@open-mercato/core 0.6.6-develop.6205.1.109e4b6a84 → 0.6.6-develop.6227.1.2695efff30

package/src/modules/customers/i18n/es.json

@@ -151,11 +151,11 @@
   "customers.audit.entityRoles.create": "Create entity role",
   "customers.audit.entityRoles.delete": "Delete entity role",
   "customers.audit.entityRoles.update": "Update entity role",
-  "customers.audit.interactions.cancel": "Cancelar interaccion",
-  "customers.audit.interactions.complete": "Completar interaccion",
-  "customers.audit.interactions.create": "Crear interaccion",
-  "customers.audit.interactions.delete": "Eliminar interaccion",
-  "customers.audit.interactions.update": "Actualizar interaccion",
+  "customers.audit.interactions.cancel": "Cancelar interacción",
+  "customers.audit.interactions.complete": "Completar interacción",
+  "customers.audit.interactions.create": "Crear interacción",
+  "customers.audit.interactions.delete": "Eliminar interacción",
+  "customers.audit.interactions.update": "Actualizar interacción",
   "customers.audit.labels.assign": "Asignar etiqueta",
   "customers.audit.labels.create": "Crear etiqueta",
   "customers.audit.labels.unassign": "Quitar etiqueta",
@@ -174,8 +174,10 @@
   "customers.audit.todos.link": "Vincular tarea",
   "customers.audit.todos.unlink": "Desvincular tarea",
   "customers.calendar.actions.newEvent": "Nuevo evento",
-  "customers.calendar.agenda.eventCount": "1 evento",
-  "customers.calendar.agenda.eventsCount": "{count} eventos",
+  "customers.calendar.agenda.eventsCount.few": "{count} eventos",
+  "customers.calendar.agenda.eventsCount.many": "{count} eventos",
+  "customers.calendar.agenda.eventsCount.one": "{count} evento",
+  "customers.calendar.agenda.eventsCount.other": "{count} eventos",
   "customers.calendar.agenda.today": "Hoy",
   "customers.calendar.agenda.tomorrow": "Mañana",
   "customers.calendar.cards.allDay": "Todo el día",
@@ -230,6 +232,7 @@
   "customers.calendar.editor.error": "No se pudo guardar el evento",
   "customers.calendar.editor.location": "Ubicación",
   "customers.calendar.editor.locationPlaceholder": "Añadir una ubicación o enlace…",
+  "customers.calendar.editor.multiDayHint": "Evento de varios días · {count} días",
   "customers.calendar.editor.noResults": "Sin resultados",
   "customers.calendar.editor.participants": "Participantes",
   "customers.calendar.editor.phoneLink": "Teléfono / enlace",
@@ -334,6 +337,7 @@
   "customers.calendar.settings.eventCategories": "Categorías de eventos",
   "customers.calendar.settings.eventCategoriesHint": "Tus propias etiquetas de agrupación (p. ej., Reunión de equipo, Llamada de ventas). Se ofrecen al crear un evento.",
   "customers.calendar.settings.max": "(máx. {count})",
+  "customers.calendar.settings.removeTag": "Eliminar {tag}",
   "customers.calendar.settings.save": "Guardar cambios",
   "customers.calendar.settings.saved": "Configuración del calendario guardada",
   "customers.calendar.settings.showCrmActivities": "Mostrar actividades de CRM en el calendario",

package/src/modules/customers/i18n/pl.json

@@ -151,11 +151,11 @@
   "customers.audit.entityRoles.create": "Create entity role",
   "customers.audit.entityRoles.delete": "Delete entity role",
   "customers.audit.entityRoles.update": "Update entity role",
-  "customers.audit.interactions.cancel": "Anuluj interakcje",
-  "customers.audit.interactions.complete": "Zakoncz interakcje",
-  "customers.audit.interactions.create": "Utworz interakcje",
-  "customers.audit.interactions.delete": "Usun interakcje",
-  "customers.audit.interactions.update": "Zaktualizuj interakcje",
+  "customers.audit.interactions.cancel": "Anuluj interakcję",
+  "customers.audit.interactions.complete": "Zakończ interakcję",
+  "customers.audit.interactions.create": "Utwórz interakcję",
+  "customers.audit.interactions.delete": "Usuń interakcję",
+  "customers.audit.interactions.update": "Zaktualizuj interakcję",
   "customers.audit.labels.assign": "Przypisz etykietę",
   "customers.audit.labels.create": "Utwórz etykietę",
   "customers.audit.labels.unassign": "Usuń przypisanie etykiety",
@@ -174,8 +174,10 @@
   "customers.audit.todos.link": "Powiąż zadanie",
   "customers.audit.todos.unlink": "Odepnij zadanie",
   "customers.calendar.actions.newEvent": "Nowe wydarzenie",
-  "customers.calendar.agenda.eventCount": "1 wydarzenie",
-  "customers.calendar.agenda.eventsCount": "{count} wydarzeń",
+  "customers.calendar.agenda.eventsCount.few": "{count} wydarzenia",
+  "customers.calendar.agenda.eventsCount.many": "{count} wydarzeń",
+  "customers.calendar.agenda.eventsCount.one": "{count} wydarzenie",
+  "customers.calendar.agenda.eventsCount.other": "{count} wydarzeń",
   "customers.calendar.agenda.today": "Dzisiaj",
   "customers.calendar.agenda.tomorrow": "Jutro",
   "customers.calendar.cards.allDay": "Cały dzień",
@@ -230,6 +232,7 @@
   "customers.calendar.editor.error": "Nie udało się zapisać wydarzenia",
   "customers.calendar.editor.location": "Lokalizacja",
   "customers.calendar.editor.locationPlaceholder": "Dodaj lokalizację lub link…",
+  "customers.calendar.editor.multiDayHint": "Wydarzenie wielodniowe · {count} dni",
   "customers.calendar.editor.noResults": "Brak wyników",
   "customers.calendar.editor.participants": "Uczestnicy",
   "customers.calendar.editor.phoneLink": "Telefon / link",
@@ -334,6 +337,7 @@
   "customers.calendar.settings.eventCategories": "Kategorie wydarzeń",
   "customers.calendar.settings.eventCategoriesHint": "Twoje własne etykiety grupujące (np. Spotkanie zespołu, Telefon sprzedażowy). Pojawiają się podczas tworzenia wydarzenia.",
   "customers.calendar.settings.max": "(maks. {count})",
+  "customers.calendar.settings.removeTag": "Usuń {tag}",
   "customers.calendar.settings.save": "Zapisz zmiany",
   "customers.calendar.settings.saved": "Zapisano ustawienia kalendarza",
   "customers.calendar.settings.showCrmActivities": "Pokaż aktywności CRM w kalendarzu",

package/src/modules/customers/lib/calendar/labels.ts

@@ -0,0 +1,42 @@
+const MS_PER_DAY = 24 * 60 * 60 * 1000
+
+export function pluralCategory(locale: string, count: number): Intl.LDMLPluralRule {
+  try {
+    return new Intl.PluralRules(locale).select(count)
+  } catch {
+    return count === 1 ? 'one' : 'other'
+  }
+}
+
+export function eventDisplayTitle(title: string | null | undefined, fallback: string): string {
+  return title && title.trim().length > 0 ? title : fallback
+}
+
+export function composeAccessibleName(
+  parts: Array<string | null | undefined>,
+  separator = ', ',
+): string {
+  return parts
+    .map((part) => (typeof part === 'string' ? part.trim() : ''))
+    .filter((part) => part.length > 0)
+    .join(separator)
+}
+
+function parseDateInput(value: string): number {
+  const parsed = new Date(`${value}T00:00:00`)
+  return parsed.getTime()
+}
+
+/**
+ * Number of calendar days a scheduled event spans when its end date falls on a
+ * later day than its start date. Returns 0 for same-day, end-before-start, or
+ * unparseable inputs, so callers can treat 0 as "not multi-day".
+ */
+export function multiDayEventSpan(startDate: string, endDate: string): number {
+  const start = parseDateInput(startDate)
+  const end = parseDateInput(endDate)
+  if (Number.isNaN(start) || Number.isNaN(end)) return 0
+  const dayDiff = Math.round((end - start) / MS_PER_DAY)
+  if (dayDiff < 1) return 0
+  return dayDiff + 1
+}

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -6,9 +6,12 @@ import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { RadioGroup } from '@open-mercato/ui/primitives/radio'
 import { RadioField } from '@open-mercato/ui/primitives/radio-field'
 import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 
+const WIDGET_VISIBILITY_CONTEXT_ID = 'dashboards-widget-visibility:save'
+
 type WidgetCatalogItem = {
   id: string
   title: string
@@ -94,6 +97,13 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     [t],
   )
   const { kind, targetId, tenantId, organizationId, preserveOnTenantChange = false } = props
+  const { runMutation, retryLastMutation } = useGuardedMutation<{
+    formId: string
+    resourceKind: string
+    retryLastMutation: () => Promise<boolean>
+  }>({
+    contextId: WIDGET_VISIBILITY_CONTEXT_ID,
+  })
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
   const [loading, setLoading] = React.useState(true)
   const [saving, setSaving] = React.useState(false)
@@ -243,11 +253,20 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
           widgetIds: selected,
         }
         // optimistic-lock-exempt: per-role widget visibility preference
-        await apiCallOrThrow('/api/dashboards/roles/widgets', {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(payload),
-        }, { errorMessage: saveError })
+        await runMutation({
+          operation: () =>
+            apiCallOrThrow('/api/dashboards/roles/widgets', {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify(payload),
+            }, { errorMessage: saveError }),
+          context: {
+            formId: WIDGET_VISIBILITY_CONTEXT_ID,
+            resourceKind: 'dashboards.role_widget_visibility',
+            retryLastMutation,
+          },
+          mutationPayload: payload,
+        })
         setOriginal(selected)
         setOriginalMode('override')
         setEffective(selected)
@@ -260,11 +279,20 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
           widgetIds: selected,
         }
         // optimistic-lock-exempt: per-user widget visibility preference
-        await apiCallOrThrow('/api/dashboards/users/widgets', {
-          method: 'PUT',
-          headers: { 'content-type': 'application/json' },
-          body: JSON.stringify(payload),
-        }, { errorMessage: saveError })
+        await runMutation({
+          operation: () =>
+            apiCallOrThrow('/api/dashboards/users/widgets', {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify(payload),
+            }, { errorMessage: saveError }),
+          context: {
+            formId: WIDGET_VISIBILITY_CONTEXT_ID,
+            resourceKind: 'dashboards.user_widget_visibility',
+            retryLastMutation,
+          },
+          mutationPayload: payload,
+        })
         setOriginal(selected)
         if (mode === 'inherit') {
           const refreshed = await readApiResultOrThrow<UserResponse>(
@@ -286,7 +314,7 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     } finally {
       setSaving(false)
     }
-  }, [catalog.length, dirty, error, kind, loading, mode, organizationId, selected, t, targetId, tenantId])
+  }, [catalog.length, dirty, error, kind, loading, mode, organizationId, retryLastMutation, runMutation, selected, t, targetId, tenantId])
 
   React.useImperativeHandle(ref, () => ({ save }), [save])
 

package/src/modules/data_sync/api/mappings/[id]/route.ts

@@ -5,6 +5,10 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const idParamsSchema = z.object({ id: z.string().uuid() })
 
@@ -108,9 +112,38 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
     return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.mapping',
+    resourceId: mapping.id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsedBody.data,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   mapping.mapping = parsedBody.data.mapping
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.mapping',
+      resourceId: mapping.id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({
     id: mapping.id,
     integrationId: mapping.integrationId,
@@ -151,8 +184,38 @@ export async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string
     return NextResponse.json({ error: 'Mapping not found' }, { status: 404 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.mapping',
+    resourceId: mapping.id,
+    operation: 'delete',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: null,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  const mappingId = mapping.id
   em.remove(mapping)
   await em.flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.mapping',
+      resourceId: mappingId,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ deleted: true })
 }

package/src/modules/data_sync/api/mappings/route.ts

@@ -5,6 +5,10 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { findAndCountWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { SyncMapping } from '@open-mercato/core/modules/data_sync/data/entities'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const listMappingsQuerySchema = z.object({
   integrationId: z.string().min(1).optional(),
@@ -115,9 +119,39 @@ export async function POST(req: Request) {
     scope,
   )
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.mapping',
+    resourceId: existing?.id ?? scope.organizationId,
+    operation: existing ? 'update' : 'create',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   if (existing) {
     existing.mapping = parsed.data.mapping
     await em.flush()
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: auth.sub,
+        resourceKind: 'data_sync.mapping',
+        resourceId: existing.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({
       id: existing.id,
       integrationId: existing.integrationId,
@@ -135,6 +169,20 @@ export async function POST(req: Request) {
   })
   await em.persist(created).flush()
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.mapping',
+      resourceId: created.id,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({
     id: created.id,
     integrationId: created.integrationId,

package/src/modules/data_sync/api/run.ts

@@ -9,6 +9,10 @@ import type { SyncRunService } from '../lib/sync-run-service'
 import { runSyncSchema } from '../data/validators'
 import { startDataSyncRun } from '../lib/start-run'
 import { getDataSyncAdapter } from '../lib/adapter-registry'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['data_sync.run'] },
@@ -80,6 +84,21 @@ export async function POST(req: Request) {
       return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })
     }
 
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: auth.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.run',
+      resourceId: parsed.data.integrationId,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: parsed.data,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
     const cursor = parsed.data.fullSync
       ? null
       : await syncRunService.resolveCursor(parsed.data.integrationId, parsed.data.entityType, parsed.data.direction, scope)
@@ -101,6 +120,20 @@ export async function POST(req: Request) {
       },
     })
 
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId: scope.organizationId,
+        userId: auth.sub,
+        resourceKind: 'data_sync.run',
+        resourceId: run.id,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error)

package/src/modules/data_sync/api/runs/[id]/cancel.ts

@@ -6,6 +6,10 @@ import type { IntegrationLogService } from '../../../../integrations/lib/log-ser
 import type { IntegrationStateService } from '../../../../integrations/lib/state-service'
 import type { ProgressService } from '../../../../progress/lib/progressService'
 import type { SyncRunService } from '../../../lib/sync-run-service'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const paramsSchema = z.object({ id: z.string().uuid() })
 
@@ -48,6 +52,21 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
     return NextResponse.json({ error: 'Only pending or running runs can be cancelled' }, { status: 409 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.run',
+    resourceId: run.id,
+    operation: 'custom',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { action: 'cancel' },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   const progressCtx = {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
@@ -84,5 +103,20 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
       summary: 'The sync run was cancelled before completion.',
     },
   }, scope)
+
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.run',
+      resourceId: run.id,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ ok: true })
 }

package/src/modules/data_sync/api/runs/[id]/retry.ts

@@ -7,6 +7,10 @@ import type { ProgressService } from '../../../../progress/lib/progressService'
 import type { SyncRunService } from '../../../lib/sync-run-service'
 import { retrySyncSchema } from '../../../data/validators'
 import { startDataSyncRun } from '../../../lib/start-run'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const paramsSchema = z.object({ id: z.string().uuid() })
 
@@ -63,6 +67,21 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
     return NextResponse.json({ error: 'A sync run is already in progress for this integration and entity direction' }, { status: 409 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.run',
+    resourceId: previous.id,
+    operation: 'custom',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: { action: 'retry', ...parsedBody.data },
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   const cursor = parsedBody.data.fromBeginning
     ? null
     : previous.cursor ?? await syncRunService.resolveCursor(previous.integrationId, previous.entityType, previous.direction, scope)
@@ -87,5 +106,19 @@ export async function POST(req: Request, ctx: { params?: Promise<{ id?: string }
     },
   })
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.run',
+      resourceId: run.id,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ id: run.id, progressJobId: progressJob?.id ?? null }, { status: 201 })
 }

package/src/modules/data_sync/api/schedules/[id]/route.ts

@@ -6,6 +6,10 @@ import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { updateSyncScheduleSchema } from '../../../data/validators'
 import type { SyncScheduleService } from '../../../lib/sync-schedule-service'
 import { serializeSchedule } from '../serialize'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
@@ -81,6 +85,21 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
     return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })
   }
 
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.schedule',
+    resourceId: current.id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
   try {
     const schedule = await scheduleService.saveSchedule({
       id: current.id,
@@ -93,6 +112,21 @@ export async function PUT(req: Request, ctx: { params?: Promise<{ id?: string }>
       fullSync: parsed.data.fullSync ?? current.fullSync,
       isEnabled: parsed.data.isEnabled ?? current.isEnabled,
     }, scope)
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId: scope.organizationId,
+        userId: auth.sub,
+        resourceKind: 'data_sync.schedule',
+        resourceId: schedule.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
     return NextResponse.json(serializeSchedule(schedule))
   } catch (error) {
     const message = error instanceof Error ? error.message : 'Failed to update sync schedule'
@@ -117,14 +151,42 @@ export async function DELETE(req: Request, ctx: { params?: Promise<{ id?: string
 
   const container = await createRequestContainer()
   const scheduleService = container.resolve('dataSyncScheduleService') as SyncScheduleService
-  const deleted = await scheduleService.deleteSchedule(parsedParams.data.id, {
-    organizationId: auth.orgId as string,
+  const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
+
+  const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
+    organizationId: scope.organizationId,
+    userId: auth.sub,
+    resourceKind: 'data_sync.schedule',
+    resourceId: parsedParams.data.id,
+    operation: 'delete',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: null,
   })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  const deleted = await scheduleService.deleteSchedule(parsedParams.data.id, scope)
 
   if (!deleted) {
     return NextResponse.json({ error: 'Schedule not found' }, { status: 404 })
   }
 
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: scope.organizationId,
+      userId: auth.sub,
+      resourceKind: 'data_sync.schedule',
+      resourceId: parsedParams.data.id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
   return NextResponse.json({ deleted: true })
 }