@open-mercato/core 0.6.5-develop.4516.1.88e6ab71a9 → 0.6.5-develop.4544.1.71c003c861

package/src/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.tsx

@@ -8,7 +8,9 @@ import { CrudForm } from '@open-mercato/ui/backend/CrudForm'
 import type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
@@ -22,6 +24,8 @@ type RoleDetail = {
   isSystem: boolean
   customerAssignable: boolean
   features: string[]
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 const PORTAL_FEATURES = [
@@ -241,25 +245,30 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
       isDefault: data.isDefault,
       customerAssignable: data.customerAssignable,
       features: data.features,
+      updatedAt: data.updatedAt ?? data.updated_at ?? null,
     }
   }, [data])
 
   const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {
     if (!id) return
-    const roleCall = await apiCall(
-      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
-      {
-        method: 'PUT',
-        headers: { 'content-type': 'application/json' },
-        body: JSON.stringify({
-          name: (values.name as string)?.trim(),
-          description: (values.description as string)?.trim() || null,
-          isDefault: values.isDefault,
-          customerAssignable: values.customerAssignable,
-        }),
-      },
-    )
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)
+    const roleCall = await withScopedApiRequestHeaders(headers, () => (
+      apiCall(
+        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
+        {
+          method: 'PUT',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            name: (values.name as string)?.trim(),
+            description: (values.description as string)?.trim() || null,
+            isDefault: values.isDefault,
+            customerAssignable: values.customerAssignable,
+          }),
+        },
+      )
+    ))
     if (!roleCall.ok) {
+      if (surfaceRecordConflict({ status: roleCall.status, body: roleCall.result }, t)) return
       flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')
       return
     }
@@ -278,21 +287,25 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
     }
     flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')
     router.push('/backend/customer_accounts/roles')
-  }, [id, router, t])
+  }, [data?.updatedAt, data?.updated_at, id, router, t])
 
   const handleDelete = React.useCallback(async () => {
     if (!id) return
-    const call = await apiCall(
-      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
-      { method: 'DELETE' },
-    )
+    const headers = buildOptimisticLockHeader(data?.updatedAt ?? data?.updated_at ?? null)
+    const call = await withScopedApiRequestHeaders(headers, () => (
+      apiCall(
+        `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
+        { method: 'DELETE' },
+      )
+    ))
     if (!call.ok) {
+      if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
       flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')
       return
     }
     flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')
     router.push('/backend/customer_accounts/roles')
-  }, [id, router, t])
+  }, [data?.updatedAt, data?.updated_at, id, router, t])
 
   if (isLoading) {
     return (
@@ -349,6 +362,7 @@ export default function CustomerRoleDetailPage({ params }: { params?: { id?: str
           fields={fields}
           groups={groups}
           initialValues={initialValues}
+          optimisticLockUpdatedAt={data.updatedAt ?? data.updated_at ?? null}
           entityId="customer_accounts:customer_role"
           onSubmit={handleSubmit}
           onDelete={!data.isSystem ? handleDelete : undefined}

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -8,7 +8,8 @@ import { DataTable } from '@open-mercato/ui/backend/DataTable'
 import type { ColumnDef } from '@tanstack/react-table'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -22,6 +23,7 @@ type RoleRow = {
   isDefault: boolean
   customerAssignable: boolean
   createdAt: string
+  updatedAt?: string | null
 }
 
 type RolesResponse = {
@@ -91,9 +93,12 @@ export default function CustomerRolesPage() {
     })
     if (!confirmed) return
     try {
-      const call = await apiCall(
-        `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
-        { method: 'DELETE' },
+      const call = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(role.updatedAt),
+        () => apiCall(
+          `/api/customer_accounts/admin/roles/${encodeURIComponent(role.id)}`,
+          { method: 'DELETE' },
+        ),
       )
       if (!call.ok) {
         flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')

package/src/modules/customer_accounts/backend/customer_accounts/settings/domain/page.tsx

@@ -8,7 +8,8 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { EmptyState } from '@open-mercato/ui/backend/EmptyState'
 import { LoadingMessage, ErrorMessage } from '@open-mercato/ui/backend/detail'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -211,6 +212,7 @@ export default function CustomerDomainSettingsPage() {
           if (registerMode === 'change' && replaceTargetId) {
             body.replacesDomainId = replaceTargetId
           }
+          // optimistic-lock-exempt: registers a new domain mapping (create), not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string; domainMapping?: DomainMappingRow }>(
             '/api/customer_accounts/admin/domain-mappings',
             {
@@ -240,6 +242,7 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
+          // optimistic-lock-exempt: DNS verify action endpoint, not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string }>(
             `/api/customer_accounts/admin/domain-mappings/${encodeURIComponent(mapping.id)}/verify`,
             { method: 'POST' },
@@ -263,6 +266,7 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
+          // optimistic-lock-exempt: TLS health-check action endpoint, not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string }>(
             `/api/customer_accounts/admin/domain-mappings/${encodeURIComponent(mapping.id)}/health-check`,
             { method: 'POST' },
@@ -299,9 +303,12 @@ export default function CustomerDomainSettingsPage() {
       setIsMutating(true)
       try {
         await runMutationWithContext(async () => {
-          const call = await apiCall<{ ok: boolean; error?: string }>(
-            `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
-            { method: 'DELETE' },
+          const call = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(mapping.updatedAt),
+            () => apiCall<{ ok: boolean; error?: string }>(
+              `/api/customer_accounts/admin/domain-mappings?id=${encodeURIComponent(mapping.id)}`,
+              { method: 'DELETE' },
+            ),
           )
           if (!call.ok || !call.result?.ok) {
             const message = call.result?.error || t('customer_accounts.domainMapping.error.load', 'Could not load custom-domain configuration')

package/src/modules/customer_accounts/backend/customer_accounts/users/[id]/page.tsx

@@ -11,7 +11,9 @@ import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { SwitchField } from '@open-mercato/ui/primitives/switch-field'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
+import { surfaceRecordConflict } from '@open-mercato/ui/backend/conflicts'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -332,21 +334,25 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     setIsSaving(true)
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall<{ ok: boolean; error?: string }>(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
-          {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({
-              displayName: editDisplayName.trim() || undefined,
-              isActive: editActive,
-              roleIds: selectedRoleIds,
-              personEntityId: editPersonEntityId,
-              customerEntityId: editCustomerEntityId,
-            }),
-          },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(data.updatedAt),
+          () => apiCall<{ ok: boolean; error?: string; updatedAt?: string | null }>(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({
+                displayName: editDisplayName.trim() || undefined,
+                isActive: editActive,
+                roleIds: selectedRoleIds,
+                personEntityId: editPersonEntityId,
+                customerEntityId: editCustomerEntityId,
+              }),
+            },
+          ),
         )
         if (!call.ok) {
+          if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
           flash(call.result?.error || t('customer_accounts.admin.detail.error.save', 'Failed to save user'), 'error')
           return
         }
@@ -357,6 +363,7 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
           displayName: editDisplayName.trim() || prev.displayName,
           personEntityId: editPersonEntityId,
           customerEntityId: editCustomerEntityId,
+          updatedAt: call.result?.updatedAt ?? prev.updatedAt,
         } : prev)
       }, { displayName: editDisplayName, isActive: editActive, roleIds: selectedRoleIds, personEntityId: editPersonEntityId, customerEntityId: editCustomerEntityId })
     } catch (err) {
@@ -378,11 +385,15 @@ export default function CustomerUserDetailPage({ params }: { params?: { id?: str
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
-          { method: 'DELETE' },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(data.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
+            { method: 'DELETE' },
+          ),
         )
         if (!call.ok) {
+          if (surfaceRecordConflict({ status: call.status, body: call.result }, t)) return
           flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')
           return
         }

package/src/modules/customer_accounts/backend/customer_accounts/users/page.tsx

@@ -13,7 +13,8 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { EmailInput } from '@open-mercato/ui/primitives/email-input'
 import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Dialog, DialogContent, DialogHeader, DialogTitle } from '@open-mercato/ui/primitives/dialog'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -29,6 +30,7 @@ type UserRow = {
   lastLoginAt: string | null
   roles: Array<{ id: string; name: string; slug: string }>
   createdAt: string
+  updatedAt?: string | null
   personEntityId: string | null
   customerEntityId: string | null
 }
@@ -339,13 +341,16 @@ export default function CustomerAccountsPage() {
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
-          {
-            method: 'PUT',
-            headers: { 'content-type': 'application/json' },
-            body: JSON.stringify({ isActive: nextActive }),
-          },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(user.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ isActive: nextActive }),
+            },
+          ),
         )
         if (!call.ok) {
           flash(t('customer_accounts.admin.error.toggleActive', 'Failed to update user status'), 'error')
@@ -375,9 +380,12 @@ export default function CustomerAccountsPage() {
     if (!confirmed) return
     try {
       await runMutationWithContext(async () => {
-        const call = await apiCall(
-          `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
-          { method: 'DELETE' },
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(user.updatedAt),
+          () => apiCall(
+            `/api/customer_accounts/admin/users/${encodeURIComponent(user.id)}`,
+            { method: 'DELETE' },
+          ),
         )
         if (!call.ok) {
           flash(t('customer_accounts.admin.error.delete', 'Failed to delete user'), 'error')

package/src/modules/customers/AGENTS.md

@@ -63,8 +63,8 @@ yarn workspace @open-mercato/core build
 When creating a new entity or CRUD slice, copy the customers module structure first, then align with `packages/core/AGENTS.md` and `packages/cli/AGENTS.md`.
 
 1. Define MikroORM v7 entities in `data/entities.ts` with decorators imported from `@mikro-orm/decorators/legacy`.
-2. Use UUID primary keys, snake_case table/column names, `organization_id`, `tenant_id`, and standard timestamp/soft-delete columns.
-3. Add validators, commands, CRUD route, backend pages, ACL, setup grants, events, search, and translations as applicable.
+2. Use UUID primary keys, snake_case table/column names, `organization_id`, `tenant_id`, and standard timestamp/soft-delete columns. For a **user-editable** entity, include `updated_at` (onCreate+onUpdate) so optimistic locking works, and return `updatedAt` from its CRUD list/detail responses.
+3. Add validators, commands, CRUD route, backend pages, ACL, setup grants, events, search, and translations as applicable. Edit/delete UI: prefer `CrudForm` (auto-derives the optimistic-lock header from `initialValues.updatedAt`); for custom list-row/dialog mutations, wrap with `withScopedApiRequestHeaders(buildOptimisticLockHeader(record.updatedAt), …)` and `surfaceRecordConflict(err, t)`.
 4. Generate or author the migration for only this entity change, then update the module's `migrations/.snapshot-open-mercato.json`.
 5. Run `yarn db:generate` again as a no-op check; expected output for the touched module is `no changes`.
 

package/src/modules/customers/api/companies/route.ts

@@ -111,6 +111,7 @@ const crud = makeCrudRoute({
       'tenant_id',
       'kind',
       'created_at',
+      'updated_at',
     ],
     sortFieldMap: {
       name: 'display_name',
@@ -406,7 +407,19 @@ const crud = makeCrudRoute({
         const parsed = companyUpdateSchema.parse(base)
         return Object.keys(custom).length ? { ...parsed, customFields: custom } : parsed
       },
-      response: () => ({ ok: true }),
+      // Return the freshly-bumped updatedAt so inline-edit detail pages can refresh
+      // their optimistic-lock token between sequential saves (avoids a false 409 on
+      // the 2nd inline edit now that locking is default-ON). #2055. The factory hands
+      // the updated entity here; read defensively in case a `{ result }` wrapper arrives.
+      response: (arg: { result?: unknown; updatedAt?: Date | string | null }) => {
+        const raw = arg?.updatedAt
+          ?? (arg?.result as { updatedAt?: Date | string | null } | null | undefined)?.updatedAt
+          ?? null
+        return {
+          ok: true,
+          updatedAt: raw instanceof Date ? raw.toISOString() : (typeof raw === 'string' ? raw : null),
+        }
+      },
     },
     delete: {
       commandId: 'customers.companies.delete',

package/src/modules/customers/api/deals/route.ts

@@ -36,6 +36,7 @@ export const dealListQuerySchema = z
   .object({
     page: z.coerce.number().min(1).default(1),
     pageSize: z.coerce.number().min(1).max(100).default(50),
+    id: z.string().uuid().optional(),
     search: z.string().optional(),
     status: stringOrStringArray.optional(),
     pipelineStage: z.string().optional(),
@@ -214,6 +215,8 @@ export async function buildDealListFilters(query: DealListQuery, ctx?: import('@
     restrictedIds = restrictedIds.filter((id) => lookup.has(id))
   }
 
+  if (query.id) filters.id = { $eq: query.id }
+
   if (query.search) {
     const matchingIds = ctx
       ? await findMatchingEntityIdsBySearchTokensAcrossSources({

package/src/modules/customers/api/people/route.ts

@@ -105,6 +105,7 @@ const crud = makeCrudRoute({
       'tenant_id',
       'kind',
       'created_at',
+      'updated_at',
     ],
     sortFieldMap: {
       name: 'display_name',
@@ -398,7 +399,17 @@ const crud = makeCrudRoute({
         const parsed = personUpdateSchema.parse(base)
         return Object.keys(custom).length ? { ...parsed, customFields: custom } : parsed
       },
-      response: () => ({ ok: true }),
+      // Return the freshly-bumped updatedAt so inline-edit detail pages can refresh
+      // their optimistic-lock token between sequential saves (#2055).
+      response: (arg: { result?: unknown; updatedAt?: Date | string | null }) => {
+        const raw = arg?.updatedAt
+          ?? (arg?.result as { updatedAt?: Date | string | null } | null | undefined)?.updatedAt
+          ?? null
+        return {
+          ok: true,
+          updatedAt: raw instanceof Date ? raw.toISOString() : (typeof raw === 'string' ? raw : null),
+        }
+      },
     },
     delete: {
       commandId: 'customers.people.delete',

package/src/modules/customers/api/todos/route.ts

@@ -595,6 +595,7 @@ const todoItemSchema = z.object({
   todoDueAt: z.string().nullable().optional(),
   todoCustomValues: z.record(z.string(), z.unknown()).nullable().optional(),
   todoOrganizationId: z.string().nullable(),
+  todoUpdatedAt: z.string().nullable().optional(),
   organizationId: z.string(),
   tenantId: z.string(),
   createdAt: z.string(),

package/src/modules/customers/backend/config/customers/deals/page.tsx

@@ -81,6 +81,7 @@ export default function DealsSettingsPage(): React.ReactElement {
     try {
       await runMutation({
         operation: async () => {
+          // optimistic-lock-exempt: tenant-scoped preference setting (single stuckThresholdDays value, no loaded record version)
           await apiCallOrThrow(
             '/api/customers/settings/stuck-threshold',
             {

package/src/modules/customers/backend/config/customers/pipeline-stages/page.tsx

@@ -3,7 +3,8 @@
 import * as React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Input } from '@open-mercato/ui/primitives/input'
@@ -24,6 +25,7 @@ type Pipeline = {
   id: string
   name: string
   isDefault: boolean
+  updatedAt?: string | null
 }
 
 type PipelineStage = {
@@ -33,6 +35,7 @@ type PipelineStage = {
   order: number
   color: string | null
   icon: string | null
+  updatedAt?: string | null
 }
 
 type PipelineDialogState =
@@ -146,11 +149,14 @@ export default function PipelineStagesPage() {
         await loadPipelines()
         if (newId) setSelectedPipelineId(newId)
       } else if (pipelineDialog?.mode === 'edit') {
-        const result = await apiCall('/api/customers/pipelines', {
-          method: 'PUT',
-          body: JSON.stringify({ id: pipelineDialog.pipeline.id, name: pipelineName.trim(), isDefault: pipelineIsDefault }),
-          headers: { 'Content-Type': 'application/json' },
-        })
+        const result = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(pipelineDialog.pipeline.updatedAt),
+          () => apiCall('/api/customers/pipelines', {
+            method: 'PUT',
+            body: JSON.stringify({ id: pipelineDialog.pipeline.id, name: pipelineName.trim(), isDefault: pipelineIsDefault }),
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        )
         if (!result.ok) {
           flash(t('customers.config.pipelineStages.errorUpdatePipeline', 'Failed to update pipeline'), 'error')
           return
@@ -175,11 +181,14 @@ export default function PipelineStagesPage() {
       variant: 'destructive',
     })
     if (!confirmed) return
-    const result = await apiCall('/api/customers/pipelines', {
-      method: 'DELETE',
-      body: JSON.stringify({ id: pipeline.id }),
-      headers: { 'Content-Type': 'application/json' },
-    })
+    const result = await withScopedApiRequestHeaders(
+      buildOptimisticLockHeader(pipeline.updatedAt),
+      () => apiCall('/api/customers/pipelines', {
+        method: 'DELETE',
+        body: JSON.stringify({ id: pipeline.id }),
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
     if (!result.ok) {
       const error = (result.result as { error?: string })?.error
       flash(error ?? t('customers.config.pipelineStages.errorDeletePipeline', 'Failed to delete pipeline'), 'error')
@@ -224,11 +233,14 @@ export default function PipelineStagesPage() {
         }
         flash(t('customers.config.pipelineStages.createdStage', 'Stage created'), 'success')
       } else if (stageDialog?.mode === 'edit') {
-        const result = await apiCall('/api/customers/pipeline-stages', {
-          method: 'PUT',
-          body: JSON.stringify({ id: stageDialog.stage.id, label: stageName.trim(), color: stageColor, icon: stageIcon }),
-          headers: { 'Content-Type': 'application/json' },
-        })
+        const result = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(stageDialog.stage.updatedAt),
+          () => apiCall('/api/customers/pipeline-stages', {
+            method: 'PUT',
+            body: JSON.stringify({ id: stageDialog.stage.id, label: stageName.trim(), color: stageColor, icon: stageIcon }),
+            headers: { 'Content-Type': 'application/json' },
+          }),
+        )
         if (!result.ok) {
           flash(t('customers.config.pipelineStages.errorUpdateStage', 'Failed to update stage'), 'error')
           return
@@ -253,11 +265,14 @@ export default function PipelineStagesPage() {
       variant: 'destructive',
     })
     if (!confirmed) return
-    const result = await apiCall('/api/customers/pipeline-stages', {
-      method: 'DELETE',
-      body: JSON.stringify({ id: stage.id }),
-      headers: { 'Content-Type': 'application/json' },
-    })
+    const result = await withScopedApiRequestHeaders(
+      buildOptimisticLockHeader(stage.updatedAt),
+      () => apiCall('/api/customers/pipeline-stages', {
+        method: 'DELETE',
+        body: JSON.stringify({ id: stage.id }),
+        headers: { 'Content-Type': 'application/json' },
+      }),
+    )
     if (!result.ok) {
       const error = (result.result as { error?: string })?.error
       flash(error ?? t('customers.config.pipelineStages.errorDeleteStage', 'Failed to delete stage'), 'error')