@open-mercato/core 0.6.6-develop.6205.1.109e4b6a84 → 0.6.6-develop.6227.1.2695efff30

package/dist/modules/currencies/components/CurrencyFetchingConfig.js

@@ -3,7 +3,8 @@ import { Fragment, jsx, jsxs } from "react/jsx-runtime";
 import { useState, useEffect, useCallback, useMemo } from "react";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { apiCall, withScopedApiRequestHeaders } from "@open-mercato/ui/backend/utils/apiCall";
-import { buildOptimisticLockHeader } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { buildOptimisticLockHeader, extractOptimisticLockConflict } from "@open-mercato/ui/backend/utils/optimisticLock";
+import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
 import { Button } from "@open-mercato/ui/primitives/button";
 import { Spinner } from "@open-mercato/ui/primitives/spinner";
 import { Switch } from "@open-mercato/ui/primitives/switch";
@@ -15,23 +16,36 @@ function CurrencyFetchingConfig() {
   const [fetching, setFetching] = useState(null);
   const [initializing, setInitializing] = useState(false);
   const availableProviders = useMemo(() => ["NBP", "Raiffeisen Bank Polska"], []);
+  const mutationContextId = "currencies-fetch-configs:mutation";
+  const { runMutation, retryLastMutation } = useGuardedMutation({
+    contextId: mutationContextId,
+    blockedMessage: t("ui.forms.flash.saveBlocked", "Save blocked by validation")
+  });
   const createProviderConfig = useCallback(async (provider) => {
     try {
-      await apiCall("/api/currencies/fetch-configs", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          provider,
-          isEnabled: false,
-          syncTime: "09:00"
-        })
+      await runMutation({
+        operation: () => apiCall("/api/currencies/fetch-configs", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            provider,
+            isEnabled: false,
+            syncTime: "09:00"
+          })
+        }),
+        context: {
+          formId: mutationContextId,
+          resourceKind: "currencies.fetch_config",
+          retryLastMutation
+        },
+        mutationPayload: { provider, isEnabled: false, syncTime: "09:00" }
       });
     } catch (err) {
       if (!err.message?.includes("already configured")) {
         throw err;
       }
     }
-  }, []);
+  }, [mutationContextId, retryLastMutation, runMutation]);
   const initializeMissingProviders = useCallback(async (providers) => {
     setInitializing(true);
     try {
@@ -70,17 +84,36 @@ function CurrencyFetchingConfig() {
   }, [availableProviders, initializeMissingProviders, t]);
   const toggleEnabled = useCallback(async (configId, currentValue, updatedAt) => {
     try {
-      const { result } = await withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(updatedAt),
-        () => apiCall("/api/currencies/fetch-configs", {
-          method: "PUT",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            id: configId,
-            isEnabled: !currentValue
-          })
-        })
-      );
+      const call = await runMutation({
+        operation: async () => {
+          const response = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(updatedAt),
+            () => apiCall("/api/currencies/fetch-configs", {
+              method: "PUT",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                id: configId,
+                isEnabled: !currentValue
+              })
+            })
+          );
+          if (!response.ok) {
+            throw Object.assign(new Error("[internal] currencies.fetchConfig.toggle failed"), {
+              status: response.status,
+              ...response.result ?? {}
+            });
+          }
+          return response;
+        },
+        context: {
+          formId: mutationContextId,
+          resourceKind: "currencies.fetch_config",
+          resourceId: configId,
+          retryLastMutation
+        },
+        mutationPayload: { id: configId, isEnabled: !currentValue }
+      });
+      const result = call.result;
       if (result?.config) {
         setConfigs(
           (prev) => prev.map((c) => c.id === configId ? result.config : c)
@@ -91,41 +124,71 @@ function CurrencyFetchingConfig() {
         );
       }
     } catch (err) {
+      if (extractOptimisticLockConflict(err)) return;
       flash(err.message || t("currencies.fetch.error_update_config"), "error");
     }
-  }, [t]);
+  }, [mutationContextId, retryLastMutation, runMutation, t]);
   const updateSyncTime = useCallback(async (configId, syncTime, updatedAt) => {
     try {
-      const { result } = await withScopedApiRequestHeaders(
-        buildOptimisticLockHeader(updatedAt),
-        () => apiCall("/api/currencies/fetch-configs", {
-          method: "PUT",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            id: configId,
-            syncTime: syncTime || null
-          })
-        })
-      );
+      const call = await runMutation({
+        operation: async () => {
+          const response = await withScopedApiRequestHeaders(
+            buildOptimisticLockHeader(updatedAt),
+            () => apiCall("/api/currencies/fetch-configs", {
+              method: "PUT",
+              headers: { "Content-Type": "application/json" },
+              body: JSON.stringify({
+                id: configId,
+                syncTime: syncTime || null
+              })
+            })
+          );
+          if (!response.ok) {
+            throw Object.assign(new Error("[internal] currencies.fetchConfig.updateSyncTime failed"), {
+              status: response.status,
+              ...response.result ?? {}
+            });
+          }
+          return response;
+        },
+        context: {
+          formId: mutationContextId,
+          resourceKind: "currencies.fetch_config",
+          resourceId: configId,
+          retryLastMutation
+        },
+        mutationPayload: { id: configId, syncTime: syncTime || null }
+      });
+      const result = call.result;
       if (result?.config) {
         setConfigs(
           (prev) => prev.map((c) => c.id === configId ? result.config : c)
         );
       }
     } catch (err) {
+      if (extractOptimisticLockConflict(err)) return;
       flash(err.message || t("currencies.fetch.error_update_sync_time"), "error");
     }
-  }, [t]);
+  }, [mutationContextId, retryLastMutation, runMutation, t]);
   const fetchNow = useCallback(async (provider) => {
     setFetching(provider);
     try {
-      const { result } = await apiCall("/api/currencies/fetch-rates", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          providers: [provider]
-        })
+      const call = await runMutation({
+        operation: () => apiCall("/api/currencies/fetch-rates", {
+          method: "POST",
+          headers: { "Content-Type": "application/json" },
+          body: JSON.stringify({
+            providers: [provider]
+          })
+        }),
+        context: {
+          formId: mutationContextId,
+          resourceKind: "currencies.fetch_rates",
+          retryLastMutation
+        },
+        mutationPayload: { providers: [provider] }
       });
+      const result = call.result;
       if (result) {
         const byProvider = result.byProvider;
         const count = byProvider?.[provider]?.count || 0;
@@ -141,7 +204,7 @@ function CurrencyFetchingConfig() {
     } finally {
       setFetching(null);
     }
-  }, [t, loadConfigs]);
+  }, [mutationContextId, retryLastMutation, runMutation, t, loadConfigs]);
   useEffect(() => {
     loadConfigs();
   }, [loadConfigs]);

package/dist/modules/currencies/components/CurrencyFetchingConfig.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/currencies/components/CurrencyFetchingConfig.tsx"],
-  "sourcesContent": ["'use client'\n\nimport { useState, useEffect, useCallback, useMemo } from 'react'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { Switch } from '@open-mercato/ui/primitives/switch'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ninterface FetchConfig {\n  id: string\n  provider: string\n  isEnabled: boolean\n  syncTime: string | null\n  lastSyncAt: string | null\n  lastSyncStatus: string | null\n  lastSyncMessage: string | null\n  lastSyncCount: number | null\n  updatedAt?: string | null\n}\n\nexport default function CurrencyFetchingConfig() {\n  const t = useT()\n  const [configs, setConfigs] = useState<FetchConfig[]>([])\n  const [loading, setLoading] = useState(true)\n  const [fetching, setFetching] = useState<string | null>(null)\n  const [initializing, setInitializing] = useState(false)\n\n  // Available providers that should be configured\n  const availableProviders = useMemo(() => ['NBP', 'Raiffeisen Bank Polska'], [])\n\n  const createProviderConfig = useCallback(async (provider: string) => {\n    try {\n      await apiCall('/api/currencies/fetch-configs', {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          provider,\n          isEnabled: false,\n          syncTime: '09:00',\n        }),\n      })\n    } catch (err: any) {\n      // Ignore errors for duplicate providers\n      if (!err.message?.includes('already configured')) {\n        throw err\n      }\n    }\n  }, [])\n\n  const initializeMissingProviders = useCallback(async (providers: string[]) => {\n    setInitializing(true)\n    try {\n      for (const provider of providers) {\n        await createProviderConfig(provider)\n      }\n      // Reload configs after initialization\n      const { result } = await apiCall('/api/currencies/fetch-configs')\n      if (result?.configs) {\n        setConfigs(result.configs as FetchConfig[])\n      }\n    } catch (err: any) {\n      console.error('Failed to initialize providers:', err)\n    } finally {\n      setInitializing(false)\n    }\n  }, [createProviderConfig])\n\n  const loadConfigs = useCallback(async () => {\n    try {\n      const { result } = await apiCall('/api/currencies/fetch-configs')\n\n      if (result?.configs) {\n        const existingConfigs = result.configs as FetchConfig[]\n        setConfigs(existingConfigs)\n\n        // Check if we need to initialize any missing providers\n        const existingProviders = existingConfigs.map((c) => c.provider)\n        const missingProviders = availableProviders.filter(\n          (p) => !existingProviders.includes(p)\n        )\n\n        // Auto-initialize missing providers\n        if (missingProviders.length > 0) {\n          await initializeMissingProviders(missingProviders)\n        }\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.error_load_configs'), 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [availableProviders, initializeMissingProviders, t])\n\n  const toggleEnabled = useCallback(async (configId: string, currentValue: boolean, updatedAt?: string | null) => {\n    try {\n      const { result } = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(updatedAt),\n        () =>\n          apiCall('/api/currencies/fetch-configs', {\n            method: 'PUT',\n            headers: { 'Content-Type': 'application/json' },\n            body: JSON.stringify({\n              id: configId,\n              isEnabled: !currentValue,\n            }),\n          }),\n      )\n\n      if (result?.config) {\n        setConfigs((prev) =>\n          prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))\n        )\n        flash(\n          currentValue\n            ? t('currencies.fetch.provider_disabled')\n            : t('currencies.fetch.provider_enabled'),\n          'success'\n        )\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.error_update_config'), 'error')\n    }\n  }, [t])\n\n  const updateSyncTime = useCallback(async (configId: string, syncTime: string, updatedAt?: string | null) => {\n    try {\n      const { result } = await withScopedApiRequestHeaders(\n        buildOptimisticLockHeader(updatedAt),\n        () =>\n          apiCall('/api/currencies/fetch-configs', {\n            method: 'PUT',\n            headers: { 'Content-Type': 'application/json' },\n            body: JSON.stringify({\n              id: configId,\n              syncTime: syncTime || null,\n            }),\n          }),\n      )\n\n      if (result?.config) {\n        setConfigs((prev) =>\n          prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))\n        )\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.error_update_sync_time'), 'error')\n    }\n  }, [t])\n\n  const fetchNow = useCallback(async (provider: string) => {\n    setFetching(provider)\n\n    try {\n      const { result } = await apiCall('/api/currencies/fetch-rates', {\n        method: 'POST',\n        headers: { 'Content-Type': 'application/json' },\n        body: JSON.stringify({\n          providers: [provider],\n        }),\n      })\n\n      if (result) {\n        const byProvider = result.byProvider as Record<string, { count: number; errors?: string[] }>\n        const count = byProvider?.[provider]?.count || 0\n\n        if (count === 0) {\n          flash(t('currencies.fetch.sync_no_rates'), 'warning')\n        } else {\n          flash(`${t('currencies.fetch.sync_success')}: ${count} rates fetched`, 'success')\n        }\n        await loadConfigs()\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.sync_error'), 'error')\n    } finally {\n      setFetching(null)\n    }\n  }, [t, loadConfigs])\n\n  useEffect(() => {\n    loadConfigs()\n  }, [loadConfigs])\n\n  function formatLastSync(date: string | null): string {\n    if (!date) return 'Never'\n    return new Date(date).toLocaleString()\n  }\n\n  function getStatusBadge(status: string | null) {\n    if (!status) return null\n\n    const styles: Record<string, string> = {\n      success: 'bg-green-100 text-green-800 px-2 py-1 rounded text-xs',\n      error: 'bg-red-100 text-red-800 px-2 py-1 rounded text-xs',\n      partial: 'bg-yellow-100 text-yellow-800 px-2 py-1 rounded text-xs',\n    }\n\n    return (\n      <span className={styles[status] || styles.error}>\n        {status}\n      </span>\n    )\n  }\n\n  function getProviderName(provider: string): string {\n    if (provider === 'NBP') return t('currencies.fetch.provider_nbp')\n    if (provider === 'Raiffeisen Bank Polska') return t('currencies.fetch.provider_raiffeisen')\n    return provider\n  }\n\n  function getProviderDescription(provider: string): string {\n    if (provider === 'NBP') {\n      return t('currencies.fetch.provider_nbp_description')\n    }\n    if (provider === 'Raiffeisen Bank Polska') {\n      return t('currencies.fetch.provider_raiffeisen_description')\n    }\n    return ''\n  }\n\n  if (loading || initializing) {\n    return (\n      <section className=\"space-y-3 rounded-lg border bg-background p-4\">\n        <header className=\"space-y-2\">\n          <h2 className=\"text-xl font-semibold\">{t('currencies.fetch.title')}</h2>\n          <p className=\"text-sm text-muted-foreground\">\n            {t('currencies.fetch.description')}\n          </p>\n        </header>\n        <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n          <Spinner className=\"h-4 w-4\" />\n          {initializing ? t('currencies.fetch.initializing_providers') : t('currencies.fetch.loading')}\n        </div>\n      </section>\n    )\n  }\n\n  return (\n    <section className=\"space-y-6 rounded-lg border bg-background p-4\">\n      <header className=\"space-y-2\">\n        <h2 className=\"text-xl font-semibold\">{t('currencies.fetch.title')}</h2>\n        <p className=\"text-sm text-muted-foreground\">\n          {t('currencies.fetch.description')}\n        </p>\n      </header>\n\n      <div className=\"space-y-3\">\n        {configs.map((config) => (\n          <div\n            key={config.id}\n            className=\"rounded-lg border bg-card p-4\"\n          >\n            <div className=\"flex items-start justify-between gap-4\">\n              <div className=\"flex-1\">\n                <h3 className=\"text-sm font-medium\">\n                  {getProviderName(config.provider)}\n                </h3>\n                <p className=\"text-xs text-muted-foreground mt-0.5\">\n                  {getProviderDescription(config.provider)}\n                </p>\n              </div>\n\n              <Switch\n                checked={config.isEnabled}\n                onCheckedChange={() => toggleEnabled(config.id, config.isEnabled, config.updatedAt)}\n              />\n            </div>\n\n            {config.isEnabled && (\n              <>\n                <div className=\"flex items-baseline gap-3 flex-wrap mt-3\">\n                  <div className=\"flex items-baseline gap-2\">\n                    <label className=\"text-xs text-muted-foreground whitespace-nowrap\">\n                      {t('currencies.fetch.sync_time')}:\n                    </label>\n                    <input\n                      type=\"time\"\n                      value={config.syncTime || '09:00'}\n                      onChange={(e) => updateSyncTime(config.id, e.target.value, config.updatedAt)}\n                      className=\"rounded border bg-background px-2 py-1.5 text-sm\"\n                    />\n                  </div>\n\n                  <div className=\"flex items-baseline gap-2\">\n                    <label className=\"text-xs text-muted-foreground whitespace-nowrap\">\n                      {t('currencies.fetch.last_sync')}:\n                    </label>\n                    <span className=\"text-xs text-muted-foreground\">\n                      {formatLastSync(config.lastSyncAt)}\n                    </span>\n                    {getStatusBadge(config.lastSyncStatus)}\n                  </div>\n\n                  <Button\n                    onClick={() => fetchNow(config.provider)}\n                    disabled={fetching === config.provider}\n                    size=\"default\"\n                    className=\"ml-auto min-w-32\"\n                  >\n                    {fetching === config.provider ? (\n                      <div>\n                        <Spinner className=\"mr-1.5\" size='sm' />\n                        {t('currencies.fetch.fetching')}\n                      </div>\n                    ) : (\n                      t('currencies.fetch.fetch_now')\n                    )}\n                  </Button>\n                </div>\n\n                {config.lastSyncCount !== null && (\n                  <div className=\"text-xs text-muted-foreground mt-2\">\n                    {t('currencies.fetch.last_sync_count')}: <span className=\"font-medium\">{config.lastSyncCount}</span> rates\n                  </div>\n                )}\n\n                {config.lastSyncMessage && config.lastSyncStatus === 'error' && (\n                  <div className=\"rounded border border-red-200 bg-red-50 p-2 text-xs text-red-700 mt-2\">\n                    {config.lastSyncMessage}\n                  </div>\n                )}\n              </>\n            )}\n          </div>\n        ))}\n\n        {configs.length === 0 && (\n          <div className=\"rounded border bg-background/80 p-6 text-center\">\n            <p className=\"text-sm text-muted-foreground\">\n              {t('currencies.fetch.no_providers')}\n            </p>\n            <Button\n              onClick={() => initializeMissingProviders(availableProviders)}\n            >\n              {t('currencies.fetch.initialize_providers')}\n            </Button>\n          </div>\n        )}\n      </div>\n    </section>\n  )\n}\n"],
-  "mappings": ";AAyMM,SAuEQ,UAvER,KAyBE,YAzBF;AAvMN,SAAS,UAAU,WAAW,aAAa,eAAe;AAC1D,SAAS,aAAa;AACtB,SAAS,SAAS,mCAAmC;AACrD,SAAS,iCAAiC;AAC1C,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,YAAY;AAcN,SAAR,yBAA0C;AAC/C,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,SAAwB,CAAC,CAAC;AACxD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAC5D,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,KAAK;AAGtD,QAAM,qBAAqB,QAAQ,MAAM,CAAC,OAAO,wBAAwB,GAAG,CAAC,CAAC;AAE9E,QAAM,uBAAuB,YAAY,OAAO,aAAqB;AACnE,QAAI;AACF,YAAM,QAAQ,iCAAiC;AAAA,QAC7C,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB;AAAA,UACA,WAAW;AAAA,UACX,UAAU;AAAA,QACZ,CAAC;AAAA,MACH,CAAC;AAAA,IACH,SAAS,KAAU;AAEjB,UAAI,CAAC,IAAI,SAAS,SAAS,oBAAoB,GAAG;AAChD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,GAAG,CAAC,CAAC;AAEL,QAAM,6BAA6B,YAAY,OAAO,cAAwB;AAC5E,oBAAgB,IAAI;AACpB,QAAI;AACF,iBAAW,YAAY,WAAW;AAChC,cAAM,qBAAqB,QAAQ;AAAA,MACrC;AAEA,YAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,+BAA+B;AAChE,UAAI,QAAQ,SAAS;AACnB,mBAAW,OAAO,OAAwB;AAAA,MAC5C;AAAA,IACF,SAAS,KAAU;AACjB,cAAQ,MAAM,mCAAmC,GAAG;AAAA,IACtD,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,oBAAoB,CAAC;AAEzB,QAAM,cAAc,YAAY,YAAY;AAC1C,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,+BAA+B;AAEhE,UAAI,QAAQ,SAAS;AACnB,cAAM,kBAAkB,OAAO;AAC/B,mBAAW,eAAe;AAG1B,cAAM,oBAAoB,gBAAgB,IAAI,CAAC,MAAM,EAAE,QAAQ;AAC/D,cAAM,mBAAmB,mBAAmB;AAAA,UAC1C,CAAC,MAAM,CAAC,kBAAkB,SAAS,CAAC;AAAA,QACtC;AAGA,YAAI,iBAAiB,SAAS,GAAG;AAC/B,gBAAM,2BAA2B,gBAAgB;AAAA,QACnD;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,qCAAqC,GAAG,OAAO;AAAA,IACxE,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,oBAAoB,4BAA4B,CAAC,CAAC;AAEtD,QAAM,gBAAgB,YAAY,OAAO,UAAkB,cAAuB,cAA8B;AAC9G,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM;AAAA,QACvB,0BAA0B,SAAS;AAAA,QACnC,MACE,QAAQ,iCAAiC;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU;AAAA,YACnB,IAAI;AAAA,YACJ,WAAW,CAAC;AAAA,UACd,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAEA,UAAI,QAAQ,QAAQ;AAClB;AAAA,UAAW,CAAC,SACV,KAAK,IAAI,CAAC,MAAO,EAAE,OAAO,WAAY,OAAO,SAAyB,CAAE;AAAA,QAC1E;AACA;AAAA,UACE,eACI,EAAE,oCAAoC,IACtC,EAAE,mCAAmC;AAAA,UACzC;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,sCAAsC,GAAG,OAAO;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,iBAAiB,YAAY,OAAO,UAAkB,UAAkB,cAA8B;AAC1G,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM;AAAA,QACvB,0BAA0B,SAAS;AAAA,QACnC,MACE,QAAQ,iCAAiC;AAAA,UACvC,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU;AAAA,YACnB,IAAI;AAAA,YACJ,UAAU,YAAY;AAAA,UACxB,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAEA,UAAI,QAAQ,QAAQ;AAClB;AAAA,UAAW,CAAC,SACV,KAAK,IAAI,CAAC,MAAO,EAAE,OAAO,WAAY,OAAO,SAAyB,CAAE;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,yCAAyC,GAAG,OAAO;AAAA,IAC5E;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,WAAW,YAAY,OAAO,aAAqB;AACvD,gBAAY,QAAQ;AAEpB,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,+BAA+B;AAAA,QAC9D,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,WAAW,CAAC,QAAQ;AAAA,QACtB,CAAC;AAAA,MACH,CAAC;AAED,UAAI,QAAQ;AACV,cAAM,aAAa,OAAO;AAC1B,cAAM,QAAQ,aAAa,QAAQ,GAAG,SAAS;AAE/C,YAAI,UAAU,GAAG;AACf,gBAAM,EAAE,gCAAgC,GAAG,SAAS;AAAA,QACtD,OAAO;AACL,gBAAM,GAAG,EAAE,+BAA+B,CAAC,KAAK,KAAK,kBAAkB,SAAS;AAAA,QAClF;AACA,cAAM,YAAY;AAAA,MACpB;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,6BAA6B,GAAG,OAAO;AAAA,IAChE,UAAE;AACA,kBAAY,IAAI;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,GAAG,WAAW,CAAC;AAEnB,YAAU,MAAM;AACd,gBAAY;AAAA,EACd,GAAG,CAAC,WAAW,CAAC;AAEhB,WAAS,eAAe,MAA6B;AACnD,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,IAAI,KAAK,IAAI,EAAE,eAAe;AAAA,EACvC;AAEA,WAAS,eAAe,QAAuB;AAC7C,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAiC;AAAA,MACrC,SAAS;AAAA,MACT,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAEA,WACE,oBAAC,UAAK,WAAW,OAAO,MAAM,KAAK,OAAO,OACvC,kBACH;AAAA,EAEJ;AAEA,WAAS,gBAAgB,UAA0B;AACjD,QAAI,aAAa,MAAO,QAAO,EAAE,+BAA+B;AAChE,QAAI,aAAa,yBAA0B,QAAO,EAAE,sCAAsC;AAC1F,WAAO;AAAA,EACT;AAEA,WAAS,uBAAuB,UAA0B;AACxD,QAAI,aAAa,OAAO;AACtB,aAAO,EAAE,2CAA2C;AAAA,IACtD;AACA,QAAI,aAAa,0BAA0B;AACzC,aAAO,EAAE,kDAAkD;AAAA,IAC7D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,cAAc;AAC3B,WACE,qBAAC,aAAQ,WAAU,iDACjB;AAAA,2BAAC,YAAO,WAAU,aAChB;AAAA,4BAAC,QAAG,WAAU,yBAAyB,YAAE,wBAAwB,GAAE;AAAA,QACnE,oBAAC,OAAE,WAAU,iCACV,YAAE,8BAA8B,GACnC;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,yDACb;AAAA,4BAAC,WAAQ,WAAU,WAAU;AAAA,QAC5B,eAAe,EAAE,yCAAyC,IAAI,EAAE,0BAA0B;AAAA,SAC7F;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,qBAAC,aAAQ,WAAU,iDACjB;AAAA,yBAAC,YAAO,WAAU,aAChB;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,wBAAwB,GAAE;AAAA,MACnE,oBAAC,OAAE,WAAU,iCACV,YAAE,8BAA8B,GACnC;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,aACZ;AAAA,cAAQ,IAAI,CAAC,WACZ;AAAA,QAAC;AAAA;AAAA,UAEC,WAAU;AAAA,UAEV;AAAA,iCAAC,SAAI,WAAU,0CACb;AAAA,mCAAC,SAAI,WAAU,UACb;AAAA,oCAAC,QAAG,WAAU,uBACX,0BAAgB,OAAO,QAAQ,GAClC;AAAA,gBACA,oBAAC,OAAE,WAAU,wCACV,iCAAuB,OAAO,QAAQ,GACzC;AAAA,iBACF;AAAA,cAEA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAS,OAAO;AAAA,kBAChB,iBAAiB,MAAM,cAAc,OAAO,IAAI,OAAO,WAAW,OAAO,SAAS;AAAA;AAAA,cACpF;AAAA,eACF;AAAA,YAEC,OAAO,aACN,iCACE;AAAA,mCAAC,SAAI,WAAU,4CACb;AAAA,qCAAC,SAAI,WAAU,6BACb;AAAA,uCAAC,WAAM,WAAU,mDACd;AAAA,sBAAE,4BAA4B;AAAA,oBAAE;AAAA,qBACnC;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,MAAK;AAAA,sBACL,OAAO,OAAO,YAAY;AAAA,sBAC1B,UAAU,CAAC,MAAM,eAAe,OAAO,IAAI,EAAE,OAAO,OAAO,OAAO,SAAS;AAAA,sBAC3E,WAAU;AAAA;AAAA,kBACZ;AAAA,mBACF;AAAA,gBAEA,qBAAC,SAAI,WAAU,6BACb;AAAA,uCAAC,WAAM,WAAU,mDACd;AAAA,sBAAE,4BAA4B;AAAA,oBAAE;AAAA,qBACnC;AAAA,kBACA,oBAAC,UAAK,WAAU,iCACb,yBAAe,OAAO,UAAU,GACnC;AAAA,kBACC,eAAe,OAAO,cAAc;AAAA,mBACvC;AAAA,gBAEA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,MAAM,SAAS,OAAO,QAAQ;AAAA,oBACvC,UAAU,aAAa,OAAO;AAAA,oBAC9B,MAAK;AAAA,oBACL,WAAU;AAAA,oBAET,uBAAa,OAAO,WACnB,qBAAC,SACC;AAAA,0CAAC,WAAQ,WAAU,UAAS,MAAK,MAAK;AAAA,sBACrC,EAAE,2BAA2B;AAAA,uBAChC,IAEA,EAAE,4BAA4B;AAAA;AAAA,gBAElC;AAAA,iBACF;AAAA,cAEC,OAAO,kBAAkB,QACxB,qBAAC,SAAI,WAAU,sCACZ;AAAA,kBAAE,kCAAkC;AAAA,gBAAE;AAAA,gBAAE,oBAAC,UAAK,WAAU,eAAe,iBAAO,eAAc;AAAA,gBAAO;AAAA,iBACtG;AAAA,cAGD,OAAO,mBAAmB,OAAO,mBAAmB,WACnD,oBAAC,SAAI,WAAU,yEACZ,iBAAO,iBACV;AAAA,eAEJ;AAAA;AAAA;AAAA,QAxEG,OAAO;AAAA,MA0Ed,CACD;AAAA,MAEA,QAAQ,WAAW,KAClB,qBAAC,SAAI,WAAU,mDACb;AAAA,4BAAC,OAAE,WAAU,iCACV,YAAE,+BAA+B,GACpC;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS,MAAM,2BAA2B,kBAAkB;AAAA,YAE3D,YAAE,uCAAuC;AAAA;AAAA,QAC5C;AAAA,SACF;AAAA,OAEJ;AAAA,KACF;AAEJ;",
+  "sourcesContent": ["'use client'\n\nimport { useState, useEffect, useCallback, useMemo } from 'react'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'\nimport { buildOptimisticLockHeader, extractOptimisticLockConflict } from '@open-mercato/ui/backend/utils/optimisticLock'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { Switch } from '@open-mercato/ui/primitives/switch'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ninterface FetchConfig {\n  id: string\n  provider: string\n  isEnabled: boolean\n  syncTime: string | null\n  lastSyncAt: string | null\n  lastSyncStatus: string | null\n  lastSyncMessage: string | null\n  lastSyncCount: number | null\n  updatedAt?: string | null\n}\n\nexport default function CurrencyFetchingConfig() {\n  const t = useT()\n  const [configs, setConfigs] = useState<FetchConfig[]>([])\n  const [loading, setLoading] = useState(true)\n  const [fetching, setFetching] = useState<string | null>(null)\n  const [initializing, setInitializing] = useState(false)\n\n  // Available providers that should be configured\n  const availableProviders = useMemo(() => ['NBP', 'Raiffeisen Bank Polska'], [])\n\n  const mutationContextId = 'currencies-fetch-configs:mutation'\n  const { runMutation, retryLastMutation } = useGuardedMutation<{\n    formId: string\n    resourceKind: string\n    resourceId?: string\n    retryLastMutation: () => Promise<boolean>\n  }>({\n    contextId: mutationContextId,\n    blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),\n  })\n\n  const createProviderConfig = useCallback(async (provider: string) => {\n    try {\n      await runMutation({\n        operation: () => apiCall('/api/currencies/fetch-configs', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({\n            provider,\n            isEnabled: false,\n            syncTime: '09:00',\n          }),\n        }),\n        context: {\n          formId: mutationContextId,\n          resourceKind: 'currencies.fetch_config',\n          retryLastMutation,\n        },\n        mutationPayload: { provider, isEnabled: false, syncTime: '09:00' },\n      })\n    } catch (err: any) {\n      // Ignore errors for duplicate providers\n      if (!err.message?.includes('already configured')) {\n        throw err\n      }\n    }\n  }, [mutationContextId, retryLastMutation, runMutation])\n\n  const initializeMissingProviders = useCallback(async (providers: string[]) => {\n    setInitializing(true)\n    try {\n      for (const provider of providers) {\n        await createProviderConfig(provider)\n      }\n      // Reload configs after initialization\n      const { result } = await apiCall('/api/currencies/fetch-configs')\n      if (result?.configs) {\n        setConfigs(result.configs as FetchConfig[])\n      }\n    } catch (err: any) {\n      console.error('Failed to initialize providers:', err)\n    } finally {\n      setInitializing(false)\n    }\n  }, [createProviderConfig])\n\n  const loadConfigs = useCallback(async () => {\n    try {\n      const { result } = await apiCall('/api/currencies/fetch-configs')\n\n      if (result?.configs) {\n        const existingConfigs = result.configs as FetchConfig[]\n        setConfigs(existingConfigs)\n\n        // Check if we need to initialize any missing providers\n        const existingProviders = existingConfigs.map((c) => c.provider)\n        const missingProviders = availableProviders.filter(\n          (p) => !existingProviders.includes(p)\n        )\n\n        // Auto-initialize missing providers\n        if (missingProviders.length > 0) {\n          await initializeMissingProviders(missingProviders)\n        }\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.error_load_configs'), 'error')\n    } finally {\n      setLoading(false)\n    }\n  }, [availableProviders, initializeMissingProviders, t])\n\n  const toggleEnabled = useCallback(async (configId: string, currentValue: boolean, updatedAt?: string | null) => {\n    try {\n      const call = await runMutation({\n        operation: async () => {\n          const response = await withScopedApiRequestHeaders(\n            buildOptimisticLockHeader(updatedAt),\n            () =>\n              apiCall('/api/currencies/fetch-configs', {\n                method: 'PUT',\n                headers: { 'Content-Type': 'application/json' },\n                body: JSON.stringify({\n                  id: configId,\n                  isEnabled: !currentValue,\n                }),\n              }),\n          )\n          if (!response.ok) {\n            throw Object.assign(new Error('[internal] currencies.fetchConfig.toggle failed'), {\n              status: response.status,\n              ...((response.result as Record<string, unknown> | null) ?? {}),\n            })\n          }\n          return response\n        },\n        context: {\n          formId: mutationContextId,\n          resourceKind: 'currencies.fetch_config',\n          resourceId: configId,\n          retryLastMutation,\n        },\n        mutationPayload: { id: configId, isEnabled: !currentValue },\n      })\n\n      const result = call.result as { config?: FetchConfig } | null\n      if (result?.config) {\n        setConfigs((prev) =>\n          prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))\n        )\n        flash(\n          currentValue\n            ? t('currencies.fetch.provider_disabled')\n            : t('currencies.fetch.provider_enabled'),\n          'success'\n        )\n      }\n    } catch (err: any) {\n      if (extractOptimisticLockConflict(err)) return\n      flash(err.message || t('currencies.fetch.error_update_config'), 'error')\n    }\n  }, [mutationContextId, retryLastMutation, runMutation, t])\n\n  const updateSyncTime = useCallback(async (configId: string, syncTime: string, updatedAt?: string | null) => {\n    try {\n      const call = await runMutation({\n        operation: async () => {\n          const response = await withScopedApiRequestHeaders(\n            buildOptimisticLockHeader(updatedAt),\n            () =>\n              apiCall('/api/currencies/fetch-configs', {\n                method: 'PUT',\n                headers: { 'Content-Type': 'application/json' },\n                body: JSON.stringify({\n                  id: configId,\n                  syncTime: syncTime || null,\n                }),\n              }),\n          )\n          if (!response.ok) {\n            throw Object.assign(new Error('[internal] currencies.fetchConfig.updateSyncTime failed'), {\n              status: response.status,\n              ...((response.result as Record<string, unknown> | null) ?? {}),\n            })\n          }\n          return response\n        },\n        context: {\n          formId: mutationContextId,\n          resourceKind: 'currencies.fetch_config',\n          resourceId: configId,\n          retryLastMutation,\n        },\n        mutationPayload: { id: configId, syncTime: syncTime || null },\n      })\n\n      const result = call.result as { config?: FetchConfig } | null\n      if (result?.config) {\n        setConfigs((prev) =>\n          prev.map((c) => (c.id === configId ? (result.config as FetchConfig) : c))\n        )\n      }\n    } catch (err: any) {\n      if (extractOptimisticLockConflict(err)) return\n      flash(err.message || t('currencies.fetch.error_update_sync_time'), 'error')\n    }\n  }, [mutationContextId, retryLastMutation, runMutation, t])\n\n  const fetchNow = useCallback(async (provider: string) => {\n    setFetching(provider)\n\n    try {\n      const call = await runMutation({\n        operation: () => apiCall('/api/currencies/fetch-rates', {\n          method: 'POST',\n          headers: { 'Content-Type': 'application/json' },\n          body: JSON.stringify({\n            providers: [provider],\n          }),\n        }),\n        context: {\n          formId: mutationContextId,\n          resourceKind: 'currencies.fetch_rates',\n          retryLastMutation,\n        },\n        mutationPayload: { providers: [provider] },\n      })\n\n      const result = call.result as { byProvider?: Record<string, { count: number; errors?: string[] }> } | null\n      if (result) {\n        const byProvider = result.byProvider as Record<string, { count: number; errors?: string[] }>\n        const count = byProvider?.[provider]?.count || 0\n\n        if (count === 0) {\n          flash(t('currencies.fetch.sync_no_rates'), 'warning')\n        } else {\n          flash(`${t('currencies.fetch.sync_success')}: ${count} rates fetched`, 'success')\n        }\n        await loadConfigs()\n      }\n    } catch (err: any) {\n      flash(err.message || t('currencies.fetch.sync_error'), 'error')\n    } finally {\n      setFetching(null)\n    }\n  }, [mutationContextId, retryLastMutation, runMutation, t, loadConfigs])\n\n  useEffect(() => {\n    loadConfigs()\n  }, [loadConfigs])\n\n  function formatLastSync(date: string | null): string {\n    if (!date) return 'Never'\n    return new Date(date).toLocaleString()\n  }\n\n  function getStatusBadge(status: string | null) {\n    if (!status) return null\n\n    const styles: Record<string, string> = {\n      success: 'bg-green-100 text-green-800 px-2 py-1 rounded text-xs',\n      error: 'bg-red-100 text-red-800 px-2 py-1 rounded text-xs',\n      partial: 'bg-yellow-100 text-yellow-800 px-2 py-1 rounded text-xs',\n    }\n\n    return (\n      <span className={styles[status] || styles.error}>\n        {status}\n      </span>\n    )\n  }\n\n  function getProviderName(provider: string): string {\n    if (provider === 'NBP') return t('currencies.fetch.provider_nbp')\n    if (provider === 'Raiffeisen Bank Polska') return t('currencies.fetch.provider_raiffeisen')\n    return provider\n  }\n\n  function getProviderDescription(provider: string): string {\n    if (provider === 'NBP') {\n      return t('currencies.fetch.provider_nbp_description')\n    }\n    if (provider === 'Raiffeisen Bank Polska') {\n      return t('currencies.fetch.provider_raiffeisen_description')\n    }\n    return ''\n  }\n\n  if (loading || initializing) {\n    return (\n      <section className=\"space-y-3 rounded-lg border bg-background p-4\">\n        <header className=\"space-y-2\">\n          <h2 className=\"text-xl font-semibold\">{t('currencies.fetch.title')}</h2>\n          <p className=\"text-sm text-muted-foreground\">\n            {t('currencies.fetch.description')}\n          </p>\n        </header>\n        <div className=\"flex items-center gap-2 text-sm text-muted-foreground\">\n          <Spinner className=\"h-4 w-4\" />\n          {initializing ? t('currencies.fetch.initializing_providers') : t('currencies.fetch.loading')}\n        </div>\n      </section>\n    )\n  }\n\n  return (\n    <section className=\"space-y-6 rounded-lg border bg-background p-4\">\n      <header className=\"space-y-2\">\n        <h2 className=\"text-xl font-semibold\">{t('currencies.fetch.title')}</h2>\n        <p className=\"text-sm text-muted-foreground\">\n          {t('currencies.fetch.description')}\n        </p>\n      </header>\n\n      <div className=\"space-y-3\">\n        {configs.map((config) => (\n          <div\n            key={config.id}\n            className=\"rounded-lg border bg-card p-4\"\n          >\n            <div className=\"flex items-start justify-between gap-4\">\n              <div className=\"flex-1\">\n                <h3 className=\"text-sm font-medium\">\n                  {getProviderName(config.provider)}\n                </h3>\n                <p className=\"text-xs text-muted-foreground mt-0.5\">\n                  {getProviderDescription(config.provider)}\n                </p>\n              </div>\n\n              <Switch\n                checked={config.isEnabled}\n                onCheckedChange={() => toggleEnabled(config.id, config.isEnabled, config.updatedAt)}\n              />\n            </div>\n\n            {config.isEnabled && (\n              <>\n                <div className=\"flex items-baseline gap-3 flex-wrap mt-3\">\n                  <div className=\"flex items-baseline gap-2\">\n                    <label className=\"text-xs text-muted-foreground whitespace-nowrap\">\n                      {t('currencies.fetch.sync_time')}:\n                    </label>\n                    <input\n                      type=\"time\"\n                      value={config.syncTime || '09:00'}\n                      onChange={(e) => updateSyncTime(config.id, e.target.value, config.updatedAt)}\n                      className=\"rounded border bg-background px-2 py-1.5 text-sm\"\n                    />\n                  </div>\n\n                  <div className=\"flex items-baseline gap-2\">\n                    <label className=\"text-xs text-muted-foreground whitespace-nowrap\">\n                      {t('currencies.fetch.last_sync')}:\n                    </label>\n                    <span className=\"text-xs text-muted-foreground\">\n                      {formatLastSync(config.lastSyncAt)}\n                    </span>\n                    {getStatusBadge(config.lastSyncStatus)}\n                  </div>\n\n                  <Button\n                    onClick={() => fetchNow(config.provider)}\n                    disabled={fetching === config.provider}\n                    size=\"default\"\n                    className=\"ml-auto min-w-32\"\n                  >\n                    {fetching === config.provider ? (\n                      <div>\n                        <Spinner className=\"mr-1.5\" size='sm' />\n                        {t('currencies.fetch.fetching')}\n                      </div>\n                    ) : (\n                      t('currencies.fetch.fetch_now')\n                    )}\n                  </Button>\n                </div>\n\n                {config.lastSyncCount !== null && (\n                  <div className=\"text-xs text-muted-foreground mt-2\">\n                    {t('currencies.fetch.last_sync_count')}: <span className=\"font-medium\">{config.lastSyncCount}</span> rates\n                  </div>\n                )}\n\n                {config.lastSyncMessage && config.lastSyncStatus === 'error' && (\n                  <div className=\"rounded border border-red-200 bg-red-50 p-2 text-xs text-red-700 mt-2\">\n                    {config.lastSyncMessage}\n                  </div>\n                )}\n              </>\n            )}\n          </div>\n        ))}\n\n        {configs.length === 0 && (\n          <div className=\"rounded border bg-background/80 p-6 text-center\">\n            <p className=\"text-sm text-muted-foreground\">\n              {t('currencies.fetch.no_providers')}\n            </p>\n            <Button\n              onClick={() => initializeMissingProviders(availableProviders)}\n            >\n              {t('currencies.fetch.initialize_providers')}\n            </Button>\n          </div>\n        )}\n      </div>\n    </section>\n  )\n}\n"],
+  "mappings": ";AA8QM,SAuEQ,UAvER,KAyBE,YAzBF;AA5QN,SAAS,UAAU,WAAW,aAAa,eAAe;AAC1D,SAAS,aAAa;AACtB,SAAS,SAAS,mCAAmC;AACrD,SAAS,2BAA2B,qCAAqC;AACzE,SAAS,0BAA0B;AACnC,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,cAAc;AACvB,SAAS,YAAY;AAcN,SAAR,yBAA0C;AAC/C,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,SAAS,UAAU,IAAI,SAAwB,CAAC,CAAC;AACxD,QAAM,CAAC,SAAS,UAAU,IAAI,SAAS,IAAI;AAC3C,QAAM,CAAC,UAAU,WAAW,IAAI,SAAwB,IAAI;AAC5D,QAAM,CAAC,cAAc,eAAe,IAAI,SAAS,KAAK;AAGtD,QAAM,qBAAqB,QAAQ,MAAM,CAAC,OAAO,wBAAwB,GAAG,CAAC,CAAC;AAE9E,QAAM,oBAAoB;AAC1B,QAAM,EAAE,aAAa,kBAAkB,IAAI,mBAKxC;AAAA,IACD,WAAW;AAAA,IACX,gBAAgB,EAAE,8BAA8B,4BAA4B;AAAA,EAC9E,CAAC;AAED,QAAM,uBAAuB,YAAY,OAAO,aAAqB;AACnE,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,WAAW,MAAM,QAAQ,iCAAiC;AAAA,UACxD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU;AAAA,YACnB;AAAA,YACA,WAAW;AAAA,YACX,UAAU;AAAA,UACZ,CAAC;AAAA,QACH,CAAC;AAAA,QACD,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB,EAAE,UAAU,WAAW,OAAO,UAAU,QAAQ;AAAA,MACnE,CAAC;AAAA,IACH,SAAS,KAAU;AAEjB,UAAI,CAAC,IAAI,SAAS,SAAS,oBAAoB,GAAG;AAChD,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF,GAAG,CAAC,mBAAmB,mBAAmB,WAAW,CAAC;AAEtD,QAAM,6BAA6B,YAAY,OAAO,cAAwB;AAC5E,oBAAgB,IAAI;AACpB,QAAI;AACF,iBAAW,YAAY,WAAW;AAChC,cAAM,qBAAqB,QAAQ;AAAA,MACrC;AAEA,YAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,+BAA+B;AAChE,UAAI,QAAQ,SAAS;AACnB,mBAAW,OAAO,OAAwB;AAAA,MAC5C;AAAA,IACF,SAAS,KAAU;AACjB,cAAQ,MAAM,mCAAmC,GAAG;AAAA,IACtD,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF,GAAG,CAAC,oBAAoB,CAAC;AAEzB,QAAM,cAAc,YAAY,YAAY;AAC1C,QAAI;AACF,YAAM,EAAE,OAAO,IAAI,MAAM,QAAQ,+BAA+B;AAEhE,UAAI,QAAQ,SAAS;AACnB,cAAM,kBAAkB,OAAO;AAC/B,mBAAW,eAAe;AAG1B,cAAM,oBAAoB,gBAAgB,IAAI,CAAC,MAAM,EAAE,QAAQ;AAC/D,cAAM,mBAAmB,mBAAmB;AAAA,UAC1C,CAAC,MAAM,CAAC,kBAAkB,SAAS,CAAC;AAAA,QACtC;AAGA,YAAI,iBAAiB,SAAS,GAAG;AAC/B,gBAAM,2BAA2B,gBAAgB;AAAA,QACnD;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,qCAAqC,GAAG,OAAO;AAAA,IACxE,UAAE;AACA,iBAAW,KAAK;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,oBAAoB,4BAA4B,CAAC,CAAC;AAEtD,QAAM,gBAAgB,YAAY,OAAO,UAAkB,cAAuB,cAA8B;AAC9G,QAAI;AACF,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,WAAW,YAAY;AACrB,gBAAM,WAAW,MAAM;AAAA,YACrB,0BAA0B,SAAS;AAAA,YACnC,MACE,QAAQ,iCAAiC;AAAA,cACvC,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,IAAI;AAAA,gBACJ,WAAW,CAAC;AAAA,cACd,CAAC;AAAA,YACH,CAAC;AAAA,UACL;AACA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,OAAO,OAAO,IAAI,MAAM,iDAAiD,GAAG;AAAA,cAChF,QAAQ,SAAS;AAAA,cACjB,GAAK,SAAS,UAA6C,CAAC;AAAA,YAC9D,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,QACT;AAAA,QACA,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,YAAY;AAAA,UACZ;AAAA,QACF;AAAA,QACA,iBAAiB,EAAE,IAAI,UAAU,WAAW,CAAC,aAAa;AAAA,MAC5D,CAAC;AAED,YAAM,SAAS,KAAK;AACpB,UAAI,QAAQ,QAAQ;AAClB;AAAA,UAAW,CAAC,SACV,KAAK,IAAI,CAAC,MAAO,EAAE,OAAO,WAAY,OAAO,SAAyB,CAAE;AAAA,QAC1E;AACA;AAAA,UACE,eACI,EAAE,oCAAoC,IACtC,EAAE,mCAAmC;AAAA,UACzC;AAAA,QACF;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,UAAI,8BAA8B,GAAG,EAAG;AACxC,YAAM,IAAI,WAAW,EAAE,sCAAsC,GAAG,OAAO;AAAA,IACzE;AAAA,EACF,GAAG,CAAC,mBAAmB,mBAAmB,aAAa,CAAC,CAAC;AAEzD,QAAM,iBAAiB,YAAY,OAAO,UAAkB,UAAkB,cAA8B;AAC1G,QAAI;AACF,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,WAAW,YAAY;AACrB,gBAAM,WAAW,MAAM;AAAA,YACrB,0BAA0B,SAAS;AAAA,YACnC,MACE,QAAQ,iCAAiC;AAAA,cACvC,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,IAAI;AAAA,gBACJ,UAAU,YAAY;AAAA,cACxB,CAAC;AAAA,YACH,CAAC;AAAA,UACL;AACA,cAAI,CAAC,SAAS,IAAI;AAChB,kBAAM,OAAO,OAAO,IAAI,MAAM,yDAAyD,GAAG;AAAA,cACxF,QAAQ,SAAS;AAAA,cACjB,GAAK,SAAS,UAA6C,CAAC;AAAA,YAC9D,CAAC;AAAA,UACH;AACA,iBAAO;AAAA,QACT;AAAA,QACA,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd,YAAY;AAAA,UACZ;AAAA,QACF;AAAA,QACA,iBAAiB,EAAE,IAAI,UAAU,UAAU,YAAY,KAAK;AAAA,MAC9D,CAAC;AAED,YAAM,SAAS,KAAK;AACpB,UAAI,QAAQ,QAAQ;AAClB;AAAA,UAAW,CAAC,SACV,KAAK,IAAI,CAAC,MAAO,EAAE,OAAO,WAAY,OAAO,SAAyB,CAAE;AAAA,QAC1E;AAAA,MACF;AAAA,IACF,SAAS,KAAU;AACjB,UAAI,8BAA8B,GAAG,EAAG;AACxC,YAAM,IAAI,WAAW,EAAE,yCAAyC,GAAG,OAAO;AAAA,IAC5E;AAAA,EACF,GAAG,CAAC,mBAAmB,mBAAmB,aAAa,CAAC,CAAC;AAEzD,QAAM,WAAW,YAAY,OAAO,aAAqB;AACvD,gBAAY,QAAQ;AAEpB,QAAI;AACF,YAAM,OAAO,MAAM,YAAY;AAAA,QAC7B,WAAW,MAAM,QAAQ,+BAA+B;AAAA,UACtD,QAAQ;AAAA,UACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,UAC9C,MAAM,KAAK,UAAU;AAAA,YACnB,WAAW,CAAC,QAAQ;AAAA,UACtB,CAAC;AAAA,QACH,CAAC;AAAA,QACD,SAAS;AAAA,UACP,QAAQ;AAAA,UACR,cAAc;AAAA,UACd;AAAA,QACF;AAAA,QACA,iBAAiB,EAAE,WAAW,CAAC,QAAQ,EAAE;AAAA,MAC3C,CAAC;AAED,YAAM,SAAS,KAAK;AACpB,UAAI,QAAQ;AACV,cAAM,aAAa,OAAO;AAC1B,cAAM,QAAQ,aAAa,QAAQ,GAAG,SAAS;AAE/C,YAAI,UAAU,GAAG;AACf,gBAAM,EAAE,gCAAgC,GAAG,SAAS;AAAA,QACtD,OAAO;AACL,gBAAM,GAAG,EAAE,+BAA+B,CAAC,KAAK,KAAK,kBAAkB,SAAS;AAAA,QAClF;AACA,cAAM,YAAY;AAAA,MACpB;AAAA,IACF,SAAS,KAAU;AACjB,YAAM,IAAI,WAAW,EAAE,6BAA6B,GAAG,OAAO;AAAA,IAChE,UAAE;AACA,kBAAY,IAAI;AAAA,IAClB;AAAA,EACF,GAAG,CAAC,mBAAmB,mBAAmB,aAAa,GAAG,WAAW,CAAC;AAEtE,YAAU,MAAM;AACd,gBAAY;AAAA,EACd,GAAG,CAAC,WAAW,CAAC;AAEhB,WAAS,eAAe,MAA6B;AACnD,QAAI,CAAC,KAAM,QAAO;AAClB,WAAO,IAAI,KAAK,IAAI,EAAE,eAAe;AAAA,EACvC;AAEA,WAAS,eAAe,QAAuB;AAC7C,QAAI,CAAC,OAAQ,QAAO;AAEpB,UAAM,SAAiC;AAAA,MACrC,SAAS;AAAA,MACT,OAAO;AAAA,MACP,SAAS;AAAA,IACX;AAEA,WACE,oBAAC,UAAK,WAAW,OAAO,MAAM,KAAK,OAAO,OACvC,kBACH;AAAA,EAEJ;AAEA,WAAS,gBAAgB,UAA0B;AACjD,QAAI,aAAa,MAAO,QAAO,EAAE,+BAA+B;AAChE,QAAI,aAAa,yBAA0B,QAAO,EAAE,sCAAsC;AAC1F,WAAO;AAAA,EACT;AAEA,WAAS,uBAAuB,UAA0B;AACxD,QAAI,aAAa,OAAO;AACtB,aAAO,EAAE,2CAA2C;AAAA,IACtD;AACA,QAAI,aAAa,0BAA0B;AACzC,aAAO,EAAE,kDAAkD;AAAA,IAC7D;AACA,WAAO;AAAA,EACT;AAEA,MAAI,WAAW,cAAc;AAC3B,WACE,qBAAC,aAAQ,WAAU,iDACjB;AAAA,2BAAC,YAAO,WAAU,aAChB;AAAA,4BAAC,QAAG,WAAU,yBAAyB,YAAE,wBAAwB,GAAE;AAAA,QACnE,oBAAC,OAAE,WAAU,iCACV,YAAE,8BAA8B,GACnC;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,yDACb;AAAA,4BAAC,WAAQ,WAAU,WAAU;AAAA,QAC5B,eAAe,EAAE,yCAAyC,IAAI,EAAE,0BAA0B;AAAA,SAC7F;AAAA,OACF;AAAA,EAEJ;AAEA,SACE,qBAAC,aAAQ,WAAU,iDACjB;AAAA,yBAAC,YAAO,WAAU,aAChB;AAAA,0BAAC,QAAG,WAAU,yBAAyB,YAAE,wBAAwB,GAAE;AAAA,MACnE,oBAAC,OAAE,WAAU,iCACV,YAAE,8BAA8B,GACnC;AAAA,OACF;AAAA,IAEA,qBAAC,SAAI,WAAU,aACZ;AAAA,cAAQ,IAAI,CAAC,WACZ;AAAA,QAAC;AAAA;AAAA,UAEC,WAAU;AAAA,UAEV;AAAA,iCAAC,SAAI,WAAU,0CACb;AAAA,mCAAC,SAAI,WAAU,UACb;AAAA,oCAAC,QAAG,WAAU,uBACX,0BAAgB,OAAO,QAAQ,GAClC;AAAA,gBACA,oBAAC,OAAE,WAAU,wCACV,iCAAuB,OAAO,QAAQ,GACzC;AAAA,iBACF;AAAA,cAEA;AAAA,gBAAC;AAAA;AAAA,kBACC,SAAS,OAAO;AAAA,kBAChB,iBAAiB,MAAM,cAAc,OAAO,IAAI,OAAO,WAAW,OAAO,SAAS;AAAA;AAAA,cACpF;AAAA,eACF;AAAA,YAEC,OAAO,aACN,iCACE;AAAA,mCAAC,SAAI,WAAU,4CACb;AAAA,qCAAC,SAAI,WAAU,6BACb;AAAA,uCAAC,WAAM,WAAU,mDACd;AAAA,sBAAE,4BAA4B;AAAA,oBAAE;AAAA,qBACnC;AAAA,kBACA;AAAA,oBAAC;AAAA;AAAA,sBACC,MAAK;AAAA,sBACL,OAAO,OAAO,YAAY;AAAA,sBAC1B,UAAU,CAAC,MAAM,eAAe,OAAO,IAAI,EAAE,OAAO,OAAO,OAAO,SAAS;AAAA,sBAC3E,WAAU;AAAA;AAAA,kBACZ;AAAA,mBACF;AAAA,gBAEA,qBAAC,SAAI,WAAU,6BACb;AAAA,uCAAC,WAAM,WAAU,mDACd;AAAA,sBAAE,4BAA4B;AAAA,oBAAE;AAAA,qBACnC;AAAA,kBACA,oBAAC,UAAK,WAAU,iCACb,yBAAe,OAAO,UAAU,GACnC;AAAA,kBACC,eAAe,OAAO,cAAc;AAAA,mBACvC;AAAA,gBAEA;AAAA,kBAAC;AAAA;AAAA,oBACC,SAAS,MAAM,SAAS,OAAO,QAAQ;AAAA,oBACvC,UAAU,aAAa,OAAO;AAAA,oBAC9B,MAAK;AAAA,oBACL,WAAU;AAAA,oBAET,uBAAa,OAAO,WACnB,qBAAC,SACC;AAAA,0CAAC,WAAQ,WAAU,UAAS,MAAK,MAAK;AAAA,sBACrC,EAAE,2BAA2B;AAAA,uBAChC,IAEA,EAAE,4BAA4B;AAAA;AAAA,gBAElC;AAAA,iBACF;AAAA,cAEC,OAAO,kBAAkB,QACxB,qBAAC,SAAI,WAAU,sCACZ;AAAA,kBAAE,kCAAkC;AAAA,gBAAE;AAAA,gBAAE,oBAAC,UAAK,WAAU,eAAe,iBAAO,eAAc;AAAA,gBAAO;AAAA,iBACtG;AAAA,cAGD,OAAO,mBAAmB,OAAO,mBAAmB,WACnD,oBAAC,SAAI,WAAU,yEACZ,iBAAO,iBACV;AAAA,eAEJ;AAAA;AAAA;AAAA,QAxEG,OAAO;AAAA,MA0Ed,CACD;AAAA,MAEA,QAAQ,WAAW,KAClB,qBAAC,SAAI,WAAU,mDACb;AAAA,4BAAC,OAAE,WAAU,iCACV,YAAE,+BAA+B,GACpC;AAAA,QACA;AAAA,UAAC;AAAA;AAAA,YACC,SAAS,MAAM,2BAA2B,kBAAkB;AAAA,YAE3D,YAAE,uCAAuC;AAAA;AAAA,QAC5C;AAAA,SACF;AAAA,OAEJ;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js

@@ -4,15 +4,23 @@ import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { CustomerRole, CustomerRoleAcl } from "@open-mercato/core/modules/customer_accounts/data/entities";
 import { updateRoleAclSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import { enforceCommandOptimisticLock } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
+import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard
+} from "@open-mercato/shared/lib/crud/mutation-guard";
 const metadata = {};
+const ROLE_RESOURCE_KIND = "customer_accounts.role";
 async function PUT(req, { params }) {
   const auth = await getAuthFromRequest(req);
-  if (!auth) {
+  if (!auth || !auth.tenantId) {
     return NextResponse.json({ ok: false, error: "Authentication required" }, { status: 401 });
   }
+  const tenantId = auth.tenantId;
   const container = await createRequestContainer();
   const rbacService = container.resolve("rbacService");
-  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ["customer_accounts.roles.manage"], { tenantId: auth.tenantId, organizationId: auth.orgId });
+  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ["customer_accounts.roles.manage"], { tenantId, organizationId: auth.orgId });
   if (!hasAccess) {
     return NextResponse.json({ ok: false, error: "Insufficient permissions" }, { status: 403 });
   }
@@ -29,15 +37,40 @@ async function PUT(req, { params }) {
   const em = container.resolve("em");
   const role = await em.findOne(CustomerRole, {
     id: params.id,
-    tenantId: auth.tenantId,
+    tenantId,
     deletedAt: null
   });
   if (!role) {
     return NextResponse.json({ ok: false, error: "Role not found" }, { status: 404 });
   }
+  try {
+    enforceCommandOptimisticLock({
+      resourceKind: ROLE_RESOURCE_KIND,
+      resourceId: role.id,
+      current: role.updatedAt ?? null,
+      request: req
+    });
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
+    throw err;
+  }
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId,
+    organizationId: auth.orgId,
+    userId: auth.sub,
+    resourceKind: ROLE_RESOURCE_KIND,
+    resourceId: role.id,
+    operation: "update",
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data
+  });
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status });
+  }
   const acl = await em.findOne(CustomerRoleAcl, {
     role: role.id,
-    tenantId: auth.tenantId
+    tenantId
   });
   if (acl) {
     await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {
@@ -47,7 +80,7 @@ async function PUT(req, { params }) {
   } else {
     const newAcl = em.create(CustomerRoleAcl, {
       role,
-      tenantId: auth.tenantId,
+      tenantId,
       featuresJson: parsed.data.features,
       isPortalAdmin: parsed.data.isPortalAdmin ?? false,
       createdAt: /* @__PURE__ */ new Date()
@@ -55,11 +88,26 @@ async function PUT(req, { params }) {
     em.persist(newAcl);
     await em.flush();
   }
+  const nextUpdatedAt = /* @__PURE__ */ new Date();
+  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt });
   const customerRbacService = container.resolve("customerRbacService");
   await customerRbacService.invalidateRoleCache(role.id);
-  return NextResponse.json({ ok: true });
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId,
+      organizationId: auth.orgId,
+      userId: auth.sub,
+      resourceKind: ROLE_RESOURCE_KIND,
+      resourceId: role.id,
+      operation: "update",
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null
+    });
+  }
+  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() });
 }
-const successSchema = z.object({ ok: z.literal(true) });
+const successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() });
 const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
 const methodDoc = {
   summary: "Update customer role ACL (admin)",
@@ -71,7 +119,8 @@ const methodDoc = {
     { status: 400, description: "Validation failed", schema: errorSchema },
     { status: 401, description: "Not authenticated", schema: errorSchema },
     { status: 403, description: "Insufficient permissions", schema: errorSchema },
-    { status: 404, description: "Role not found", schema: errorSchema }
+    { status: 404, description: "Role not found", schema: errorSchema },
+    { status: 409, description: "Stale ACL write (optimistic-lock conflict)", schema: errorSchema }
   ]
 };
 const openApi = {

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/api/admin/roles/%5Bid%5D/acl.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\n\nexport const metadata = {}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId: auth.tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AAE7B,MAAM,WAAW,CAAC;AAEzB,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA,UAAU,KAAK;AAAA,MACf,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {}\n\nconst ROLE_RESOURCE_KIND = 'customer_accounts.role'\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // The ACL is part of the role aggregate: the role-edit screen loads and saves\n  // the role and its permissions together. Guard the write against the parent\n  // role's `updatedAt` so two admins editing the same role cannot silently\n  // overwrite each other's permission changes (#3194). Strictly additive \u2014 when\n  // the client sends no expected-version header the helper is a no-op.\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    resourceKind: ROLE_RESOURCE_KIND,\n    resourceId: role.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  // Bump the aggregate version so a stale role-edit screen (which holds the role's\n  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nconst successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AACpC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW,CAAC;AAEzB,MAAM,qBAAqB;AAE3B,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC7I,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAOA,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAKA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,cAAc,CAAC;AAEjF,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,EAChG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js

@@ -241,15 +241,18 @@ function CustomerRoleDetailPage({ params }) {
       return;
     }
     const features = Array.isArray(values.features) ? values.features : [];
-    const aclCall = await apiCall(
+    const roleResult = roleCall.result ?? null;
+    const aclHeaders = buildOptimisticLockHeader(roleResult?.updatedAt ?? data?.updatedAt ?? data?.updated_at ?? null);
+    const aclCall = await withScopedApiRequestHeaders(aclHeaders, () => apiCall(
       `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,
       {
         method: "PUT",
         headers: { "content-type": "application/json" },
         body: JSON.stringify({ features })
       }
-    );
+    ));
     if (!aclCall.ok) {
+      if (surfaceRecordConflict({ status: aclCall.status, body: aclCall.result }, t)) return;
       flash(t("customer_accounts.admin.roleDetail.error.saveAcl", "Failed to save permissions"), "error");
       return;
     }