.returnLabelProvider,\n        returnWindowDays: result.returnWindowDays,\n        updatedAt: result.updatedAt,\n      },\n    })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.settings-general.put failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nconst settingsResultSchema = z.object({\n  slaHours: z.number(),\n  slaPauseOnInfoRequested: z.boolean(),\n  slaAtRiskThresholdPct: z.number(),\n  autoApproveEnabled: z.boolean(),\n  autoApproveMaxAmount: z.number().nullable(),\n  autoApproveCurrencyCode: z.string().nullable(),\n  autoApproveRequireInWarranty: z.boolean(),\n  defaultWarrantyMonths: z.number().nullable(),\n  businessHours: z.record(z.string(), z.unknown()).nullable(),\n  escalationTiers: z.array(z.unknown()).nullable(),\n  adjudicationUseRules: z.boolean(),\n  quarantineGrades: z.array(z.string()).nullable(),\n  returnLabelProvider: z.string().nullable(),\n  returnWindowDays: z.number().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst settingsResponseSchema = z.object({\n  ok: z.boolean(),\n  result: settingsResultSchema,\n})\n\nconst settingsErrorSchema = z.object({\n  error: z.string(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim general settings',\n  methods: {\n    GET: {\n      summary: 'Get warranty claim general settings',\n      responses: [\n        { status: 200, description: 'Current warranty claim general settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: settingsErrorSchema },\n        { status: 400, description: 'Invalid scope', schema: settingsErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update warranty claim general settings',\n      requestBody: {\n        contentType: 'application/json',\n        schema: warrantyClaimSettingsUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated warranty claim general settings', schema: settingsResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: settingsErrorSchema },\n        { status: 400, description: 'Invalid payload', schema: settingsErrorSchema },\n        { status: 409, description: 'Optimistic lock conflict', schema: settingsErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAElC;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AACP,SAAS,6CAAmF;AAC5F,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAEtC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AAAA,EAC/E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAgBA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,SAAS,MAAM,OAAwD;AACrE,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,OAAO,iBAAiB,OAAO,QAAQ,IAAI,KAAK,KAAK;AAC3D,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO,KAAK,YAAY;AAChE;AAEA,eAAe,uBAAuB,KAA6C;AACjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,QAAM,MAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAClE,SAAS;AAAA,EACX;AACA,SAAO;AAAA,IACL;AAAA,IACA,IAAI,UAAU,QAAQ,IAAI;AAAA,IAC1B,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,KAAK,OAAO;AAAA,IACpB;AAAA,EACF;AACF;AAEA,eAAe,oBACb,IACA,OACiC;AACjC,QAAM,SAAS,MAAM,0BAA0B,IAAI,KAAK;AACxD,QAAM,oBAAoB,MAAM,sCAAsC,IAAI,KAAK;AAC/E,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,QAAQ,oBAAoB;AAAA,IAC9C,WAAW,MAAM,QAAQ,SAAS;AAAA,EACpC;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,IAAI,UAAU,eAAe,IAAI,MAAM,uBAAuB,GAAG;AACzE,UAAM,SAAS,MAAM,oBAAoB,IAAI,EAAE,UAAU,eAAe,CAAC;AACzE,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,CAAC;AAAA,EAC/C,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,qCAAqC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7I;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,EAAE,KAAK,IAAI,UAAU,gBAAgB,QAAQ,UAAU,IAAI,MAAM,uBAAuB,GAAG;AACjG,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,SAAS,kCAAkC,MAAM,OAAO;AAC9D,UAAM,gBAAyC,EAAE,GAAG,OAAO;AAC3D,UAAM,WAAW,MAAM,0BAA0B,IAAI,EAAE,UAAU,eAAe,CAAC;AACjF,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C,WAAW,IAAI;AAAA,MACf;AAAA,MACA,MAAM,EAAE,QAAQ,UAAU,eAAe;AAAA,MACzC,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY,UAAU,MAAM;AAAA,QAC5B,WAAW,WAAW,WAAW;AAAA,QACjC,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAEhC,UAAM,iBAAiB,QAAQ,kBAC3B,kCAAkC,MAAM,EAAE,GAAG,eAAe,GAAG,QAAQ,gBAAgB,CAAC,IACxF;AACJ,UAAM,eAAe,gCAAgC,MAAM,kBAAkB,EAAE,GAAG,eAAe,GAAG,KAAK,SAAS,CAAC;AACnH,UAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,iCAAiC,EAAE,OAAO,cAAc,IAAI,CAAC;AAE/D,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN,UAAU,OAAO;AAAA,QACjB,yBAAyB,OAAO;AAAA,QAChC,uBAAuB,OAAO;AAAA,QAC9B,oBAAoB,OAAO;AAAA,QAC3B,sBAAsB,OAAO;AAAA,QAC7B,yBAAyB,OAAO;AAAA,QAChC,8BAA8B,OAAO;AAAA,QACrC,uBAAuB,OAAO;AAAA,QAC9B,eAAe,OAAO;AAAA,QACtB,iBAAiB,OAAO;AAAA,QACxB,sBAAsB,OAAO;AAAA,QAC7B,kBAAkB,OAAO;AAAA,QACzB,qBAAqB,OAAO;AAAA,QAC5B,kBAAkB,OAAO;AAAA,QACzB,WAAW,OAAO;AAAA,MACpB;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,+CAA+C,EAAE,IAAI,CAAC;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEA,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,UAAU,EAAE,OAAO;AAAA,EACnB,yBAAyB,EAAE,QAAQ;AAAA,EACnC,uBAAuB,EAAE,OAAO;AAAA,EAChC,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,sBAAsB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1C,yBAAyB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7C,8BAA8B,EAAE,QAAQ;AAAA,EACxC,uBAAuB,EAAE,OAAO,EAAE,SAAS;AAAA,EAC3C,eAAe,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC1D,iBAAiB,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,SAAS;AAAA,EAC/C,sBAAsB,EAAE,QAAQ;AAAA,EAChC,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC/C,qBAAqB,EAAE,OAAO,EAAE,SAAS;AAAA,EACzC,kBAAkB,EAAE,OAAO,EAAE,SAAS;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,IAAI,EAAE,QAAQ;AAAA,EACd,QAAQ;AACV,CAAC;AAED,MAAM,sBAAsB,EAAE,OAAO;AAAA,EACnC,OAAO,EAAE,OAAO;AAClB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C,QAAQ,uBAAuB;AAAA,QACtG,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,oBAAoB;AAAA,QACxE,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,oBAAoB;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,oBAAoB;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/stats/route.js

@@ -4,6 +4,7 @@ import { sql } from "kysely";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveEffectiveWarrantyClaimSettings } from "../../lib/settings.js";
@@ -50,6 +51,12 @@ function parseNumeric(value) {
   return Number.isFinite(parsed) ? parsed : 0;
 }
 function applyOrganizationScope(query, organizationIds) {
+  if (organizationIds === void 0) {
+    return query;
+  }
+  if (organizationIds.length === 0) {
+    return query.where(sql`false`);
+  }
   if (organizationIds.length === 1) {
     return query.where("organization_id", "=", organizationIds[0]);
   }
@@ -69,10 +76,7 @@ async function resolveStatsContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0 ? scope.filterIds : auth.orgId ? [auth.orgId] : [];
-  if (organizationIds.length === 0) {
-    throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
-  }
+  const { organizationIds } = resolveOrganizationScopeFilter(scope, auth);
   return {
     tenantId: auth.tenantId,
     organizationIds,
@@ -90,7 +94,7 @@ async function GET(req) {
     const thirtyDaysAgo = new Date(now.getTime() - THIRTY_DAYS_MS);
     const effectiveSettings = await resolveEffectiveWarrantyClaimSettings(context.em, {
       tenantId: context.tenantId,
-      organizationId: context.organizationIds[0] ?? null
+      organizationId: context.organizationIds?.[0] ?? null
     });
     const openRows = await baseClaimsQuery(
       db.selectFrom("warranty_claims").select(["status", sql`count(*)`.as("count")]).where("status", "in", OPEN_STATUSES).groupBy("status"),

package/dist/modules/warranty_claims/api/stats/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/stats/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql, type SelectQueryBuilder } from 'kysely'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveEffectiveWarrantyClaimSettings } from '../../lib/settings'\nimport { SLA_EXCLUDED_STATUSES } from '../../lib/deskFilters'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype NumericAggregateValue = string | number | bigint | null\n\ntype WarrantyClaimsStatsTable = {\n  id: string\n  organization_id: string\n  tenant_id: string\n  status: string\n  deleted_at: Date | null\n  sla_due_at: Date | null\n  sla_paused_at: Date | null\n  assignee_user_id: string | null\n  submitted_at: Date | null\n  resolved_at: Date | null\n  total_approved_amount: string | number | null\n  total_recovered_amount: string | number | null\n  currency_code: string | null\n}\n\ntype WarrantyClaimsStatsDb = {\n  warranty_claims: WarrantyClaimsStatsTable\n}\n\ntype StatsRouteContext = {\n  tenantId: string\n  organizationIds: string[]\n  userId: string | null\n  em: EntityManager\n}\n\nconst querySchema = z.object({}).strict()\n\nconst OPEN_STATUSES = [\n  'submitted',\n  'in_review',\n  'info_requested',\n  'approved',\n  'awaiting_return',\n  'received',\n  'inspecting',\n]\n\nconst RESOLUTION_STATUSES = ['resolved', 'closed']\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000\n\nconst recoveredByCurrencySchema = z.object({\n  currencyCode: z.string().nullable(),\n  total: z.number(),\n})\n\nconst resultSchema = z.object({\n  openByStatus: z.record(z.string(), z.number().int().nonnegative()),\n  overdue: z.number().int().nonnegative(),\n  slaAtRisk: z.number().int().nonnegative(),\n  assignedToMe: z.number().int().nonnegative(),\n  resolvedLast30d: z.number().int().nonnegative(),\n  avgResolutionDays: z.number().nullable(),\n  approvalRatePct: z.number().nullable(),\n  recoveredLast30dByCurrency: z.array(recoveredByCurrencySchema),\n  slaAtRiskThresholdPct: z.number().int().min(1).max(100),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: resultSchema,\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nfunction parseNumeric(value: NumericAggregateValue | undefined): number {\n  if (value === undefined || value === null) return 0\n  const parsed = Number(value)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\nfunction applyOrganizationScope<O>(\n  query: SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O>,\n  organizationIds: string[],\n): SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O> {\n  if (organizationIds.length === 1) {\n    return query.where('organization_id', '=', organizationIds[0])\n  }\n  return query.where('organization_id', 'in', organizationIds)\n}\n\nfunction baseClaimsQuery<O>(\n  query: SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O>,\n  context: StatsRouteContext,\n): SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O> {\n  return applyOrganizationScope(\n    query\n      .where('tenant_id', '=', context.tenantId)\n      .where('deleted_at', 'is', null),\n    context.organizationIds,\n  )\n}\n\nasync function resolveStatsContext(req: Request): Promise<StatsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationIds = Array.isArray(scope?.filterIds) && scope.filterIds.length > 0\n    ? scope.filterIds\n    : auth.orgId\n      ? [auth.orgId]\n      : []\n  if (organizationIds.length === 0) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    tenantId: auth.tenantId,\n    organizationIds,\n    userId: typeof auth.sub === 'string' ? auth.sub : null,\n    em: (container.resolve('em') as EntityManager).fork(),\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    querySchema.parse(Object.fromEntries(url.searchParams))\n    const context = await resolveStatsContext(req)\n    const db = context.em.getKysely<WarrantyClaimsStatsDb>()\n    const now = new Date()\n    const thirtyDaysAgo = new Date(now.getTime() - THIRTY_DAYS_MS)\n    const effectiveSettings = await resolveEffectiveWarrantyClaimSettings(context.em, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationIds[0] ?? null,\n    })\n\n    const openRows = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(['status', sql<NumericAggregateValue>`count(*)`.as('count')])\n        .where('status', 'in', OPEN_STATUSES)\n        .groupBy('status'),\n      context,\n    ).execute()\n    const openByStatus: Record<string, number> = Object.fromEntries(OPEN_STATUSES.map((status) => [status, 0]))\n    for (const row of openRows) {\n      openByStatus[row.status] = Math.trunc(parseNumeric(row.count))\n    }\n\n    const overdueRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('sla_due_at', '<', now)\n        .where('sla_paused_at', 'is', null)\n        .where('status', 'not in', [...SLA_EXCLUDED_STATUSES]),\n      context,\n    ).executeTakeFirst()\n    const overdue = Math.trunc(parseNumeric(overdueRow?.count))\n\n    const atRiskRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('sla_due_at', '>', now)\n        .where('sla_paused_at', 'is', null)\n        .where('status', 'not in', [...SLA_EXCLUDED_STATUSES])\n        .where('submitted_at', 'is not', null)\n        .where(sql<boolean>`sla_due_at > submitted_at`)\n        .where(sql<boolean>`extract(epoch from (${now}::timestamptz - submitted_at)) * 100 >= extract(epoch from (sla_due_at - submitted_at)) * ${effectiveSettings.slaAtRiskThresholdPct}`),\n      context,\n    ).executeTakeFirst()\n    const slaAtRisk = Math.trunc(parseNumeric(atRiskRow?.count))\n\n    let assignedToMe = 0\n    if (context.userId) {\n      const assignedRow = await baseClaimsQuery(\n        db\n          .selectFrom('warranty_claims')\n          .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n          .where('status', 'in', OPEN_STATUSES)\n          .where('assignee_user_id', '=', context.userId),\n        context,\n      ).executeTakeFirst()\n      assignedToMe = Math.trunc(parseNumeric(assignedRow?.count))\n    }\n\n    const resolvedRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('resolved_at', '>=', thirtyDaysAgo),\n      context,\n    ).executeTakeFirst()\n    const resolvedLast30d = Math.trunc(parseNumeric(resolvedRow?.count))\n\n    const avgRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`avg(extract(epoch from (resolved_at - submitted_at)) / 86400.0)`.as('avgDays'))\n        .where('resolved_at', '>=', thirtyDaysAgo)\n        .where('submitted_at', 'is not', null),\n      context,\n    ).executeTakeFirst()\n    const avgValue = avgRow?.avgDays\n    const avgResolutionDays = avgValue === undefined || avgValue === null\n      ? null\n      : Number(parseNumeric(avgValue).toFixed(1))\n\n    const approvalRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select([\n          sql<NumericAggregateValue>`count(*)`.as('total'),\n          sql<NumericAggregateValue>`count(*) filter (where total_approved_amount > 0)`.as('approved'),\n        ])\n        .where('status', 'in', RESOLUTION_STATUSES)\n        .where('resolved_at', '>=', thirtyDaysAgo),\n      context,\n    ).executeTakeFirst()\n    const approvalTotal = parseNumeric(approvalRow?.total)\n    const approvalApproved = parseNumeric(approvalRow?.approved)\n    const approvalRatePct = approvalTotal > 0 ? Math.round((approvalApproved / approvalTotal) * 100) : null\n\n    const recoveredRows = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select([\n          'currency_code as currencyCode',\n          sql<NumericAggregateValue>`coalesce(sum(total_recovered_amount), 0)`.as('total'),\n        ])\n        .where('status', 'in', RESOLUTION_STATUSES)\n        .where('resolved_at', '>=', thirtyDaysAgo)\n        .where('total_recovered_amount', '>', 0)\n        .groupBy('currency_code'),\n      context,\n    ).execute()\n    // `group by` returns rows in an unspecified order, so consumers that render a\n    // single bucket would otherwise show an arbitrary currency. Sort largest-first\n    // with the code as a tiebreak so the response is deterministic.\n    const recoveredLast30dByCurrency = recoveredRows\n      .map((row) => ({\n        currencyCode: row.currencyCode ?? null,\n        total: Number(parseNumeric(row.total).toFixed(2)),\n      }))\n      .sort((left, right) =>\n        right.total - left.total\n        || (left.currencyCode ?? '').localeCompare(right.currencyCode ?? ''))\n\n    return NextResponse.json({\n      ok: true,\n      result: {\n        openByStatus,\n        overdue,\n        slaAtRisk,\n        assignedToMe,\n        resolvedLast30d,\n        avgResolutionDays,\n        approvalRatePct,\n        recoveredLast30dByCurrency,\n        slaAtRiskThresholdPct: effectiveSettings.slaAtRiskThresholdPct,\n      },\n    })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.stats.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim statistics',\n  methods: {\n    GET: {\n      summary: 'Get warranty claim queue and resolution statistics',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Warranty claim statistics',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAoC;AAC7C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,2BAA2B;AAEpC,SAAS,6CAA6C;AACtD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AA+B7C,MAAM,cAAc,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAExC,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,sBAAsB,CAAC,YAAY,QAAQ;AACjD,MAAM,iBAAiB,KAAK,KAAK,KAAK,KAAK;AAE3C,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC;AAAA,EACjE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC9C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,4BAA4B,EAAE,MAAM,yBAAyB;AAAA,EAC7D,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ;AACV,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,SAAS,aAAa,OAAkD;AACtE,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,uBACP,OACA,iBACiE;AACjE,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO,MAAM,MAAM,mBAAmB,KAAK,gBAAgB,CAAC,CAAC;AAAA,EAC/D;AACA,SAAO,MAAM,MAAM,mBAAmB,MAAM,eAAe;AAC7D;AAEA,SAAS,gBACP,OACA,SACiE;AACjE,SAAO;AAAA,IACL,MACG,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,cAAc,MAAM,IAAI;AAAA,IACjC,QAAQ;AAAA,EACV;AACF;AAEA,eAAe,oBAAoB,KAA0C;AAC3E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,kBAAkB,MAAM,QAAQ,OAAO,SAAS,KAAK,MAAM,UAAU,SAAS,IAChF,MAAM,YACN,KAAK,QACH,CAAC,KAAK,KAAK,IACX,CAAC;AACP,MAAI,gBAAgB,WAAW,GAAG;AAChC,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,IAClD,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,EACtD;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,gBAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACtD,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,KAAK,QAAQ,GAAG,UAAiC;AACvD,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,cAAc;AAC7D,UAAM,oBAAoB,MAAM,sCAAsC,QAAQ,IAAI;AAAA,MAChF,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,gBAAgB,CAAC,KAAK;AAAA,IAChD,CAAC;AAED,UAAM,WAAW,MAAM;AAAA,MACrB,GACG,WAAW,iBAAiB,EAC5B,OAAO,CAAC,UAAU,cAAqC,GAAG,OAAO,CAAC,CAAC,EACnE,MAAM,UAAU,MAAM,aAAa,EACnC,QAAQ,QAAQ;AAAA,MACnB;AAAA,IACF,EAAE,QAAQ;AACV,UAAM,eAAuC,OAAO,YAAY,cAAc,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1G,eAAW,OAAO,UAAU;AAC1B,mBAAa,IAAI,MAAM,IAAI,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,cAAc,KAAK,GAAG,EAC5B,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,UAAU,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAAA,MACvD;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,UAAU,KAAK,MAAM,aAAa,YAAY,KAAK,CAAC;AAE1D,UAAM,YAAY,MAAM;AAAA,MACtB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,cAAc,KAAK,GAAG,EAC5B,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,UAAU,UAAU,CAAC,GAAG,qBAAqB,CAAC,EACpD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,8BAAuC,EAC7C,MAAM,0BAAmC,GAAG,6FAA6F,kBAAkB,qBAAqB,EAAE;AAAA,MACrL;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,YAAY,KAAK,MAAM,aAAa,WAAW,KAAK,CAAC;AAE3D,QAAI,eAAe;AACnB,QAAI,QAAQ,QAAQ;AAClB,YAAM,cAAc,MAAM;AAAA,QACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,UAAU,MAAM,aAAa,EACnC,MAAM,oBAAoB,KAAK,QAAQ,MAAM;AAAA,QAChD;AAAA,MACF,EAAE,iBAAiB;AACnB,qBAAe,KAAK,MAAM,aAAa,aAAa,KAAK,CAAC;AAAA,IAC5D;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,eAAe,MAAM,aAAa;AAAA,MAC3C;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,kBAAkB,KAAK,MAAM,aAAa,aAAa,KAAK,CAAC;AAEnE,UAAM,SAAS,MAAM;AAAA,MACnB,GACG,WAAW,iBAAiB,EAC5B,OAAO,qEAA4F,GAAG,SAAS,CAAC,EAChH,MAAM,eAAe,MAAM,aAAa,EACxC,MAAM,gBAAgB,UAAU,IAAI;AAAA,MACvC;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,WAAW,QAAQ;AACzB,UAAM,oBAAoB,aAAa,UAAa,aAAa,OAC7D,OACA,OAAO,aAAa,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO;AAAA,QACN,cAAqC,GAAG,OAAO;AAAA,QAC/C,uDAA8E,GAAG,UAAU;AAAA,MAC7F,CAAC,EACA,MAAM,UAAU,MAAM,mBAAmB,EACzC,MAAM,eAAe,MAAM,aAAa;AAAA,MAC3C;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,gBAAgB,aAAa,aAAa,KAAK;AACrD,UAAM,mBAAmB,aAAa,aAAa,QAAQ;AAC3D,UAAM,kBAAkB,gBAAgB,IAAI,KAAK,MAAO,mBAAmB,gBAAiB,GAAG,IAAI;AAEnG,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GACG,WAAW,iBAAiB,EAC5B,OAAO;AAAA,QACN;AAAA,QACA,8CAAqE,GAAG,OAAO;AAAA,MACjF,CAAC,EACA,MAAM,UAAU,MAAM,mBAAmB,EACzC,MAAM,eAAe,MAAM,aAAa,EACxC,MAAM,0BAA0B,KAAK,CAAC,EACtC,QAAQ,eAAe;AAAA,MAC1B;AAAA,IACF,EAAE,QAAQ;AAIV,UAAM,6BAA6B,cAChC,IAAI,CAAC,SAAS;AAAA,MACb,cAAc,IAAI,gBAAgB;AAAA,MAClC,OAAO,OAAO,aAAa,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;AAAA,IAClD,EAAE,EACD,KAAK,CAAC,MAAM,UACX,MAAM,QAAQ,KAAK,UACf,KAAK,gBAAgB,IAAI,cAAc,MAAM,gBAAgB,EAAE,CAAC;AAExE,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,uBAAuB,kBAAkB;AAAA,MAC3C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql, type SelectQueryBuilder } from 'kysely'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveEffectiveWarrantyClaimSettings } from '../../lib/settings'\nimport { SLA_EXCLUDED_STATUSES } from '../../lib/deskFilters'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype NumericAggregateValue = string | number | bigint | null\n\ntype WarrantyClaimsStatsTable = {\n  id: string\n  organization_id: string\n  tenant_id: string\n  status: string\n  deleted_at: Date | null\n  sla_due_at: Date | null\n  sla_paused_at: Date | null\n  assignee_user_id: string | null\n  submitted_at: Date | null\n  resolved_at: Date | null\n  total_approved_amount: string | number | null\n  total_recovered_amount: string | number | null\n  currency_code: string | null\n}\n\ntype WarrantyClaimsStatsDb = {\n  warranty_claims: WarrantyClaimsStatsTable\n}\n\ntype StatsRouteContext = {\n  tenantId: string\n  organizationIds: string[] | undefined\n  userId: string | null\n  em: EntityManager\n}\n\nconst querySchema = z.object({}).strict()\n\nconst OPEN_STATUSES = [\n  'submitted',\n  'in_review',\n  'info_requested',\n  'approved',\n  'awaiting_return',\n  'received',\n  'inspecting',\n]\n\nconst RESOLUTION_STATUSES = ['resolved', 'closed']\nconst THIRTY_DAYS_MS = 30 * 24 * 60 * 60 * 1000\n\nconst recoveredByCurrencySchema = z.object({\n  currencyCode: z.string().nullable(),\n  total: z.number(),\n})\n\nconst resultSchema = z.object({\n  openByStatus: z.record(z.string(), z.number().int().nonnegative()),\n  overdue: z.number().int().nonnegative(),\n  slaAtRisk: z.number().int().nonnegative(),\n  assignedToMe: z.number().int().nonnegative(),\n  resolvedLast30d: z.number().int().nonnegative(),\n  avgResolutionDays: z.number().nullable(),\n  approvalRatePct: z.number().nullable(),\n  recoveredLast30dByCurrency: z.array(recoveredByCurrencySchema),\n  slaAtRiskThresholdPct: z.number().int().min(1).max(100),\n})\n\nconst responseSchema = z.object({\n  ok: z.literal(true),\n  result: resultSchema,\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['warranty_claims.claim.view'] },\n}\n\nfunction parseNumeric(value: NumericAggregateValue | undefined): number {\n  if (value === undefined || value === null) return 0\n  const parsed = Number(value)\n  return Number.isFinite(parsed) ? parsed : 0\n}\n\nfunction applyOrganizationScope<O>(\n  query: SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O>,\n  organizationIds: string[] | undefined,\n): SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O> {\n  if (organizationIds === undefined) {\n    return query\n  }\n  if (organizationIds.length === 0) {\n    return query.where(sql<boolean>`false`)\n  }\n  if (organizationIds.length === 1) {\n    return query.where('organization_id', '=', organizationIds[0])\n  }\n  return query.where('organization_id', 'in', organizationIds)\n}\n\nfunction baseClaimsQuery<O>(\n  query: SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O>,\n  context: StatsRouteContext,\n): SelectQueryBuilder<WarrantyClaimsStatsDb, 'warranty_claims', O> {\n  return applyOrganizationScope(\n    query\n      .where('tenant_id', '=', context.tenantId)\n      .where('deleted_at', 'is', null),\n    context.organizationIds,\n  )\n}\n\nasync function resolveStatsContext(req: Request): Promise<StatsRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const { organizationIds } = resolveOrganizationScopeFilter(scope, auth)\n  return {\n    tenantId: auth.tenantId,\n    organizationIds,\n    userId: typeof auth.sub === 'string' ? auth.sub : null,\n    em: (container.resolve('em') as EntityManager).fork(),\n  }\n}\n\nexport async function GET(req: Request) {\n  try {\n    const url = new URL(req.url)\n    querySchema.parse(Object.fromEntries(url.searchParams))\n    const context = await resolveStatsContext(req)\n    const db = context.em.getKysely<WarrantyClaimsStatsDb>()\n    const now = new Date()\n    const thirtyDaysAgo = new Date(now.getTime() - THIRTY_DAYS_MS)\n    const effectiveSettings = await resolveEffectiveWarrantyClaimSettings(context.em, {\n      tenantId: context.tenantId,\n      organizationId: context.organizationIds?.[0] ?? null,\n    })\n\n    const openRows = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(['status', sql<NumericAggregateValue>`count(*)`.as('count')])\n        .where('status', 'in', OPEN_STATUSES)\n        .groupBy('status'),\n      context,\n    ).execute()\n    const openByStatus: Record<string, number> = Object.fromEntries(OPEN_STATUSES.map((status) => [status, 0]))\n    for (const row of openRows) {\n      openByStatus[row.status] = Math.trunc(parseNumeric(row.count))\n    }\n\n    const overdueRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('sla_due_at', '<', now)\n        .where('sla_paused_at', 'is', null)\n        .where('status', 'not in', [...SLA_EXCLUDED_STATUSES]),\n      context,\n    ).executeTakeFirst()\n    const overdue = Math.trunc(parseNumeric(overdueRow?.count))\n\n    const atRiskRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('sla_due_at', '>', now)\n        .where('sla_paused_at', 'is', null)\n        .where('status', 'not in', [...SLA_EXCLUDED_STATUSES])\n        .where('submitted_at', 'is not', null)\n        .where(sql<boolean>`sla_due_at > submitted_at`)\n        .where(sql<boolean>`extract(epoch from (${now}::timestamptz - submitted_at)) * 100 >= extract(epoch from (sla_due_at - submitted_at)) * ${effectiveSettings.slaAtRiskThresholdPct}`),\n      context,\n    ).executeTakeFirst()\n    const slaAtRisk = Math.trunc(parseNumeric(atRiskRow?.count))\n\n    let assignedToMe = 0\n    if (context.userId) {\n      const assignedRow = await baseClaimsQuery(\n        db\n          .selectFrom('warranty_claims')\n          .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n          .where('status', 'in', OPEN_STATUSES)\n          .where('assignee_user_id', '=', context.userId),\n        context,\n      ).executeTakeFirst()\n      assignedToMe = Math.trunc(parseNumeric(assignedRow?.count))\n    }\n\n    const resolvedRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`count(*)`.as('count'))\n        .where('resolved_at', '>=', thirtyDaysAgo),\n      context,\n    ).executeTakeFirst()\n    const resolvedLast30d = Math.trunc(parseNumeric(resolvedRow?.count))\n\n    const avgRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select(sql<NumericAggregateValue>`avg(extract(epoch from (resolved_at - submitted_at)) / 86400.0)`.as('avgDays'))\n        .where('resolved_at', '>=', thirtyDaysAgo)\n        .where('submitted_at', 'is not', null),\n      context,\n    ).executeTakeFirst()\n    const avgValue = avgRow?.avgDays\n    const avgResolutionDays = avgValue === undefined || avgValue === null\n      ? null\n      : Number(parseNumeric(avgValue).toFixed(1))\n\n    const approvalRow = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select([\n          sql<NumericAggregateValue>`count(*)`.as('total'),\n          sql<NumericAggregateValue>`count(*) filter (where total_approved_amount > 0)`.as('approved'),\n        ])\n        .where('status', 'in', RESOLUTION_STATUSES)\n        .where('resolved_at', '>=', thirtyDaysAgo),\n      context,\n    ).executeTakeFirst()\n    const approvalTotal = parseNumeric(approvalRow?.total)\n    const approvalApproved = parseNumeric(approvalRow?.approved)\n    const approvalRatePct = approvalTotal > 0 ? Math.round((approvalApproved / approvalTotal) * 100) : null\n\n    const recoveredRows = await baseClaimsQuery(\n      db\n        .selectFrom('warranty_claims')\n        .select([\n          'currency_code as currencyCode',\n          sql<NumericAggregateValue>`coalesce(sum(total_recovered_amount), 0)`.as('total'),\n        ])\n        .where('status', 'in', RESOLUTION_STATUSES)\n        .where('resolved_at', '>=', thirtyDaysAgo)\n        .where('total_recovered_amount', '>', 0)\n        .groupBy('currency_code'),\n      context,\n    ).execute()\n    // `group by` returns rows in an unspecified order, so consumers that render a\n    // single bucket would otherwise show an arbitrary currency. Sort largest-first\n    // with the code as a tiebreak so the response is deterministic.\n    const recoveredLast30dByCurrency = recoveredRows\n      .map((row) => ({\n        currencyCode: row.currencyCode ?? null,\n        total: Number(parseNumeric(row.total).toFixed(2)),\n      }))\n      .sort((left, right) =>\n        right.total - left.total\n        || (left.currencyCode ?? '').localeCompare(right.currencyCode ?? ''))\n\n    return NextResponse.json({\n      ok: true,\n      result: {\n        openByStatus,\n        overdue,\n        slaAtRisk,\n        assignedToMe,\n        resolvedLast30d,\n        avgResolutionDays,\n        approvalRatePct,\n        recoveredLast30dByCurrency,\n        slaAtRiskThresholdPct: effectiveSettings.slaAtRiskThresholdPct,\n      },\n    })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.stats.get failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Warranty claim statistics',\n  methods: {\n    GET: {\n      summary: 'Get warranty claim queue and resolution statistics',\n      query: querySchema,\n      responses: [\n        {\n          status: 200,\n          description: 'Warranty claim statistics',\n          schema: responseSchema,\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,WAAoC;AAC7C,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,sCAAsC;AAC/C,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,2BAA2B;AAEpC,SAAS,6CAA6C;AACtD,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AA+B7C,MAAM,cAAc,EAAE,OAAO,CAAC,CAAC,EAAE,OAAO;AAExC,MAAM,gBAAgB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,MAAM,sBAAsB,CAAC,YAAY,QAAQ;AACjD,MAAM,iBAAiB,KAAK,KAAK,KAAK,KAAK;AAE3C,MAAM,4BAA4B,EAAE,OAAO;AAAA,EACzC,cAAc,EAAE,OAAO,EAAE,SAAS;AAAA,EAClC,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,eAAe,EAAE,OAAO;AAAA,EAC5B,cAAc,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC;AAAA,EACjE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACxC,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC3C,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EAC9C,mBAAmB,EAAE,OAAO,EAAE,SAAS;AAAA,EACvC,iBAAiB,EAAE,OAAO,EAAE,SAAS;AAAA,EACrC,4BAA4B,EAAE,MAAM,yBAAyB;AAAA,EAC7D,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AACxD,CAAC;AAED,MAAM,iBAAiB,EAAE,OAAO;AAAA,EAC9B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,QAAQ;AACV,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,4BAA4B,EAAE;AAC5E;AAEA,SAAS,aAAa,OAAkD;AACtE,MAAI,UAAU,UAAa,UAAU,KAAM,QAAO;AAClD,QAAM,SAAS,OAAO,KAAK;AAC3B,SAAO,OAAO,SAAS,MAAM,IAAI,SAAS;AAC5C;AAEA,SAAS,uBACP,OACA,iBACiE;AACjE,MAAI,oBAAoB,QAAW;AACjC,WAAO;AAAA,EACT;AACA,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO,MAAM,MAAM,UAAmB;AAAA,EACxC;AACA,MAAI,gBAAgB,WAAW,GAAG;AAChC,WAAO,MAAM,MAAM,mBAAmB,KAAK,gBAAgB,CAAC,CAAC;AAAA,EAC/D;AACA,SAAO,MAAM,MAAM,mBAAmB,MAAM,eAAe;AAC7D;AAEA,SAAS,gBACP,OACA,SACiE;AACjE,SAAO;AAAA,IACL,MACG,MAAM,aAAa,KAAK,QAAQ,QAAQ,EACxC,MAAM,cAAc,MAAM,IAAI;AAAA,IACjC,QAAQ;AAAA,EACV;AACF;AAEA,eAAe,oBAAoB,KAA0C;AAC3E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,EAAE,gBAAgB,IAAI,+BAA+B,OAAO,IAAI;AACtE,SAAO;AAAA,IACL,UAAU,KAAK;AAAA,IACf;AAAA,IACA,QAAQ,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,IAClD,IAAK,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAAA,EACtD;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,gBAAY,MAAM,OAAO,YAAY,IAAI,YAAY,CAAC;AACtD,UAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,UAAM,KAAK,QAAQ,GAAG,UAAiC;AACvD,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,gBAAgB,IAAI,KAAK,IAAI,QAAQ,IAAI,cAAc;AAC7D,UAAM,oBAAoB,MAAM,sCAAsC,QAAQ,IAAI;AAAA,MAChF,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ,kBAAkB,CAAC,KAAK;AAAA,IAClD,CAAC;AAED,UAAM,WAAW,MAAM;AAAA,MACrB,GACG,WAAW,iBAAiB,EAC5B,OAAO,CAAC,UAAU,cAAqC,GAAG,OAAO,CAAC,CAAC,EACnE,MAAM,UAAU,MAAM,aAAa,EACnC,QAAQ,QAAQ;AAAA,MACnB;AAAA,IACF,EAAE,QAAQ;AACV,UAAM,eAAuC,OAAO,YAAY,cAAc,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;AAC1G,eAAW,OAAO,UAAU;AAC1B,mBAAa,IAAI,MAAM,IAAI,KAAK,MAAM,aAAa,IAAI,KAAK,CAAC;AAAA,IAC/D;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,cAAc,KAAK,GAAG,EAC5B,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,UAAU,UAAU,CAAC,GAAG,qBAAqB,CAAC;AAAA,MACvD;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,UAAU,KAAK,MAAM,aAAa,YAAY,KAAK,CAAC;AAE1D,UAAM,YAAY,MAAM;AAAA,MACtB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,cAAc,KAAK,GAAG,EAC5B,MAAM,iBAAiB,MAAM,IAAI,EACjC,MAAM,UAAU,UAAU,CAAC,GAAG,qBAAqB,CAAC,EACpD,MAAM,gBAAgB,UAAU,IAAI,EACpC,MAAM,8BAAuC,EAC7C,MAAM,0BAAmC,GAAG,6FAA6F,kBAAkB,qBAAqB,EAAE;AAAA,MACrL;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,YAAY,KAAK,MAAM,aAAa,WAAW,KAAK,CAAC;AAE3D,QAAI,eAAe;AACnB,QAAI,QAAQ,QAAQ;AAClB,YAAM,cAAc,MAAM;AAAA,QACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,UAAU,MAAM,aAAa,EACnC,MAAM,oBAAoB,KAAK,QAAQ,MAAM;AAAA,QAChD;AAAA,MACF,EAAE,iBAAiB;AACnB,qBAAe,KAAK,MAAM,aAAa,aAAa,KAAK,CAAC;AAAA,IAC5D;AAEA,UAAM,cAAc,MAAM;AAAA,MACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO,cAAqC,GAAG,OAAO,CAAC,EACvD,MAAM,eAAe,MAAM,aAAa;AAAA,MAC3C;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,kBAAkB,KAAK,MAAM,aAAa,aAAa,KAAK,CAAC;AAEnE,UAAM,SAAS,MAAM;AAAA,MACnB,GACG,WAAW,iBAAiB,EAC5B,OAAO,qEAA4F,GAAG,SAAS,CAAC,EAChH,MAAM,eAAe,MAAM,aAAa,EACxC,MAAM,gBAAgB,UAAU,IAAI;AAAA,MACvC;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,WAAW,QAAQ;AACzB,UAAM,oBAAoB,aAAa,UAAa,aAAa,OAC7D,OACA,OAAO,aAAa,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAE5C,UAAM,cAAc,MAAM;AAAA,MACxB,GACG,WAAW,iBAAiB,EAC5B,OAAO;AAAA,QACN,cAAqC,GAAG,OAAO;AAAA,QAC/C,uDAA8E,GAAG,UAAU;AAAA,MAC7F,CAAC,EACA,MAAM,UAAU,MAAM,mBAAmB,EACzC,MAAM,eAAe,MAAM,aAAa;AAAA,MAC3C;AAAA,IACF,EAAE,iBAAiB;AACnB,UAAM,gBAAgB,aAAa,aAAa,KAAK;AACrD,UAAM,mBAAmB,aAAa,aAAa,QAAQ;AAC3D,UAAM,kBAAkB,gBAAgB,IAAI,KAAK,MAAO,mBAAmB,gBAAiB,GAAG,IAAI;AAEnG,UAAM,gBAAgB,MAAM;AAAA,MAC1B,GACG,WAAW,iBAAiB,EAC5B,OAAO;AAAA,QACN;AAAA,QACA,8CAAqE,GAAG,OAAO;AAAA,MACjF,CAAC,EACA,MAAM,UAAU,MAAM,mBAAmB,EACzC,MAAM,eAAe,MAAM,aAAa,EACxC,MAAM,0BAA0B,KAAK,CAAC,EACtC,QAAQ,eAAe;AAAA,MAC1B;AAAA,IACF,EAAE,QAAQ;AAIV,UAAM,6BAA6B,cAChC,IAAI,CAAC,SAAS;AAAA,MACb,cAAc,IAAI,gBAAgB;AAAA,MAClC,OAAO,OAAO,aAAa,IAAI,KAAK,EAAE,QAAQ,CAAC,CAAC;AAAA,IAClD,EAAE,EACD,KAAK,CAAC,MAAM,UACX,MAAM,QAAQ,KAAK,UACf,KAAK,gBAAgB,IAAI,cAAc,MAAM,gBAAgB,EAAE,CAAC;AAExE,WAAO,aAAa,KAAK;AAAA,MACvB,IAAI;AAAA,MACJ,QAAQ;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,uBAAuB,kBAAkB;AAAA,MAC3C;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,oCAAoC,EAAE,IAAI,CAAC;AACxD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,oCAAoC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5I;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/submit/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
@@ -29,7 +30,7 @@ async function resolveActionContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }

package/dist/modules/warranty_claims/api/submit/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/submit/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\n// Scope is derived from the authenticated principal, never accepted from the body \u2014\n// mirroring the sibling transition/assign routes. `withScopedPayload` prefers a\n// caller-supplied tenantId/organizationId over the actor's context, so admitting them\n// here would let the request choose its own scope.\nconst submitSchema = z\n  .object({\n    id: z.string().uuid(),\n  })\n  .strict()\n\ntype SubmitInput = z.infer<typeof submitSchema>\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: SubmitInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.id,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = toRecord(withScopedPayload(payload, context.ctx, context.translate))\n    const input = submitSchema.parse({ id: scopedPayload.id })\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? submitSchema.parse(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<SubmitInput, { claimId: string }>(\n      'warranty_claims.claim.submit',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.submit.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Submit warranty claim',\n  methods: {\n    POST: {\n      summary: 'Submit a draft claim',\n      requestBody: { contentType: 'application/json', schema: submitSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Claim submitted',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAM7C,MAAM,eAAe,EAClB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC,EACA,OAAO;AAWH,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,SAAS,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS,CAAC;AACzF,UAAM,QAAQ,aAAa,MAAM,EAAE,IAAI,cAAc,GAAG,CAAC;AACzD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,aAAa,MAAM,QAAQ,eAAe,IAAI;AAE7F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,GAAG,CAAC;AAAA,EACpF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,aAAa;AAAA,MACrE,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\n// Scope is derived from the authenticated principal, never accepted from the body \u2014\n// mirroring the sibling transition/assign routes. `withScopedPayload` prefers a\n// caller-supplied tenantId/organizationId over the actor's context, so admitting them\n// here would let the request choose its own scope.\nconst submitSchema = z\n  .object({\n    id: z.string().uuid(),\n  })\n  .strict()\n\ntype SubmitInput = z.infer<typeof submitSchema>\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: SubmitInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.id,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = toRecord(withScopedPayload(payload, context.ctx, context.translate))\n    const input = submitSchema.parse({ id: scopedPayload.id })\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? submitSchema.parse(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<SubmitInput, { claimId: string }>(\n      'warranty_claims.claim.submit',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.submit.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Submit warranty claim',\n  methods: {\n    POST: {\n      summary: 'Submit a draft claim',\n      requestBody: { contentType: 'application/json', schema: submitSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Claim submitted',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAM7C,MAAM,eAAe,EAClB,OAAO;AAAA,EACN,IAAI,EAAE,OAAO,EAAE,KAAK;AACtB,CAAC,EACA,OAAO;AAWH,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,SAAS,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS,CAAC;AACzF,UAAM,QAAQ,aAAa,MAAM,EAAE,IAAI,cAAc,GAAG,CAAC;AACzD,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,aAAa,MAAM,QAAQ,eAAe,IAAI;AAE7F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,GAAG,CAAC;AAAA,EACpF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,sCAAsC,EAAE,IAAI,CAAC;AAC1D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,aAAa;AAAA,MACrE,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/transition/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
@@ -27,7 +28,7 @@ async function resolveActionContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }

package/dist/modules/warranty_claims/api/transition/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/warranty_claims/api/transition/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { transitionClaimInputSchema, type TransitionClaimInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope?.selectedId ?? auth.orgId ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toTransitionInput(scopedPayload: Record<string, unknown>): TransitionClaimInput {\n  return transitionClaimInputSchema.parse({\n    id: scopedPayload.id,\n    toStatus: scopedPayload.toStatus,\n    rejectionReasonCode: scopedPayload.rejectionReasonCode,\n    resolutionSummary: scopedPayload.resolutionSummary,\n  })\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: TransitionClaimInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.id,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = withScopedPayload(payload, context.ctx, context.translate)\n    const input = toTransitionInput(scopedPayload)\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? toTransitionInput(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<TransitionClaimInput, { claimId: string }>(\n      'warranty_claims.claim.transition',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.transition.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Transition warranty claim',\n  methods: {\n    POST: {\n      summary: 'Move a claim through the lifecycle',\n      requestBody: { contentType: 'application/json', schema: transitionClaimInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Claim transitioned',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AAEnD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,kCAA6D;AACtE,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAStC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,OAAO,cAAc,KAAK,SAAS;AAC1D,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,eAA8D;AACvF,SAAO,2BAA2B,MAAM;AAAA,IACtC,IAAI,cAAc;AAAA,IAClB,UAAU,cAAc;AAAA,IACxB,qBAAqB,cAAc;AAAA,IACnC,mBAAmB,cAAc;AAAA,EACnC,CAAC;AACH;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS;AAC/E,UAAM,QAAQ,kBAAkB,aAAa;AAC7C,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,kBAAkB,QAAQ,eAAe,IAAI;AAE5F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,GAAG,CAAC;AAAA,EACpF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,MACnF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from '@open-mercato/shared/lib/crud/errors'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { transitionClaimInputSchema, type TransitionClaimInput } from '../../data/validators'\nimport { WARRANTY_CLAIM_RESOURCE_KIND } from '../../commands/shared'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('warranty_claims')\n\ntype ActionRouteContext = {\n  ctx: CommandRuntimeContext\n  tenantId: string\n  organizationId: string\n  translate: (key: string, fallback?: string) => string\n}\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage'] },\n}\n\nfunction toRecord(value: unknown): Record<string, unknown> {\n  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}\n}\n\nasync function resolveActionContext(req: Request): Promise<ActionRouteContext> {\n  const container = await createRequestContainer()\n  const auth = await getAuthFromRequest(req)\n  const { translate } = await resolveTranslations()\n  if (!auth || !auth.tenantId) {\n    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null\n  if (!organizationId) {\n    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required') })\n  }\n  return {\n    ctx: {\n      container,\n      auth,\n      organizationScope: scope,\n      selectedOrganizationId: organizationId,\n      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),\n      request: req,\n    },\n    tenantId: auth.tenantId,\n    organizationId,\n    translate,\n  }\n}\n\nfunction toTransitionInput(scopedPayload: Record<string, unknown>): TransitionClaimInput {\n  return transitionClaimInputSchema.parse({\n    id: scopedPayload.id,\n    toStatus: scopedPayload.toStatus,\n    rejectionReasonCode: scopedPayload.rejectionReasonCode,\n    resolutionSummary: scopedPayload.resolutionSummary,\n  })\n}\n\nasync function runGuard(\n  req: Request,\n  context: ActionRouteContext,\n  input: TransitionClaimInput,\n): Promise<RouteMutationGuardResult> {\n  const userId = context.ctx.auth?.sub\n  if (!userId) {\n    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })\n  }\n  return runRouteMutationGuards({\n    container: context.ctx.container,\n    req,\n    auth: {\n      userId,\n      tenantId: context.tenantId,\n      organizationId: context.organizationId,\n    },\n    input: {\n      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,\n      resourceId: input.id,\n      operation: 'custom',\n      mutationPayload: { ...input },\n    },\n  })\n}\n\nexport async function POST(req: Request) {\n  try {\n    const context = await resolveActionContext(req)\n    const payload = toRecord(await readJsonSafe(req, {}))\n    const scopedPayload = withScopedPayload(payload, context.ctx, context.translate)\n    const input = toTransitionInput(scopedPayload)\n    const guarded = await runGuard(req, context, input)\n    if (!guarded.ok) {\n      return guarded.response\n    }\n    const commandInput = guarded.modifiedPayload ? toTransitionInput(guarded.modifiedPayload) : input\n\n    const commandBus = context.ctx.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<TransitionClaimInput, { claimId: string }>(\n      'warranty_claims.claim.transition',\n      { input: commandInput, ctx: context.ctx },\n    )\n\n    await guarded.runAfterSuccess()\n\n    return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })\n  } catch (err) {\n    const { translate } = await resolveTranslations()\n    if (isCrudHttpError(err)) return NextResponse.json(translateCrudErrorBody(err.body, translate), { status: err.status })\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    if (err instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })\n    }\n    logger.error('warranty_claims.transition.post failed', { err })\n    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Warranty Claims',\n  summary: 'Transition warranty claim',\n  methods: {\n    POST: {\n      summary: 'Move a claim through the lifecycle',\n      requestBody: { contentType: 'application/json', schema: transitionClaimInputSchema },\n      responses: [\n        {\n          status: 200,\n          description: 'Claim transitioned',\n          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),\n        },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,0CAA0C;AACnD,SAAS,yCAAyC;AAElD,SAAS,2BAA2B;AACpC,SAAS,eAAe,iBAAiB,8BAA8B;AACvE,SAAS,0CAA0C;AACnD,SAAS,oBAAoB;AAC7B,SAAS,8BAA6D;AACtE,SAAS,yBAAyB;AAElC,SAAS,kCAA6D;AACtE,SAAS,oCAAoC;AAC7C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,iBAAiB;AAStC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAC/E;AAEA,SAAS,SAAS,OAAyC;AACzD,SAAO,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAmC,CAAC;AAC3G;AAEA,eAAe,qBAAqB,KAA2C;AAC7E,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAC1G;AACA,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,kCAAkC,OAAO,IAAI,KAAK;AACzE,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,gDAAgD,kCAAkC,EAAE,CAAC;AAAA,EACvI;AACA,SAAO;AAAA,IACL,KAAK;AAAA,MACH;AAAA,MACA;AAAA,MACA,mBAAmB;AAAA,MACnB,wBAAwB;AAAA,MACxB,iBAAiB,OAAO,cAAc,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,kBAAkB,eAA8D;AACvF,SAAO,2BAA2B,MAAM;AAAA,IACtC,IAAI,cAAc;AAAA,IAClB,UAAU,cAAc;AAAA,IACxB,qBAAqB,cAAc;AAAA,IACnC,mBAAmB,cAAc;AAAA,EACnC,CAAC;AACH;AAEA,eAAe,SACb,KACA,SACA,OACmC;AACnC,QAAM,SAAS,QAAQ,IAAI,MAAM;AACjC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,QAAQ,UAAU,uCAAuC,cAAc,EAAE,CAAC;AAAA,EAClH;AACA,SAAO,uBAAuB;AAAA,IAC5B,WAAW,QAAQ,IAAI;AAAA,IACvB;AAAA,IACA,MAAM;AAAA,MACJ;AAAA,MACA,UAAU,QAAQ;AAAA,MAClB,gBAAgB,QAAQ;AAAA,IAC1B;AAAA,IACA,OAAO;AAAA,MACL,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,iBAAiB,EAAE,GAAG,MAAM;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,GAAG;AAC9C,UAAM,UAAU,SAAS,MAAM,aAAa,KAAK,CAAC,CAAC,CAAC;AACpD,UAAM,gBAAgB,kBAAkB,SAAS,QAAQ,KAAK,QAAQ,SAAS;AAC/E,UAAM,QAAQ,kBAAkB,aAAa;AAC7C,UAAM,UAAU,MAAM,SAAS,KAAK,SAAS,KAAK;AAClD,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,QAAQ;AAAA,IACjB;AACA,UAAM,eAAe,QAAQ,kBAAkB,kBAAkB,QAAQ,eAAe,IAAI;AAE5F,UAAM,aAAa,QAAQ,IAAI,UAAU,QAAQ,YAAY;AAC7D,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA,EAAE,OAAO,cAAc,KAAK,QAAQ,IAAI;AAAA,IAC1C;AAEA,UAAM,QAAQ,gBAAgB;AAE9B,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,QAAQ,WAAW,aAAa,GAAG,CAAC;AAAA,EACpF,SAAS,KAAK;AACZ,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,uBAAuB,IAAI,MAAM,SAAS,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AACtH,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,QAAI,eAAe,EAAE,UAAU;AAC7B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,uCAAuC,eAAe,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACxH;AACA,WAAO,MAAM,0CAA0C,EAAE,IAAI,CAAC;AAC9D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,sCAAsC,+BAA+B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvI;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,aAAa,oBAAoB,QAAQ,2BAA2B;AAAA,MACnF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,GAAG,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/warranty_claims/api/vendor-recovery/route.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { resolveOrganizationScopeForRequest } from "@open-mercato/core/modules/directory/utils/organizationScope";
+import { resolveSingleOrganizationIdOrDeny } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { CrudHttpError, isCrudHttpError, translateCrudErrorBody } from "@open-mercato/shared/lib/crud/errors";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
@@ -27,7 +28,7 @@ async function resolveActionContext(req) {
     throw new CrudHttpError(401, { error: translate("warranty_claims.errors.unauthorized", "Unauthorized") });
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req });
-  const organizationId = scope?.selectedId ?? auth.orgId ?? null;
+  const organizationId = resolveSingleOrganizationIdOrDeny(scope, auth) ?? null;
   if (!organizationId) {
     throw new CrudHttpError(400, { error: translate("warranty_claims.errors.organization_required", "Organization context is required") });
   }