@open-mercato/core 0.10.1-develop.7836.1.0ef0f453c6 → 0.10.1-develop.7847.1.7d83dc5794

package/src/modules/customers/lib/dictionaryDefaults.ts

@@ -0,0 +1,137 @@
+type DictionaryDefault = {
+  value: string
+  label: string
+  color?: string
+  icon?: string
+}
+
+export const DEAL_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'open', label: 'Open', color: '#2563eb', icon: 'lucide:circle' },
+  { value: 'closed', label: 'Closed', color: '#6b7280', icon: 'lucide:check-circle' },
+  { value: 'win', label: 'Win', color: '#22c55e', icon: 'lucide:trophy' },
+  { value: 'lost', label: 'Lost', color: '#ef4444', icon: 'lucide:flag' },
+  { value: 'in_progress', label: 'In progress', color: '#f59e0b', icon: 'lucide:activity' },
+]
+
+export const PIPELINE_STAGE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'opportunity', label: 'Opportunity', color: '#38bdf8', icon: 'lucide:target' },
+  { value: 'marketing_qualified_lead', label: 'Marketing Qualified Lead', color: '#a855f7', icon: 'lucide:sparkles' },
+  { value: 'sales_qualified_lead', label: 'Sales Qualified Lead', color: '#f97316', icon: 'lucide:users' },
+  { value: 'offering', label: 'Offering', color: '#22c55e', icon: 'lucide:package' },
+  { value: 'negotiations', label: 'Negotiations', color: '#facc15', icon: 'lucide:handshake' },
+  { value: 'win', label: 'Win', color: '#16a34a', icon: 'lucide:award' },
+  { value: 'lost', label: 'Lost', color: '#ef4444', icon: 'lucide:flag' },
+  { value: 'stalled', label: 'Stalled', color: '#6b7280', icon: 'lucide:alert-circle' },
+]
+
+export const ENTITY_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'active', label: 'Active', color: '#22c55e', icon: 'lucide:user-check' },
+  { value: 'inactive', label: 'Inactive', color: '#94a3b8', icon: 'lucide:pause-circle' },
+  { value: 'pending', label: 'Pending', color: '#f59e0b', icon: 'lucide:clock' },
+  { value: 'archived', label: 'Archived', color: '#64748b', icon: 'lucide:archive' },
+]
+
+export const ENTITY_LIFECYCLE_STAGE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'lead', label: 'Lead', color: '#3b82f6', icon: 'lucide:sparkles' },
+  { value: 'prospect', label: 'Prospect', color: '#8b5cf6', icon: 'lucide:eye' },
+  { value: 'customer', label: 'Customer', color: '#22c55e', icon: 'lucide:handshake' },
+  { value: 'subscriber', label: 'Subscriber', color: '#10b981', icon: 'lucide:bell' },
+  { value: 'churned', label: 'Churned', color: '#ef4444', icon: 'lucide:user-x' },
+  { value: 'other', label: 'Other', color: '#94a3b8', icon: 'lucide:circle' },
+]
+
+export const ENTITY_SOURCE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'linkedin', label: 'LinkedIn', color: '#0a66c2', icon: 'lucide:linkedin' },
+  { value: 'email', label: 'Email', color: '#3b82f6', icon: 'lucide:mail' },
+  { value: 'web_form', label: 'Web form', color: '#22c55e', icon: 'lucide:globe' },
+  { value: 'referral', label: 'Referral', color: '#8b5cf6', icon: 'lucide:users' },
+  { value: 'customer_referral', label: 'Customer referral', color: '#22c55e', icon: 'lucide:thumbs-up' },
+  { value: 'partner_referral', label: 'Partner referral', color: '#3b82f6', icon: 'lucide:handshake' },
+  { value: 'event', label: 'Conference / Event', color: '#f59e0b', icon: 'lucide:calendar' },
+  { value: 'cold_outreach', label: 'Cold outreach', color: '#94a3b8', icon: 'lucide:phone' },
+  { value: 'facebook', label: 'Facebook', color: '#1877f2', icon: 'lucide:facebook' },
+  { value: 'typeform', label: 'Typeform', color: '#262627', icon: 'lucide:file-text' },
+  { value: 'other', label: 'Other', color: '#64748b', icon: 'lucide:circle' },
+]
+
+export const ADDRESS_TYPE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'office', label: 'Office', color: '#3b82f6', icon: 'lucide:building' },
+  { value: 'work', label: 'Work', color: '#6366f1', icon: 'lucide:briefcase' },
+  { value: 'billing', label: 'Billing', color: '#f97316', icon: 'lucide:wallet' },
+  { value: 'shipping', label: 'Shipping', color: '#22c55e', icon: 'lucide:truck' },
+  { value: 'home', label: 'Home', color: '#10b981', icon: 'lucide:map-pin' },
+]
+
+export const ACTIVITY_TYPE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'call', label: 'Call', color: '#2563eb', icon: 'lucide:phone-call' },
+  { value: 'email', label: 'Email', color: '#16a34a', icon: 'lucide:mail' },
+  { value: 'event', label: 'Event', color: '#6366f1', icon: 'lucide:calendar' },
+  { value: 'meeting', label: 'Meeting', color: '#f59e0b', icon: 'lucide:users' },
+  { value: 'note', label: 'Note', color: '#a855f7', icon: 'lucide:notebook' },
+  { value: 'task', label: 'Task', color: '#ef4444', icon: 'lucide:check-square' },
+]
+
+export const INTERACTION_STATUS_DEFAULTS: DictionaryDefault[] = [
+  { value: 'planned', label: 'Planned', color: '#2563eb', icon: 'lucide:circle' },
+  { value: 'in_progress', label: 'In progress', color: '#f59e0b', icon: 'lucide:activity' },
+  { value: 'waiting', label: 'Waiting / blocked', color: '#a855f7', icon: 'lucide:pause-circle' },
+  { value: 'done', label: 'Done', color: '#22c55e', icon: 'lucide:check-circle' },
+  { value: 'canceled', label: 'Canceled', color: '#6b7280', icon: 'lucide:x-circle' },
+]
+
+export const JOB_TITLE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'Director of Operations', label: 'Director of Operations', color: '#f97316', icon: 'lucide:settings' },
+  { value: 'VP of Partnerships', label: 'VP of Partnerships', color: '#6366f1', icon: 'lucide:users' },
+  { value: 'Founder & Principal', label: 'Founder & Principal', color: '#ec4899', icon: 'lucide:star' },
+  { value: 'Senior Project Manager', label: 'Senior Project Manager', color: '#0ea5e9', icon: 'lucide:clipboard-list' },
+  { value: 'Chief Revenue Officer', label: 'Chief Revenue Officer', color: '#8b5cf6', icon: 'lucide:bar-chart-3' },
+  { value: 'Director of Retail Partnerships', label: 'Director of Retail Partnerships', color: '#f59e0b', icon: 'lucide:shopping-bag' },
+]
+
+export const INDUSTRY_DEFAULTS: DictionaryDefault[] = [
+  { value: 'Renewable Energy', label: 'Renewable Energy' },
+  { value: 'Software', label: 'Software' },
+  { value: 'Interior Design', label: 'Interior Design' },
+  { value: 'SaaS', label: 'SaaS' },
+  { value: 'E-commerce', label: 'E-commerce' },
+  { value: 'Healthcare', label: 'Healthcare' },
+  { value: 'Manufacturing', label: 'Manufacturing' },
+  { value: 'Logistics', label: 'Logistics' },
+  { value: 'Financial Services', label: 'Financial Services' },
+  { value: 'Retail', label: 'Retail' },
+  { value: 'Hospitality', label: 'Hospitality' },
+  { value: 'Energy', label: 'Energy' },
+  { value: 'Media', label: 'Media' },
+]
+
+export const TEMPERATURE_DEFAULTS: DictionaryDefault[] = [
+  { value: 'hot', label: 'Hot', color: '#ef4444', icon: 'lucide:flame' },
+  { value: 'high', label: 'High', color: '#f59e0b', icon: 'lucide:trending-up' },
+  { value: 'medium', label: 'Medium', color: '#8b5cf6', icon: 'lucide:sparkles' },
+  { value: 'low', label: 'Low', color: '#64748b', icon: 'lucide:clock' },
+  { value: 'cold', label: 'Cold', color: '#94a3b8', icon: 'lucide:snowflake' },
+]
+
+export const PERSON_COMPANY_ROLE_DEFAULTS = [
+  { value: 'decision_maker', label: 'Decision maker', color: '#f59e0b', icon: 'lucide:crown' },
+  { value: 'influencer', label: 'Influencer', color: '#8b5cf6', icon: 'lucide:sparkles' },
+  { value: 'budget_holder', label: 'Budget holder', color: '#3b82f6', icon: 'lucide:wallet' },
+  { value: 'technical_evaluator', label: 'Technical evaluator', color: '#22c55e', icon: 'lucide:wrench' },
+  { value: 'primary_contact', label: 'Primary contact', color: '#0ea5e9', icon: 'lucide:star' },
+  { value: 'end_user', label: 'End user', color: '#64748b', icon: 'lucide:user' },
+]
+
+export const CUSTOMER_DICTIONARY_DEFAULTS: Record<string, readonly DictionaryDefault[]> = {
+  status: ENTITY_STATUS_DEFAULTS,
+  source: ENTITY_SOURCE_DEFAULTS,
+  lifecycle_stage: ENTITY_LIFECYCLE_STAGE_DEFAULTS,
+  address_type: ADDRESS_TYPE_DEFAULTS,
+  activity_type: ACTIVITY_TYPE_DEFAULTS,
+  interaction_status: INTERACTION_STATUS_DEFAULTS,
+  job_title: JOB_TITLE_DEFAULTS,
+  deal_status: DEAL_STATUS_DEFAULTS,
+  pipeline_stage: PIPELINE_STAGE_DEFAULTS,
+  industry: INDUSTRY_DEFAULTS,
+  temperature: TEMPERATURE_DEFAULTS,
+  person_company_role: PERSON_COMPANY_ROLE_DEFAULTS,
+}

package/src/modules/customers/lib/dictionaryLabels.ts

@@ -0,0 +1,73 @@
+import type { AwilixContainer } from 'awilix'
+import type { Locale } from '@open-mercato/shared/lib/i18n/config'
+import { loadDictionary } from '@open-mercato/shared/lib/i18n/server'
+import { createFallbackTranslator } from '@open-mercato/shared/lib/i18n/translate'
+import { getTranslationOverlayPlugin } from '@open-mercato/shared/lib/localization/overlay-plugin'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import { CUSTOMER_DICTIONARY_DEFAULTS } from './dictionaryDefaults'
+
+const logger = createLogger('customers').child({ component: 'dictionary-labels' })
+
+type DictionaryLabelEntry = {
+  id: string
+  value: string
+  label: string
+  organizationId: string
+}
+
+export function customerDictionaryLabelKey(kind: string, value: string): string {
+  const token = value.trim().toLowerCase().replace(/[^a-z0-9]+/g, '_').replace(/^_|_$/g, '')
+  return `customers.dictionaries.defaults.${kind}.${token}`
+}
+
+export async function localizeCustomerDictionaryEntries<T extends DictionaryLabelEntry>(
+  entries: T[],
+  options: { kind: string; locale: string; tenantId: string; container: AwilixContainer },
+): Promise<T[]> {
+  if (!entries.length) return []
+  const dictionaryLocale = options.locale.toLowerCase().split('-')[0] as Locale
+  const translate = createFallbackTranslator(await loadDictionary(dictionaryLocale))
+  const defaults = Object.prototype.hasOwnProperty.call(CUSTOMER_DICTIONARY_DEFAULTS, options.kind)
+    ? CUSTOMER_DICTIONARY_DEFAULTS[options.kind]
+    : []
+  const localized = entries.map((entry) => {
+    const seeded = defaults.find((candidate) => candidate.value === entry.value && candidate.label === entry.label)
+    const renewalQuarter = options.kind === 'renewal_quarter' ? /^(\d{4})_q([1-4])$/.exec(entry.value) : null
+    const label = renewalQuarter && entry.label === `Q${renewalQuarter[2]} ${renewalQuarter[1]}`
+      ? translate('customers.dictionaries.defaults.renewal_quarter.label', entry.label, {
+          year: renewalQuarter[1], quarter: renewalQuarter[2],
+        })
+      : seeded ? translate(customerDictionaryLabelKey(options.kind, seeded.value), entry.label) : entry.label
+    return {
+      ...entry,
+      label,
+    }
+  })
+  const { overlay } = getTranslationOverlayPlugin()
+  if (!overlay) return localized
+
+  const organizationIds = new Set(localized.map((entry) => entry.organizationId))
+  const labelsById = new Map<string, string>()
+  for (const organizationId of organizationIds) {
+    const items = localized.filter((entry) => entry.organizationId === organizationId)
+    try {
+      const translated = await overlay(items.map(({ id, label }) => ({ id, label })), {
+        entityType: 'customers:customer_dictionary_entry',
+        locale: options.locale,
+        tenantId: options.tenantId,
+        organizationId,
+        container: options.container,
+      })
+      for (const item of translated) {
+        if (typeof item.id === 'string' && typeof item.label === 'string' && item.label.trim()) {
+          labelsById.set(item.id, item.label)
+        }
+      }
+    } catch (error) {
+      getTelemetryRuntime()?.reportError(error, { module: 'customers', code: 'customers.dictionary_translation_failed' })
+      logger.warn('Translation overlay failed', { error })
+    }
+  }
+  return localized.map((entry) => ({ ...entry, label: labelsById.get(entry.id) ?? entry.label }))
+}

package/src/modules/customers/lib/interactionCompatibility.ts

@@ -63,6 +63,7 @@ export function mapInteractionRecordToTodoSummary(interaction: InteractionRecord
     todoId: interaction.id,
     todoSource: CUSTOMER_INTERACTION_TASK_SOURCE,
     createdAt: interaction.createdAt,
+    updatedAt: interaction.updatedAt,
     title: interaction.title ?? null,
     isDone: interaction.status === 'done',
     status: interaction.status,

package/src/modules/customers/translations.ts

@@ -0,0 +1,5 @@
+export const translatableFields: Record<string, string[]> = {
+  'customers:customer_dictionary_entry': ['label'],
+}
+
+export default translatableFields

package/src/modules/directory/api/organization-branding/route.ts

@@ -17,7 +17,7 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { organizationUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import { resolveSingleOrganizationIdOrDeny } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
+import { isExplicitlyEmptyOrganizationScope } from '@open-mercato/shared/lib/auth/organizationScope'
 import '@open-mercato/core/modules/directory/commands/organizations'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
@@ -82,15 +82,12 @@ async function resolveCurrentOrganization(req: Request) {
 
   const container = await createRequestContainer()
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-  let organizationId: string | null
-  try {
-    organizationId = resolveSingleOrganizationIdOrDeny(scope, auth)
-  } catch (error) {
-    if (isCrudHttpError(error)) {
-      return { response: NextResponse.json(error.body, { status: error.status }) }
+  if (isExplicitlyEmptyOrganizationScope(scope)) {
+    return {
+      response: NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 }),
     }
-    throw error
   }
+  const organizationId = scope.selectedId
   const tenantId = scope.tenantId ?? auth.tenantId ?? null
   if (!organizationId || !tenantId) {
     return {

package/src/modules/directory/backend/directory/branding/page.tsx

@@ -15,7 +15,8 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
 import { SwitchField } from '@open-mercato/ui/primitives/switch-field'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { useOrganizationScopeDetail } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
+import { useOrganizationScopeDetail, useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
+import { getCurrentOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/organizationEvents'
 
 type BrandingPayload = {
   organizationId: string
@@ -42,6 +43,7 @@ export default function OrganizationBrandingPage() {
   const t = useT()
   const queryClient = useQueryClient()
   const { organizationId, tenantId } = useOrganizationScopeDetail()
+  const scopeVersion = useOrganizationScopeVersion()
   const [logoUrl, setLogoUrl] = React.useState('')
   const [logoPreserveAspectRatio, setLogoPreserveAspectRatio] = React.useState(false)
   const [selectedFile, setSelectedFile] = React.useState<File | null>(null)
@@ -67,7 +69,8 @@ export default function OrganizationBrandingPage() {
     setLogoUrl(data?.logoUrl ?? '')
     setLogoPreserveAspectRatio(data?.logoPreserveAspectRatio ?? false)
     setSelectedFile(null)
-  }, [data?.logoPreserveAspectRatio, data?.logoUrl, organizationId, tenantId])
+    if (fileInputRef.current) fileInputRef.current.value = ''
+  }, [scopeVersion, organizationId, tenantId, data?.organizationId, data?.logoPreserveAspectRatio, data?.logoUrl])
 
   React.useEffect(() => {
     if (!selectedFile || typeof URL === 'undefined') {
@@ -111,7 +114,13 @@ export default function OrganizationBrandingPage() {
     try {
       await runMutation({
         operation: async () => {
+          if (getCurrentOrganizationScopeVersion() !== scopeVersion) {
+            throw new Error('[internal] Organization scope changed during branding save')
+          }
           const uploadedLogoUrl = shouldUpload ? await uploadLogo(data.organizationId) : null
+          if (getCurrentOrganizationScopeVersion() !== scopeVersion) {
+            throw new Error('[internal] Organization scope changed during branding save')
+          }
           const resolvedLogoUrl = uploadedLogoUrl ?? nextLogoUrl ?? logoUrl.trim()
           const response = await withScopedApiRequestHeaders(
             buildOptimisticLockHeader(data.updatedAt),
@@ -142,12 +151,15 @@ export default function OrganizationBrandingPage() {
           hasUpload: shouldUpload,
         },
       })
+      if (getCurrentOrganizationScopeVersion() !== scopeVersion) return
       await queryClient.invalidateQueries({ queryKey: ['directory-organization-branding'] })
+      if (getCurrentOrganizationScopeVersion() !== scopeVersion) return
       window.dispatchEvent(new Event('om:refresh-sidebar'))
       setSelectedFile(null)
       if (fileInputRef.current) fileInputRef.current.value = ''
       flash(t('directory.branding.flash.saved', 'Organization branding updated'), 'success')
     } catch (err: unknown) {
+      if (getCurrentOrganizationScopeVersion() !== scopeVersion) return
       if (surfaceRecordConflict(err, t)) return
       const fallback = t('directory.branding.errors.save', 'Failed to update organization branding')
       const message = err instanceof Error ? err.message : fallback
@@ -155,7 +167,7 @@ export default function OrganizationBrandingPage() {
     } finally {
       setSaving(false)
     }
-  }, [data, logoPreserveAspectRatio, logoUrl, queryClient, runMutation, selectedFile, t, uploadLogo])
+  }, [data, logoPreserveAspectRatio, logoUrl, queryClient, runMutation, scopeVersion, selectedFile, t, uploadLogo])
 
   const handleSubmit = React.useCallback((event: React.FormEvent<HTMLFormElement>) => {
     event.preventDefault()

package/src/modules/eudr/index.ts

@@ -7,6 +7,19 @@ export const metadata: ModuleInfo = {
   description: 'EU Deforestation Regulation compliance: product commodity mappings, supplier origin evidence, due diligence statements.',
   author: 'Open Mercato Team',
   license: 'MIT',
+  /**
+   * `catalog` is a HARD dependency, and saying so is the fix.
+   *
+   * `data/enrichers.ts` reads `E.catalog.catalog_product` at module scope, so with `catalog` disabled
+   * `E.catalog` is undefined and the read throws while the enricher registry is being imported — which takes
+   * `/api/auth/login` with it. An installation shaped as a CRM rather than a shop could not reach its own login
+   * screen, and the error named a property rather than a module.
+   *
+   * Declared rather than defended with optional chaining. This module exists to map PRODUCTS to deforestation
+   * compliance evidence, so without a catalogue it has nothing to work on at all — the honest answer is that it
+   * cannot be enabled, which the generator now says before anybody starts the app rather than after.
+   */
+  requires: ['catalog'],
   ejectable: true,
 }
 

package/src/modules/staff/api/timesheets/access-requests/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
@@ -74,7 +75,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   if (!requesterUserId) {
     throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
   }
-  if (!auth.orgId) {
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  if (!scope.tenantId || !scope.selectedId || scope.selectionRejected === true) {
     throw new CrudHttpError(400, {
       error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),
     })
@@ -82,8 +84,8 @@ async function resolveAccessRequestContext(req: Request): Promise<AccessRequestC
   return {
     container,
     em: (container.resolve('em') as EntityManager).fork(),
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    tenantId: scope.tenantId,
+    organizationId: scope.selectedId,
     requesterUserId,
     requesterEmail: typeof auth.email === 'string' && auth.email.trim().length > 0 ? auth.email : null,
     translate,
@@ -155,17 +157,14 @@ async function resolveRequesterName(context: AccessRequestContext): Promise<stri
 async function POST(req: Request) {
   try {
     const context = await resolveAccessRequestContext(req)
-    // The grant list the interceptors and the mutation-guard registry gate on
-    // comes from the module's single RBAC authority, so it is always an array:
-    // the nullable read it replaces could not say whether an empty answer meant
-    // "no grants" or "could not ask". Authorization itself stays with the
-    // declarative `requireFeatures` guard in `metadata`.
-    const grantedFeatures = (
-      await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
-        tenantId: context.tenantId,
-        organizationId: context.organizationId,
-      })
-    ).grantedFeatures
+    const featureAccess = await resolveFeatureAccess(context.container, context.requesterUserId, [VIEW_FEATURE], {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+    })
+    if (!featureAccess.allowed) {
+      throw new CrudHttpError(403, { error: context.translate('staff.errors.forbidden', 'Forbidden') })
+    }
+    const grantedFeatures = featureAccess.grantedFeatures
 
     const interceptors = await runTimesheetInterceptors({
       request: req,

package/src/modules/staff/api/timesheets/time-projects/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { staffTimeProjectCrudEvents } from '../../../lib/crud'
+import { PROJECT_SCOPE_TENANT_HEADER, PROJECT_SCOPE_ORGANIZATION_HEADER, type ResolvedProjectAccessScope } from '../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
@@ -500,24 +501,28 @@ async function buildAccessDenialResponse(): Promise<Response> {
  * `reason` discriminator carries only "you are not a member of this project",
  * never the project or customer it is refusing to describe.
  */
-async function resolveProjectAccessDenial(req: Request): Promise<Response | null> {
+async function resolveProjectAccessDenial(req: Request): Promise<{ denial: Response | null; scope: ResolvedProjectAccessScope | null }> {
+  const unresolved = { denial: null, scope: null }
   const url = new URL(req.url)
   const rawIds = url.searchParams.get('ids') ?? url.searchParams.get('id')
-  if (!isIdsParamProvided(rawIds)) return null
+  if (!isIdsParamProvided(rawIds)) return unresolved
   const requestedIds = parseIdsParam(rawIds)
   // Malformed ids match nothing on their own; the factory answers an empty list.
-  if (requestedIds.length === 0) return null
+  if (requestedIds.length === 0) return unresolved
 
   try {
     const container = await createRequestContainer()
     const auth = await getAuthFromRequest(req)
     // Unauthenticated and unscoped requests are the factory's to reject.
-    if (!auth) return null
+    if (!auth) return unresolved
     const orgScope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
     const tenantId = orgScope?.tenantId ?? auth.tenantId ?? null
     const organizationId = resolveSingleOrganizationIdOrDeny(orgScope, auth) ?? null
-    if (!tenantId || !organizationId) return null
+    if (!tenantId || !organizationId) return unresolved
 
+    const scope = orgScope?.tenantId && orgScope.selectedId && orgScope.selectionRejected !== true
+      ? { tenantId: orgScope.tenantId, organizationId: orgScope.selectedId }
+      : null
     const access = await resolveRequestProjectAccess(req, () =>
       loadProjectAccess(
         container,
@@ -526,20 +531,24 @@ async function resolveProjectAccessDenial(req: Request): Promise<Response | null
         organizationId,
       ),
     )
-    if (access.canManageAll) return null
-    if (requestedIds.some((id) => access.projectIds.includes(id))) return null
-    return await buildAccessDenialResponse()
+    if (access.canManageAll) return { denial: null, scope }
+    if (requestedIds.some((id) => access.projectIds.includes(id))) return { denial: null, scope }
+    return { denial: await buildAccessDenialResponse(), scope }
   } catch (err) {
     // Fail closed: an access decision that could not be made is a denial.
     logger.error('staff.timesheets.time-projects denial probe failed', { err })
-    return await buildAccessDenialResponse()
+    return { denial: await buildAccessDenialResponse(), scope: null }
   }
 }
 
 export async function GET(req: Request): Promise<Response> {
-  const denial = await resolveProjectAccessDenial(req)
-  if (denial) return denial
-  return crud.GET(req)
+  const { denial, scope } = await resolveProjectAccessDenial(req)
+  const response = denial ?? await crud.GET(req)
+  if (scope) {
+    response.headers.set(PROJECT_SCOPE_TENANT_HEADER, scope.tenantId)
+    response.headers.set(PROJECT_SCOPE_ORGANIZATION_HEADER, scope.organizationId)
+  }
+  return response
 }
 
 export const POST = crud.POST
@@ -611,7 +620,7 @@ export const openApi = {
       ? {
           GET: {
             ...baseOpenApi.methods.GET,
-            description: `${baseOpenApi.methods.GET.description ?? ''} Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
+            description: `${baseOpenApi.methods.GET.description ?? ''} Project-specific reads include optional x-om-project-scope-tenant-id and x-om-project-scope-organization-id response headers when the server resolves a scope. These identify the request scope for client hydration; a missing header provides no scope identity. Rows are intersected with the caller's project access: without staff.timesheets.projects.manage only projects the caller is an active member of are returned. Asking for a single id the caller may not see answers 404 with reason=${NO_PROJECT_ACCESS_REASON} and never names the project or its customer; the same 404 covers ids that do not exist, so the endpoint cannot be used to enumerate projects.`.trim(),
             responses: [
               ...(baseOpenApi.methods.GET.responses ?? []),
               {

package/src/modules/staff/backend/staff/time-tracking/projects/[id]/edit/page.tsx

@@ -15,6 +15,8 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { DEFAULT_BUDGET_WARN_AT_PERCENT, type ProjectBudgetKind } from '../../../../../../lib/time-tracking-ui/ProjectFormSections'
 import { NoProjectAccess } from '../../../../../../lib/time-tracking-ui/NoProjectAccess'
+import { useProjectAccessScope } from '../../../../../../lib/time-tracking-ui/projectAccessScope'
+import { readResolvedProjectAccessScope, type ResolvedProjectAccessScope } from '../../../../../../lib/time-tracking-ui/projectAccessScopeHeaders'
 import {
   buildProjectPayload,
   createProjectFormFields,
@@ -36,7 +38,7 @@ const NO_PROJECT_ACCESS_REASON = 'no_project_access'
 
 /** Thrown by the loader so the caller can branch on the guard state. */
 class ProjectAccessDeniedError extends Error {
-  constructor() {
+  constructor(readonly resolvedScope: ResolvedProjectAccessScope | null) {
     super('[internal] no project access')
     this.name = 'ProjectAccessDeniedError'
   }
@@ -106,25 +108,28 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   const t = useT()
   const router = useRouter()
   const scopeVersion = useOrganizationScopeVersion()
+  const { scopeKey: projectAccessScopeKey, resolvedScope, resolveScope } = useProjectAccessScope(projectId)
 
   const [initialValues, setInitialValues] = React.useState<ProjectFormValues | null>(null)
   const [loading, setLoading] = React.useState(true)
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
-  const [accessDenied, setAccessDenied] = React.useState(false)
+  const [accessDeniedScopeKey, setAccessDeniedScopeKey] = React.useState<string | null>(null)
+  const [loadedScopeKey, setLoadedScopeKey] = React.useState<string | null>(null)
+  const accessDenied = accessDeniedScopeKey === projectAccessScopeKey
 
-  const fetchProject = React.useCallback(async (): Promise<ProjectRecord | null> => {
+  const fetchProject = React.useCallback(async (): Promise<{ record: ProjectRecord | null; scope: ResolvedProjectAccessScope | null }> => {
     const call = await apiCall<{ items?: ProjectRecord[]; reason?: unknown }>(
       `/api/staff/timesheets/time-projects?ids=${projectId}&pageSize=1`,
     )
     if (call.status === 404 && call.result?.reason === NO_PROJECT_ACCESS_REASON) {
-      throw new ProjectAccessDeniedError()
+      throw new ProjectAccessDeniedError(readResolvedProjectAccessScope(call.response))
     }
     if (!call.ok) {
       throw new Error(t('staff.timesheets.projects.errors.load', 'Failed to load project.'))
     }
     const record = Array.isArray(call.result?.items) ? call.result.items[0] : null
-    return record ?? null
+    return { record: record ?? null, scope: readResolvedProjectAccessScope(call.response) }
   }, [projectId, t])
 
   /**
@@ -137,7 +142,7 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   const handleCurrencyChanged = React.useCallback(() => {
     if (!projectId) return
     void fetchProject()
-      .then((record) => { if (record) setInitialValues(toValues(record)) })
+      .then(({ record }) => { if (record) setInitialValues(toValues(record)) })
       .catch(() => {
         // Best effort: the optimistic-lock conflict bar remains the backstop.
       })
@@ -159,25 +164,30 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
   // it was loaded for. The decision looks at the load this one replaces,
   // settled or not: a version-0 load cancelled by a quick second switch must
   // not let that switch through.
-  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number } | null>(null)
+  const lastLoadRef = React.useRef<{ projectId: string; scopeVersion: number; scopeKey: string } | null>(null)
   React.useEffect(() => {
     if (!projectId) return
     let cancelled = false
     const replaced = lastLoadRef.current
-    lastLoadRef.current = { projectId, scopeVersion }
-    const keepScreen = replaced !== null && replaced.projectId === projectId && replaced.scopeVersion === 0
+    lastLoadRef.current = { projectId, scopeVersion, scopeKey: projectAccessScopeKey }
+    const keepScreen = replaced !== null
+      && replaced.projectId === projectId
+      && replaced.scopeVersion === 0
+      && replaced.scopeKey === projectAccessScopeKey
     async function load() {
       if (!keepScreen) setLoading(true)
       const settle = (outcome: { values?: ProjectFormValues; accessDenied?: boolean; isNotFound?: boolean; error?: string }) => {
         if (cancelled) return
-        setAccessDenied(outcome.accessDenied === true)
+        setAccessDeniedScopeKey(outcome.accessDenied === true ? projectAccessScopeKey : null)
         setIsNotFound(outcome.isNotFound === true)
         setError(outcome.error ?? null)
         if (outcome.values) setInitialValues(outcome.values)
+        setLoadedScopeKey(projectAccessScopeKey)
         setLoading(false)
       }
       try {
-        const record = await fetchProject()
+        const { record, scope } = await fetchProject()
+        if (!cancelled) resolveScope(scope)
         if (!record) {
           settle({ isNotFound: true })
           return
@@ -185,6 +195,7 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
         settle({ values: toValues(record) })
       } catch (err) {
         if (err instanceof ProjectAccessDeniedError) {
+          if (!cancelled) resolveScope(err.resolvedScope)
           settle({ accessDenied: true })
           return
         }
@@ -197,16 +208,16 @@ export default function TimeTrackingProjectEditPage({ params }: { params?: { id?
     }
     load()
     return () => { cancelled = true }
-  }, [projectId, fetchProject, scopeVersion, t])
+  }, [projectId, fetchProject, scopeVersion, t, projectAccessScopeKey, resolveScope])
 
-  if (loading) {
+  if (!accessDenied && (loading || loadedScopeKey !== projectAccessScopeKey)) {
     return <Page><PageBody><LoadingMessage label={t('staff.timesheets.projects.loading', 'Loading project...')} /></PageBody></Page>
   }
 
   // Screen 17 — the caller may not open this project. Same guard state the
   // detail page renders; it names neither the customer nor the project.
   if (accessDenied) {
-    return <NoProjectAccess timeProjectId={projectId} />
+    return <NoProjectAccess timeProjectId={projectId} resolvedScope={resolvedScope} />
   }
 
   if (isNotFound) {