Class EscrowTransferRequestService

Record that the recipient accepted the request and was paid: link the fulfilling escrow transfer id and move the request to SENT. Only valid from CREATED, so a second accept (even with a different escrow transfer id) is rejected rather than silently re-linking. An escrow transfer id already linked to a different request trips the unique constraint and surfaces as ESCROW_TRANSFER_ALREADY_LINKED.

Mark the request CANCELLED (the sender withdrew it). Only valid from CREATED — a fulfilled (SENT) or already-terminal request cannot be cancelled.

Create a request for payment. Self-send (requesting from your own phone) is rejected. The recipient is addressed by phone and may not be a known identity, so recipientIdentityId is left null.

senderId is resolved to its int identity FK via the identityInternalId subquery, scoped to the customer — an unknown or cross-customer sender id yields NULL and trips the NOT NULL sender_identity_id FK.

Look up a single request by id, scoped to the calling customer. Returns null for both "missing" and "owned by a different customer" — never leaks existence of another customer's row. Controllers map null to 404.

Mark the request REJECTED (the recipient declined it). Only valid from CREATED.

Customer-scoped search. Filter by senderId (requests this identity sent) and/or recipientPhone (requests addressed to this phone) and/or statuses. Ordered newest-first. The customer-scope is a hard WHERE so no filter combination can leak rows across tenants.