@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/dist/modules/customer_accounts/api/portal/users-invite.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/portal/users-invite.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = inviteUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Validate all roles are customer_assignable\n  const requestedRoleIds = parsed.data.roleIds\n  const roles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const rolesById = new Map(roles.map((role) => [role.id, role]))\n  for (const roleId of requestedRoleIds) {\n    const role = rolesById.get(roleId)\n    if (!role) {\n      return NextResponse.json({ ok: false, error: `Role ${roleId} not found` }, { status: 400 })\n    }\n    if (!role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: `Role \"${role.name}\" cannot be assigned by portal users` }, { status: 403 })\n    }\n  }\n\n  const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService\n\n  const { invitation } = await customerInvitationService.createInvitation(\n    parsed.data.email,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n    {\n      customerEntityId: auth.customerEntityId,\n      roleIds: parsed.data.roleIds,\n      invitedByCustomerUserId: auth.sub,\n      displayName: parsed.data.displayName || null,\n    },\n  )\n\n  return NextResponse.json({\n    ok: true,\n    invitation: {\n      id: invitation.id,\n      email: invitation.email,\n      expiresAt: invitation.expiresAt,\n    },\n  }, { status: 201 })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  invitation: z.object({\n    id: z.string().uuid(),\n    email: z.string(),\n    expiresAt: z.string().datetime(),\n  }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Invite a user to the company portal',\n  description: 'Creates an invitation for a new user to join the company portal.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: inviteUserSchema },\n  responses: [{ status: 201, description: 'Invitation created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Invite portal user',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AAGvC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AAE5B,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,qBAAqB,GAAG,mBAAmB;AAAA,EACjF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,QAAQ,iBAAiB,SAAS,IACpC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC9D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,UAAU,IAAI,MAAM;AACjC,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,MAAM,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AACA,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,SAAS,KAAK,IAAI,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AAAA,EACF;AAEA,QAAM,4BAA4B,UAAU,QAAQ,2BAA2B;AAE/E,QAAM,EAAE,WAAW,IAAI,MAAM,0BAA0B;AAAA,IACrD,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACtD;AAAA,MACE,kBAAkB,KAAK;AAAA,MACvB,SAAS,OAAO,KAAK;AAAA,MACrB,yBAAyB,KAAK;AAAA,MAC9B,aAAa,OAAO,KAAK,eAAe;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,YAAY;AAAA,MACV,IAAI,WAAW;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,EACrF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,EACrG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerInviteRateLimitConfig,\n  customerInviteIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerInviteIpRateLimitConfig,\n    compoundConfig: customerInviteRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = inviteUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Validate all roles are customer_assignable\n  const requestedRoleIds = parsed.data.roleIds\n  const roles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const rolesById = new Map(roles.map((role) => [role.id, role]))\n  for (const roleId of requestedRoleIds) {\n    const role = rolesById.get(roleId)\n    if (!role) {\n      return NextResponse.json({ ok: false, error: `Role ${roleId} not found` }, { status: 400 })\n    }\n    if (!role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: `Role \"${role.name}\" cannot be assigned by portal users` }, { status: 403 })\n    }\n  }\n\n  const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService\n\n  const { invitation } = await customerInvitationService.createInvitation(\n    parsed.data.email,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n    {\n      customerEntityId: auth.customerEntityId,\n      roleIds: parsed.data.roleIds,\n      invitedByCustomerUserId: auth.sub,\n      displayName: parsed.data.displayName || null,\n    },\n  )\n\n  return NextResponse.json({\n    ok: true,\n    invitation: {\n      id: invitation.id,\n      email: invitation.email,\n      expiresAt: invitation.expiresAt,\n    },\n  }, { status: 201 })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  invitation: z.object({\n    id: z.string().uuid(),\n    email: z.string(),\n    expiresAt: z.string().datetime(),\n  }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Invite a user to the company portal',\n  description: 'Creates an invitation for a new user to join the company portal.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: inviteUserSchema },\n  responses: [{ status: 201, description: 'Invitation created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },\n    { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Invite portal user',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AAGvC,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,qBAAqB,GAAG,mBAAmB;AAAA,EACjF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,QAAQ,iBAAiB,SAAS,IACpC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC9D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,UAAU,IAAI,MAAM;AACjC,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,MAAM,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AACA,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,SAAS,KAAK,IAAI,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AAAA,EACF;AAEA,QAAM,4BAA4B,UAAU,QAAQ,2BAA2B;AAE/E,QAAM,EAAE,WAAW,IAAI,MAAM,0BAA0B;AAAA,IACrD,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACtD;AAAA,MACE,kBAAkB,KAAK;AAAA,MACvB,SAAS,OAAO,KAAK;AAAA,MACrB,yBAAyB,KAAK;AAAA,MAC9B,aAAa,OAAO,KAAK,eAAe;AAAA,IAC1C;AAAA,EACF;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,YAAY;AAAA,MACV,IAAI,WAAW;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,EACrF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,IACnG,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,qBAAqB;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/signup.js

@@ -55,7 +55,9 @@ async function POST(req) {
   let tenantId;
   let organizationId;
   try {
-    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    const context = await resolveTenantContext(req, parsed.data.tenantId, {
+      organizationId: parsed.data.organizationId ?? null
+    });
     tenantId = context.tenantId;
     organizationId = context.organizationId ?? parsed.data.organizationId ?? null;
   } catch (err) {

package/dist/modules/customer_accounts/api/signup.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/api/signup.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { compare as bcryptCompare } from 'bcryptjs'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { signupSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRole, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport CustomerSignupVerificationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerSignupVerificationEmail'\nimport CustomerExistingAccountEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerExistingAccountEmail'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerSignupRateLimitConfig,\n  customerSignupIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\n// Precomputed bcrypt cost-10 hash of an unknowable random 32-byte input; used to equalize\n// response latency between the existing-user and new-user signup branches so the endpoint's\n// 202-for-both contract is not undone by a timing side channel.\nconst TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'\nfunction resolvePortalLoginUrl(baseUrl: string, organizationSlug?: string | null): string {\n  return organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/login`\n    : `${baseUrl}/portal/login`\n}\n\nfunction resolvePortalVerifyUrl(baseUrl: string, token: string, organizationSlug?: string | null): string {\n  const route = organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/verify`\n    : `${baseUrl}/portal/verify`\n  return `${route}?token=${encodeURIComponent(token)}`\n}\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerSignupIpRateLimitConfig,\n    compoundConfig: customerSignupRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = signupSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const { email, password, displayName } = parsed.data\n  let tenantId: string\n  let organizationId: string | null\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n    organizationId = context.organizationId ?? parsed.data.organizationId ?? null\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })\n    }\n    throw err\n  }\n  if (!organizationId) {\n    return NextResponse.json({ ok: false, error: 'organizationId is required' }, { status: 400 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'customer_accounts.signup',\n      configMessage: 'Customer signup is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const { translate } = await resolveTranslations()\n\n  const orgRow = await findOrganizationInTenant(em, organizationId, tenantId)\n  if (!orgRow) {\n    return NextResponse.json({ ok: false, error: 'Registration could not be completed' }, { status: 400 })\n  }\n\n  const existing = await customerUserService.findByEmail(email, tenantId)\n  if (existing) {\n    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)\n    const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId)\n    // Prefer the org's active custom domain when available; fall back to the\n    // platform login URL preserved by `resolvePortalLoginUrl`.\n    let loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null)\n    try {\n      loginUrl = await urlForCustomerOrg(existing.organizationId, '/login', { container })\n    } catch {\n      // Fall back to platform URL on any resolution issue.\n    }\n    const subject = translate('customer_accounts.signup.existing.subject', 'You already have a portal account')\n    const copy = {\n      preview: translate('customer_accounts.signup.existing.preview', 'A sign-up attempt was made for an email that already has a portal account.'),\n      title: translate('customer_accounts.signup.existing.title', 'You already have a portal account'),\n      body: translate(\n        'customer_accounts.signup.existing.body',\n        'A sign-up request was made for this email address. You can sign in with your existing account. If you forgot your password, use the password reset option on the sign-in page.',\n      ),\n      cta: translate('customer_accounts.signup.existing.cta', 'Open sign-in page'),\n      hint: translate(\n        'customer_accounts.signup.existing.hint',\n        'If this was not you, you can ignore this message. No new portal account was created.',\n      ),\n    }\n\n    void sendEmail({\n      to: existing.email,\n      subject,\n      react: CustomerExistingAccountEmail({ loginUrl, copy }),\n    }).catch((error) => {\n      console.error('[customer_accounts.signup] existing-account email failed', error)\n    })\n\n    return NextResponse.json({ ok: true }, { status: 202 })\n  }\n\n  const user = await customerUserService.createUser(email, password, displayName, { tenantId, organizationId })\n\n  const defaultRole = await em.findOne(CustomerRole, {\n    tenantId,\n    isDefault: true,\n    deletedAt: null,\n  })\n  if (defaultRole) {\n    const userRole = em.create(CustomerUserRole, {\n      user,\n      role: defaultRole,\n      createdAt: new Date(),\n    } as any)\n    em.persist(userRole)\n  }\n\n  await em.persist(user).flush()\n\n  const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId)\n  let verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug)\n  try {\n    verifyUrl = await urlForCustomerOrg(organizationId, `/verify?token=${encodeURIComponent(verificationToken)}`, {\n      container,\n    })\n  } catch {\n    // Fall back to the platform-derived URL on any resolution issue.\n  }\n  const subject = translate('customer_accounts.signup.created.subject', 'Verify your portal account')\n  const copy = {\n    preview: translate('customer_accounts.signup.created.preview', 'Verify your portal account to finish sign-up.'),\n    title: translate('customer_accounts.signup.created.title', 'Verify your portal account'),\n    body: translate(\n      'customer_accounts.signup.created.body',\n      'Your account request was accepted. Confirm your email address to finish setting up portal access.',\n    ),\n    cta: translate('customer_accounts.signup.created.cta', 'Verify email address'),\n    hint: translate(\n      'customer_accounts.signup.created.hint',\n      'This verification link expires in 24 hours. If you did not request this, you can ignore this email.',\n    ),\n  }\n\n  void sendEmail({\n    to: user.email,\n    subject,\n    react: CustomerSignupVerificationEmail({ verifyUrl, copy }),\n  }).catch((error) => {\n    console.error('[customer_accounts.signup] verification email failed', error)\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true }, { status: 202 })\n}\n\nconst signupAcceptedSchema = z.object({ ok: z.literal(true) })\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Register a new customer account',\n  description: 'Accepts a signup request and always returns 202 to prevent account enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: signupSchema,\n    description: 'Signup payload with email, password, and display name.',\n  },\n  responses: [\n    { status: 202, description: 'Signup accepted', schema: signupAcceptedSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or invalid request origin', schema: errorSchema },\n    { status: 429, description: 'Too many signup attempts', schema: rateLimitErrorSchema },\n    { status: 500, description: 'Signup email origin is not configured', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer account registration',\n  description: 'Handles customer self-registration without revealing whether the email already exists.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAGvC,SAAS,cAAc,wBAAwB;AAC/C,SAAS,iCAAiC;AAC1C,OAAO,qCAAqC;AAC5C,OAAO,kCAAkC;AACzC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,gCAAgC;AAClE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAE3B,MAAM,WAAqD,EAAE,aAAa,MAAM;AAKvF,MAAM,2BAA2B;AACjC,SAAS,sBAAsB,SAAiB,kBAA0C;AACxF,SAAO,mBACH,GAAG,OAAO,IAAI,gBAAgB,kBAC9B,GAAG,OAAO;AAChB;AAEA,SAAS,uBAAuB,SAAiB,OAAe,kBAA0C;AACxG,QAAM,QAAQ,mBACV,GAAG,OAAO,IAAI,gBAAgB,mBAC9B,GAAG,OAAO;AACd,SAAO,GAAG,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACpD;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,EAAE,OAAO,UAAU,YAAY,IAAI,OAAO;AAChD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AACnB,qBAAiB,QAAQ,kBAAkB,OAAO,KAAK,kBAAkB;AAAA,EAC3E,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACpF;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAM,SAAS,MAAM,yBAAyB,IAAI,gBAAgB,QAAQ;AAC1E,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AACtE,MAAI,UAAU;AACZ,UAAM,cAAc,UAAU,wBAAwB;AACtD,UAAM,cAAc,MAAM,yBAAyB,IAAI,SAAS,gBAAgB,QAAQ;AAGxF,QAAI,WAAW,sBAAsB,SAAS,aAAa,QAAQ,IAAI;AACvE,QAAI;AACF,iBAAW,MAAM,kBAAkB,SAAS,gBAAgB,UAAU,EAAE,UAAU,CAAC;AAAA,IACrF,QAAQ;AAAA,IAER;AACA,UAAMA,WAAU,UAAU,6CAA6C,mCAAmC;AAC1G,UAAMC,QAAO;AAAA,MACX,SAAS,UAAU,6CAA6C,4EAA4E;AAAA,MAC5I,OAAO,UAAU,2CAA2C,mCAAmC;AAAA,MAC/F,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,MACA,KAAK,UAAU,yCAAyC,mBAAmB;AAAA,MAC3E,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,UAAU;AAAA,MACb,IAAI,SAAS;AAAA,MACb,SAAAD;AAAA,MACA,OAAO,6BAA6B,EAAE,UAAU,MAAAC,MAAK,CAAC;AAAA,IACxD,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAQ,MAAM,4DAA4D,KAAK;AAAA,IACjF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD;AAEA,QAAM,OAAO,MAAM,oBAAoB,WAAW,OAAO,UAAU,aAAa,EAAE,UAAU,eAAe,CAAC;AAE5G,QAAM,cAAc,MAAM,GAAG,QAAQ,cAAc;AAAA,IACjD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,aAAa;AACf,UAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,MAC3C;AAAA,MACA,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,QAAQ;AAAA,EACrB;AAEA,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,QAAM,oBAAoB,MAAM,qBAAqB,wBAAwB,KAAK,IAAI,QAAQ;AAC9F,MAAI,YAAY,uBAAuB,SAAS,mBAAmB,OAAO,IAAI;AAC9E,MAAI;AACF,gBAAY,MAAM,kBAAkB,gBAAgB,iBAAiB,mBAAmB,iBAAiB,CAAC,IAAI;AAAA,MAC5G;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACA,QAAM,UAAU,UAAU,4CAA4C,4BAA4B;AAClG,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,4CAA4C,+CAA+C;AAAA,IAC9G,OAAO,UAAU,0CAA0C,4BAA4B;AAAA,IACvF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,wCAAwC,sBAAsB;AAAA,IAC7E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,OAAK,UAAU;AAAA,IACb,IAAI,KAAK;AAAA,IACT;AAAA,IACA,OAAO,gCAAgC,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5D,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,wDAAwD,KAAK;AAAA,EAC7E,CAAC;AAED,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxD;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAE7D,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB;AAAA,EAC9E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { compare as bcryptCompare } from 'bcryptjs'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { signupSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRole, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport CustomerSignupVerificationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerSignupVerificationEmail'\nimport CustomerExistingAccountEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerExistingAccountEmail'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerSignupRateLimitConfig,\n  customerSignupIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\n// Precomputed bcrypt cost-10 hash of an unknowable random 32-byte input; used to equalize\n// response latency between the existing-user and new-user signup branches so the endpoint's\n// 202-for-both contract is not undone by a timing side channel.\nconst TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'\nfunction resolvePortalLoginUrl(baseUrl: string, organizationSlug?: string | null): string {\n  return organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/login`\n    : `${baseUrl}/portal/login`\n}\n\nfunction resolvePortalVerifyUrl(baseUrl: string, token: string, organizationSlug?: string | null): string {\n  const route = organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/verify`\n    : `${baseUrl}/portal/verify`\n  return `${route}?token=${encodeURIComponent(token)}`\n}\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerSignupIpRateLimitConfig,\n    compoundConfig: customerSignupRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = signupSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const { email, password, displayName } = parsed.data\n  let tenantId: string\n  let organizationId: string | null\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId, {\n      organizationId: parsed.data.organizationId ?? null,\n    })\n    tenantId = context.tenantId\n    organizationId = context.organizationId ?? parsed.data.organizationId ?? null\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })\n    }\n    throw err\n  }\n  if (!organizationId) {\n    return NextResponse.json({ ok: false, error: 'organizationId is required' }, { status: 400 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'customer_accounts.signup',\n      configMessage: 'Customer signup is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const { translate } = await resolveTranslations()\n\n  const orgRow = await findOrganizationInTenant(em, organizationId, tenantId)\n  if (!orgRow) {\n    return NextResponse.json({ ok: false, error: 'Registration could not be completed' }, { status: 400 })\n  }\n\n  const existing = await customerUserService.findByEmail(email, tenantId)\n  if (existing) {\n    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)\n    const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId)\n    // Prefer the org's active custom domain when available; fall back to the\n    // platform login URL preserved by `resolvePortalLoginUrl`.\n    let loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null)\n    try {\n      loginUrl = await urlForCustomerOrg(existing.organizationId, '/login', { container })\n    } catch {\n      // Fall back to platform URL on any resolution issue.\n    }\n    const subject = translate('customer_accounts.signup.existing.subject', 'You already have a portal account')\n    const copy = {\n      preview: translate('customer_accounts.signup.existing.preview', 'A sign-up attempt was made for an email that already has a portal account.'),\n      title: translate('customer_accounts.signup.existing.title', 'You already have a portal account'),\n      body: translate(\n        'customer_accounts.signup.existing.body',\n        'A sign-up request was made for this email address. You can sign in with your existing account. If you forgot your password, use the password reset option on the sign-in page.',\n      ),\n      cta: translate('customer_accounts.signup.existing.cta', 'Open sign-in page'),\n      hint: translate(\n        'customer_accounts.signup.existing.hint',\n        'If this was not you, you can ignore this message. No new portal account was created.',\n      ),\n    }\n\n    void sendEmail({\n      to: existing.email,\n      subject,\n      react: CustomerExistingAccountEmail({ loginUrl, copy }),\n    }).catch((error) => {\n      console.error('[customer_accounts.signup] existing-account email failed', error)\n    })\n\n    return NextResponse.json({ ok: true }, { status: 202 })\n  }\n\n  const user = await customerUserService.createUser(email, password, displayName, { tenantId, organizationId })\n\n  const defaultRole = await em.findOne(CustomerRole, {\n    tenantId,\n    isDefault: true,\n    deletedAt: null,\n  })\n  if (defaultRole) {\n    const userRole = em.create(CustomerUserRole, {\n      user,\n      role: defaultRole,\n      createdAt: new Date(),\n    } as any)\n    em.persist(userRole)\n  }\n\n  await em.persist(user).flush()\n\n  const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId)\n  let verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug)\n  try {\n    verifyUrl = await urlForCustomerOrg(organizationId, `/verify?token=${encodeURIComponent(verificationToken)}`, {\n      container,\n    })\n  } catch {\n    // Fall back to the platform-derived URL on any resolution issue.\n  }\n  const subject = translate('customer_accounts.signup.created.subject', 'Verify your portal account')\n  const copy = {\n    preview: translate('customer_accounts.signup.created.preview', 'Verify your portal account to finish sign-up.'),\n    title: translate('customer_accounts.signup.created.title', 'Verify your portal account'),\n    body: translate(\n      'customer_accounts.signup.created.body',\n      'Your account request was accepted. Confirm your email address to finish setting up portal access.',\n    ),\n    cta: translate('customer_accounts.signup.created.cta', 'Verify email address'),\n    hint: translate(\n      'customer_accounts.signup.created.hint',\n      'This verification link expires in 24 hours. If you did not request this, you can ignore this email.',\n    ),\n  }\n\n  void sendEmail({\n    to: user.email,\n    subject,\n    react: CustomerSignupVerificationEmail({ verifyUrl, copy }),\n  }).catch((error) => {\n    console.error('[customer_accounts.signup] verification email failed', error)\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true }, { status: 202 })\n}\n\nconst signupAcceptedSchema = z.object({ ok: z.literal(true) })\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Register a new customer account',\n  description: 'Accepts a signup request and always returns 202 to prevent account enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: signupSchema,\n    description: 'Signup payload with email, password, and display name.',\n  },\n  responses: [\n    { status: 202, description: 'Signup accepted', schema: signupAcceptedSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or invalid request origin', schema: errorSchema },\n    { status: 429, description: 'Too many signup attempts', schema: rateLimitErrorSchema },\n    { status: 500, description: 'Signup email origin is not configured', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer account registration',\n  description: 'Handles customer self-registration without revealing whether the email already exists.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAGvC,SAAS,cAAc,wBAAwB;AAC/C,SAAS,iCAAiC;AAC1C,OAAO,qCAAqC;AAC5C,OAAO,kCAAkC;AACzC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,gCAAgC;AAClE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAE3B,MAAM,WAAqD,EAAE,aAAa,MAAM;AAKvF,MAAM,2BAA2B;AACjC,SAAS,sBAAsB,SAAiB,kBAA0C;AACxF,SAAO,mBACH,GAAG,OAAO,IAAI,gBAAgB,kBAC9B,GAAG,OAAO;AAChB;AAEA,SAAS,uBAAuB,SAAiB,OAAe,kBAA0C;AACxG,QAAM,QAAQ,mBACV,GAAG,OAAO,IAAI,gBAAgB,mBAC9B,GAAG,OAAO;AACd,SAAO,GAAG,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACpD;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,EAAE,OAAO,UAAU,YAAY,IAAI,OAAO;AAChD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,UAAU;AAAA,MACpE,gBAAgB,OAAO,KAAK,kBAAkB;AAAA,IAChD,CAAC;AACD,eAAW,QAAQ;AACnB,qBAAiB,QAAQ,kBAAkB,OAAO,KAAK,kBAAkB;AAAA,EAC3E,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACpF;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAM,SAAS,MAAM,yBAAyB,IAAI,gBAAgB,QAAQ;AAC1E,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AACtE,MAAI,UAAU;AACZ,UAAM,cAAc,UAAU,wBAAwB;AACtD,UAAM,cAAc,MAAM,yBAAyB,IAAI,SAAS,gBAAgB,QAAQ;AAGxF,QAAI,WAAW,sBAAsB,SAAS,aAAa,QAAQ,IAAI;AACvE,QAAI;AACF,iBAAW,MAAM,kBAAkB,SAAS,gBAAgB,UAAU,EAAE,UAAU,CAAC;AAAA,IACrF,QAAQ;AAAA,IAER;AACA,UAAMA,WAAU,UAAU,6CAA6C,mCAAmC;AAC1G,UAAMC,QAAO;AAAA,MACX,SAAS,UAAU,6CAA6C,4EAA4E;AAAA,MAC5I,OAAO,UAAU,2CAA2C,mCAAmC;AAAA,MAC/F,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,MACA,KAAK,UAAU,yCAAyC,mBAAmB;AAAA,MAC3E,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,UAAU;AAAA,MACb,IAAI,SAAS;AAAA,MACb,SAAAD;AAAA,MACA,OAAO,6BAA6B,EAAE,UAAU,MAAAC,MAAK,CAAC;AAAA,IACxD,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAQ,MAAM,4DAA4D,KAAK;AAAA,IACjF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD;AAEA,QAAM,OAAO,MAAM,oBAAoB,WAAW,OAAO,UAAU,aAAa,EAAE,UAAU,eAAe,CAAC;AAE5G,QAAM,cAAc,MAAM,GAAG,QAAQ,cAAc;AAAA,IACjD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,aAAa;AACf,UAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,MAC3C;AAAA,MACA,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,QAAQ;AAAA,EACrB;AAEA,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,QAAM,oBAAoB,MAAM,qBAAqB,wBAAwB,KAAK,IAAI,QAAQ;AAC9F,MAAI,YAAY,uBAAuB,SAAS,mBAAmB,OAAO,IAAI;AAC9E,MAAI;AACF,gBAAY,MAAM,kBAAkB,gBAAgB,iBAAiB,mBAAmB,iBAAiB,CAAC,IAAI;AAAA,MAC5G;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACA,QAAM,UAAU,UAAU,4CAA4C,4BAA4B;AAClG,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,4CAA4C,+CAA+C;AAAA,IAC9G,OAAO,UAAU,0CAA0C,4BAA4B;AAAA,IACvF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,wCAAwC,sBAAsB;AAAA,IAC7E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,OAAK,UAAU;AAAA,IACb,IAAI,KAAK;AAAA,IACT;AAAA,IACA,OAAO,gCAAgC,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5D,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,wDAAwD,KAAK;AAAA,EAC7E,CAAC;AAED,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxD;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAE7D,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB;AAAA,EAC9E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": ["subject", "copy"]
 }

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js

@@ -7,7 +7,9 @@ import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { CrudForm } from "@open-mercato/ui/backend/CrudForm";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { Spinner } from "@open-mercato/ui/primitives/spinner";
-import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { surfaceRecordConflict } from "@open-mercato/ui/backend/conflicts";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { RecordNotFoundState, ErrorMessage } from "@open-mercato/ui/backend/detail";
@@ -213,12 +215,14 @@ function CustomerRoleDetailPage({ params }) {
       description: data.description || "",
       isDefault: data.isDefault,
       customerAssignable: data.customerAssignable,
-      features: data.features
+      features: data.features,
+      updatedAt: data.updatedAt ?? data.updated_at ?? null
     };
   }, [data]);
   const handleSubmit = React.useCallback(async (values) => {
     if (!id) return;
-    const roleCall = await apiCall(
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null);
+    const roleCall = await withScopedApiRequestHeaders(headers, () => apiCall(
       `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
       {
         method: "PUT",
@@ -230,8 +234,9 @@ function CustomerRoleDetailPage({ params }) {
           customerAssignable: values.customerAssignable
         })
       }
-    );
+    ));
     if (!roleCall.ok) {
+      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return;
       flash(t("customer_accounts.admin.roleDetail.error.save", "Failed to save role"), "error");
       return;
     }
@@ -250,20 +255,22 @@ function CustomerRoleDetailPage({ params }) {
     }
     flash(t("customer_accounts.admin.roleDetail.flash.saved", "Role updated"), "success");
     router.push("/backend/customer_accounts/roles");
-  }, [id, router, t]);
+  }, [data?.updatedAt, data?.updated_at, id, router, t]);
   const handleDelete = React.useCallback(async () => {
     if (!id) return;
-    const call = await apiCall(
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null);
+    const call = await withScopedApiRequestHeaders(headers, () => apiCall(
       `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
       { method: "DELETE" }
-    );
+    ));
     if (!call.ok) {
+      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return;
       flash(t("customer_accounts.admin.roles.error.delete", "Failed to delete role"), "error");
       return;
     }
     flash(t("customer_accounts.admin.roles.flash.deleted", "Role deleted"), "success");
     router.push("/backend/customer_accounts/roles");
-  }, [id, router, t]);
+  }, [data?.updatedAt, data?.updated_at, id, router, t]);
   if (isLoading) {
     return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsxs("div", { className: "flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground", children: [
       /* @__PURE__ */ jsx(Spinner, { className: "h-6 w-6" }),
@@ -297,6 +304,7 @@ function CustomerRoleDetailPage({ params }) {
       fields,
       groups,
       initialValues,
+      optimisticLockUpdatedAt: data.updatedAt ?? data.updated_at ?? null,
       entityId: "customer_accounts:customer_role",
       onSubmit: handleSubmit,
       onDelete: !data.isSystem ? handleDelete : void 0,

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/backend/customer_accounts/roles/%5Bid%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <input\n                  type=\"checkbox\"\n                  checked={allSelected}\n                  ref={(el) => { if (el) el.indeterminate = someSelected && !allSelected }}\n                  onChange={() => handleGroupToggle(groupFeatures)}\n                  className=\"rounded border-border\"\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <input\n                      type=\"checkbox\"\n                      checked={features.includes(featureId)}\n                      onChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5 rounded border-border\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n\n  React.useEffect(() => {\n    if (!id) {\n      setIsNotFound(true)\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      setIsNotFound(false)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        if ((err as { status?: number }).status === 404) {\n          setIsNotFound(true)\n        } else {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n          setError(message)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const roleCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          name: (values.name as string)?.trim(),\n          description: (values.description as string)?.trim() || null,\n          isDefault: values.isDefault,\n          customerAssignable: values.customerAssignable,\n        }),\n      },\n    )\n    if (!roleCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    const aclCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ features }),\n      },\n    )\n    if (!aclCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const call = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      { method: 'DELETE' },\n    )\n    if (!call.ok) {\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            backHref=\"/backend/customer_accounts/roles\"\n            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <ErrorMessage\n            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            action={\n              <Button asChild variant=\"outline\" size=\"sm\">\n                <Link href=\"/backend/customer_accounts/roles\">\n                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n                </Link>\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isSystem ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAsGc,cACA,YADA;AApGd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,qBAAqB,oBAAoB;AAalD,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAC1R;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,KAAK,CAAC,OAAO;AAAE,oBAAI,GAAI,IAAG,gBAAgB,gBAAgB,CAAC;AAAA,cAAY;AAAA,cACvE,UAAU,MAAM,kBAAkB,aAAa;AAAA,cAC/C,WAAU;AAAA;AAAA,UACZ;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,UAAU,MAAM,oBAAoB,SAAS;AAAA,cAC7C,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAZU,SAaZ;AAAA,MAEJ,CAAC,GACH;AAAA,SAlCQ,MAAM,EAmChB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AAExD,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,oBAAc,IAAI;AAClB,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,oBAAc,KAAK;AACnB,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAK,IAA4B,WAAW,KAAK;AAC/C,wBAAc,IAAI;AAAA,QACpB,OAAO;AACL,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,WAAW,MAAM;AAAA,MACrB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACrE,UAAM,UAAU,MAAM;AAAA,MACpB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,MAAM;AAAA,MACjB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB;AACA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qDAAqD,gBAAgB;AAAA,QAC9E,UAAS;AAAA,QACT,WAAW,EAAE,yDAAyD,eAAe;AAAA;AAAA,IACvF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS,EAAE,qDAAqD,gBAAgB;AAAA,QACvF,QACE,oBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA;AAAA,IAEJ,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,WAAW,eAAe;AAAA,MAC1C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n  updatedAt?: string | null\n  updated_at?: string | null\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <input\n                  type=\"checkbox\"\n                  checked={allSelected}\n                  ref={(el) => { if (el) el.indeterminate = someSelected && !allSelected }}\n                  onChange={() => handleGroupToggle(groupFeatures)}\n                  className=\"rounded border-border\"\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <input\n                      type=\"checkbox\"\n                      checked={features.includes(featureId)}\n                      onChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5 rounded border-border\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n\n  React.useEffect(() => {\n    if (!id) {\n      setIsNotFound(true)\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      setIsNotFound(false)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        if ((err as { status?: number }).status === 404) {\n          setIsNotFound(true)\n        } else {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n          setError(message)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n      updatedAt: data.updatedAt ?? data.updated_at ?? null,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const roleCall = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        {\n          method: 'PUT',\n          headers: { 'content-type': 'application/json' },\n          body: JSON.stringify({\n            name: (values.name as string)?.trim(),\n            description: (values.description as string)?.trim() || null,\n            isDefault: values.isDefault,\n            customerAssignable: values.customerAssignable,\n          }),\n        },\n      )\n    ))\n    if (!roleCall.ok) {\n      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    const aclCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ features }),\n      },\n    )\n    if (!aclCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)\n    const call = await withScopedApiRequestHeaders(headers, () => (\n      apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n        { method: 'DELETE' },\n      )\n    ))\n    if (!call.ok) {\n      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [data?.updatedAt, data?.updated_at, id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            backHref=\"/backend/customer_accounts/roles\"\n            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <ErrorMessage\n            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            action={\n              <Button asChild variant=\"outline\" size=\"sm\">\n                <Link href=\"/backend/customer_accounts/roles\">\n                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n                </Link>\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          optimisticLockUpdatedAt={data.updatedAt ?? data.updated_at ?? null}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isSystem ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AA0Gc,cACA,YADA;AAxGd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,6BAA6B;AACtC,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,qBAAqB,oBAAoB;AAelD,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAC1R;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,KAAK,CAAC,OAAO;AAAE,oBAAI,GAAI,IAAG,gBAAgB,gBAAgB,CAAC;AAAA,cAAY;AAAA,cACvE,UAAU,MAAM,kBAAkB,aAAa;AAAA,cAC/C,WAAU;AAAA;AAAA,UACZ;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,UAAU,MAAM,oBAAoB,SAAS;AAAA,cAC7C,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAZU,SAaZ;AAAA,MAEJ,CAAC,GACH;AAAA,SAlCQ,MAAM,EAmChB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AAExD,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,oBAAc,IAAI;AAClB,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,oBAAc,KAAK;AACnB,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAK,IAA4B,WAAW,KAAK;AAC/C,wBAAc,IAAI;AAAA,QACpB,OAAO;AACL,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,MACf,WAAW,KAAK,aAAa,KAAK,cAAc;AAAA,IAClD;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,WAAW,MAAM,4BAA4B,SAAS,MAC1D;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF,CACD;AACD,QAAI,CAAC,SAAS,IAAI;AAChB,UAAI,sBAAsB,EAAE,QAAQ,SAAS,QAAQ,MAAM,SAAS,OAAO,GAAG,CAAC,EAAG;AAClF,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACrE,UAAM,UAAU,MAAM;AAAA,MACpB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,UAAU,0BAA0B,MAAM,aAAa,MAAM,cAAc,IAAI;AACrF,UAAM,OAAO,MAAM,4BAA4B,SAAS,MACtD;AAAA,MACE,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB,CACD;AACD,QAAI,CAAC,KAAK,IAAI;AACZ,UAAI,sBAAsB,EAAE,QAAQ,KAAK,QAAQ,MAAM,KAAK,OAAO,GAAG,CAAC,EAAG;AAC1E,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,MAAM,WAAW,MAAM,YAAY,IAAI,QAAQ,CAAC,CAAC;AAErD,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qDAAqD,gBAAgB;AAAA,QAC9E,UAAS;AAAA,QACT,WAAW,EAAE,yDAAyD,eAAe;AAAA;AAAA,IACvF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS,EAAE,qDAAqD,gBAAgB;AAAA,QACvF,QACE,oBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA;AAAA,IAEJ,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB,KAAK,aAAa,KAAK,cAAc;AAAA,MAC9D,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,WAAW,eAAe;AAAA,MAC1C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/roles/page.js

@@ -6,11 +6,14 @@ import { useRouter } from "next/navigation";
 import { Page, PageBody } from "@open-mercato/ui/backend/Page";
 import { DataTable } from "@open-mercato/ui/backend/DataTable";
 import { Button } from "@open-mercato/ui/primitives/button";
+import { Badge } from "@open-mercato/ui/primitives/badge";
 import { RowActions } from "@open-mercato/ui/backend/RowActions";
-import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
+import { ListEmptyState } from "@open-mercato/ui/backend/filters/ListEmptyState";
 function CustomerRolesPage() {
   const { confirm, ConfirmDialogElement } = useConfirmDialog();
   const t = useT();
@@ -71,9 +74,12 @@ function CustomerRolesPage() {
     });
     if (!confirmed) return;
     try {
-      const call = await apiCall(
-        `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
-        { method: "DELETE" }
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(role.updatedAt),
+        () => apiCall(
+          `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
+          { method: "DELETE" }
+        )
       );
       if (!call.ok) {
         flash(t("customer_accounts.admin.roles.error.delete", "Failed to delete role"), "error");
@@ -122,7 +128,7 @@ function CustomerRolesPage() {
     {
       accessorKey: "customerAssignable",
       header: t("customer_accounts.admin.roles.columns.customerAssignable", "Self-assignable"),
-      cell: ({ row }) => row.original.customerAssignable ? /* @__PURE__ */ jsx("span", { className: "inline-flex items-center rounded-full bg-purple-100 px-2 py-0.5 text-xs font-medium text-purple-800 dark:bg-purple-900 dark:text-purple-200", children: t("customer_accounts.admin.roles.assignable", "Yes") }) : /* @__PURE__ */ jsx("span", { className: "text-muted-foreground text-sm", children: t("customer_accounts.admin.roles.notAssignable", "No") })
+      cell: ({ row }) => row.original.customerAssignable ? /* @__PURE__ */ jsx(Badge, { variant: "brand", children: t("customer_accounts.admin.roles.assignable", "Yes") }) : /* @__PURE__ */ jsx("span", { className: "text-muted-foreground text-sm", children: t("customer_accounts.admin.roles.notAssignable", "No") })
     }
   ], [t]);
   return /* @__PURE__ */ jsxs(Page, { children: [
@@ -140,6 +146,14 @@ function CustomerRolesPage() {
         },
         searchPlaceholder: t("customer_accounts.admin.roles.searchPlaceholder", "Search roles..."),
         perspective: { tableId: "customer_accounts.admin.roles" },
+        emptyState: /* @__PURE__ */ jsx(
+          ListEmptyState,
+          {
+            entityName: t("customer_accounts.admin.roles.title", "Customer Roles"),
+            createHref: "/backend/customer_accounts/roles/create",
+            createLabel: t("customer_accounts.admin.roles.actions.create", "Create Role")
+          }
+        ),
         onRowClick: (row) => router.push(`/backend/customer_accounts/roles/${row.id}`),
         rowActions: (row) => /* @__PURE__ */ jsx(
           RowActions,

package/dist/modules/customer_accounts/backend/customer_accounts/roles/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\n\ntype RoleRow = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isSystem: boolean\n  isDefault: boolean\n  customerAssignable: boolean\n  createdAt: string\n}\n\ntype RolesResponse = {\n  items?: RoleRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function CustomerRolesPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<RoleRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    return params.toString()\n  }, [page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: RolesResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<RolesResponse>(\n          `/api/customer_accounts/admin/roles?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roles.error.load', 'Failed to load roles'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.load', 'Failed to load roles')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleDelete = React.useCallback(async (role: RoleRow) => {\n    if (role.isSystem) {\n      flash(t('customer_accounts.admin.roles.error.deleteSystem', 'System roles cannot be deleted'), 'error')\n      return\n    }\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.roles.confirm.delete', 'Delete role \"{{name}}\"?', { name: role.name }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await apiCall(\n        `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,\n        { method: 'DELETE' },\n      )\n      if (!call.ok) {\n        flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n        return\n      }\n      flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.delete', 'Failed to delete role')\n      flash(message, 'error')\n    }\n  }, [confirm, t])\n\n  const columns = React.useMemo<ColumnDef<RoleRow>[]>(() => [\n    {\n      accessorKey: 'name',\n      header: t('customer_accounts.admin.roles.columns.name', 'Name'),\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/customer_accounts/roles/${row.original.id}`}\n          className=\"font-medium hover:underline\"\n        >\n          {row.original.name}\n        </Link>\n      ),\n    },\n    {\n      accessorKey: 'slug',\n      header: t('customer_accounts.admin.roles.columns.slug', 'Slug'),\n      cell: ({ row }) => (\n        <code className=\"rounded bg-muted px-1.5 py-0.5 text-xs\">{row.original.slug}</code>\n      ),\n    },\n    {\n      accessorKey: 'description',\n      header: t('customer_accounts.admin.roles.columns.description', 'Description'),\n      cell: ({ row }) => row.original.description || <span className=\"text-muted-foreground\">-</span>,\n    },\n    {\n      accessorKey: 'isSystem',\n      header: t('customer_accounts.admin.roles.columns.isSystem', 'System'),\n      cell: ({ row }) => (\n        row.original.isSystem ? (\n          <span className=\"inline-flex items-center rounded-full bg-status-info-bg px-2 py-0.5 text-xs font-medium text-status-info-text\">\n            {t('customer_accounts.admin.roles.system', 'System')}\n          </span>\n        ) : null\n      ),\n    },\n    {\n      accessorKey: 'isDefault',\n      header: t('customer_accounts.admin.roles.columns.isDefault', 'Default'),\n      cell: ({ row }) => (\n        row.original.isDefault ? (\n          <span className=\"inline-flex items-center rounded-full bg-status-success-bg px-2 py-0.5 text-xs font-medium text-status-success-text\">\n            {t('customer_accounts.admin.roles.default', 'Default')}\n          </span>\n        ) : null\n      ),\n    },\n    {\n      accessorKey: 'customerAssignable',\n      header: t('customer_accounts.admin.roles.columns.customerAssignable', 'Self-assignable'),\n      cell: ({ row }) => (\n        row.original.customerAssignable ? (\n          <span className=\"inline-flex items-center rounded-full bg-purple-100 px-2 py-0.5 text-xs font-medium text-purple-800 dark:bg-purple-900 dark:text-purple-200\">\n            {t('customer_accounts.admin.roles.assignable', 'Yes')}\n          </span>\n        ) : (\n          <span className=\"text-muted-foreground text-sm\">\n            {t('customer_accounts.admin.roles.notAssignable', 'No')}\n          </span>\n        )\n      ),\n    },\n  ], [t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<RoleRow>\n          title={t('customer_accounts.admin.roles.title', 'Customer Roles')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/customer_accounts/roles/create\">\n                {t('customer_accounts.admin.roles.actions.create', 'Create Role')}\n              </Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          searchPlaceholder={t('customer_accounts.admin.roles.searchPlaceholder', 'Search roles...')}\n          perspective={{ tableId: 'customer_accounts.admin.roles' }}\n          onRowClick={(row) => router.push(`/backend/customer_accounts/roles/${row.id}`)}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'edit',\n                  label: t('customer_accounts.admin.roles.actions.edit', 'Edit'),\n                  onSelect: () => { router.push(`/backend/customer_accounts/roles/${row.id}`) },\n                },\n                ...(!row.isSystem ? [{\n                  id: 'delete',\n                  label: t('customer_accounts.admin.roles.actions.delete', 'Delete'),\n                  destructive: true,\n                  onSelect: () => { void handleDelete(row) },\n                }] : []),\n              ]}\n            />\n          )}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAkHQ,cA4DJ,YA5DI;AAhHR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,cAAc;AACvB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AAmBlB,SAAR,oBAAqC;AAC1C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AAEtD,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,MAAM,UAAU,MAAM,CAAC;AAE3B,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,4CAA4C,sBAAsB,GAAG,SAAS;AAAA,QAClG;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAAA,MAChF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,4CAA4C,sBAAsB;AACzH,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,QAAI,KAAK,UAAU;AACjB,YAAM,EAAE,oDAAoD,gCAAgC,GAAG,OAAO;AACtG;AAAA,IACF;AACA,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,2BAA2B,EAAE,MAAM,KAAK,KAAK,CAAC;AAAA,MACvG,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,QACjE,EAAE,QAAQ,SAAS;AAAA,MACrB;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,MACF;AACA,YAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,uBAAuB;AAC5H,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM,QAA8B,MAAM;AAAA,IACxD;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,8CAA8C,MAAM;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,UACzD,WAAU;AAAA,UAET,cAAI,SAAS;AAAA;AAAA,MAChB;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,8CAA8C,MAAM;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,0CAA0C,cAAI,SAAS,MAAK;AAAA,IAEhF;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,qDAAqD,aAAa;AAAA,MAC5E,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,eAAe,oBAAC,UAAK,WAAU,yBAAwB,eAAC;AAAA,IAC1F;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,kDAAkD,QAAQ;AAAA,MACpE,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,UAAK,WAAU,iHACb,YAAE,wCAAwC,QAAQ,GACrD,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mDAAmD,SAAS;AAAA,MACtE,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,YACX,oBAAC,UAAK,WAAU,uHACb,YAAE,yCAAyC,SAAS,GACvD,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,4DAA4D,iBAAiB;AAAA,MACvF,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,qBACX,oBAAC,UAAK,WAAU,+IACb,YAAE,4CAA4C,KAAK,GACtD,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,+CAA+C,IAAI,GACxD;AAAA,IAGN;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,uCAAuC,gBAAgB;AAAA,QAChE,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,2CACR,YAAE,gDAAgD,aAAa,GAClE,GACF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,mDAAmD,iBAAiB;AAAA,QACzF,aAAa,EAAE,SAAS,gCAAgC;AAAA,QACxD,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,QAC7E,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,8CAA8C,MAAM;AAAA,gBAC7D,UAAU,MAAM;AAAE,yBAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,gBAAE;AAAA,cAC9E;AAAA,cACA,GAAI,CAAC,IAAI,WAAW,CAAC;AAAA,gBACnB,IAAI;AAAA,gBACJ,OAAO,EAAE,gDAAgD,QAAQ;AAAA,gBACjE,aAAa;AAAA,gBACb,UAAU,MAAM;AAAE,uBAAK,aAAa,GAAG;AAAA,gBAAE;AAAA,cAC3C,CAAC,IAAI,CAAC;AAAA,YACR;AAAA;AAAA,QACF;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,QACvE;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { DataTable } from '@open-mercato/ui/backend/DataTable'\nimport type { ColumnDef } from '@tanstack/react-table'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Badge } from '@open-mercato/ui/primitives/badge'\nimport { RowActions } from '@open-mercato/ui/backend/RowActions'\nimport { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'\nimport { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'\n\ntype RoleRow = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isSystem: boolean\n  isDefault: boolean\n  customerAssignable: boolean\n  createdAt: string\n  updatedAt?: string | null\n}\n\ntype RolesResponse = {\n  items?: RoleRow[]\n  total?: number\n  totalPages?: number\n}\n\nexport default function CustomerRolesPage() {\n  const { confirm, ConfirmDialogElement } = useConfirmDialog()\n  const t = useT()\n  const router = useRouter()\n  const [rows, setRows] = React.useState<RoleRow[]>([])\n  const [page, setPage] = React.useState(1)\n  const [pageSize] = React.useState(50)\n  const [total, setTotal] = React.useState(0)\n  const [totalPages, setTotalPages] = React.useState(1)\n  const [search, setSearch] = React.useState('')\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [reloadToken, setReloadToken] = React.useState(0)\n\n  const queryParams = React.useMemo(() => {\n    const params = new URLSearchParams()\n    params.set('page', String(page))\n    params.set('pageSize', String(pageSize))\n    if (search.trim()) params.set('search', search.trim())\n    return params.toString()\n  }, [page, pageSize, search])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      try {\n        const fallback: RolesResponse = { items: [], total: 0, totalPages: 1 }\n        const payload = await readApiResultOrThrow<RolesResponse>(\n          `/api/customer_accounts/admin/roles?${queryParams}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roles.error.load', 'Failed to load roles'), fallback },\n        )\n        if (cancelled) return\n        const items = Array.isArray(payload?.items) ? payload.items : []\n        setRows(items)\n        setTotal(typeof payload?.total === 'number' ? payload.total : items.length)\n        setTotalPages(typeof payload?.totalPages === 'number' ? payload.totalPages : 1)\n      } catch (err) {\n        if (!cancelled) {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.load', 'Failed to load roles')\n          flash(message, 'error')\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [queryParams, reloadToken, t])\n\n  const handleDelete = React.useCallback(async (role: RoleRow) => {\n    if (role.isSystem) {\n      flash(t('customer_accounts.admin.roles.error.deleteSystem', 'System roles cannot be deleted'), 'error')\n      return\n    }\n    const confirmed = await confirm({\n      title: t('customer_accounts.admin.roles.confirm.delete', 'Delete role \"{{name}}\"?', { name: role.name }),\n      variant: 'destructive',\n    })\n    if (!confirmed) return\n    try {\n      const call = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(role.updatedAt),\n        () => apiCall(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,\n          { method: 'DELETE' },\n        ),\n      )\n      if (!call.ok) {\n        flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n        return\n      }\n      flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n      setReloadToken((token) => token + 1)\n    } catch (err) {\n      const message = err instanceof Error ? err.message : t('customer_accounts.admin.roles.error.delete', 'Failed to delete role')\n      flash(message, 'error')\n    }\n  }, [confirm, t])\n\n  const columns = React.useMemo<ColumnDef<RoleRow>[]>(() => [\n    {\n      accessorKey: 'name',\n      header: t('customer_accounts.admin.roles.columns.name', 'Name'),\n      cell: ({ row }) => (\n        <Link\n          href={`/backend/customer_accounts/roles/${row.original.id}`}\n          className=\"font-medium hover:underline\"\n        >\n          {row.original.name}\n        </Link>\n      ),\n    },\n    {\n      accessorKey: 'slug',\n      header: t('customer_accounts.admin.roles.columns.slug', 'Slug'),\n      cell: ({ row }) => (\n        <code className=\"rounded bg-muted px-1.5 py-0.5 text-xs\">{row.original.slug}</code>\n      ),\n    },\n    {\n      accessorKey: 'description',\n      header: t('customer_accounts.admin.roles.columns.description', 'Description'),\n      cell: ({ row }) => row.original.description || <span className=\"text-muted-foreground\">-</span>,\n    },\n    {\n      accessorKey: 'isSystem',\n      header: t('customer_accounts.admin.roles.columns.isSystem', 'System'),\n      cell: ({ row }) => (\n        row.original.isSystem ? (\n          <span className=\"inline-flex items-center rounded-full bg-status-info-bg px-2 py-0.5 text-xs font-medium text-status-info-text\">\n            {t('customer_accounts.admin.roles.system', 'System')}\n          </span>\n        ) : null\n      ),\n    },\n    {\n      accessorKey: 'isDefault',\n      header: t('customer_accounts.admin.roles.columns.isDefault', 'Default'),\n      cell: ({ row }) => (\n        row.original.isDefault ? (\n          <span className=\"inline-flex items-center rounded-full bg-status-success-bg px-2 py-0.5 text-xs font-medium text-status-success-text\">\n            {t('customer_accounts.admin.roles.default', 'Default')}\n          </span>\n        ) : null\n      ),\n    },\n    {\n      accessorKey: 'customerAssignable',\n      header: t('customer_accounts.admin.roles.columns.customerAssignable', 'Self-assignable'),\n      cell: ({ row }) => (\n        row.original.customerAssignable ? (\n          <Badge variant=\"brand\">\n            {t('customer_accounts.admin.roles.assignable', 'Yes')}\n          </Badge>\n        ) : (\n          <span className=\"text-muted-foreground text-sm\">\n            {t('customer_accounts.admin.roles.notAssignable', 'No')}\n          </span>\n        )\n      ),\n    },\n  ], [t])\n\n  return (\n    <Page>\n      <PageBody>\n        <DataTable<RoleRow>\n          title={t('customer_accounts.admin.roles.title', 'Customer Roles')}\n          actions={(\n            <Button asChild>\n              <Link href=\"/backend/customer_accounts/roles/create\">\n                {t('customer_accounts.admin.roles.actions.create', 'Create Role')}\n              </Link>\n            </Button>\n          )}\n          columns={columns}\n          data={rows}\n          searchValue={search}\n          onSearchChange={(value) => { setSearch(value); setPage(1) }}\n          searchPlaceholder={t('customer_accounts.admin.roles.searchPlaceholder', 'Search roles...')}\n          perspective={{ tableId: 'customer_accounts.admin.roles' }}\n          emptyState={(\n            <ListEmptyState\n              entityName={t('customer_accounts.admin.roles.title', 'Customer Roles')}\n              createHref=\"/backend/customer_accounts/roles/create\"\n              createLabel={t('customer_accounts.admin.roles.actions.create', 'Create Role')}\n            />\n          )}\n          onRowClick={(row) => router.push(`/backend/customer_accounts/roles/${row.id}`)}\n          rowActions={(row) => (\n            <RowActions\n              items={[\n                {\n                  id: 'edit',\n                  label: t('customer_accounts.admin.roles.actions.edit', 'Edit'),\n                  onSelect: () => { router.push(`/backend/customer_accounts/roles/${row.id}`) },\n                },\n                ...(!row.isSystem ? [{\n                  id: 'delete',\n                  label: t('customer_accounts.admin.roles.actions.delete', 'Delete'),\n                  destructive: true,\n                  onSelect: () => { void handleDelete(row) },\n                }] : []),\n              ]}\n            />\n          )}\n          pagination={{ page, pageSize, total, totalPages, onPageChange: setPage }}\n          isLoading={isLoading}\n        />\n      </PageBody>\n      {ConfirmDialogElement}\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAyHQ,cA4DJ,YA5DI;AAvHR,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,iBAAiB;AAE1B,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,SAAS,sBAAsB,mCAAmC;AAC3E,SAAS,iCAAiC;AAC1C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,wBAAwB;AACjC,SAAS,sBAAsB;AAoBhB,SAAR,oBAAqC;AAC1C,QAAM,EAAE,SAAS,qBAAqB,IAAI,iBAAiB;AAC3D,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAoB,CAAC,CAAC;AACpD,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAAS,CAAC;AACxC,QAAM,CAAC,QAAQ,IAAI,MAAM,SAAS,EAAE;AACpC,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,CAAC;AAC1C,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,CAAC;AACpD,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,EAAE;AAC7C,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,CAAC;AAEtD,QAAM,cAAc,MAAM,QAAQ,MAAM;AACtC,UAAM,SAAS,IAAI,gBAAgB;AACnC,WAAO,IAAI,QAAQ,OAAO,IAAI,CAAC;AAC/B,WAAO,IAAI,YAAY,OAAO,QAAQ,CAAC;AACvC,QAAI,OAAO,KAAK,EAAG,QAAO,IAAI,UAAU,OAAO,KAAK,CAAC;AACrD,WAAO,OAAO,SAAS;AAAA,EACzB,GAAG,CAAC,MAAM,UAAU,MAAM,CAAC;AAE3B,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,UAAI;AACF,cAAM,WAA0B,EAAE,OAAO,CAAC,GAAG,OAAO,GAAG,YAAY,EAAE;AACrE,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,WAAW;AAAA,UACjD;AAAA,UACA,EAAE,cAAc,EAAE,4CAA4C,sBAAsB,GAAG,SAAS;AAAA,QAClG;AACA,YAAI,UAAW;AACf,cAAM,QAAQ,MAAM,QAAQ,SAAS,KAAK,IAAI,QAAQ,QAAQ,CAAC;AAC/D,gBAAQ,KAAK;AACb,iBAAS,OAAO,SAAS,UAAU,WAAW,QAAQ,QAAQ,MAAM,MAAM;AAC1E,sBAAc,OAAO,SAAS,eAAe,WAAW,QAAQ,aAAa,CAAC;AAAA,MAChF,SAAS,KAAK;AACZ,YAAI,CAAC,WAAW;AACd,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,4CAA4C,sBAAsB;AACzH,gBAAM,SAAS,OAAO;AAAA,QACxB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,aAAa,aAAa,CAAC,CAAC;AAEhC,QAAM,eAAe,MAAM,YAAY,OAAO,SAAkB;AAC9D,QAAI,KAAK,UAAU;AACjB,YAAM,EAAE,oDAAoD,gCAAgC,GAAG,OAAO;AACtG;AAAA,IACF;AACA,UAAM,YAAY,MAAM,QAAQ;AAAA,MAC9B,OAAO,EAAE,gDAAgD,2BAA2B,EAAE,MAAM,KAAK,KAAK,CAAC;AAAA,MACvG,SAAS;AAAA,IACX,CAAC;AACD,QAAI,CAAC,UAAW;AAChB,QAAI;AACF,YAAM,OAAO,MAAM;AAAA,QACjB,0BAA0B,KAAK,SAAS;AAAA,QACxC,MAAM;AAAA,UACJ,sCAAsC,mBAAmB,KAAK,EAAE,CAAC;AAAA,UACjE,EAAE,QAAQ,SAAS;AAAA,QACrB;AAAA,MACF;AACA,UAAI,CAAC,KAAK,IAAI;AACZ,cAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,MACF;AACA,YAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,qBAAe,CAAC,UAAU,QAAQ,CAAC;AAAA,IACrC,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,8CAA8C,uBAAuB;AAC5H,YAAM,SAAS,OAAO;AAAA,IACxB;AAAA,EACF,GAAG,CAAC,SAAS,CAAC,CAAC;AAEf,QAAM,UAAU,MAAM,QAA8B,MAAM;AAAA,IACxD;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,8CAA8C,MAAM;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX;AAAA,QAAC;AAAA;AAAA,UACC,MAAM,oCAAoC,IAAI,SAAS,EAAE;AAAA,UACzD,WAAU;AAAA,UAET,cAAI,SAAS;AAAA;AAAA,MAChB;AAAA,IAEJ;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,8CAA8C,MAAM;AAAA,MAC9D,MAAM,CAAC,EAAE,IAAI,MACX,oBAAC,UAAK,WAAU,0CAA0C,cAAI,SAAS,MAAK;AAAA,IAEhF;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,qDAAqD,aAAa;AAAA,MAC5E,MAAM,CAAC,EAAE,IAAI,MAAM,IAAI,SAAS,eAAe,oBAAC,UAAK,WAAU,yBAAwB,eAAC;AAAA,IAC1F;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,kDAAkD,QAAQ;AAAA,MACpE,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,WACX,oBAAC,UAAK,WAAU,iHACb,YAAE,wCAAwC,QAAQ,GACrD,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,mDAAmD,SAAS;AAAA,MACtE,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,YACX,oBAAC,UAAK,WAAU,uHACb,YAAE,yCAAyC,SAAS,GACvD,IACE;AAAA,IAER;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,QAAQ,EAAE,4DAA4D,iBAAiB;AAAA,MACvF,MAAM,CAAC,EAAE,IAAI,MACX,IAAI,SAAS,qBACX,oBAAC,SAAM,SAAQ,SACZ,YAAE,4CAA4C,KAAK,GACtD,IAEA,oBAAC,UAAK,WAAU,iCACb,YAAE,+CAA+C,IAAI,GACxD;AAAA,IAGN;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,SACE,qBAAC,QACC;AAAA,wBAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,uCAAuC,gBAAgB;AAAA,QAChE,SACE,oBAAC,UAAO,SAAO,MACb,8BAAC,QAAK,MAAK,2CACR,YAAE,gDAAgD,aAAa,GAClE,GACF;AAAA,QAEF;AAAA,QACA,MAAM;AAAA,QACN,aAAa;AAAA,QACb,gBAAgB,CAAC,UAAU;AAAE,oBAAU,KAAK;AAAG,kBAAQ,CAAC;AAAA,QAAE;AAAA,QAC1D,mBAAmB,EAAE,mDAAmD,iBAAiB;AAAA,QACzF,aAAa,EAAE,SAAS,gCAAgC;AAAA,QACxD,YACE;AAAA,UAAC;AAAA;AAAA,YACC,YAAY,EAAE,uCAAuC,gBAAgB;AAAA,YACrE,YAAW;AAAA,YACX,aAAa,EAAE,gDAAgD,aAAa;AAAA;AAAA,QAC9E;AAAA,QAEF,YAAY,CAAC,QAAQ,OAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,QAC7E,YAAY,CAAC,QACX;AAAA,UAAC;AAAA;AAAA,YACC,OAAO;AAAA,cACL;AAAA,gBACE,IAAI;AAAA,gBACJ,OAAO,EAAE,8CAA8C,MAAM;AAAA,gBAC7D,UAAU,MAAM;AAAE,yBAAO,KAAK,oCAAoC,IAAI,EAAE,EAAE;AAAA,gBAAE;AAAA,cAC9E;AAAA,cACA,GAAI,CAAC,IAAI,WAAW,CAAC;AAAA,gBACnB,IAAI;AAAA,gBACJ,OAAO,EAAE,gDAAgD,QAAQ;AAAA,gBACjE,aAAa;AAAA,gBACb,UAAU,MAAM;AAAE,uBAAK,aAAa,GAAG;AAAA,gBAAE;AAAA,cAC3C,CAAC,IAAI,CAAC;AAAA,YACR;AAAA;AAAA,QACF;AAAA,QAEF,YAAY,EAAE,MAAM,UAAU,OAAO,YAAY,cAAc,QAAQ;AAAA,QACvE;AAAA;AAAA,IACF,GACF;AAAA,IACC;AAAA,KACH;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/page.js

@@ -8,7 +8,8 @@ import { FormHeader } from "@open-mercato/ui/backend/forms";
 import { EmptyState } from "@open-mercato/ui/backend/EmptyState";
 import { LoadingMessage, ErrorMessage } from "@open-mercato/ui/backend/detail";
 import { Button } from "@open-mercato/ui/primitives/button";
-import { apiCall } from "@open-mercato/ui/backend/utils/apiCall";
+import { apiCall, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
+import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
@@ -260,9 +261,12 @@ function CustomerDomainSettingsPage() {
       setIsMutating(true);
       try {
         await runMutationWithContext(async () => {
-          const call = await apiCall(
-            `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
-            { method: "DELETE" }
+          const call = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(mapping.updatedAt),
+            () => apiCall(
+              `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
+              { method: "DELETE" }
+            )
           );
           if (!call.ok || !call.result?.ok) {
             const message = call.result?.error || t("customer_accounts.domainMapping.error.load", "Could not load custom-domain configuration");