@open-mercato/core 0.6.6-develop.6094.1.28b081ea16 → 0.6.6-develop.6121.1.5797a901b3

package/src/modules/sales/api/settings/order-editing/route.ts

@@ -12,6 +12,11 @@ import { salesEditingSettingsSchema, salesSettingsUpsertSchema } from '../../../
 import { loadSalesSettings } from '../../../commands/settings'
 import { DEFAULT_ORDER_NUMBER_FORMAT, DEFAULT_QUOTE_NUMBER_FORMAT } from '../../../lib/documentNumberTokens'
 import { withScopedPayload } from '../../utils'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import { ensureSalesDictionary } from '../../../lib/dictionaries'
 import { DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
 
@@ -114,23 +119,52 @@ export async function GET(req: Request) {
 export async function PUT(req: Request) {
   try {
     const { ctx, translate, organizationId, tenantId, em } = await resolveSettingsContext(req)
-    const payload = await req.json().catch(() => ({}))
+    const payload = (await readJsonSafe<Record<string, unknown>>(req, {})) ?? {}
     const scoped = withScopedPayload(payload, ctx, translate)
     const parsed = salesEditingSettingsSchema.parse(scoped)
 
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      userId: ctx.auth!.sub,
+      resourceKind: 'sales.settings',
+      resourceId: organizationId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const current = await loadSalesSettings(em, { tenantId, organizationId })
     const commandInput = salesSettingsUpsertSchema.parse({
       ...parsed,
       orderNumberFormat: parsed.orderNumberFormat ?? current?.orderNumberFormat ?? DEFAULT_ORDER_NUMBER_FORMAT,
       quoteNumberFormat: parsed.quoteNumberFormat ?? current?.quoteNumberFormat ?? DEFAULT_QUOTE_NUMBER_FORMAT,
-      orderNextNumber: payload?.orderNextNumber,
-      quoteNextNumber: payload?.quoteNextNumber,
+      orderNextNumber: payload.orderNextNumber,
+      quoteNextNumber: payload.quoteNextNumber,
     })
 
     const commandBus = ctx.container.resolve('commandBus') as CommandBus
     const response = await commandBus.execute('sales.settings.save', { input: commandInput, ctx })
     const result = (response as { result?: { orderCustomerEditableStatuses?: string[] | null; orderAddressEditableStatuses?: string[] | null } }).result
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        userId: ctx.auth!.sub,
+        resourceKind: 'sales.settings',
+        resourceId: organizationId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     const orderStatuses = await loadStatusOptions(em, tenantId, organizationId)
 
     return NextResponse.json({

package/src/modules/staff/api/leave-requests/accept/route.ts

@@ -10,6 +10,11 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../guards'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },
@@ -39,11 +44,51 @@ export async function POST(req: Request) {
     const { ctx, translate } = await buildContext(req)
     const body = await req.json().catch(() => ({}))
     const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)
+
+    const auth = ctx.auth
+    const tenantId = auth?.tenantId ?? ''
+    const organizationId = ctx.selectedOrganizationId ?? null
+    const guardResult = await runStaffMutationGuards(
+      ctx.container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.leave_request',
+        resourceId: input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: input,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(
       'staff.leave-requests.accept',
       { input, ctx },
     )
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.leave_request',
+        resourceId: result?.requestId ?? input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
     const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/staff/api/leave-requests/reject/route.ts

@@ -10,6 +10,11 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { staffLeaveRequestDecisionSchema, type StaffLeaveRequestDecisionInput } from '../../../data/validators'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../guards'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['staff.leave_requests.manage'] },
@@ -39,11 +44,51 @@ export async function POST(req: Request) {
     const { ctx, translate } = await buildContext(req)
     const body = await req.json().catch(() => ({}))
     const input = parseScopedCommandInput(staffLeaveRequestDecisionSchema, body, ctx, translate)
+
+    const auth = ctx.auth
+    const tenantId = auth?.tenantId ?? ''
+    const organizationId = ctx.selectedOrganizationId ?? null
+    const guardResult = await runStaffMutationGuards(
+      ctx.container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.leave_request',
+        resourceId: input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: input,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<StaffLeaveRequestDecisionInput, { requestId: string }>(
       'staff.leave-requests.reject',
       { input, ctx },
     )
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.leave_request',
+        resourceId: result?.requestId ?? input.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
     const response = NextResponse.json({ ok: true, id: result?.requestId ?? null }, { status: 200 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/staff/api/team-members/self/route.ts

@@ -16,6 +16,11 @@ import {
   type StaffTeamMemberSelfCreateInput,
   type StaffTeamMemberCreateInput,
 } from '../../../data/validators'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../guards'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['staff.leave_requests.send'] },
@@ -102,6 +107,30 @@ export async function POST(req: Request) {
       throw new CrudHttpError(409, { error: translate('staff.teamMembers.self.exists', 'Team member profile already exists.') })
     }
 
+    const tenantId = auth.tenantId ?? ''
+    const organizationId = ctx.selectedOrganizationId ?? null
+    const guardResult = await runStaffMutationGuards(
+      ctx.container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: 'staff.team_member',
+        resourceId: auth.sub,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: parsed,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const selfInput: StaffTeamMemberCreateInput = {
       ...parsed,
@@ -119,6 +148,20 @@ export async function POST(req: Request) {
         ctx,
       },
     )
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth.sub,
+        resourceKind: 'staff.team_member',
+        resourceId: result?.memberId ?? auth.sub,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
     const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/staff/api/team-members/tags/assign/route.ts

@@ -13,6 +13,11 @@ import {
   staffTeamMemberTagAssignmentSchema,
   type StaffTeamMemberTagAssignmentInput,
 } from '../../../../data/validators'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../guards'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },
@@ -42,11 +47,51 @@ export async function POST(req: Request) {
     const { ctx, translate } = await buildContext(req)
     const body = await req.json().catch(() => ({}))
     const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)
+
+    const auth = ctx.auth
+    const tenantId = auth?.tenantId ?? ''
+    const organizationId = ctx.selectedOrganizationId ?? null
+    const guardResult = await runStaffMutationGuards(
+      ctx.container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.team_member',
+        resourceId: input.memberId,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: input,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(
       'staff.team-members.tags.assign',
       { input, ctx },
     )
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.team_member',
+        resourceId: result?.memberId ?? input.memberId,
+        operation: 'create',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
     const response = NextResponse.json({ id: result?.memberId ?? null }, { status: 201 })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/staff/api/team-members/tags/unassign/route.ts

@@ -13,6 +13,11 @@ import {
   staffTeamMemberTagAssignmentSchema,
   type StaffTeamMemberTagAssignmentInput,
 } from '../../../../data/validators'
+import {
+  resolveUserFeatures,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../guards'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['staff.manage_team'] },
@@ -42,11 +47,51 @@ export async function POST(req: Request) {
     const { ctx, translate } = await buildContext(req)
     const body = await req.json().catch(() => ({}))
     const input = parseScopedCommandInput(staffTeamMemberTagAssignmentSchema, body, ctx, translate)
+
+    const auth = ctx.auth
+    const tenantId = auth?.tenantId ?? ''
+    const organizationId = ctx.selectedOrganizationId ?? null
+    const guardResult = await runStaffMutationGuards(
+      ctx.container,
+      {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.team_member',
+        resourceId: input.memberId,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        mutationPayload: input,
+      },
+      resolveUserFeatures(auth),
+    )
+    if (!guardResult.ok) {
+      return NextResponse.json(
+        guardResult.errorBody ?? { error: 'Operation blocked by guard' },
+        { status: guardResult.errorStatus ?? 422 },
+      )
+    }
+
     const commandBus = (ctx.container.resolve('commandBus') as CommandBus)
     const { result, logEntry } = await commandBus.execute<StaffTeamMemberTagAssignmentInput, { memberId: string }>(
       'staff.team-members.tags.unassign',
       { input, ctx },
     )
+
+    if (guardResult.afterSuccessCallbacks.length) {
+      await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+        tenantId,
+        organizationId,
+        userId: auth?.sub ?? '',
+        resourceKind: 'staff.team_member',
+        resourceId: result?.memberId ?? input.memberId,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+      })
+    }
+
     const response = NextResponse.json({ id: result?.memberId ?? null })
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
       response.headers.set(

package/src/modules/translations/api/[entityType]/[entityId]/route.ts

@@ -1,9 +1,13 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { sql } from 'kysely'
-import { resolveTranslationsRouteContext, requireTranslationFeatures } from '@open-mercato/core/modules/translations/api/context'
+import { resolveTranslationsRouteContext, requireTranslationFeatures, resolveTranslationsActorId } from '@open-mercato/core/modules/translations/api/context'
 import { translationBodySchema, entityTypeParamSchema, entityIdParamSchema } from '@open-mercato/core/modules/translations/data/validators'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -80,6 +84,22 @@ export async function PUT(req: Request, ctx: { params?: { entityType?: string; e
     }
     const translations = translationBodySchema.parse(rawBody)
 
+    const guardUserId = resolveTranslationsActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'translations.translation',
+      resourceId: `${entityType}:${entityId}`,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: { entityType, entityId, translations },
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const commandBus = context.container.resolve('commandBus') as CommandBus
     const { result, logEntry } = await commandBus.execute<
       { entityType: string; entityId: string; translations: typeof translations; organizationId: string | null; tenantId: string },
@@ -95,6 +115,20 @@ export async function PUT(req: Request, ctx: { params?: { entityType?: string; e
       ctx: context.commandCtx,
     })
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'translations.translation',
+        resourceId: `${entityType}:${entityId}`,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     const row = await (context.db as any)
       .selectFrom('entity_translations')
       .selectAll()
@@ -150,6 +184,22 @@ export async function DELETE(req: Request, ctx: { params?: { entityType?: string
       entityId: ctx.params?.entityId,
     })
 
+    const guardUserId = resolveTranslationsActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'translations.translation',
+      resourceId: `${entityType}:${entityId}`,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const commandBus = context.container.resolve('commandBus') as CommandBus
     const { logEntry } = await commandBus.execute<
       { entityType: string; entityId: string; organizationId: string | null; tenantId: string },
@@ -164,6 +214,20 @@ export async function DELETE(req: Request, ctx: { params?: { entityType?: string
       ctx: context.commandCtx,
     })
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'translations.translation',
+        resourceId: `${entityType}:${entityId}`,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     const response = new NextResponse(null, { status: 204 })
 
     if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {

package/src/modules/translations/api/context.ts

@@ -17,6 +17,13 @@ export type TranslationsRouteContext = {
   commandCtx: CommandRuntimeContext
 }
 
+export function resolveTranslationsActorId(auth: TranslationsRouteContext['auth']): string {
+  if (typeof auth.sub === 'string' && auth.sub.trim().length > 0) return auth.sub
+  if (typeof auth.userId === 'string' && auth.userId.trim().length > 0) return auth.userId
+  if (typeof auth.keyId === 'string' && auth.keyId.trim().length > 0) return auth.keyId
+  return 'system'
+}
+
 export async function resolveTranslationsRouteContext(req: Request): Promise<TranslationsRouteContext> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)

package/src/modules/translations/api/put/locales.ts

@@ -1,7 +1,11 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
-import { resolveTranslationsRouteContext } from '@open-mercato/core/modules/translations/api/context'
+import { resolveTranslationsRouteContext, resolveTranslationsActorId } from '@open-mercato/core/modules/translations/api/context'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 import { isValidIso639 } from '@open-mercato/shared/lib/i18n/iso639'
 import type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -23,9 +27,39 @@ async function PUT(req: Request) {
     const body = bodySchema.parse(await req.json())
     const uniqueLocales = [...new Set(body.locales.map((l) => l.toLowerCase().trim()))]
 
+    const guardUserId = resolveTranslationsActorId(context.auth)
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: guardUserId,
+      resourceKind: 'translations.locales',
+      resourceId: 'supported_locales',
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: { locales: uniqueLocales },
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const configService = context.container.resolve('moduleConfigService') as ModuleConfigService
     await configService.setValue('translations', 'supported_locales', uniqueLocales)
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: guardUserId,
+        resourceKind: 'translations.locales',
+        resourceId: 'supported_locales',
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({ locales: uniqueLocales })
   } catch (err) {
     if (isCrudHttpError(err)) {

package/src/modules/workflows/backend/definitions/visual-editor/page.tsx

@@ -6,10 +6,10 @@ import { NodeEditDialog } from '../../../components/NodeEditDialog'
 import { EdgeEditDialog } from '../../../components/EdgeEditDialog'
 import { NodeEditDialogCrudForm } from '../../../components/NodeEditDialogCrudForm'
 import { EdgeEditDialogCrudForm } from '../../../components/EdgeEditDialogCrudForm'
-import { Node, Edge, addEdge, Connection, applyNodeChanges, applyEdgeChanges, NodeChange, EdgeChange } from '@xyflow/react'
+import type { Node, Edge, Connection } from '@xyflow/react'
 import { useState, useCallback, useEffect } from 'react'
 import { useRouter, useSearchParams } from 'next/navigation'
-import { graphToDefinition, definitionToGraph, validateWorkflowGraph, generateStepId, generateTransitionId, ValidationError } from '../../../lib/graph-utils'
+import { graphToDefinition, definitionToGraph, validateWorkflowGraph, generateStepId, generateTransitionId, appendWorkflowEdge, ValidationError } from '../../../lib/graph-utils'
 import { performDeleteEdgeFlow, performDeleteNodeFlow } from '../../../lib/visual-editor-delete-flow'
 import { workflowDefinitionDataSchema } from '../../../data/validators'
 import { Page } from '@open-mercato/ui/backend/Page'
@@ -169,16 +169,18 @@ export default function VisualEditorPage() {
     loadDefinition()
   }, [definitionId])
 
-  // Handle node changes from ReactFlow
-  const handleNodesChange = useCallback((changes: NodeChange[]) => {
+  // Handle node changes from ReactFlow. The lazy graph applies React Flow's
+  // change reducers internally (#3169) and hands back the resolved nodes, so
+  // this page never imports the @xyflow/react runtime.
+  const handleNodesChange = useCallback((nextNodes: Node[]) => {
     if (isCodeOnly) return
-    setNodes((nds) => applyNodeChanges(changes, nds))
+    setNodes(nextNodes)
   }, [isCodeOnly])
 
-  // Handle edge changes from ReactFlow
-  const handleEdgesChange = useCallback((changes: EdgeChange[]) => {
+  // Handle edge changes from ReactFlow (resolved edges from the lazy graph).
+  const handleEdgesChange = useCallback((nextEdges: Edge[]) => {
     if (isCodeOnly) return
-    setEdges((eds) => applyEdgeChanges(changes, eds))
+    setEdges(nextEdges)
   }, [isCodeOnly])
 
   // Handle adding new node from palette
@@ -285,7 +287,7 @@ export default function VisualEditorPage() {
       },
     }
 
-    setEdges((eds) => addEdge(newEdge, eds))
+    setEdges((eds) => appendWorkflowEdge(eds, newEdge))
   }, [])
 
   // Validate workflow

package/src/modules/workflows/backend/instances/[id]/page.tsx

@@ -18,7 +18,7 @@ import { WorkflowLegend } from '../../../components/WorkflowLegend'
 import { MobileInstanceOverview } from '../../../components/mobile/MobileInstanceOverview'
 import { useIsMobile } from '@open-mercato/ui/hooks/useIsMobile'
 import { definitionToGraph } from '../../../lib/graph-utils'
-import { Node } from '@xyflow/react'
+import type { Node } from '@xyflow/react'
 import { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'
 
 export default function WorkflowInstanceDetailPage({ params }: { params?: { id?: string } }) {

package/src/modules/workflows/components/EdgeEditDialog.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import {Edge} from '@xyflow/react'
+import type {Edge} from '@xyflow/react'
 import {useEffect, useState} from 'react'
 import {
   Dialog,

package/src/modules/workflows/components/EdgeEditDialogCrudForm.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { Edge } from '@xyflow/react'
+import type { Edge } from '@xyflow/react'
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from '@open-mercato/ui/primitives/dialog'
 import { Badge } from '@open-mercato/ui/primitives/badge'

package/src/modules/workflows/components/NodeEditDialog.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import {Node} from '@xyflow/react'
+import type {Node} from '@xyflow/react'
 import {useEffect, useState} from 'react'
 import {Dialog, DialogContent, DialogFooter, DialogHeader, DialogTitle} from '@open-mercato/ui/primitives/dialog'
 import {Button} from '@open-mercato/ui/primitives/button'

package/src/modules/workflows/components/NodeEditDialogCrudForm.tsx

@@ -1,6 +1,6 @@
 'use client'
 
-import { Node } from '@xyflow/react'
+import type { Node } from '@xyflow/react'
 import { useState, useEffect, useCallback, useMemo } from 'react'
 import { Dialog, DialogContent, DialogHeader, DialogTitle, DialogDescription } from '@open-mercato/ui/primitives/dialog'
 import { Badge } from '@open-mercato/ui/primitives/badge'

package/src/modules/workflows/components/WorkflowGraph.tsx

@@ -8,8 +8,8 @@ import { Spinner } from '@open-mercato/ui/primitives/spinner'
 export interface WorkflowGraphProps {
   initialNodes?: Node[]
   initialEdges?: Edge[]
-  onNodesChange?: (changes: any[]) => void
-  onEdgesChange?: (changes: any[]) => void
+  onNodesChange?: (nodes: Node[]) => void
+  onEdgesChange?: (edges: Edge[]) => void
   onNodeClick?: (event: React.MouseEvent, node: Node) => void
   onEdgeClick?: (event: React.MouseEvent, edge: Edge) => void
   onConnect?: (connection: Connection) => void