@open-mercato/core 0.6.3-develop.3876.1.d40fe4ec2d → 0.6.3-develop.3894.1.352abf4240

package/src/modules/auth/services/rbacDefaultCache.ts

@@ -0,0 +1,145 @@
+import type { CacheStrategy, CacheValue, CacheSetOptions, CacheGetOptions } from '@open-mercato/cache'
+
+/**
+ * Process-scoped fallback CacheStrategy for RbacService.
+ *
+ * Used only when no shared `cache` service is registered in DI
+ * (CLI scripts, lean test bootstraps, isolated unit harnesses). Production
+ * deployments wire `@open-mercato/cache` via bootstrap.ts, which preempts
+ * this fallback.
+ *
+ * Goals:
+ *  - Match the CacheStrategy contract that RbacService consumes (`get`,
+ *    `set`, `has`, `delete`, `deleteByTags`, `clear`).
+ *  - Bound memory: LRU eviction at MAX_ENTRIES.
+ *  - Honor `OM_RBAC_DEFAULT_CACHE=off` so callers can disable it explicitly.
+ *  - Stay process-scoped via `globalThis` so HMR / module duplication does
+ *    not produce divergent caches (same pattern as registerDiRegistrars).
+ */
+
+type FallbackEntry = {
+  value: CacheValue
+  tags: string[]
+  expiresAt: number | null
+}
+
+type FallbackCache = CacheStrategy & {
+  __reset: () => void
+}
+
+const GLOBAL_KEY = '__openMercatoRbacFallbackCache__'
+const MAX_ENTRIES = 5000
+
+export function isRbacDefaultCacheEnabled(): boolean {
+  // Default OFF — same gating posture as Phases 2/4/5 in this PR. The
+  // integration runtime stays on the bare `asClass(RbacService).scoped()`
+  // path (matching develop) unless an operator opts in explicitly.
+  // Set `OM_RBAC_DEFAULT_CACHE=on` (or `1`/`true`/`yes`) to enable the
+  // in-process LRU fallback.
+  const raw = process.env.OM_RBAC_DEFAULT_CACHE
+  if (raw === undefined) return false
+  const normalized = raw.trim().toLowerCase()
+  if (!normalized.length) return false
+  return normalized === 'on' || normalized === '1' || normalized === 'true' || normalized === 'yes'
+}
+
+function nowMs(): number {
+  return Date.now()
+}
+
+function createCache(): FallbackCache {
+  const store = new Map<string, FallbackEntry>()
+  const touch = (key: string) => {
+    const entry = store.get(key)
+    if (!entry) return undefined
+    if (entry.expiresAt !== null && entry.expiresAt < nowMs()) {
+      store.delete(key)
+      return undefined
+    }
+    // Move to most-recently-used position (Map preserves insertion order).
+    store.delete(key)
+    store.set(key, entry)
+    return entry
+  }
+  const evictIfNeeded = () => {
+    while (store.size > MAX_ENTRIES) {
+      const oldest = store.keys().next().value
+      if (typeof oldest !== 'string') break
+      store.delete(oldest)
+    }
+  }
+  const cache: FallbackCache = {
+    async get(key: string, _options?: CacheGetOptions): Promise<CacheValue | null> {
+      const entry = touch(key)
+      return entry ? entry.value : null
+    },
+    async set(key: string, value: CacheValue, options?: CacheSetOptions): Promise<void> {
+      const ttl = options?.ttl ?? null
+      store.delete(key)
+      store.set(key, {
+        value,
+        tags: options?.tags ?? [],
+        expiresAt: typeof ttl === 'number' && ttl > 0 ? nowMs() + ttl : null,
+      })
+      evictIfNeeded()
+    },
+    async has(key: string): Promise<boolean> {
+      return touch(key) !== undefined
+    },
+    async delete(key: string): Promise<boolean> {
+      return store.delete(key)
+    },
+    async deleteByTags(tags: string[]): Promise<number> {
+      if (!tags.length) return 0
+      const tagSet = new Set(tags)
+      let removed = 0
+      for (const [key, entry] of store.entries()) {
+        if (entry.tags.some((tag) => tagSet.has(tag))) {
+          store.delete(key)
+          removed += 1
+        }
+      }
+      return removed
+    },
+    async clear(): Promise<number> {
+      const count = store.size
+      store.clear()
+      return count
+    },
+    async keys(pattern?: string): Promise<string[]> {
+      if (!pattern) return Array.from(store.keys())
+      const matcher = pattern.replace(/[.+^${}()|[\]\\]/g, '\\$&').replace(/\*/g, '.*').replace(/\?/g, '.')
+      const regex = new RegExp(`^${matcher}$`)
+      return Array.from(store.keys()).filter((key) => regex.test(key))
+    },
+    async size(): Promise<number> {
+      return store.size
+    },
+    async stats(): Promise<{ size: number; expired: number }> {
+      const now = nowMs()
+      let expired = 0
+      for (const entry of store.values()) {
+        if (entry.expiresAt !== null && entry.expiresAt < now) expired += 1
+      }
+      return { size: store.size, expired }
+    },
+    __reset() {
+      store.clear()
+    },
+  } as FallbackCache
+  return cache
+}
+
+export function createRbacFallbackCache(): CacheStrategy {
+  const existing = (globalThis as any)[GLOBAL_KEY] as FallbackCache | undefined
+  if (existing) return existing
+  const cache = createCache()
+  ;(globalThis as any)[GLOBAL_KEY] = cache
+  return cache
+}
+
+/** Test-only helper. Clears the process-scoped fallback cache. */
+export function resetRbacFallbackCache(): void {
+  const existing = (globalThis as any)[GLOBAL_KEY] as FallbackCache | undefined
+  existing?.__reset()
+}

package/src/modules/catalog/backend/catalog/products/[id]/page.tsx

@@ -556,7 +556,14 @@ export default function EditCatalogProductPage({
         const productRes = await apiCall<ProductResponse>(
           `/api/catalog/products?id=${encodeURIComponent(productId!)}&page=1&pageSize=1&withDeleted=false`,
         );
-        if (!productRes.ok) throw new Error("load_failed");
+        if (!productRes.ok) {
+          throw new Error(
+            t(
+              "catalog.products.edit.errors.load",
+              "Failed to load product details.",
+            ),
+          );
+        }
         const record = Array.isArray(productRes.result?.items)
           ? productRes.result?.items?.[0]
           : undefined;

package/src/modules/catalog/backend/catalog/products/[productId]/variants/[variantId]/page.tsx

@@ -9,6 +9,7 @@ import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
 import { E } from '#generated/entities.ids.generated'
@@ -165,7 +166,7 @@ export default function EditVariantPage({ params }: { params?: { productId?: str
         const variantRes = await apiCall<VariantResponse>(
           `/api/catalog/variants?id=${encodeURIComponent(variantId!)}&page=1&pageSize=1`,
         )
-        if (!variantRes.ok) throw new Error('load_variant_failed')
+        if (!variantRes.ok) throw new Error(t('catalog.variants.form.errors.load', 'Failed to load variant.'))
         const record = Array.isArray(variantRes.result?.items) ? variantRes.result?.items?.[0] : undefined
         if (!record) throw new Error(t('catalog.variants.form.errors.notFound', 'Variant not found.'))
         const resolvedProductId =
@@ -421,7 +422,7 @@ export default function EditVariantPage({ params }: { params?: { productId?: str
     <Page>
       <PageBody>
         {error ? (
-          <div className="mb-4 rounded border border-destructive/40 bg-destructive/10 px-4 py-3 text-sm text-destructive">{error}</div>
+          <ErrorMessage label={error} className="mb-4" />
         ) : null}
         <CrudForm<VariantFormValues>
           title={formTitle}

package/src/modules/catalog/backend/catalog/products/[productId]/variants/create/page.tsx

@@ -9,6 +9,7 @@ import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors
 import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customFieldValues'
 import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { E } from '#generated/entities.ids.generated'
 import {
@@ -136,7 +137,7 @@ export default function CreateVariantPage({ params }: { params?: { productId?: s
         const res = await apiCall<ProductResponse>(
           `/api/catalog/products?id=${encodeURIComponent(productId!)}&page=1&pageSize=1`,
         )
-        if (!res.ok) throw new Error('load_failed')
+        if (!res.ok) throw new Error(t('catalog.variants.form.errors.load', 'Failed to load product context.'))
         const record = Array.isArray(res.result?.items) ? res.result?.items?.[0] : undefined
         if (!record) throw new Error(t('catalog.products.edit.errors.notFound', 'Product not found.'))
         const metadata = (record.metadata ?? {}) as Record<string, unknown>
@@ -298,7 +299,7 @@ export default function CreateVariantPage({ params }: { params?: { productId?: s
     <Page>
       <PageBody>
         {error ? (
-          <div className="mb-4 rounded border border-destructive/40 bg-destructive/10 px-4 py-3 text-sm text-destructive">{error}</div>
+          <ErrorMessage label={error} className="mb-4" />
         ) : null}
         <CrudForm<VariantFormValues>
           title={formTitle}

package/src/modules/configs/cli.ts

@@ -16,6 +16,12 @@ import { touchGeneratedBarrels } from './lib/touchGeneratedBarrels'
 
 type ParsedArgs = Record<string, string | boolean>
 
+export const STRUCTURAL_CACHE_REQUESTS: CachePurgeRequest[] = [
+  { kind: 'pattern', pattern: 'nav:*' },
+  { kind: 'segment', segment: 'admin-nav' },
+  { kind: 'segment', segment: 'portal-nav' },
+]
+
 type CacheScope = {
   label: string
   tenantId: string | null
@@ -157,7 +163,7 @@ function printCacheHelp() {
   console.log('ℹ️ Notes:')
   console.log('  `stats` mirrors the cache admin page segment overview for CRUD/widget caches.')
   console.log('  `purge --id` removes every key whose name contains the provided token (for example a user id or entity id).')
-  console.log('  `structural` targets navigation caches (`nav:*`) and is the recommended post-step after module/sidebar structure changes.')
+  console.log('  `structural` targets navigation/sidebar caches and is the recommended post-step after module/sidebar structure changes.')
   console.log('  When no scope flag is supplied, this command uses the global cache scope only.')
 }
 
@@ -201,11 +207,14 @@ async function runCacheStats(args: ParsedArgs) {
   }
 }
 
-async function runCachePurge(args: ParsedArgs) {
+async function runCachePurgeRequest(
+  args: ParsedArgs,
+  request: CachePurgeRequest,
+  emitOutput = true,
+) {
   const json = flagEnabled(args, 'json')
   const quiet = flagEnabled(args, 'quiet')
   const dryRun = flagEnabled(args, 'dry-run', 'dryRun')
-  const request = resolveCachePurgeRequest(args)
   const container = await createRequestContainer()
   try {
     const em = container.resolve('em') as EntityManager
@@ -228,13 +237,13 @@ async function runCachePurge(args: ParsedArgs) {
       })
     }
 
-    if (json) {
+    if (json && emitOutput) {
       console.log(JSON.stringify(results, null, 2))
-      return
+      return results
     }
 
-    if (quiet) {
-      return
+    if (quiet || !emitOutput) {
+      return results
     }
 
     for (const result of results) {
@@ -246,22 +255,34 @@ async function runCachePurge(args: ParsedArgs) {
         }
       }
     }
+    return results
   } finally {
     await disposeContainer(container)
   }
 }
 
+async function runCachePurge(args: ParsedArgs) {
+  await runCachePurgeRequest(args, resolveCachePurgeRequest(args))
+}
+
 async function runStructuralCachePurge(args: ParsedArgs) {
-  const nextArgs: ParsedArgs = {
-    ...args,
-    pattern: 'nav:*',
+  const json = flagEnabled(args, 'json')
+  const structuralResults: Array<{
+    request: CachePurgeRequest
+    results: Awaited<ReturnType<typeof runCachePurgeRequest>>
+  }> = []
+  for (const request of STRUCTURAL_CACHE_REQUESTS) {
+    const results = await runCachePurgeRequest(args, request, !json)
+    structuralResults.push({ request, results })
+  }
+  if (json) {
+    console.log(JSON.stringify(structuralResults, null, 2))
   }
-  await runCachePurge(nextArgs)
   const quiet = flagEnabled(args, 'quiet')
   try {
-    touchGeneratedBarrels({ quiet })
+    touchGeneratedBarrels({ quiet: quiet || json })
   } catch (err) {
-    if (!quiet) {
+    if (!quiet && !json) {
       console.warn(
         `[structural] failed to touch generated barrels: ${(err as Error).message ?? err}`,
       )

package/src/modules/currencies/api/currencies/route.ts

@@ -172,10 +172,9 @@ export async function GET(req: Request) {
     orderBy.code = 'ASC'
   }
 
-  const [all, total] = await em.findAndCount(Currency, filter, { orderBy })
-  const start = (page - 1) * pageSize
-  const paged = all.slice(start, start + pageSize)
-  const items = paged.map(toRow)
+  const offset = (page - 1) * pageSize
+  const [rows, total] = await em.findAndCount(Currency, filter, { orderBy, limit: pageSize, offset })
+  const items = rows.map(toRow)
   const totalPages = Math.max(1, Math.ceil(total / pageSize))
 
   return NextResponse.json({ items, total, page, pageSize, totalPages })

package/src/modules/currencies/api/exchange-rates/route.ts

@@ -169,10 +169,9 @@ export async function GET(req: Request) {
     orderBy.date = 'DESC'
   }
 
-  const [all, total] = await em.findAndCount(ExchangeRate, where, { orderBy })
-  const start = (page - 1) * pageSize
-  const paged = all.slice(start, start + pageSize)
-  const items = paged.map(toRow)
+  const offset = (page - 1) * pageSize
+  const [rows, total] = await em.findAndCount(ExchangeRate, where, { orderBy, limit: pageSize, offset })
+  const items = rows.map(toRow)
   const totalPages = Math.max(1, Math.ceil(total / pageSize))
 
   return NextResponse.json({ items, total, page, pageSize, totalPages })

package/src/modules/customers/api/people/route.ts

@@ -427,37 +427,39 @@ const crud = makeCrudRoute({
         tenantId: ctx.auth?.tenantId ?? null,
         organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
       }
-      const entities = await findWithDecryption(
-        em,
-        CustomerEntity,
-        {
-          id: { $in: ids },
-          deletedAt: null,
-          kind: 'person',
-        } as FilterQuery<CustomerEntity>,
-        undefined,
-        decryptionScope,
-      )
-      const entitiesById = new Map<string, CustomerEntity>()
-      for (const entity of entities) {
-        entitiesById.set(entity.id, entity)
-      }
-
-      const where: Record<string, unknown> = {
+      const profileWhere: Record<string, unknown> = {
         entity: { $in: ids },
         tenantId: ctx.auth?.tenantId ?? null,
       }
       if (ctx.selectedOrganizationId) {
-        where.organizationId = ctx.selectedOrganizationId
+        profileWhere.organizationId = ctx.selectedOrganizationId
       }
 
-      const profiles = await findWithDecryption(
-        em,
-        CustomerPersonProfile,
-        where as FilterQuery<CustomerPersonProfile>,
-        { populate: ['entity', 'company'] },
-        decryptionScope,
-      )
+      const [entities, profiles] = await Promise.all([
+        findWithDecryption(
+          em,
+          CustomerEntity,
+          {
+            id: { $in: ids },
+            deletedAt: null,
+            kind: 'person',
+          } as FilterQuery<CustomerEntity>,
+          undefined,
+          decryptionScope,
+        ),
+        findWithDecryption(
+          em,
+          CustomerPersonProfile,
+          profileWhere as FilterQuery<CustomerPersonProfile>,
+          { populate: ['entity', 'company'] },
+          decryptionScope,
+        ),
+      ])
+
+      const entitiesById = new Map<string, CustomerEntity>()
+      for (const entity of entities) {
+        entitiesById.set(entity.id, entity)
+      }
 
       const profilesByEntityId = new Map<string, CustomerPersonProfile>()
       for (const profile of profiles) {

package/src/modules/directory/subscribers/invalidateOrgScopeCache.ts

@@ -0,0 +1,39 @@
+// Invalidate the OrganizationScope cache when an organization mutates.
+//
+// resolveOrganizationScopeForRequest caches its result with a short TTL
+// (default 60s, OM_ORG_SCOPE_CACHE_TTL_MS). When an organization is
+// created/updated/deleted, the cached scope for users of the affected
+// tenant may be stale (visibility set or descendant tree changed). We
+// drop every cache entry tagged for that tenant; the TTL is the backstop
+// for races where the event fires after a request reads the cache.
+
+type CacheService = {
+  deleteByTags(tags: string[]): Promise<number>
+}
+
+export const metadata = {
+  event: 'directory.organization.*',
+  persistent: false,
+  id: 'directory:invalidate-org-scope-cache',
+}
+
+export default async function handle(
+  payload: unknown,
+  ctx: { resolve: <T = unknown>(name: string) => T },
+): Promise<void> {
+  const data = (payload ?? {}) as Record<string, unknown>
+  const tenantId = typeof data.tenantId === 'string' ? data.tenantId : null
+  if (!tenantId) return
+  let cache: CacheService | null = null
+  try {
+    cache = ctx.resolve<CacheService>('cache')
+  } catch {
+    return
+  }
+  if (!cache) return
+  try {
+    await cache.deleteByTags([`org-scope:tenant:${tenantId}`])
+  } catch {
+    // best-effort; TTL is the backstop.
+  }
+}

package/src/modules/directory/utils/organizationScope.ts

@@ -5,6 +5,7 @@ import { Organization } from '@open-mercato/core/modules/directory/data/entities
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { CacheStrategy } from '@open-mercato/cache'
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'
 
 export { parseSelectedOrganizationCookie, parseSelectedTenantCookie }
@@ -16,6 +17,90 @@ export type OrganizationScope = {
   tenantId: string | null
 }
 
+// Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
+// OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,
+// requestedTenant) between membership changes; caching it bypasses 1
+// SELECT on `organizations` per CRUD request. TTL is short (60s default)
+// to keep staleness bounded for membership/visibility changes. Tag-based
+// invalidation kicks the cache when user_organizations or organizations
+// mutate (wired via invalidateOrganizationScopeCacheFor).
+const ORG_SCOPE_CACHE_KEY_PREFIX = 'org-scope'
+// Phase 4 default-off until the same readiness probe (`GET /api/customers/people`)
+// stays green with the cache layer engaged. Set `OM_ORG_SCOPE_CACHE_TTL_MS=60000`
+// (or any positive integer) to opt in once cross-request safety is re-verified.
+const ORG_SCOPE_DEFAULT_TTL_MS = 0
+
+function resolveOrgScopeTtlMs(): number {
+  const raw = process.env.OM_ORG_SCOPE_CACHE_TTL_MS
+  if (raw === undefined) return ORG_SCOPE_DEFAULT_TTL_MS
+  const parsed = Number(raw)
+  if (!Number.isFinite(parsed) || parsed < 0) return ORG_SCOPE_DEFAULT_TTL_MS
+  return parsed
+}
+
+function buildOrgScopeCacheKey(parts: {
+  userId: string
+  effectiveTenantId: string
+  selectedOrgId: string | null
+  requestedTenantId: string | null
+}): string {
+  const selected = parts.selectedOrgId ?? 'none'
+  const requested = parts.requestedTenantId ?? 'none'
+  return `${ORG_SCOPE_CACHE_KEY_PREFIX}:${parts.userId}:${parts.effectiveTenantId}:${selected}:${requested}`
+}
+
+function buildOrgScopeCacheTags(parts: { userId: string; effectiveTenantId: string }): string[] {
+  return [
+    `${ORG_SCOPE_CACHE_KEY_PREFIX}:user:${parts.userId}`,
+    `${ORG_SCOPE_CACHE_KEY_PREFIX}:tenant:${parts.effectiveTenantId}`,
+  ]
+}
+
+function isValidCachedScope(value: unknown): value is OrganizationScope {
+  if (typeof value !== 'object' || value === null) return false
+  const record = value as Partial<OrganizationScope>
+  const idOk = (v: unknown) => v === null || typeof v === 'string'
+  const arrOk = (v: unknown) => v === null || (Array.isArray(v) && v.every((entry) => typeof entry === 'string'))
+  return idOk(record.selectedId) && idOk(record.tenantId) && arrOk(record.filterIds) && arrOk(record.allowedIds)
+}
+
+function resolveCacheFromContainer(container: AwilixContainer | null | undefined): CacheStrategy | null {
+  if (!container) return null
+  try {
+    const c = container.resolve('cache') as CacheStrategy | undefined
+    if (c && typeof c.get === 'function' && typeof c.set === 'function') return c
+  } catch {
+    return null
+  }
+  return null
+}
+
+export async function invalidateOrganizationScopeCacheForUser(
+  container: AwilixContainer,
+  userId: string,
+): Promise<void> {
+  const cache = resolveCacheFromContainer(container)
+  if (!cache?.deleteByTags) return
+  try {
+    await cache.deleteByTags([`${ORG_SCOPE_CACHE_KEY_PREFIX}:user:${userId}`])
+  } catch (err) {
+    console.warn('[org-scope:cache] invalidate user failed', err)
+  }
+}
+
+export async function invalidateOrganizationScopeCacheForTenant(
+  container: AwilixContainer,
+  tenantId: string,
+): Promise<void> {
+  const cache = resolveCacheFromContainer(container)
+  if (!cache?.deleteByTags) return
+  try {
+    await cache.deleteByTags([`${ORG_SCOPE_CACHE_KEY_PREFIX}:tenant:${tenantId}`])
+  } catch (err) {
+    console.warn('[org-scope:cache] invalidate tenant failed', err)
+  }
+}
+
 function normalizeOrganizationId(value: unknown): string | null {
   if (typeof value !== 'string') return null
   const trimmed = value.trim()
@@ -270,6 +355,31 @@ export async function resolveOrganizationScopeForRequest({
   }
 
   const rawSelected = selectedId !== undefined ? selectedId : (request ? getSelectedOrganizationFromRequest(request) : null)
+  const normalizedSelectedId = typeof rawSelected === 'string' && rawSelected.trim().length > 0
+    ? rawSelected.trim()
+    : null
+
+  const userId = typeof auth.sub === 'string' && auth.sub.length > 0 ? auth.sub : null
+  const ttlMs = resolveOrgScopeTtlMs()
+  const cache = ttlMs > 0 ? resolveCacheFromContainer(container) : null
+  const cacheKey = userId
+    ? buildOrgScopeCacheKey({
+        userId,
+        effectiveTenantId,
+        selectedOrgId: normalizedSelectedId,
+        requestedTenantId: requestedTenantId ?? null,
+      })
+    : null
+
+  if (cache && cacheKey && typeof cache.get === 'function') {
+    try {
+      const cached = await cache.get(cacheKey)
+      if (isValidCachedScope(cached)) return cached
+    } catch (err) {
+      console.warn('[org-scope:cache] read failed', err)
+    }
+  }
+
   const baseScope = await resolveOrganizationScope({
     em,
     rbac,
@@ -278,6 +388,17 @@ export async function resolveOrganizationScopeForRequest({
     tenantId: effectiveTenantId,
   })
 
+  if (cache && cacheKey && userId && typeof cache.set === 'function') {
+    try {
+      await cache.set(cacheKey, baseScope, {
+        ttl: ttlMs,
+        tags: buildOrgScopeCacheTags({ userId, effectiveTenantId }),
+      })
+    } catch (err) {
+      console.warn('[org-scope:cache] write failed', err)
+    }
+  }
+
   return baseScope
 }
 

package/src/modules/resources/backend/resources/resource-types/[id]/edit/page.tsx

@@ -37,7 +37,7 @@ export default function ResourcesResourceTypeEditPage({ params }: { params?: { i
           { errorMessage: t('resources.resourceTypes.errors.load', 'Failed to load resource types.') },
         )
         const item = Array.isArray(payload.items) ? payload.items[0] : null
-        if (!item) throw new Error('not_found')
+        if (!item) throw new Error(t('resources.resourceTypes.errors.notFound', 'Resource type not found.'))
         if (!cancelled) {
           const customValues = extractCustomFieldValues(item)
           setInitialValues({

package/src/modules/sales/backend/sales/channels/[channelId]/edit/page.tsx

@@ -53,7 +53,7 @@ export default function EditChannelPage({ params }: { params?: { channelId?: str
         )
         const item = Array.isArray(payload.items) ? payload.items[0] : null
         if (!item) {
-          throw new Error('not_found')
+          throw new Error(t('sales.channels.form.errors.notFound', 'Channel not found.'))
         }
         if (!cancelled) {
           setInitialValues(mapChannelToFormValues(item))

package/src/modules/sales/components/channels/ChannelOfferForm.tsx

@@ -291,7 +291,7 @@ export function ChannelOfferForm({ channelId: lockedChannelId, offerId, mode }:
           { errorMessage: t('sales.channels.offers.errors.loadOffer', 'Failed to load offer.') },
         )
         const offer = Array.isArray(payload.items) ? payload.items[0] : null
-        if (!offer) throw new Error('not_found')
+        if (!offer) throw new Error(t('sales.channels.offers.errors.notFound', 'Offer not found.'))
         const values = mapOfferToFormValues(offer, lockedChannelId)
         const pricePayload = await readApiResultOrThrow<PriceResponse>(
           `/api/catalog/prices?offerId=${encodeURIComponent(offer.id as string)}&pageSize=${MAX_LIST_PAGE_SIZE}`,

package/src/modules/workflows/backend/definitions/[id]/page.tsx

@@ -10,6 +10,7 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
 import { apiFetch } from '@open-mercato/ui/backend/utils/api'
 import { readJsonSafe } from '@open-mercato/ui/backend/utils/serverErrors'
+import { formatWorkflowValidationError } from '../../../lib/format-validation-error'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -94,8 +95,8 @@ export default function EditWorkflowDefinitionPage() {
           body: JSON.stringify(payload),
         })
         if (!response.ok) {
-          const errorBody = await readJsonSafe<{ error?: string }>(response, null)
-          throw new Error(errorBody?.error || t('workflows.errors.updateFailed'))
+          const errorBody = await readJsonSafe<{ error?: string; details?: Array<{ path?: Array<string | number>; message?: string }> }>(response, null)
+          throw new Error(formatWorkflowValidationError(errorBody, t('workflows.errors.updateFailed')))
         }
         return response
       },