@open-mercato/core 0.6.5-develop.4534.1.b459babe6d → 0.6.5-develop.4544.1.71c003c861

package/src/modules/catalog/commands/variants.ts

@@ -726,48 +726,48 @@ const updateVariantCommand: CommandHandler<VariantUpdateInput, { variantId: stri
       ? await resolveVariantTaxRate(em, product, parsed.taxRateId ?? null, parsed.taxRate)
       : null
 
-    if (parsed.name !== undefined) record.name = parsed.name ?? null
-    if (parsed.sku !== undefined) record.sku = parsed.sku ?? null
-    if (parsed.barcode !== undefined) record.barcode = parsed.barcode ?? null
-    if (parsed.statusEntryId !== undefined) record.statusEntryId = parsed.statusEntryId ?? null
-    if (parsed.isDefault !== undefined) record.isDefault = parsed.isDefault
-    if (parsed.isActive !== undefined) record.isActive = parsed.isActive
-    if (Object.prototype.hasOwnProperty.call(parsed, 'weightValue')) {
-      record.weightValue = toNumericString(parsed.weightValue)
-    }
-    if (parsed.weightUnit !== undefined) record.weightUnit = parsed.weightUnit ?? null
-    if (parsed.dimensions !== undefined) {
-      record.dimensions = parsed.dimensions ? cloneJson(parsed.dimensions) : null
-    }
-    let metadataSplit: MetadataSplitResult | null = null
-    if (parsed.metadata !== undefined) {
-      metadataSplit = splitOptionValuesFromMetadata(parsed.metadata)
-      record.metadata = metadataSplit.metadata
-    }
-    if (parsed.optionValues !== undefined) {
-      record.optionValues = parsed.optionValues ? cloneJson(parsed.optionValues) : null
-    } else if (metadataSplit?.hadOptionValues) {
-      record.optionValues = metadataSplit.optionValues ? cloneJson(metadataSplit.optionValues) : null
-    }
-    if (taxRateProvided) {
-      record.taxRateId = resolvedTaxRate?.taxRateId ?? null
-      record.taxRate = resolvedTaxRate?.taxRate ?? null
-    }
-    if (parsed.customFieldsetCode !== undefined) {
-      record.customFieldsetCode = parsed.customFieldsetCode ?? null
-    }
-
     let previousDefaultVariantId: string | null = null
     try {
       await withAtomicFlush(
         em,
         [
+          () => {
+            if (parsed.name !== undefined) record.name = parsed.name ?? null
+            if (parsed.sku !== undefined) record.sku = parsed.sku ?? null
+            if (parsed.barcode !== undefined) record.barcode = parsed.barcode ?? null
+            if (parsed.statusEntryId !== undefined) record.statusEntryId = parsed.statusEntryId ?? null
+            if (parsed.isDefault !== undefined) record.isDefault = parsed.isDefault
+            if (parsed.isActive !== undefined) record.isActive = parsed.isActive
+            if (Object.prototype.hasOwnProperty.call(parsed, 'weightValue')) {
+              record.weightValue = toNumericString(parsed.weightValue)
+            }
+            if (parsed.weightUnit !== undefined) record.weightUnit = parsed.weightUnit ?? null
+            if (parsed.dimensions !== undefined) {
+              record.dimensions = parsed.dimensions ? cloneJson(parsed.dimensions) : null
+            }
+            let metadataSplit: MetadataSplitResult | null = null
+            if (parsed.metadata !== undefined) {
+              metadataSplit = splitOptionValuesFromMetadata(parsed.metadata)
+              record.metadata = metadataSplit.metadata
+            }
+            if (parsed.optionValues !== undefined) {
+              record.optionValues = parsed.optionValues ? cloneJson(parsed.optionValues) : null
+            } else if (metadataSplit?.hadOptionValues) {
+              record.optionValues = metadataSplit.optionValues ? cloneJson(metadataSplit.optionValues) : null
+            }
+            if (taxRateProvided) {
+              record.taxRateId = resolvedTaxRate?.taxRateId ?? null
+              record.taxRate = resolvedTaxRate?.taxRate ?? null
+            }
+            if (parsed.customFieldsetCode !== undefined) {
+              record.customFieldsetCode = parsed.customFieldsetCode ?? null
+            }
+          },
           async () => {
             if (parsed.isDefault === true) {
               previousDefaultVariantId = await enforceSingleDefaultVariant(em, record)
             }
           },
-          () => em.flush(),
           () => aggregateVariantMediaToProduct(em, record),
         ],
         { transaction: true }

package/src/modules/catalog/components/PriceKindSettings.tsx

@@ -17,7 +17,8 @@ import {
   DialogTitle,
 } from '@open-mercato/ui/primitives/dialog'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -211,11 +212,17 @@ export function PriceKindSettings() {
         dialog.mode === 'edit'
           ? JSON.stringify({ id: dialog.entry.id, ...payload })
           : JSON.stringify(payload)
-      const call = await apiCall(path, {
+      const savePriceKind = () => apiCall(path, {
         method,
         headers: { 'content-type': 'application/json' },
         body,
       })
+      const optimisticLockHeader = buildOptimisticLockHeader(
+        dialog.mode === 'edit' ? dialog.entry.updatedAt : null,
+      )
+      const call = Object.keys(optimisticLockHeader).length > 0
+        ? await withScopedApiRequestHeaders(optimisticLockHeader, savePriceKind)
+        : await savePriceKind()
       if (!call.ok) {
         await raiseCrudError(call.response, t('catalog.priceKinds.errors.save', 'Failed to save price kind.'))
       }
@@ -229,8 +236,9 @@ export function PriceKindSettings() {
       await loadItems()
     } catch (err) {
       console.error('catalog.price-kinds.save failed', err)
-      const message =
-        err instanceof Error ? err.message : t('catalog.priceKinds.errors.save', 'Failed to save price kind.')
+      const message = extractOptimisticLockConflict(err)
+        ? t('ui.forms.flash.recordModified', 'This record was modified by someone else. Refresh and try again.')
+        : err instanceof Error ? err.message : t('catalog.priceKinds.errors.save', 'Failed to save price kind.')
       setError(message)
     } finally {
       setSubmitting(false)
@@ -246,11 +254,15 @@ export function PriceKindSettings() {
       })
       if (!confirmed) return
       try {
-        const call = await apiCall('/api/catalog/price-kinds', {
+        const deletePriceKind = () => apiCall('/api/catalog/price-kinds', {
           method: 'DELETE',
           headers: { 'content-type': 'application/json' },
           body: JSON.stringify({ id: entry.id }),
         })
+        const optimisticLockHeader = buildOptimisticLockHeader(entry.updatedAt)
+        const call = Object.keys(optimisticLockHeader).length > 0
+          ? await withScopedApiRequestHeaders(optimisticLockHeader, deletePriceKind)
+          : await deletePriceKind()
         if (!call.ok) {
           await raiseCrudError(call.response, t('catalog.priceKinds.errors.delete', 'Failed to delete price kind.'))
         }
@@ -258,8 +270,9 @@ export function PriceKindSettings() {
         await loadItems()
       } catch (err) {
         console.error('catalog.price-kinds.delete failed', err)
-        const message =
-          err instanceof Error ? err.message : t('catalog.priceKinds.errors.delete', 'Failed to delete price kind.')
+        const message = extractOptimisticLockConflict(err)
+          ? t('ui.forms.flash.recordModified', 'This record was modified by someone else. Refresh and try again.')
+          : err instanceof Error ? err.message : t('catalog.priceKinds.errors.delete', 'Failed to delete price kind.')
         flash(message, 'error')
       }
     },

package/src/modules/catalog/components/categories/CategoriesDataTable.tsx

@@ -170,6 +170,7 @@ export default function CategoriesDataTable() {
     })
     if (!confirmed) return
     try {
+      // optimistic-lock-exempt: delete-only mutation — no field-level lost-update
       await apiCallOrThrow(
         `/api/catalog/categories?id=${encodeURIComponent(category.id)}`,
         { method: 'DELETE' },

package/src/modules/catalog/components/products/ProductMediaManager.tsx

@@ -68,6 +68,7 @@ export function ProductMediaManager({
           fd.set('entityId', entityId)
           fd.set('recordId', draftRecordId)
           fd.set('file', file)
+          // optimistic-lock-exempt: media attach/detach/reorder
           const call = await apiCall<{ ok?: boolean; item?: ProductMediaItem; error?: string }>(
             '/api/attachments',
             { method: 'POST', body: fd },
@@ -111,6 +112,7 @@ export function ProductMediaManager({
   const handleRemove = React.useCallback(
     async (attachmentId: string) => {
       setError(null)
+      // optimistic-lock-exempt: media attach/detach/reorder
       const call = await apiCall<{ ok?: boolean; error?: string }>(
         `/api/attachments?id=${encodeURIComponent(attachmentId)}`,
         { method: 'DELETE' },

package/src/modules/catalog/components/products/ProductsDataTable.tsx

@@ -6,9 +6,10 @@ import type { ColumnDef, SortingState } from '@tanstack/react-table'
 import { DataTable, type DataTableExportFormat } from '@open-mercato/ui/backend/DataTable'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
-import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { deleteCrud, buildCrudExportUrl } from '@open-mercato/ui/backend/utils/crud'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useCustomFieldDefs } from '@open-mercato/ui/backend/utils/customFieldDefs'
 import { applyCustomFieldVisibility } from '@open-mercato/ui/backend/utils/customFieldColumns'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
@@ -619,9 +620,12 @@ export default function ProductsDataTable({
     })
     if (!confirmed) return
     try {
-      await deleteCrud('catalog/products', row.id, {
-        errorMessage: t('catalog.products.list.error.delete', 'Failed to delete product'),
-      })
+      const headers = buildOptimisticLockHeader(typeof row.updated_at === 'string' ? row.updated_at : null)
+      await withScopedApiRequestHeaders(headers, () => (
+        deleteCrud('catalog/products', row.id, {
+          errorMessage: t('catalog.products.list.error.delete', 'Failed to delete product'),
+        })
+      ))
       flash(t('catalog.products.flash.deleted', 'Product deleted'), 'success')
       setReloadToken((token) => token + 1)
     } catch (error) {

package/src/modules/catalog/components/products/productForm.ts

@@ -68,6 +68,8 @@ export type ProductUnitConversionDraft = {
   toBaseFactor: string;
   sortOrder: string;
   isActive: boolean;
+  /** The conversion row's version, for the per-row optimistic-lock header (#2055). Optional — only loaded rows carry it. */
+  updatedAt?: string | null;
 };
 
 export type VariantDraft = {
@@ -116,6 +118,7 @@ export type ProductFormValues = {
   channelIds: string[];
   tags: string[];
   optionSchemaId?: string | null;
+  updatedAt?: string | null;
 };
 
 const optionalPositiveNumberInput = z.preprocess((value) => {

package/src/modules/catalog/components/products/variantForm.ts

@@ -17,6 +17,8 @@ export type VariantPriceDraft = {
   amount: string
   currencyCode?: string | null
   displayMode: 'including-tax' | 'excluding-tax'
+  /** The price row's version, for the per-price optimistic-lock header (#2055). */
+  updatedAt?: string | null
 }
 
 export type VariantFormValues = {
@@ -34,6 +36,7 @@ export type VariantFormValues = {
   prices: Record<string, VariantPriceDraft>
   taxRateId: string | null
   customFieldsetCode?: string | null
+  updatedAt?: string | null
 }
 
 export const VARIANT_BASE_VALUES: VariantFormValues = {
@@ -147,5 +150,11 @@ export function mapPriceItemToDraft(
           ? item.currencyCode
           : null,
     displayMode: kindMode,
+    updatedAt:
+      typeof item.updatedAt === 'string'
+        ? item.updatedAt
+        : typeof item.updated_at === 'string'
+          ? item.updated_at
+          : null,
   }
 }

package/src/modules/communication_channels/backend/profile/communication-channels/page.tsx

@@ -787,6 +787,11 @@ function DisconnectChannelDialog({
     let response
     try {
       response = await runMutation({
+        // optimistic-lock-exempt: self-service connect/disconnect of the
+        // signed-in operator's OWN communication channel (an integration link),
+        // not a shared multi-editor record. Disconnect is a terminal action
+        // keyed by channel id; there is no concurrent-edit lost-update window to
+        // guard, and the row carries no client-surfaced `updatedAt` round-trip.
         operation: () => apiCall(
           `/api/communication_channels/channels/${encodeURIComponent(channel.id)}`,
           { method: 'DELETE' },

package/src/modules/currencies/backend/currencies/[id]/page.tsx

@@ -7,7 +7,8 @@ import { CrudForm, type CrudFormGroup } from '@open-mercato/ui/backend/CrudForm'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { SendObjectMessageDialog } from '@open-mercato/ui/backend/messages'
 import { DataLoader } from '@open-mercato/ui/primitives/DataLoader'
@@ -26,6 +27,8 @@ type CurrencyData = {
   isActive: boolean
   organizationId: string
   tenantId: string
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export default function EditCurrencyPage({ params }: { params?: { id?: string } }) {
@@ -141,11 +144,14 @@ export default function EditCurrencyPage({ params }: { params?: { id?: string }
     if (!confirmed) return
 
     try {
-      await apiCall('/api/currencies/currencies', {
-        method: 'DELETE',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({ id: currency.id, organizationId: currency.organizationId, tenantId: currency.tenantId }),
-      })
+      const headers = buildOptimisticLockHeader(currency.updatedAt ?? currency.updated_at ?? null)
+      await withScopedApiRequestHeaders(headers, () => (
+        apiCall('/api/currencies/currencies', {
+          method: 'DELETE',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ id: currency.id, organizationId: currency.organizationId, tenantId: currency.tenantId }),
+        })
+      ))
 
       flash(t('currencies.flash.deleted'), 'success')
       router.push('/backend/currencies')
@@ -221,6 +227,7 @@ export default function EditCurrencyPage({ params }: { params?: { id?: string }
           )}
           fields={[]}
           groups={groups}
+          optimisticLockUpdatedAt={currency.updatedAt ?? currency.updated_at ?? null}
           initialValues={{
             code: currency.code,
             name: currency.name,

package/src/modules/currencies/backend/currencies/page.tsx

@@ -11,7 +11,8 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
 import { Plus, Star } from 'lucide-react'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -99,11 +100,14 @@ export default function CurrenciesPage() {
   const handleSetBase = React.useCallback(
     async (row: CurrencyRow) => {
       try {
-        const call = await apiCall('/api/currencies/currencies', {
-          method: 'PUT',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: row.id, isBase: true }),
-        })
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(row.updatedAt),
+          () => apiCall('/api/currencies/currencies', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ id: row.id, isBase: true }),
+          }),
+        )
 
         if (!call.ok) {
           flash(t('currencies.flash.baseSetError'), 'error')
@@ -128,11 +132,14 @@ export default function CurrenciesPage() {
       if (!confirmed) return
 
       try {
-        const call = await apiCall(`/api/currencies/currencies`, {
-          method: 'DELETE',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: row.id, organizationId: row.organizationId, tenantId: row.tenantId }),
-        })
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(row.updatedAt),
+          () => apiCall(`/api/currencies/currencies`, {
+            method: 'DELETE',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ id: row.id, organizationId: row.organizationId, tenantId: row.tenantId }),
+          }),
+        )
 
         if (!call.ok) {
           flash(t('currencies.flash.deleteError'), 'error')

package/src/modules/currencies/backend/exchange-rates/[id]/page.tsx

@@ -40,6 +40,8 @@ type ExchangeRateData = {
   isActive: boolean
   organizationId: string
   tenantId: string
+  updatedAt?: string | null
+  updated_at?: string | null
 }
 
 export default function EditExchangeRatePage({ params }: { params?: { id?: string } }) {
@@ -125,6 +127,7 @@ export default function EditExchangeRatePage({ params }: { params?: { id?: strin
           versionHistory={{ resourceKind: 'currencies.exchange_rate', resourceId: exchangeRate.id }}
           fields={[]}
           groups={groups}
+          optimisticLockUpdatedAt={exchangeRate.updatedAt ?? exchangeRate.updated_at ?? null}
           initialValues={{
             fromCurrencyCode: exchangeRate.fromCurrencyCode,
             toCurrencyCode: exchangeRate.toCurrencyCode,

package/src/modules/currencies/backend/exchange-rates/page.tsx

@@ -10,7 +10,8 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { BooleanIcon } from '@open-mercato/ui/backend/ValueIcons'
 import { Plus } from 'lucide-react'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
@@ -108,11 +109,14 @@ export default function ExchangeRatesPage() {
       if (!confirmed) return
 
       try {
-        const call = await apiCall(`/api/currencies/exchange-rates`, {
-          method: 'DELETE',
-          headers: { 'Content-Type': 'application/json' },
-          body: JSON.stringify({ id: row.id, organizationId: row.organizationId, tenantId: row.tenantId }),
-        })
+        const call = await withScopedApiRequestHeaders(
+          buildOptimisticLockHeader(row.updatedAt),
+          () => apiCall(`/api/currencies/exchange-rates`, {
+            method: 'DELETE',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ id: row.id, organizationId: row.organizationId, tenantId: row.tenantId }),
+          }),
+        )
 
         if (!call.ok) {
           flash(t('exchangeRates.flash.deleteError'), 'error')

package/src/modules/currencies/commands/currencies.ts

@@ -230,16 +230,21 @@ const updateCurrencyCommand: CommandHandler<CurrencyUpdateInput, { currencyId: s
       return { currencyId: record.id }
     }
 
-    for (const [key, change] of Object.entries(changes)) {
-      ;(record as any)[key] = change.to
-    }
-    record.updatedAt = new Date()
-
     // Demote any existing base currency and persist the scalar changes in one
     // transaction; a partial commit would leave zero or two base currencies.
+    // The scalar mutations live in the first phase so the per-phase flush issues
+    // the pending changeset on the managed `record` before `enforceBaseCurrency`
+    // runs its interleaved `nativeUpdate` (which would otherwise drop the pending
+    // UPDATE under v7).
     await withAtomicFlush(
       em,
       [
+        () => {
+          for (const [key, change] of Object.entries(changes)) {
+            ;(record as any)[key] = change.to
+          }
+          record.updatedAt = new Date()
+        },
         () =>
           parsed.isBase === true && record.isBase
             ? enforceBaseCurrency(em, record.id, record.organizationId, record.tenantId)

package/src/modules/currencies/components/CurrencyFetchingConfig.tsx

@@ -2,7 +2,8 @@
 
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
+import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { Switch } from '@open-mercato/ui/primitives/switch'
@@ -17,6 +18,7 @@ interface FetchConfig {
   lastSyncStatus: string | null
   lastSyncMessage: string | null
   lastSyncCount: number | null
+  updatedAt?: string | null
 }
 
 export default function CurrencyFetchingConfig() {
@@ -92,16 +94,20 @@ export default function CurrencyFetchingConfig() {
     }
   }, [availableProviders, initializeMissingProviders, t])
 
-  const toggleEnabled = useCallback(async (configId: string, currentValue: boolean) => {
+  const toggleEnabled = useCallback(async (configId: string, currentValue: boolean, updatedAt?: string | null) => {
     try {
-      const { result } = await apiCall('/api/currencies/fetch-configs', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          id: configId,
-          isEnabled: !currentValue,
-        }),
-      })
+      const { result } = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt),
+        () =>
+          apiCall('/api/currencies/fetch-configs', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              id: configId,
+              isEnabled: !currentValue,
+            }),
+          }),
+      )
 
       if (result?.config) {
         setConfigs((prev) =>
@@ -119,16 +125,20 @@ export default function CurrencyFetchingConfig() {
     }
   }, [t])
 
-  const updateSyncTime = useCallback(async (configId: string, syncTime: string) => {
+  const updateSyncTime = useCallback(async (configId: string, syncTime: string, updatedAt?: string | null) => {
     try {
-      const { result } = await apiCall('/api/currencies/fetch-configs', {
-        method: 'PUT',
-        headers: { 'Content-Type': 'application/json' },
-        body: JSON.stringify({
-          id: configId,
-          syncTime: syncTime || null,
-        }),
-      })
+      const { result } = await withScopedApiRequestHeaders(
+        buildOptimisticLockHeader(updatedAt),
+        () =>
+          apiCall('/api/currencies/fetch-configs', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+              id: configId,
+              syncTime: syncTime || null,
+            }),
+          }),
+      )
 
       if (result?.config) {
         setConfigs((prev) =>
@@ -255,7 +265,7 @@ export default function CurrencyFetchingConfig() {
 
               <Switch
                 checked={config.isEnabled}
-                onCheckedChange={() => toggleEnabled(config.id, config.isEnabled)}
+                onCheckedChange={() => toggleEnabled(config.id, config.isEnabled, config.updatedAt)}
               />
             </div>
 
@@ -269,7 +279,7 @@ export default function CurrencyFetchingConfig() {
                     <input
                       type="time"
                       value={config.syncTime || '09:00'}
-                      onChange={(e) => updateSyncTime(config.id, e.target.value)}
+                      onChange={(e) => updateSyncTime(config.id, e.target.value, config.updatedAt)}
                       className="rounded border bg-background px-2 py-1.5 text-sm"
                     />
                   </div>

package/src/modules/customer_accounts/api/admin/roles/[id].ts

@@ -7,6 +7,8 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerRole, CustomerRoleAcl, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { updateRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
+import { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
 export const metadata = {}
 
@@ -102,15 +104,30 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     return NextResponse.json({ ok: false, error: 'Cannot change name of a system role' }, { status: 400 })
   }
 
-  const updates: Record<string, unknown> = {}
+  // Optimistic lock: refuse a stale overwrite so two admins editing the same role
+  // in parallel cannot silently clobber each other (#2055). Strictly additive.
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'customer_accounts.role',
+      resourceId: role.id,
+      current: role.updatedAt ?? null,
+      request: req,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    throw err
+  }
+
+  // Always bump updated_at so the lock version advances on every save — `nativeUpdate`
+  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.
+  const nextUpdatedAt = new Date()
+  const updates: Record<string, unknown> = { updatedAt: nextUpdatedAt }
   if (parsed.data.name !== undefined) updates.name = parsed.data.name
   if (parsed.data.description !== undefined) updates.description = parsed.data.description
   if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault
   if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable
 
-  if (Object.keys(updates).length > 0) {
-    await em.nativeUpdate(CustomerRole, { id: role.id }, updates)
-  }
+  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)
 
   void emitCustomerAccountsEvent('customer_accounts.role.updated', {
     id: role.id,
@@ -119,7 +136,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     organizationId: auth.orgId,
   }).catch(() => undefined)
 
-  return NextResponse.json({ ok: true })
+  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })
 }
 
 export async function DELETE(req: Request, { params }: { params: { id: string } }) {
@@ -150,6 +167,19 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return NextResponse.json({ ok: false, error: 'Cannot delete a system role' }, { status: 400 })
   }
 
+  // Optimistic lock: refuse a stale delete. Strictly additive.
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: 'customer_accounts.role',
+      resourceId: role.id,
+      current: role.updatedAt ?? null,
+      request: req,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    throw err
+  }
+
   const assignedUsersCount = await em.count(CustomerUserRole, {
     role: role.id as any,
     deletedAt: null,

package/src/modules/customer_accounts/api/admin/roles.ts

@@ -62,6 +62,7 @@ export async function GET(req: Request) {
     isSystem: role.isSystem,
     customerAssignable: role.customerAssignable,
     createdAt: role.createdAt,
+    updatedAt: role.updatedAt || null,
   }))
 
   return NextResponse.json({ ok: true, items, total, totalPages, page })
@@ -159,6 +160,7 @@ const roleSchema = z.object({
   isSystem: z.boolean(),
   customerAssignable: z.boolean(),
   createdAt: z.string().datetime(),
+  updatedAt: z.string().datetime().nullable(),
 })
 
 const roleResponseSchema = z.object({