@open-mercato/core 0.6.4-develop.4382.1.6b4f656b77 → 0.6.4

package/src/modules/messages/data/validators.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
+import { sanitizeRichTextHref } from '@open-mercato/shared/lib/html/sanitizeRichText'
 
 function collectDuplicateRecipientIds(
   recipients: Array<{ userId: string }>,
@@ -80,7 +81,13 @@ export const messageActionSchema = z.object({
   variant: z.enum(['default', 'secondary', 'destructive', 'outline', 'ghost']).optional(),
   icon: z.string().optional(),
   commandId: z.string().optional(),
-  href: z.string().optional(),
+  href: z
+    .string()
+    .optional()
+    .refine(
+      (value) => value == null || sanitizeRichTextHref(value) != null,
+      { message: '[internal] message action href must be http(s), mailto, tel, or a relative path' },
+    ),
   isTerminal: z.boolean().optional(),
   confirmRequired: z.boolean().optional(),
   confirmMessage: z.string().optional(),

package/src/modules/messages/lib/actions.ts

@@ -1,4 +1,5 @@
 import { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
+import { sanitizeRichTextHref } from '@open-mercato/shared/lib/html/sanitizeRichText'
 import type { Message, MessageAction, MessageActionData, MessageObject } from '../data/entities'
 import { getMessageObjectType } from './message-objects-registry'
 import { getMessageType } from './message-types-registry'
@@ -203,11 +204,15 @@ function buildTemplateContext(
   }
 }
 
-function resolveTemplateString(template: string, context: Record<string, unknown>): string {
+function resolveTemplateString(
+  template: string,
+  context: Record<string, unknown>,
+  encodeValue: (value: string) => string = (value) => value,
+): string {
   return template.replace(/\{([a-zA-Z0-9_]+)\}/g, (fullMatch, key: string) => {
     const value = context[key]
     if (value == null) return fullMatch
-    return String(value)
+    return encodeValue(String(value))
   })
 }
 
@@ -218,7 +223,8 @@ export function resolveActionHref(
 ): string | null {
   if (!action.href) return null
   const context = buildTemplateContext(message, resolutionContext, action.objectRef)
-  return resolveTemplateString(action.href, context)
+  const resolved = resolveTemplateString(action.href, context, encodeURIComponent)
+  return sanitizeRichTextHref(resolved)
 }
 
 export function resolveActionCommandInput(

package/src/modules/messages/migrations/.snapshot-open-mercato.json

@@ -270,6 +270,15 @@
           "nullable": true,
           "mappedType": "text"
         },
+        "idempotency_key": {
+          "name": "idempotency_key",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
         "external_name": {
           "name": "external_name",
           "type": "text",
@@ -365,6 +374,15 @@
           "primary": false,
           "unique": false
         },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "messages_idempotency_key_uq",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"messages_idempotency_key_uq\" on \"messages\" (\"tenant_id\", \"idempotency_key\") where \"idempotency_key\" is not null"
+        },
         {
           "keyName": "messages_pkey",
           "columnNames": [

package/src/modules/messages/migrations/Migration20260531130000.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260531130000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "messages" add column if not exists "idempotency_key" text null;`);
+    this.addSql(`create unique index if not exists "messages_idempotency_key_uq" on "messages" ("tenant_id", "idempotency_key") where "idempotency_key" is not null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "messages_idempotency_key_uq";`);
+    this.addSql(`alter table "messages" drop column if exists "idempotency_key";`);
+  }
+
+}

package/src/modules/messages/widgets/injection-table.ts

@@ -0,0 +1,29 @@
+import type { ModuleInjectionTable } from '@open-mercato/shared/modules/widgets/injection'
+
+/**
+ * Messages module — widget injection table.
+ *
+ * The messages module currently does not register any widgets INTO other modules' spots.
+ * This file exists primarily to document the spots the messages module EXPOSES for other
+ * modules to inject into. The actual `<InjectionSpot>` placements live in the messages
+ * pages themselves (see `components/MessagesInboxPageClient.tsx`,
+ * `components/MessageDetailPageClient.tsx`, `components/ComposeMessagePageClient.tsx`).
+ *
+ * Exposed spot IDs (additive contract per BACKWARD_COMPATIBILITY.md §6):
+ *   - `data-table:messages:columns`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:row-actions`          — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:bulk-actions`         — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:filters`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:search-trailing`      — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `data-table:messages:toolbar`              — auto-wired by `DataTable extensionTableId="messages"`
+ *   - `detail:messages:message:body:after`       — placed in `MessageDetailPageClient.tsx`
+ *   - `detail:messages:message:sidebar`          — placed in `MessageDetailPageClient.tsx`
+ *   - `crud-form:messages:message:fields`        — placed in `ComposeMessagePageClient.tsx` as a standalone widget mount above the composer (NOT CrudForm field resolution; the compose page is not a CrudForm)
+ *
+ * The `communication_channels` hub (SPEC-045d) is the primary consumer of these spots,
+ * injecting channel badges, channel payload renderers, reaction bars, channel info
+ * sidebars, and composer capability adapters.
+ */
+export const injectionTable: ModuleInjectionTable = {}
+
+export default injectionTable

package/src/modules/notifications/api/[id]/action/route.ts

@@ -1,6 +1,10 @@
 import { executeActionSchema } from '../../../data/validators'
 import { actionResultResponseSchema, errorResponseSchema } from '../../openapi'
-import { resolveNotificationContext } from '../../../lib/routeHelpers'
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext,
+} from '../../../lib/routeHelpers'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 
 export const metadata = {
@@ -12,7 +16,11 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
   const { service, scope } = await resolveNotificationContext(req)
 
   const body = await req.json().catch(() => ({}))
-  const input = executeActionSchema.parse(body)
+  const parsed = executeActionSchema.safeParse(body)
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error)
+  }
+  const input = parsed.data
 
   try {
     const { notification, result } = await service.executeAction(id, input, scope)
@@ -26,6 +34,9 @@ export async function POST(req: Request, { params }: { params: Promise<{ id: str
       href,
     })
   } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error)
+    if (errorResponse) return errorResponse
+
     const { t } = await resolveTranslations()
     const fallback = t('notifications.error.action', 'Failed to execute action')
     const message = error instanceof Error && error.message ? error.message : fallback

package/src/modules/notifications/api/route.ts

@@ -3,7 +3,11 @@ import type { EntityManager } from '@mikro-orm/core'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
-import { resolveNotificationContext } from '../lib/routeHelpers'
+import {
+  notificationCrudErrorResponse,
+  notificationValidationErrorResponse,
+  resolveNotificationContext,
+} from '../lib/routeHelpers'
 import {
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
@@ -73,11 +77,20 @@ export async function POST(req: Request) {
   const { service, scope } = await resolveNotificationContext(req)
 
   const body = await req.json().catch(() => ({}))
-  const input = createNotificationSchema.parse(body)
+  const parsed = createNotificationSchema.safeParse(body)
+  if (!parsed.success) {
+    return notificationValidationErrorResponse(parsed.error)
+  }
 
-  const notification = await service.create(input, scope)
+  try {
+    const notification = await service.create(parsed.data, scope)
 
-  return Response.json({ id: notification.id }, { status: 201 })
+    return Response.json({ id: notification.id }, { status: 201 })
+  } catch (error) {
+    const errorResponse = notificationCrudErrorResponse(error)
+    if (errorResponse) return errorResponse
+    throw error
+  }
 }
 
 export const openApi = buildNotificationsCrudOpenApi({

package/src/modules/notifications/lib/notificationService.ts

@@ -1,10 +1,11 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql } from 'kysely'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   buildNotificationEntity,
   emitNotificationCreated,
@@ -76,6 +77,31 @@ function applyNotificationContent(
   notification.createdAt = new Date()
 }
 
+async function findScopedNotificationOrThrow(
+  em: EntityManager,
+  notificationId: string,
+  ctx: NotificationServiceContext,
+): Promise<Notification> {
+  const notification = await findOneWithDecryption(
+    em,
+    Notification,
+    {
+      id: notificationId,
+      recipientUserId: ctx.userId,
+      tenantId: ctx.tenantId,
+    },
+    undefined,
+    {
+      tenantId: ctx.tenantId,
+      organizationId: ctx.organizationId ?? null,
+    },
+  )
+  if (!notification) {
+    throw new CrudHttpError(404, { error: 'Notification not found' })
+  }
+  return notification
+}
+
 async function emitNotificationSseEvents(
   eventBus: { emit: (event: string, payload: unknown) => Promise<void> },
   notifications: Notification[],
@@ -286,11 +312,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async markAsRead(notificationId, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       if (notification.status === 'unread') {
         notification.status = 'read'
@@ -370,11 +392,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async dismiss(notificationId, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       notification.status = 'dismissed'
       notification.dismissedAt = new Date()
@@ -391,11 +409,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async restoreDismissed(notificationId, status, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       if (notification.status !== 'dismissed') {
         return notification
@@ -425,11 +439,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
     async executeAction(notificationId, input, ctx) {
       const em = rootEm.fork()
-      const notification = await em.findOneOrFail(Notification, {
-        id: notificationId,
-        recipientUserId: ctx.userId,
-        tenantId: ctx.tenantId,
-      })
+      const notification = await findScopedNotificationOrThrow(em, notificationId, ctx)
 
       const actionData = notification.actionData
       const action = actionData?.actions?.find((a) => a.id === input.actionId)

package/src/modules/notifications/lib/routeHelpers.ts

@@ -1,5 +1,7 @@
 import { z } from 'zod'
 import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { resolveNotificationService, type NotificationService } from './notificationService'
 
 /**
@@ -20,6 +22,30 @@ export interface NotificationRequestContext {
   ctx: Awaited<ReturnType<typeof resolveRequestContext>>['ctx']
 }
 
+function formatZodIssues(error: z.ZodError): string {
+  return error.issues
+    .map((issue) => {
+      const path = issue.path.length ? `${issue.path.join('.')}: ` : ''
+      return `${path}${issue.message}`
+    })
+    .join('; ')
+}
+
+export async function notificationValidationErrorResponse(error: z.ZodError): Promise<Response> {
+  const { t } = await resolveTranslations()
+  const prefix = t('api.errors.invalidPayload', 'Invalid request body')
+  const details = formatZodIssues(error)
+  return Response.json(
+    { error: details ? `${prefix}: ${details}` : prefix },
+    { status: 400 },
+  )
+}
+
+export function notificationCrudErrorResponse(error: unknown): Response | null {
+  if (!isCrudHttpError(error)) return null
+  return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
+}
+
 /**
  * Resolve notification service and scope from a request.
  * Centralizes the common pattern used across all notification API routes.
@@ -49,15 +75,24 @@ export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
     const { service, scope } = await resolveNotificationContext(req)
 
     const body = await req.json().catch(() => ({}))
-    const input = schema.parse(body)
+    const parsed = schema.safeParse(body)
+    if (!parsed.success) {
+      return notificationValidationErrorResponse(parsed.error)
+    }
 
-    const notifications = await service[serviceMethod](input as never, scope)
+    try {
+      const notifications = await service[serviceMethod](parsed.data as never, scope)
 
-    return Response.json({
-      ok: true,
-      count: notifications.length,
-      ids: notifications.map((n) => n.id),
-    }, { status: 201 })
+      return Response.json({
+        ok: true,
+        count: notifications.length,
+        ids: notifications.map((n) => n.id),
+      }, { status: 201 })
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error)
+      if (errorResponse) return errorResponse
+      throw error
+    }
   }
 }
 
@@ -111,7 +146,13 @@ export function createSingleNotificationActionRoute(
     const { id } = await params
     const { service, scope } = await resolveNotificationContext(req)
 
-    await service[serviceMethod](id, scope)
+    try {
+      await service[serviceMethod](id, scope)
+    } catch (error) {
+      const errorResponse = notificationCrudErrorResponse(error)
+      if (errorResponse) return errorResponse
+      throw error
+    }
 
     return Response.json({ ok: true })
   }

package/src/modules/payment_gateways/api/status/route.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getStatusSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
 
@@ -20,6 +21,10 @@ export async function GET(req: Request) {
   if (!transactionId) {
     return NextResponse.json({ error: 'transactionId is required' }, { status: 400 })
   }
+  const parsedTransactionId = getStatusSchema.safeParse({ transactionId })
+  if (!parsedTransactionId.success) {
+    return NextResponse.json({ error: 'Invalid transactionId', details: parsedTransactionId.error.flatten() }, { status: 400 })
+  }
 
   const container = await createRequestContainer()
   const service = container.resolve('paymentGatewayService') as PaymentGatewayService
@@ -62,6 +67,7 @@ export const openApi = {
       tags: [paymentGatewaysTag],
       responses: [
         { status: 200, description: 'Transaction status' },
+        { status: 400, description: 'Missing or malformed transactionId' },
         { status: 404, description: 'Transaction not found' },
       ],
     },

package/src/modules/perspectives/api/[tableId]/route.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { perspectiveSaveSchema } from '@open-mercato/core/modules/perspectives/data/validators'
 import {
   loadPerspectivesState,
@@ -199,12 +200,14 @@ export async function POST(req: Request, ctx: { params: { tableId: string } }) {
   let saved: Awaited<ReturnType<typeof saveUserPerspective>> | null = null
   let updatedRolePerspectives: Awaited<ReturnType<typeof saveRolePerspectives>> | null = null
 
-  await withAtomicFlush(em, [
+  try {
+    await withAtomicFlush(em, [
     async () => {
       saved = await saveUserPerspective(em, cache, {
         scope,
         tableId,
         input: parsed.data,
+        request: req,
       })
     },
     async () => {
@@ -232,7 +235,13 @@ export async function POST(req: Request, ctx: { params: { tableId: string } }) {
         })
       }
     },
-  ], { transaction: true })
+    ], { transaction: true })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
 
   return NextResponse.json({
     perspective: saved,

package/src/modules/perspectives/services/perspectiveService.ts

@@ -1,5 +1,6 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { Perspective, RolePerspective } from '../data/entities'
 import type {
   PerspectiveSettings,
@@ -216,7 +217,12 @@ export async function loadPerspectivesState(
 export async function saveUserPerspective(
   em: EntityManager,
   cache: CacheStrategy | null | undefined,
-  options: { scope: PerspectiveScope; tableId: string; input: PerspectiveSaveInput },
+  options: {
+    scope: PerspectiveScope
+    tableId: string
+    input: PerspectiveSaveInput
+    request?: Request | Headers | null
+  },
 ): Promise<ResolvedPerspective> {
   const { scope, tableId, input } = options
   const tenantId = scope.tenantId ?? null
@@ -235,6 +241,12 @@ export async function saveUserPerspective(
     if (!entity) {
       throw Object.assign(new Error('Perspective not found'), { code: 'NOT_FOUND' })
     }
+    enforceCommandOptimisticLock({
+      resourceKind: 'perspectives.perspective',
+      resourceId: entity.id,
+      current: entity.updatedAt ?? null,
+      request: options.request ?? null,
+    })
   } else {
     entity = await em.findOne(Perspective, {
       userId: scope.userId,

package/src/modules/planner/backend/planner/availability-rulesets/[id]/page.tsx

@@ -8,7 +8,6 @@ import { ErrorMessage, RecordNotFoundState } from '@open-mercato/ui/backend/deta
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { AvailabilityRulesEditor, type AvailabilityScheduleItemBuilder } from '@open-mercato/core/modules/planner/components/AvailabilityRulesEditor'
 import { parseAvailabilityRuleWindow } from '@open-mercato/core/modules/planner/lib/availabilitySchedule'
 import { extractCustomFieldEntries } from '@open-mercato/shared/lib/crud/custom-fields-client'
@@ -29,6 +28,7 @@ type RuleSetRecord = {
   description?: string | null
   timezone: string
   updatedAt?: string | null
+  updated_at?: string | null
   name_raw?: string | null
 } & Record<string, unknown>
 
@@ -40,6 +40,7 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
   const rulesetId = params?.id
   const translate = useT()
   const router = useRouter()
+  // optimistic-lock: AvailabilityRuleSetForm forwards optimisticLockUpdatedAt from initialValues.updatedAt (wrapper auto-derives the header on save + delete).
   const [initialValues, setInitialValues] = React.useState<AvailabilityRuleSetFormValues | null>(null)
   const [error, setError] = React.useState<string | null>(null)
   const [isNotFound, setIsNotFound] = React.useState(false)
@@ -73,6 +74,11 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
             name: record.name ?? record.name_raw ?? '',
             description: record.description ?? '',
             timezone: record.timezone ?? 'UTC',
+            updatedAt: typeof record.updatedAt === 'string'
+              ? record.updatedAt
+              : typeof record.updated_at === 'string'
+                ? record.updated_at
+                : null,
             ...customFields,
           })
         }
@@ -106,19 +112,15 @@ export default function PlannerAvailabilityRuleSetDetailPage({ params }: { param
 
   const handleDelete = React.useCallback(async () => {
     if (!rulesetId) return
-    try {
-      await deleteCrud('planner/availability-rule-sets', rulesetId, {
-        errorMessage: translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
-      })
-      flash(translate('planner.availabilityRuleSets.form.flash.deleted', 'Schedule deleted.'), 'success')
-      router.push('/backend/planner/availability-rulesets')
-    } catch (error) {
-      const normalized = normalizeCrudServerError(error)
-      flash(
-        normalized.message ?? translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
-        'error',
-      )
-    }
+    // Let a non-ok DELETE (e.g. the 409 optimistic-lock conflict) propagate so
+    // CrudForm surfaces the unified conflict bar and skips its success toast.
+    // Swallowing the error here made CrudForm treat the delete as successful and
+    // show a false "Schedule deleted." toast even though the record was kept.
+    await deleteCrud('planner/availability-rule-sets', rulesetId, {
+      errorMessage: translate('planner.availabilityRuleSets.form.errors.delete', 'Failed to delete schedule.'),
+    })
+    flash(translate('planner.availabilityRuleSets.form.flash.deleted', 'Schedule deleted.'), 'success')
+    router.push('/backend/planner/availability-rulesets')
   }, [router, rulesetId, translate])
 
   const buildScheduleItems: AvailabilityScheduleItemBuilder = React.useCallback(({ availabilityRules, bookedEvents, translate: translateLabel }) => {

package/src/modules/planner/backend/planner/availability-rulesets/page.tsx

@@ -9,8 +9,9 @@ import { markdownToPlainText } from '@open-mercato/ui/backend/markdown/markdownT
 import { DataTable, withDataTableNamespaces } from '@open-mercato/ui/backend/DataTable'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { deleteCrud } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { normalizeCrudServerError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
@@ -126,7 +127,10 @@ export default function PlannerAvailabilityRuleSetsPage() {
     })
     if (!confirmed) return
     try {
-      await deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
+      const headers = buildOptimisticLockHeader(entry.updatedAt)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('planner/availability-rule-sets', entry.id, { errorMessage: labels.errors.delete })
+      ))
       flash(labels.messages.deleted, 'success')
       handleRefresh()
     } catch (error) {
@@ -237,4 +241,3 @@ function mapRuleSet(item: Record<string, unknown>): RuleSetRow {
     updatedAt,
   }, item)
 }
-

package/src/modules/planner/commands/availability-rule-sets.ts

@@ -16,6 +16,7 @@ import {
   type PlannerAvailabilityRuleSetUpdateInput,
 } from '../data/validators'
 import { plannerAvailabilityRuleSetCrudEvents } from '../lib/crud'
+import { makeCreateRedo } from '@open-mercato/shared/lib/commands/redo'
 import { ensureOrganizationScope, ensureTenantScope, extractUndoPayload } from './shared'
 import { E } from '#generated/entities.ids.generated'
 
@@ -164,6 +165,24 @@ const createAvailabilityRuleSetCommand: CommandHandler<PlannerAvailabilityRuleSe
       })
     }
   },
+  redo: makeCreateRedo<PlannerAvailabilityRuleSet, AvailabilityRuleSetSnapshot, PlannerAvailabilityRuleSetCreateInput, { ruleSetId: string }>({
+    entityClass: PlannerAvailabilityRuleSet,
+    getSnapshotId: (snapshot) => snapshot.id,
+    seedFromSnapshot: (snapshot) => ({
+      id: snapshot.id,
+      tenantId: snapshot.tenantId,
+      organizationId: snapshot.organizationId,
+      name: snapshot.name,
+      description: snapshot.description ?? null,
+      timezone: snapshot.timezone,
+      createdAt: new Date(),
+      updatedAt: new Date(),
+      deletedAt: null,
+    }),
+    buildResult: (entity) => ({ ruleSetId: entity.id }),
+    events: plannerAvailabilityRuleSetCrudEvents,
+    indexer: availabilityRuleSetCrudIndexer,
+  }),
 }
 
 const updateAvailabilityRuleSetCommand: CommandHandler<PlannerAvailabilityRuleSetUpdateInput, { ruleSetId: string }> = {

package/src/modules/planner/commands/availability.ts

@@ -13,6 +13,7 @@ import {
 import { ensureOrganizationScope, ensureTenantScope } from './shared'
 import type { PlannerAvailabilityKind, PlannerAvailabilitySubjectType } from '../data/entities'
 import { extractUndoPayload } from './shared'
+import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
 
 const AVAILABILITY_RULE_RESOURCE_KIND = 'planner.availability.rule'
 
@@ -155,6 +156,14 @@ const createAvailabilityRuleCommand: CommandHandler<PlannerAvailabilityRuleCreat
       await em.flush()
     }
   },
+  redo: async ({ logEntry, ctx }) => {
+    const after = resolveRedoSnapshot<AvailabilityRuleSnapshot>(logEntry)
+    if (!after) throw new CrudHttpError(400, { error: '[internal] redo snapshot unavailable for availability rule create' })
+    const em = (ctx.container.resolve('em') as EntityManager).fork()
+    await restoreAvailabilityRuleFromSnapshot(em, { ...after, deletedAt: null })
+    await em.flush()
+    return { ruleId: after.id }
+  },
 }
 
 const updateAvailabilityRuleCommand: CommandHandler<PlannerAvailabilityRuleUpdateInput, { ruleId: string }> = {