@open-mercato/core 0.9.1-develop.7513.1.ae2715553f → 0.9.1-develop.7515.1.e2712c8b00

package/dist/modules/warranty_claims/commands/shared.js

@@ -1,10 +1,11 @@
 import { randomUUID } from "crypto";
-import { assertFound } from "@open-mercato/shared/lib/crud/errors";
+import { CrudHttpError, assertFound } from "@open-mercato/shared/lib/crud/errors";
 import { invalidateCrudCache } from "@open-mercato/shared/lib/crud/cache";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
 import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
 import { emitCrudSideEffects, flushCrudSideEffects } from "@open-mercato/shared/lib/commands/helpers";
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import {
   WarrantyClaim,
   WarrantyClaimEvent,
@@ -26,6 +27,10 @@ async function enforceWarrantyClaimOptimisticLock(ctx, record, resourceKind = WA
     request: ctx.request ?? null
   });
 }
+async function throwUndoRefusal(key, fallback) {
+  const { translate } = await resolveTranslations();
+  throw new CrudHttpError(409, { error: translate(key, fallback), code: key });
+}
 async function loadScopedClaim(em, id, scope, options = {}) {
   return findOneWithDecryption(
     em,
@@ -157,6 +162,7 @@ export {
   extractUndoPayload,
   loadScopedClaim,
   reconcileVendorRecoverySourceClaim,
-  requireScopedClaim
+  requireScopedClaim,
+  throwUndoRefusal
 };
 //# sourceMappingURL=shared.js.map

package/dist/modules/warranty_claims/commands/shared.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/warranty_claims/commands/shared.ts"],
-  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
-  "mappings": "AAAA,SAAS,kBAAkB;AAI3B,SAAS,mBAAmB;AAC5B,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { randomUUID } from 'crypto'\nimport type { FindOneOptions } from '@mikro-orm/core'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { CrudHttpError, assertFound } from '@open-mercato/shared/lib/crud/errors'\nimport { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { emitCrudSideEffects, flushCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport {\n  WarrantyClaim,\n  WarrantyClaimEvent,\n  WarrantyClaimLine,\n} from '../data/entities'\nimport type {\n  WarrantyClaimEventKind,\n  WarrantyClaimEventVisibility,\n} from '../data/validators'\nimport { computeHeaderRollups } from '../lib/stateMachine'\n\nexport { assertFound } from '@open-mercato/shared/lib/crud/errors'\nexport { ensureOrganizationScope, ensureSameScope, ensureTenantScope } from '@open-mercato/shared/lib/commands/scope'\nexport { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'\n\nexport const WARRANTY_CLAIM_RESOURCE_KIND = 'warranty_claims.claim'\nexport const WARRANTY_CLAIM_LINE_RESOURCE_KIND = 'warranty_claims.claim_line'\n\nexport type WarrantyClaimScope = {\n  organizationId: string\n  tenantId: string\n}\n\nexport type VersionedRecord = {\n  id: string\n  updatedAt?: Date | string | null\n}\n\nexport type ResolverContext = {\n  resolve: <T = unknown>(name: string) => T\n}\n\nexport type AppendClaimEventInput = {\n  visibility?: WarrantyClaimEventVisibility\n  body?: string | null\n  payload?: Record<string, unknown> | null\n  actorUserId?: string | null\n  actorCustomerId?: string | null\n}\n\nexport async function enforceWarrantyClaimOptimisticLock(\n  ctx: CommandRuntimeContext,\n  record: VersionedRecord | null | undefined,\n  resourceKind = WARRANTY_CLAIM_RESOURCE_KIND,\n  expected?: string | Date | null,\n): Promise<void> {\n  if (!record) return\n  await enforceCommandOptimisticLockWithGuards(ctx.container, {\n    resourceKind,\n    resourceId: record.id,\n    current: record.updatedAt ?? null,\n    expected,\n    request: ctx.request ?? null,\n  })\n}\n\nexport async function throwUndoRefusal(key: string, fallback: string): Promise<never> {\n  const { translate } = await resolveTranslations()\n  throw new CrudHttpError(409, { error: translate(key, fallback), code: key })\n}\n\nexport async function loadScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n): Promise<WarrantyClaim | null> {\n  return findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    options,\n    scope,\n  )\n}\n\n/**\n * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers\n * must hand in an already-translated sentence; the key default only suits the\n * command surface, which runs without a request locale.\n */\nexport async function requireScopedClaim(\n  em: EntityManager,\n  id: string,\n  scope: WarrantyClaimScope,\n  options: FindOneOptions<WarrantyClaim> = {},\n  notFoundMessage = 'warranty_claims.errors.notFound',\n): Promise<WarrantyClaim> {\n  const claim = await loadScopedClaim(em, id, scope, options)\n  return assertFound(claim, notFoundMessage)\n}\n\nexport function appendClaimEvent(\n  em: EntityManager,\n  claim: WarrantyClaim,\n  kind: WarrantyClaimEventKind,\n  input: AppendClaimEventInput = {},\n): WarrantyClaimEvent {\n  const event = em.create(WarrantyClaimEvent, {\n    id: randomUUID(),\n    claim,\n    organizationId: claim.organizationId,\n    tenantId: claim.tenantId,\n    kind,\n    visibility: input.visibility ?? 'internal',\n    body: input.body ?? null,\n    payload: input.payload ?? null,\n    actorUserId: input.actorUserId ?? null,\n    actorCustomerId: input.actorCustomerId ?? null,\n    createdAt: new Date(),\n  })\n  em.persist(event)\n  return event\n}\n\nexport async function reconcileVendorRecoverySourceClaim(\n  ctx: ResolverContext,\n  input: { claimId: string; tenantId: string; organizationId: string },\n): Promise<void> {\n  const em = (ctx.resolve('em') as EntityManager).fork()\n  const scope = { tenantId: input.tenantId, organizationId: input.organizationId }\n  const recoveryClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: input.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!recoveryClaim || recoveryClaim.claimType !== 'vendor_recovery' || !recoveryClaim.sourceClaimId) return\n\n  const sourceClaim = await findOneWithDecryption(\n    em,\n    WarrantyClaim,\n    { id: recoveryClaim.sourceClaimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },\n    {},\n    scope,\n  )\n  if (!sourceClaim) return\n\n  const resolvedChildren = await findWithDecryption(\n    em,\n    WarrantyClaim,\n    {\n      sourceClaimId: sourceClaim.id,\n      claimType: 'vendor_recovery',\n      status: { $in: ['resolved', 'closed'] },\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      deletedAt: null,\n    },\n    {},\n    scope,\n  )\n  const childLines = resolvedChildren.length\n    ? await findWithDecryption(\n        em,\n        WarrantyClaimLine,\n        {\n          claim: { $in: resolvedChildren.map((child) => child.id) },\n          tenantId: scope.tenantId,\n          organizationId: scope.organizationId,\n          deletedAt: null,\n        },\n        {},\n        scope,\n      )\n    : []\n  const recoveredTotal = computeHeaderRollups(childLines).totalApprovedAmount\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        sourceClaim.totalRecoveredAmount = String(recoveredTotal)\n        sourceClaim.updatedAt = new Date()\n      },\n    ],\n    { transaction: true, label: 'warranty_claims.vendor_recovery.reconciliation' },\n  )\n\n  const dataEngine = ctx.resolve<DataEngine>('dataEngine')\n  await emitCrudSideEffects({\n    dataEngine,\n    action: 'updated',\n    entity: sourceClaim,\n    identifiers: {\n      id: sourceClaim.id,\n      organizationId: sourceClaim.organizationId,\n      tenantId: sourceClaim.tenantId,\n    },\n    indexer: { entityType: 'warranty_claims:warranty_claim' },\n    events: {\n      module: 'warranty_claims',\n      entity: 'claim',\n      persistent: true,\n      buildPayload: () => ({\n        id: sourceClaim.id,\n        organizationId: sourceClaim.organizationId,\n        tenantId: sourceClaim.tenantId,\n        claimType: sourceClaim.claimType,\n        status: sourceClaim.status,\n      }),\n    },\n  })\n  await flushCrudSideEffects(dataEngine)\n  await invalidateCrudCache(\n    ctx as unknown as Parameters<typeof invalidateCrudCache>[0],\n    'warranty_claims.claim',\n    { id: sourceClaim.id, organizationId: sourceClaim.organizationId, tenantId: sourceClaim.tenantId },\n    input.tenantId,\n    'warranty_claims.vendor_recovery.reconciliation',\n  )\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB;AAI3B,SAAS,eAAe,mBAAmB;AAC3C,SAAS,2BAA2B;AACpC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,qBAAqB,4BAA4B;AAE1D,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAKP,SAAS,4BAA4B;AAErC,SAAS,eAAAA,oBAAmB;AAC5B,SAAS,yBAAyB,iBAAiB,yBAAyB;AAC5E,SAAS,0BAA0B;AAE5B,MAAM,+BAA+B;AACrC,MAAM,oCAAoC;AAwBjD,eAAsB,mCACpB,KACA,QACA,eAAe,8BACf,UACe;AACf,MAAI,CAAC,OAAQ;AACb,QAAM,uCAAuC,IAAI,WAAW;AAAA,IAC1D;AAAA,IACA,YAAY,OAAO;AAAA,IACnB,SAAS,OAAO,aAAa;AAAA,IAC7B;AAAA,IACA,SAAS,IAAI,WAAW;AAAA,EAC1B,CAAC;AACH;AAEA,eAAsB,iBAAiB,KAAa,UAAkC;AACpF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,IAAI,cAAc,KAAK,EAAE,OAAO,UAAU,KAAK,QAAQ,GAAG,MAAM,IAAI,CAAC;AAC7E;AAEA,eAAsB,gBACpB,IACA,IACA,OACA,UAAyC,CAAC,GACX;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACtF;AAAA,IACA;AAAA,EACF;AACF;AAOA,eAAsB,mBACpB,IACA,IACA,OACA,UAAyC,CAAC,GAC1C,kBAAkB,mCACM;AACxB,QAAM,QAAQ,MAAM,gBAAgB,IAAI,IAAI,OAAO,OAAO;AAC1D,SAAO,YAAY,OAAO,eAAe;AAC3C;AAEO,SAAS,iBACd,IACA,OACA,MACA,QAA+B,CAAC,GACZ;AACpB,QAAM,QAAQ,GAAG,OAAO,oBAAoB;AAAA,IAC1C,IAAI,WAAW;AAAA,IACf;AAAA,IACA,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB;AAAA,IACA,YAAY,MAAM,cAAc;AAAA,IAChC,MAAM,MAAM,QAAQ;AAAA,IACpB,SAAS,MAAM,WAAW;AAAA,IAC1B,aAAa,MAAM,eAAe;AAAA,IAClC,iBAAiB,MAAM,mBAAmB;AAAA,IAC1C,WAAW,oBAAI,KAAK;AAAA,EACtB,CAAC;AACD,KAAG,QAAQ,KAAK;AAChB,SAAO;AACT;AAEA,eAAsB,mCACpB,KACA,OACe;AACf,QAAM,KAAM,IAAI,QAAQ,IAAI,EAAoB,KAAK;AACrD,QAAM,QAAQ,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAC/E,QAAM,gBAAgB,MAAM;AAAA,IAC1B;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,SAAS,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACrG,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,iBAAiB,cAAc,cAAc,qBAAqB,CAAC,cAAc,cAAe;AAErG,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,cAAc,eAAe,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,WAAW,KAAK;AAAA,IACnH,CAAC;AAAA,IACD;AAAA,EACF;AACA,MAAI,CAAC,YAAa;AAElB,QAAM,mBAAmB,MAAM;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,MACE,eAAe,YAAY;AAAA,MAC3B,WAAW;AAAA,MACX,QAAQ,EAAE,KAAK,CAAC,YAAY,QAAQ,EAAE;AAAA,MACtC,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF;AACA,QAAM,aAAa,iBAAiB,SAChC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,OAAO,EAAE,KAAK,iBAAiB,IAAI,CAAC,UAAU,MAAM,EAAE,EAAE;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,WAAW;AAAA,IACb;AAAA,IACA,CAAC;AAAA,IACD;AAAA,EACF,IACA,CAAC;AACL,QAAM,iBAAiB,qBAAqB,UAAU,EAAE;AACxD,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,oBAAY,uBAAuB,OAAO,cAAc;AACxD,oBAAY,YAAY,oBAAI,KAAK;AAAA,MACnC;AAAA,IACF;AAAA,IACA,EAAE,aAAa,MAAM,OAAO,iDAAiD;AAAA,EAC/E;AAEA,QAAM,aAAa,IAAI,QAAoB,YAAY;AACvD,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,aAAa;AAAA,MACX,IAAI,YAAY;AAAA,MAChB,gBAAgB,YAAY;AAAA,MAC5B,UAAU,YAAY;AAAA,IACxB;AAAA,IACA,SAAS,EAAE,YAAY,iCAAiC;AAAA,IACxD,QAAQ;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,YAAY;AAAA,MACZ,cAAc,OAAO;AAAA,QACnB,IAAI,YAAY;AAAA,QAChB,gBAAgB,YAAY;AAAA,QAC5B,UAAU,YAAY;AAAA,QACtB,WAAW,YAAY;AAAA,QACvB,QAAQ,YAAY;AAAA,MACtB;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,qBAAqB,UAAU;AACrC,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,YAAY,IAAI,gBAAgB,YAAY,gBAAgB,UAAU,YAAY,SAAS;AAAA,IACjG,MAAM;AAAA,IACN;AAAA,EACF;AACF;",
   "names": ["assertFound"]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.9.1-develop.7513.1.ae2715553f",
+  "version": "0.9.1-develop.7515.1.e2712c8b00",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -264,16 +264,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/shared": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/ui": "0.9.1-develop.7513.1.ae2715553f",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7515.1.e2712c8b00",
+    "@open-mercato/shared": "0.9.1-develop.7515.1.e2712c8b00",
+    "@open-mercato/ui": "0.9.1-develop.7515.1.e2712c8b00",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/shared": "0.9.1-develop.7513.1.ae2715553f",
-    "@open-mercato/ui": "0.9.1-develop.7513.1.ae2715553f",
+    "@open-mercato/ai-assistant": "0.9.1-develop.7515.1.e2712c8b00",
+    "@open-mercato/shared": "0.9.1-develop.7515.1.e2712c8b00",
+    "@open-mercato/ui": "0.9.1-develop.7515.1.e2712c8b00",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/shipping_carriers/api/webhook/[provider]/route.ts

@@ -115,13 +115,10 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
     }
 
     await queue.enqueue({
-      name: 'shipping-carrier-webhook',
-      payload: {
-        providerKey,
-        event,
-        shipmentId: shipment.id,
-        scope: matchedScope,
-      },
+      providerKey,
+      event,
+      shipmentId: shipment.id,
+      scope: matchedScope,
     })
 
     return NextResponse.json({ received: true, queued: true }, { status: 202 })

package/src/modules/shipping_carriers/lib/shipping-service.ts

@@ -1,3 +1,4 @@
+import { LockMode } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { CredentialsService } from '../../integrations/lib/credentials-service'
@@ -200,7 +201,7 @@ export function createShippingCarrierService(deps: {
           trackingNumber: created.trackingNumber,
           organizationId: input.organizationId,
           tenantId: input.tenantId,
-        })
+        }, { tenantId: input.tenantId, organizationId: input.organizationId })
         return shipment
       } catch (error: unknown) {
         // Release the claim only when the carrier was NOT successfully called, so a retry can
@@ -256,24 +257,41 @@ export function createShippingCarrierService(deps: {
         trackingNumber: shipment.trackingNumber,
         credentials,
       })
-      const previousStatus = shipment.unifiedStatus
-      shipment.trackingEvents = tracking.events
-      shipment.lastPolledAt = new Date()
-      const transitionApplied = syncShipmentStatus(shipment, tracking.status)
-      await em.flush()
-      if (transitionApplied) {
+      const outcome = await em.transactional(async (tx) => {
+        const locked = await findOneWithDecryption(
+          tx,
+          CarrierShipment,
+          {
+            id: shipment.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            deletedAt: null,
+          },
+          { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true },
+          scope,
+        )
+        if (!locked) return null
+        const previousStatus = locked.unifiedStatus
+        locked.trackingEvents = tracking.events
+        locked.lastPolledAt = new Date()
+        const applied = syncShipmentStatus(locked, tracking.status)
+        await tx.flush()
+        return { applied, previousStatus }
+      }, { clear: true })
+      if (outcome?.applied) {
         const eventPayload = {
           shipmentId: shipment.id,
           providerKey: input.providerKey,
-          previousStatus,
+          previousStatus: outcome.previousStatus,
           newStatus: tracking.status,
           organizationId: input.organizationId,
           tenantId: input.tenantId,
         }
-        await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload)
+        const eventScope = { tenantId: input.tenantId, organizationId: input.organizationId }
+        await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload, eventScope)
         if (TERMINAL_SHIPPING_STATUSES.has(tracking.status)) {
           const terminalEvent = getTerminalShippingEvent(tracking.status)
-          if (terminalEvent) await emitShippingEvent(terminalEvent, eventPayload)
+          if (terminalEvent) await emitShippingEvent(terminalEvent, eventPayload, eventScope)
         }
       }
       return tracking
@@ -307,7 +325,7 @@ export function createShippingCarrierService(deps: {
         providerKey: input.providerKey,
         organizationId: input.organizationId,
         tenantId: input.tenantId,
-      })
+      }, { tenantId: input.tenantId, organizationId: input.organizationId })
       return result
     },
 

package/src/modules/shipping_carriers/lib/status-sync.ts

@@ -29,8 +29,8 @@ export function isShipmentCancelNotAllowedError(error: unknown): error is Shipme
 }
 
 const VALID_SHIPPING_TRANSITIONS: Record<string, UnifiedShipmentStatus[]> = {
-  label_created: ['picked_up', 'in_transit', 'cancelled'],
-  picked_up: ['in_transit', 'cancelled'],
+  label_created: ['picked_up', 'in_transit', 'out_for_delivery', 'delivered', 'failed_delivery', 'returned', 'cancelled'],
+  picked_up: ['in_transit', 'out_for_delivery', 'delivered', 'failed_delivery', 'returned', 'cancelled'],
   in_transit: ['out_for_delivery', 'delivered', 'returned', 'failed_delivery'],
   out_for_delivery: ['delivered', 'returned', 'failed_delivery'],
   failed_delivery: ['in_transit', 'out_for_delivery', 'delivered', 'returned', 'cancelled'],

package/src/modules/shipping_carriers/workers/webhook-processor.ts

@@ -1,9 +1,10 @@
+import { LockMode } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { CarrierShipment } from '../data/entities'
 import { emitShippingEvent } from '../events'
-import type { ShippingWebhookEvent } from '../lib/adapter'
+import type { ShippingWebhookEvent, UnifiedShipmentStatus } from '../lib/adapter'
 import { getShippingAdapter } from '../lib/adapter-registry'
 import { getTerminalShippingEvent, syncShipmentStatus, TERMINAL_SHIPPING_STATUSES } from '../lib/status-sync'
 import { claimWebhookProcessing, releaseWebhookClaim } from '../lib/webhook-utils'
@@ -21,6 +22,16 @@ type WebhookJobPayload = {
   } | null
 }
 
+type LegacyWebhookJobEnvelope = {
+  name?: string
+  payload: WebhookJobPayload
+}
+
+function readWebhookJobPayload(data: WebhookJobPayload | LegacyWebhookJobEnvelope): WebhookJobPayload {
+  if ('providerKey' in data) return data
+  return data.payload
+}
+
 type HandlerContext = JobContext & {
   resolve: <T = unknown>(name: string) => T
 }
@@ -31,24 +42,25 @@ export const metadata: WorkerMeta = {
   concurrency: 5,
 }
 
-export default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: HandlerContext): Promise<void> {
+export default async function handle(job: QueuedJob<WebhookJobPayload | LegacyWebhookJobEnvelope>, ctx: HandlerContext): Promise<void> {
+  const payload = readWebhookJobPayload(job.payload)
   try {
     const em = ctx.resolve<EntityManager>('em')
-    const adapter = getShippingAdapter(job.payload.providerKey)
+    const adapter = getShippingAdapter(payload.providerKey)
     if (!adapter) return
 
-    const shipment = job.payload.shipmentId && job.payload.scope
+    const shipment = payload.shipmentId && payload.scope
       ? await findOneWithDecryption(
         em,
         CarrierShipment,
         {
-          id: job.payload.shipmentId,
-          organizationId: job.payload.scope.organizationId,
-          tenantId: job.payload.scope.tenantId,
+          id: payload.shipmentId,
+          organizationId: payload.scope.organizationId,
+          tenantId: payload.scope.tenantId,
           deletedAt: null,
         },
         undefined,
-        job.payload.scope,
+        payload.scope,
       )
       : null
     if (!shipment) return
@@ -56,53 +68,73 @@ export default async function handle(job: QueuedJob<WebhookJobPayload>, ctx: Han
     const scope = { organizationId: shipment.organizationId, tenantId: shipment.tenantId }
     const claimed = await claimWebhookProcessing(
       em,
-      job.payload.event.idempotencyKey,
-      job.payload.providerKey,
+      payload.event.idempotencyKey,
+      payload.providerKey,
       scope,
-      job.payload.event.eventType,
+      payload.event.eventType,
     )
     if (!claimed) {
       return
     }
 
+    const carrierStatus = typeof payload.event.data.status === 'string'
+      ? payload.event.data.status
+      : payload.event.eventType
+
+    let transition: { previousStatus: string; newStatus: UnifiedShipmentStatus } | null = null
     try {
-      const carrierStatus = typeof job.payload.event.data.status === 'string'
-        ? job.payload.event.data.status
-        : job.payload.event.eventType
       const unifiedStatus = adapter.mapStatus(carrierStatus)
-      shipment.carrierStatus = carrierStatus
-      shipment.lastWebhookAt = new Date()
-
-      const transitionApplied = syncShipmentStatus(shipment, unifiedStatus)
-      if (!transitionApplied) return
-
-      await em.flush()
-
-      const eventPayload = {
-        shipmentId: shipment.id,
-        providerKey: job.payload.providerKey,
-        previousStatus: carrierStatus,
-        newStatus: unifiedStatus,
-        organizationId: shipment.organizationId,
-        tenantId: shipment.tenantId,
-      }
-      await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload)
-      if (TERMINAL_SHIPPING_STATUSES.has(unifiedStatus)) {
-        const terminalEvent = getTerminalShippingEvent(unifiedStatus)
-        if (!terminalEvent) return
-        await emitShippingEvent(terminalEvent, eventPayload)
-      }
+      transition = await em.transactional(async (tx) => {
+        const locked = await findOneWithDecryption(
+          tx,
+          CarrierShipment,
+          {
+            id: shipment.id,
+            organizationId: scope.organizationId,
+            tenantId: scope.tenantId,
+            deletedAt: null,
+          },
+          { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true },
+          scope,
+        )
+        if (!locked) return null
+        const previousStatus = locked.unifiedStatus
+        if (!syncShipmentStatus(locked, unifiedStatus)) return null
+        locked.carrierStatus = carrierStatus
+        locked.lastWebhookAt = new Date()
+        await tx.flush()
+        return { previousStatus, newStatus: unifiedStatus }
+      }, { clear: true })
     } catch (error) {
       await releaseWebhookClaim(
         em,
-        job.payload.event.idempotencyKey,
-        job.payload.providerKey,
+        payload.event.idempotencyKey,
+        payload.providerKey,
         scope,
       )
       throw error
     }
+    if (!transition) return
+
+    const unifiedStatus = transition.newStatus
+    const eventPayload = {
+      shipmentId: shipment.id,
+      providerKey: payload.providerKey,
+      previousStatus: transition.previousStatus,
+      newStatus: unifiedStatus,
+      carrierStatus,
+      organizationId: shipment.organizationId,
+      tenantId: shipment.tenantId,
+    }
+    const eventScope = { tenantId: shipment.tenantId, organizationId: shipment.organizationId }
+    await emitShippingEvent('shipping_carriers.shipment.status_changed', eventPayload, eventScope)
+    if (TERMINAL_SHIPPING_STATUSES.has(unifiedStatus)) {
+      const terminalEvent = getTerminalShippingEvent(unifiedStatus)
+      if (!terminalEvent) return
+      await emitShippingEvent(terminalEvent, eventPayload, eventScope)
+    }
   } catch (error) {
-    logger.error('Job processing failed', { providerKey: job.payload.providerKey, shipmentId: job.payload.shipmentId, err: error })
+    logger.error('Job processing failed', { providerKey: payload.providerKey, shipmentId: payload.shipmentId, err: error })
     throw error
   }
 }

package/src/modules/warranty_claims/commands/claim-lines.ts

@@ -43,6 +43,7 @@ import {
   ensureTenantScope,
   extractUndoPayload,
   requireScopedClaim,
+  throwUndoRefusal,
   type WarrantyClaimScope,
 } from './shared'
 import { assertPendingClaimQuantitiesWithinSold, validateClaimReferences } from './claims'
@@ -135,6 +136,31 @@ const mutableParentStatuses = new Set([
   'inspecting',
 ])
 
+const receivingParentStatuses = new Set(['received', 'inspecting'])
+
+type LineUndoParentRule = {
+  allowedParentStatuses: ReadonlySet<string>
+  lockedKey: string
+  lockedFallback: string
+}
+
+type LineUndoState = {
+  claim: WarrantyClaim
+  line: WarrantyClaimLine
+}
+
+const mutableParentUndoRule: LineUndoParentRule = {
+  allowedParentStatuses: mutableParentStatuses,
+  lockedKey: 'warranty_claims.errors.lineLocked',
+  lockedFallback: 'This line is locked in the current claim status.',
+}
+
+const receivingParentUndoRule: LineUndoParentRule = {
+  allowedParentStatuses: receivingParentStatuses,
+  lockedKey: 'warranty_claims.errors.receivingStatusInvalid',
+  lockedFallback: 'Receiving details can only be saved when the claim is received or under inspection.',
+}
+
 function parseCommandInput<T>(schema: z.ZodType<T>, rawInput: unknown): T {
   const result = schema.safeParse(rawInput ?? {})
   if (!result.success) {
@@ -482,6 +508,37 @@ async function recomputeClaimRollups(em: EntityManager, claim: WarrantyClaim): P
   claim.updatedAt = new Date()
 }
 
+function refuseLineUndoConflict(): Promise<never> {
+  return throwUndoRefusal('warranty_claims.errors.conflict', 'This claim changed while you were editing it.')
+}
+
+async function requireCurrentLineUndoState(
+  em: EntityManager,
+  after: LineSnapshot | null | undefined,
+  rule: LineUndoParentRule,
+): Promise<LineUndoState> {
+  if (!after) return refuseLineUndoConflict()
+  const scope: WarrantyClaimScope = { tenantId: after.tenantId, organizationId: after.organizationId }
+  const claim = await findOneWithDecryption(
+    em,
+    WarrantyClaim,
+    { id: after.claimId, tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null },
+    { lockMode: LockMode.PESSIMISTIC_WRITE },
+    scope,
+  )
+  if (!claim) return refuseLineUndoConflict()
+  if (!rule.allowedParentStatuses.has(claim.status)) return throwUndoRefusal(rule.lockedKey, rule.lockedFallback)
+  const line = await findOneWithDecryption(
+    em,
+    WarrantyClaimLine,
+    { id: after.id, tenantId: scope.tenantId, organizationId: scope.organizationId },
+    { lockMode: LockMode.PESSIMISTIC_WRITE },
+    scope,
+  )
+  if (!line || !after.updatedAt || toIso(line.updatedAt) !== after.updatedAt) return refuseLineUndoConflict()
+  return { claim, line }
+}
+
 async function requireScopedLine(
   em: EntityManager,
   lineId: string,
@@ -654,22 +711,20 @@ const createClaimLineCommand: CommandHandler<ClaimLineCreateInput, { lineId: str
   buildLog: async ({ result, snapshots }) => buildLineLog('warranty_claims.audit.claim_line.create', result.lineId, snapshots),
   undo: async ({ logEntry, ctx }) => {
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
-    const after = payload?.after
-    if (!after) return
-    const scope = { tenantId: after.tenantId, organizationId: after.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: after.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    const claim = line ? claimOf(line) : null
-    if (!line || !claim) return
+    let state!: LineUndoState
     await withAtomicFlush(em, [
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
       () => {
-        line.deletedAt = new Date()
-        line.updatedAt = new Date()
+        state.line.deletedAt = new Date()
+        state.line.updatedAt = new Date()
       },
-      () => recomputeClaimRollups(em, claim),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.create.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'deleted', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'deleted', state.line)
   },
 }
 
@@ -744,17 +799,17 @@ const updateClaimLineCommand: CommandHandler<ClaimLineUpdateInput, { lineId: str
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = claimOf(line) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.update.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -800,35 +855,20 @@ const deleteClaimLineCommand: CommandHandler<LineDeleteInput, { lineId: string;
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    let line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    const claim = (line ? claimOf(line) : null) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
       () => {
-        if (!line) {
-          line = em.create(WarrantyClaimLine, {
-            id: before.id,
-            claim,
-            organizationId: before.organizationId,
-            tenantId: before.tenantId,
-            lineNo: before.lineNo,
-            qtyClaimed: before.qtyClaimed,
-            lineStatus: before.lineStatus,
-            warrantyStatus: before.warrantyStatus,
-            createdAt: new Date(),
-            updatedAt: new Date(),
-          })
-          em.persist(line)
-        }
-        restoreLineFromSnapshot(line, before)
-        line.deletedAt = null
+        restoreLineFromSnapshot(state.line, before)
+        state.line.deletedAt = null
       },
-      () => recomputeClaimRollups(em, claim),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.delete.undo' })
-    if (!line) return
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'created', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'created', state.line)
   },
 }
 
@@ -916,17 +956,17 @@ const receiveClaimLineCommand: CommandHandler<ClaimLineReceiveInput, { lineId: s
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.receive.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -980,17 +1020,17 @@ const releaseClaimLineQuarantineCommand: CommandHandler<ClaimLineReleaseQuaranti
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
-      () => recomputeClaimRollups(em, claim),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, receivingParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.release_quarantine.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }
 
@@ -1043,16 +1083,17 @@ const setClaimLineAssessmentCommand: CommandHandler<LineSetAssessmentInput, { li
     const payload = extractUndoPayload<LineUndoPayload>(logEntry)
     const before = payload?.before
     if (!before) return
-    const scope = { tenantId: before.tenantId, organizationId: before.organizationId }
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const line = await findOneWithDecryption(em, WarrantyClaimLine, { id: before.id, tenantId: scope.tenantId, organizationId: scope.organizationId }, { populate: ['claim'] }, scope)
-    if (!line) return
-    const claim = claimOf(line) ?? await requireScopedClaim(em, before.claimId, scope)
+    let state!: LineUndoState
     await withAtomicFlush(em, [
-      () => restoreLineFromSnapshot(line, before),
+      async () => {
+        state = await requireCurrentLineUndoState(em, payload?.after, mutableParentUndoRule)
+      },
+      () => restoreLineFromSnapshot(state.line, before),
+      () => recomputeClaimRollups(em, state.claim),
     ], { transaction: true, label: 'warranty_claims.claim_line.set_assessment.undo' })
-    await emitClaimUpdated(ctx, claim)
-    await emitLineUndoCrud(ctx, 'updated', line)
+    await emitClaimUpdated(ctx, state.claim)
+    await emitLineUndoCrud(ctx, 'updated', state.line)
   },
 }